Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f149581054b45f83054d4b616e348c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7f149581054b45f83054d4b616e348c0N.exe
-
Size
64KB
-
MD5
7f149581054b45f83054d4b616e348c0
-
SHA1
ae484dcb3987e4d4db2a11f608d38d2e889f0d51
-
SHA256
794365d91ff6f206e7ca2b2f6ee6d2cc4acddaa061b7df73b168c7ef13ccd612
-
SHA512
8e3276aac1dfc686e0a49c15e788adb46fbfae39123f51d64c9e4c9d83db79854982ceb020016f6d7fcb411d6438fcf9fb1ee6fecd86f048bfac73d3e43beb29
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B11:ymb3NkkiQ3mdBjFI9cD
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2524-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 flrfxrr.exe 2456 5bhthn.exe 2892 pjvvp.exe 2752 pjdjv.exe 2836 fxllllf.exe 2168 hbtntb.exe 2632 jjjpd.exe 2668 pdvdp.exe 2676 ffrlrrf.exe 2660 vvvdv.exe 880 7pvdp.exe 292 rrlfrrf.exe 1072 lxxlfxl.exe 2856 nnnnhn.exe 1432 vvvdv.exe 796 ppjpv.exe 1564 3lrlxfl.exe 1868 bbtnbh.exe 1728 ttnbnb.exe 3068 9pjvp.exe 1624 5pddj.exe 2152 fffxlrf.exe 852 lfxlrxf.exe 2276 1htnnt.exe 948 jjjjp.exe 1576 vppjv.exe 1880 rrlfxrx.exe 1740 7nhtbn.exe 2324 tttnnb.exe 2004 pvppp.exe 872 5vpjp.exe 2524 xxlfxfr.exe 1888 5xxlxlr.exe 2272 ntthbn.exe 2180 jvdvv.exe 1400 1djvp.exe 2768 xrfrxfl.exe 2876 nthnnh.exe 2716 hhbtth.exe 2888 3vvdv.exe 2824 vjjpv.exe 2784 rlxxlxl.exe 1008 9lxxflx.exe 2612 hhbnnn.exe 2676 btntnt.exe 1572 3ddpj.exe 492 1dpjp.exe 2016 1xrfrxr.exe 1556 3lrflfl.exe 2948 1bttht.exe 1300 hhtbhn.exe 2900 ddvvd.exe 1952 jjddv.exe 2964 xxrfrff.exe 1668 lfflxfr.exe 2976 hhthbh.exe 2448 hbntnt.exe 3052 ddpvj.exe 1284 pjddp.exe 2116 9xlffxr.exe 2460 nnthhh.exe 1152 jjpdj.exe 1900 ppdjv.exe 1544 xrxfflx.exe -
resource yara_rule behavioral1/memory/2524-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2540 2524 7f149581054b45f83054d4b616e348c0N.exe 30 PID 2524 wrote to memory of 2540 2524 7f149581054b45f83054d4b616e348c0N.exe 30 PID 2524 wrote to memory of 2540 2524 7f149581054b45f83054d4b616e348c0N.exe 30 PID 2524 wrote to memory of 2540 2524 7f149581054b45f83054d4b616e348c0N.exe 30 PID 2540 wrote to memory of 2456 2540 flrfxrr.exe 31 PID 2540 wrote to memory of 2456 2540 flrfxrr.exe 31 PID 2540 wrote to memory of 2456 2540 flrfxrr.exe 31 PID 2540 wrote to memory of 2456 2540 flrfxrr.exe 31 PID 2456 wrote to memory of 2892 2456 5bhthn.exe 32 PID 2456 wrote to memory of 2892 2456 5bhthn.exe 32 PID 2456 wrote to memory of 2892 2456 5bhthn.exe 32 PID 2456 wrote to memory of 2892 2456 5bhthn.exe 32 PID 2892 wrote to memory of 2752 2892 pjvvp.exe 33 PID 2892 wrote to memory of 2752 2892 pjvvp.exe 33 PID 2892 wrote to memory of 2752 2892 pjvvp.exe 33 PID 2892 wrote to memory of 2752 2892 pjvvp.exe 33 PID 2752 wrote to memory of 2836 2752 pjdjv.exe 34 PID 2752 wrote to memory of 2836 2752 pjdjv.exe 34 PID 2752 wrote to memory of 2836 2752 pjdjv.exe 34 PID 2752 wrote to memory of 2836 2752 pjdjv.exe 34 PID 2836 wrote to memory of 2168 2836 fxllllf.exe 35 PID 2836 wrote to memory of 2168 2836 fxllllf.exe 35 PID 2836 wrote to memory of 2168 2836 fxllllf.exe 35 PID 2836 wrote to memory of 2168 2836 fxllllf.exe 35 PID 2168 wrote