Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe
-
Size
106KB
-
MD5
e6dceb99941d34b31538573e996a3800
-
SHA1
103ebedecf007811cfd6dc15fc61ac336d4dff97
-
SHA256
1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbb
-
SHA512
e6178bc236ee33c28ccf036323635f05602f2a89da47037cab06fe0c13dc79be521f4c3f2f0160ba38778195d2ecac512ebff47718cb94ef80e90f875a6e2b41
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3Cml:n3C9BRo7MlrWKVT+buBGu3PHl
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2904-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 dvdpv.exe 1900 rlrxflf.exe 2272 flllrlr.exe 1636 btttnt.exe 2836 jvdvd.exe 2716 pvjjj.exe 2772 fxxllll.exe 2764 hbbhtb.exe 2656 7dpvj.exe 1128 pjpjv.exe 1252 rrrxlrx.exe 2560 ffrfrrx.exe 2440 1ththh.exe 2448 vjvvj.exe 2776 5djpd.exe 1220 xrfflrx.exe 2896 9rffrxl.exe 2156 bthbbb.exe 480 9vddp.exe 1008 7lxxflx.exe 1044 rrxrxxl.exe 1564 hhbhth.exe 3008 1jdvd.exe 1880 pjpvd.exe 1248 xlrrrrx.exe 1372 frllxlx.exe 592 nnhhtt.exe 3040 vpppj.exe 3052 vjdvd.exe 1520 xrlxllr.exe 2064 rlrxxxx.exe 2020 tthhtb.exe 1744 thtttt.exe 2200 7vpjv.exe 1632 pjjpd.exe 2700 xrrrrrx.exe 2088 fxlrffl.exe 2856 llxfllr.exe 2892 hhthhn.exe 2172 1nnnbt.exe 2752 7jpvd.exe 1816 jvdjp.exe 2760 xxxllff.exe 2604 rlxflfx.exe 2124 9lrxfff.exe 1908 hbhntn.exe 1996 7nhhhh.exe 1980 5ppdv.exe 2680 pjjjd.exe 2688 rlflllr.exe 2448 9rlfffr.exe 2948 thtttt.exe 1796 7htbtn.exe 2296 nbtnnh.exe 2896 jvjpv.exe 2164 pjdjp.exe 1268 lfxxfxl.exe 1208 lrrrlff.exe 2576 tnbtbn.exe 2424 hbntnn.exe 3012 jvddp.exe 1940 dpdvd.exe 308 1xlrrrx.exe 924 fxfrrrx.exe -
resource yara_rule behavioral1/memory/2904-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2768 2904 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 29 PID 2904 wrote to memory of 2768 2904 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 29 PID 2904 wrote to memory of 2768 2904 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 29 PID 2904 wrote to memory of 2768 2904 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 29 PID 2768 wrote to memory of 1900 2768 dvdpv.exe 30 PID 2768 wrote to memory of 1900 2768 dvdpv.exe 30 PID 2768 wrote to memory of 1900 2768 dvdpv.exe 30 PID 2768 wrote to memory of 1900 2768 dvdpv.exe 30 PID 1900 wrote to memory of 2272 1900 rlrxflf.exe 31 PID 1900 wrote to memory of 2272 1900 rlrxflf.exe 31 PID 1900 wrote to memory of 2272 1900 rlrxflf.exe 31 PID 1900 wrote to memory of 2272 1900 rlrxflf.exe 31 PID 2272 wrote to memory of 1636 2272 flllrlr.exe 32 PID 2272 wrote to memory of 1636 2272 flllrlr.exe 32 PID 2272 wrote to memory of 1636 2272 flllrlr.exe 32 PID 2272 wrote to memory of 1636 2272 flllrlr.exe 32 PID 1636 wrote to memory of 2836 1636 btttnt.exe 33 PID 1636 wrote to memory of 2836 1636 btttnt.exe 33 PID 1636 wrote to memory of 2836 1636 btttnt.exe 33 PID 1636 wrote to memory of 2836 1636 btttnt.exe 33 PID 2836 wrote to memory of 2716 2836 jvdvd.exe 34 PID 2836 wrote to memory of 2716 2836 jvdvd.exe 34 PID 2836 wrote to memory of 2716 2836 jvdvd.exe 34 PID 2836 wrote to memory of 2716 2836 jvdvd.exe 34 PID 2716 wrote to memory of 2772 2716 pvjjj.exe 35 PID 2716 wrote to memory of 2772 2716 pvjjj.exe 35 PID 2716 wrote to memory of 2772 2716 pvjjj.exe 35 PID 2716 wrote to memory of 2772 2716 pvjjj.exe 35 PID 2772 wrote to memory of 2764 2772 fxxllll.exe 36 PID 2772 wrote to memory of 2764 2772 fxxllll.exe 36 PID 2772 wrote to memory of 2764 2772 fxxllll.exe 36 PID 2772 wrote to memory of 2764 2772 fxxllll.exe 36 