to memory of 2632 2168 hbtntb.exe 36 PID 2168 wrote to memory of 2632 2168 hbtntb.exe 36 PID 2168 wrote to memory of 2632 2168 hbtntb.exe 36 PID 2168 wrote to memory of 2632 2168 hbtntb.exe 36 PID 2632 wrote to memory of 2668 2632 jjjpd.exe 37 PID 2632 wrote to memory of 2668 2632 jjjpd.exe 37 PID 2632 wrote to memory of 2668 2632 jjjpd.exe 37 PID 2632 wrote to memory of 2668 2632 jjjpd.exe 37 PID 2668 wrote to memory of 2676 2668 pdvdp.exe 38 PID 2668 wrote to memory of 2676 2668 pdvdp.exe 38 PID 2668 wrote to memory of 2676 2668 pdvdp.exe 38 PID 2668 wrote to memory of 2676 2668 pdvdp.exe 38 PID 2676 wrote to memory of 2660 2676 ffrlrrf.exe 39 PID 2676 wrote to memory of 2660 2676 ffrlrrf.exe 39 PID 2676 wrote to memory of 2660 2676 ffrlrrf.exe 39 PID 2676 wrote to memory of 2660 2676 ffrlrrf.exe 39 PID 2660 wrote to memory of 880 2660 vvvdv.exe 40 PID 2660 wrote to memory of 880 2660 vvvdv.exe 40 PID 2660 wrote to memory of 880 2660 vvvdv.exe 40 PID 2660 wrote to memory of 880 2660 vvvdv.exe 40 PID 880 wrote to memory of 292 880 7pvdp.exe 41 PID 880 wrote to memory of 292 880 7pvdp.exe 41 PID 880 wrote to memory of 292 880 7pvdp.exe 41 PID 880 wrote to memory of 292 880 7pvdp.exe 41 PID 292 wrote to memory of 1072 292 rrlfrrf.exe 42 PID 292 wrote to memory of 1072 292 rrlfrrf.exe 42 PID 292 wrote to memory of 1072 292 rrlfrrf.exe 42 PID 292 wrote to memory of 1072 292 rrlfrrf.exe 42 PID 1072 wrote to memory of 2856 1072 lxxlfxl.exe 43 PID 1072 wrote to memory of 2856 1072 lxxlfxl.exe 43 PID 1072 wrote to memory of 2856 1072 lxxlfxl.exe 43 PID 1072 wrote to memory of 2856 1072 lxxlfxl.exe 43 PID 2856 wrote to memory of 1432 2856 nnnnhn.exe 44 PID 2856 wrote to memory of 1432 2856 nnnnhn.exe 44 PID 2856 wrote to memory of 1432 2856 nnnnhn.exe 44 PID 2856 wrote to memory of 1432 2856 nnnnhn.exe 44 PID 1432 wrote to memory of 796 1432 vvvdv.exe 45 PID 1432 wrote to memory of 796 1432 vvvdv.exe 45 PID 1432 wrote to memory of 796 1432 vvvdv.exe 45 PID 1432 wrote to memory of 796 1432 vvvdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f149581054b45f83054d4b616e348c0N.exe"C:\Users\Admin\AppData\Local\Temp\7f149581054b45f83054d4b616e348c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\flrfxrr.exec:\flrfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5bhthn.exec:\5bhthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\pjvvp.exec:\pjvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pjdjv.exec:\pjdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxllllf.exec:\fxllllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hbtntb.exec:\hbtntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\jjjpd.exec:\jjjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pdvdp.exec:\pdvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\ffrlrrf.exec:\ffrlrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vvvdv.exec:\vvvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7pvdp.exec:\7pvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\lxxlfxl.exec:\lxxlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\nnnnhn.exec:\nnnnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vvvdv.exec:\vvvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\ppjpv.exec:\ppjpv.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\3lrlxfl.exec:\3lrlxfl.exe18⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bbtnbh.exec:\bbtnbh.exe19⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ttnbnb.exec:\ttnbnb.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9pjvp.exec:\9pjvp.exe21⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5pddj.exec:\5pddj.exe22⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fffxlrf.exec:\fffxlrf.exe23⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe24⤵
- Executes dropped EXE
PID:852 -
\??\c:\1htnnt.exec:\1htnnt.exe25⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jjjjp.exec:\jjjjp.exe26⤵
- Executes dropped EXE
PID:948 -
\??\c:\vppjv.exec:\vppjv.exe27⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\7nhtbn.exec:\7nhtbn.exe29⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tttnnb.exec:\tttnnb.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pvppp.exec:\pvppp.exe31⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5vpjp.exec:\5vpjp.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\xxlfxfr.exec:\xxlfxfr.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5xxlxlr.exec:\5xxlxlr.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ntthbn.exec:\ntthbn.exe35⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jvdvv.exec:\jvdvv.exe36⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1djvp.exec:\1djvp.exe37⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nthnnh.exec:\nthnnh.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hhbtth.exec:\hhbtth.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3vvdv.exec:\3vvdv.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vjjpv.exec:\vjjpv.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rlxxlxl.exec:\rlxxlxl.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9lxxflx.exec:\9lxxflx.exe44⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hhbnnn.exec:\hhbnnn.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\btntnt.exec:\btntnt.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3ddpj.exec:\3ddpj.exe47⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1dpjp.exec:\1dpjp.exe48⤵
- Executes dropped EXE
PID:492 -
\??\c:\1xrfrxr.exec:\1xrfrxr.exe49⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3lrflfl.exec:\3lrflfl.exe50⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1bttht.exec:\1bttht.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hhtbhn.exec:\hhtbhn.exe52⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ddvvd.exec:\ddvvd.exe53⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jjddv.exec:\jjddv.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xxrfrff.exec:\xxrfrff.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfflxfr.exec:\lfflxfr.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhthbh.exec:\hhthbh.exe57⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hbntnt.exec:\hbntnt.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ddpvj.exec:\ddpvj.exe59⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjddp.exec:\pjddp.exe60⤵
- Executes dropped EXE
PID:1284 -
\??\c:\9xlffxr.exec:\9xlffxr.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nnthhh.exec:\nnthhh.exe62⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjpdj.exec:\jjpdj.exe63⤵
- Executes dropped EXE
PID:1152 -
\??\c:\ppdjv.exec:\ppdjv.exe64⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrxfflx.exec:\xrxfflx.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fffxffl.exec:\fffxffl.exe66⤵PID:1680
-
\??\c:\tnntbb.exec:\tnntbb.exe67⤵PID:2084
-
\??\c:\bbnbhn.exec:\bbnbhn.exe68⤵PID:1740
-
\??\c:\jpddv.exec:\jpddv.exe69⤵PID:688
-
\??\c:\pjjpv.exec:\pjjpv.exe70⤵PID:1552
-
\??\c:\xllxlrf.exec:\xllxlrf.exe71⤵PID:532
-
\??\c:\ffxlxxl.exec:\ffxlxxl.exe72⤵PID:872
-
\??\c:\hnbtbn.exec:\hnbtbn.exe73⤵PID:1632
-
\??\c:\tthhnt.exec:\tthhnt.exe74⤵PID:1484
-
\??\c:\pppjv.exec:\pppjv.exe75⤵PID:1512
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe76⤵PID:2844
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe77⤵PID:2256
-
\??\c:\hhtnnt.exec:\hhtnnt.exe78⤵PID:2236
-
\??\c:\5hbtth.exec:\5hbtth.exe79⤵PID:2852
-
\??\c:\dddvp.exec:\dddvp.exe80⤵PID:2644
-
\??\c:\dddpv.exec:\dddpv.exe81⤵PID:2168
-
\??\c:\rlrxllx.exec:\rlrxllx.exe82⤵PID:2812
-
\??\c:\lrfrrxx.exec:\lrfrrxx.exe83⤵PID:2632
-
\??\c:\hbnbtt.exec:\hbnbtt.exe84⤵PID:2684
-
\??\c:\1pppd.exec:\1pppd.exe85⤵PID:2228
-
\??\c:\jdjjj.exec:\jdjjj.exe86⤵PID:296
-
\??\c:\ppjjv.exec:\ppjjv.exe87⤵PID:1004
-
\??\c:\3fllrxf.exec:\3fllrxf.exe88⤵PID:2960
-
\??\c:\hhnbbh.exec:\hhnbbh.exe89⤵PID:1704
-
\??\c:\btbhnt.exec:\btbhnt.exe90⤵PID:2860
-
\??\c:\7vvpd.exec:\7vvpd.exe91⤵PID:1176
-
\??\c:\lflrxxf.exec:\lflrxxf.exe92⤵PID:2680
-
\??\c:\rlllxxl.exec:\rlllxxl.exe93⤵PID:1084
-
\??\c:\hbthhn.exec:\hbthhn.exe94⤵PID:1960
-
\??\c:\bbntbh.exec:\bbntbh.exe95⤵PID:1252
-
\??\c:\jdvdp.exec:\jdvdp.exe96⤵PID:2648
-
\??\c:\9jjvp.exec:\9jjvp.exe97⤵PID:1724
-
\??\c:\llfrlff.exec:\llfrlff.exe98⤵PID:2072
-
\??\c:\lrlflfx.exec:\lrlflfx.exe99⤵PID:2332
-
\??\c:\bnnbbb.exec:\bnnbbb.exe100⤵PID:1928
-
\??\c:\bhhtth.exec:\bhhtth.exe101⤵PID:740
-
\??\c:\ppjpj.exec:\ppjpj.exe102⤵PID:2204
-
\??\c:\dpvdv.exec:\dpvdv.exe103⤵PID:1304
-
\??\c:\vpjjd.exec:\vpjjd.exe104⤵PID:1224
-
\??\c:\7xlllxl.exec:\7xlllxl.exe105⤵
- System Location Discovery: System Language Discovery
PID:1576 -
\??\c:\7fxlllr.exec:\7fxlllr.exe106⤵PID:1452
-
\??\c:\ntbtbb.exec:\ntbtbb.exe107⤵PID:2412
-
\??\c:\ppjvj.exec:\ppjvj.exe108⤵PID:2692
-
\??\c:\djpjp.exec:\djpjp.exe109⤵PID:1740
-
\??\c:\3rrxlrf.exec:\3rrxlrf.exe110⤵PID:876
-
\??\c:\xffxxrl.exec:\xffxxrl.exe111⤵PID:1772
-
\??\c:\hnntbn.exec:\hnntbn.exe112⤵PID:1536
-
\??\c:\5hbnbh.exec:\5hbnbh.exe113⤵PID:872
-
\??\c:\7jvjv.exec:\7jvjv.exe114⤵PID:2464
-
\??\c:\pjdjv.exec:\pjdjv.exe115⤵PID:1620
-
\??\c:\xflxlrf.exec:\xflxlrf.exe116⤵PID:2756
-
\??\c:\1lxlxfr.exec:\1lxlxfr.exe117⤵PID:2844
-
\??\c:\nhttnt.exec:\nhttnt.exe118⤵PID:2256
-
\??\c:\3tttht.exec:\3tttht.exe119⤵PID:2864
-
\??\c:\9jdpj.exec:\9jdpj.exe120⤵PID:2836
-
\??\c:\vdpdd.exec:\vdpdd.exe121⤵PID:1492
-
\??\c:\3lflrrf.exec:\3lflrrf.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-