PID 2764 wrote to memory of 2656 2764 hbbhtb.exe 37 PID 2764 wrote to memory of 2656 2764 hbbhtb.exe 37 PID 2764 wrote to memory of 2656 2764 hbbhtb.exe 37 PID 2764 wrote to memory of 2656 2764 hbbhtb.exe 37 PID 2656 wrote to memory of 1128 2656 7dpvj.exe 38 PID 2656 wrote to memory of 1128 2656 7dpvj.exe 38 PID 2656 wrote to memory of 1128 2656 7dpvj.exe 38 PID 2656 wrote to memory of 1128 2656 7dpvj.exe 38 PID 1128 wrote to memory of 1252 1128 pjpjv.exe 39 PID 1128 wrote to memory of 1252 1128 pjpjv.exe 39 PID 1128 wrote to memory of 1252 1128 pjpjv.exe 39 PID 1128 wrote to memory of 1252 1128 pjpjv.exe 39 PID 1252 wrote to memory of 2560 1252 rrrxlrx.exe 40 PID 1252 wrote to memory of 2560 1252 rrrxlrx.exe 40 PID 1252 wrote to memory of 2560 1252 rrrxlrx.exe 40 PID 1252 wrote to memory of 2560 1252 rrrxlrx.exe 40 PID 2560 wrote to memory of 2440 2560 ffrfrrx.exe 41 PID 2560 wrote to memory of 2440 2560 ffrfrrx.exe 41 PID 2560 wrote to memory of 2440 2560 ffrfrrx.exe 41 PID 2560 wrote to memory of 2440 2560 ffrfrrx.exe 41 PID 2440 wrote to memory of 2448 2440 1ththh.exe 42 PID 2440 wrote to memory of 2448 2440 1ththh.exe 42 PID 2440 wrote to memory of 2448 2440 1ththh.exe 42 PID 2440 wrote to memory of 2448 2440 1ththh.exe 42 PID 2448 wrote to memory of 2776 2448 vjvvj.exe 43 PID 2448 wrote to memory of 2776 2448 vjvvj.exe 43 PID 2448 wrote to memory of 2776 2448 vjvvj.exe 43 PID 2448 wrote to memory of 2776 2448 vjvvj.exe 43 PID 2776 wrote to memory of 1220 2776 5djpd.exe 44 PID 2776 wrote to memory of 1220 2776 5djpd.exe 44 PID 2776 wrote to memory of 1220 2776 5djpd.exe 44 PID 2776 wrote to memory of 1220 2776 5djpd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe"C:\Users\Admin\AppData\Local\Temp\1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dvdpv.exec:\dvdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlrxflf.exec:\rlrxflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\flllrlr.exec:\flllrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\btttnt.exec:\btttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\jvdvd.exec:\jvdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\pvjjj.exec:\pvjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\fxxllll.exec:\fxxllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbbhtb.exec:\hbbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\7dpvj.exec:\7dpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pjpjv.exec:\pjpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1ththh.exec:\1ththh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vjvvj.exec:\vjvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5djpd.exec:\5djpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrfflrx.exec:\xrfflrx.exe17⤵
- Executes dropped EXE
PID:1220 -
\??\c:\9rffrxl.exec:\9rffrxl.exe18⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bthbbb.exec:\bthbbb.exe19⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9vddp.exec:\9vddp.exe20⤵
- Executes dropped EXE
PID:480 -
\??\c:\7lxxflx.exec:\7lxxflx.exe21⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe22⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hhbhth.exec:\hhbhth.exe23⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1jdvd.exec:\1jdvd.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pjpvd.exec:\pjpvd.exe25⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\frllxlx.exec:\frllxlx.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nnhhtt.exec:\nnhhtt.exe28⤵
- Executes dropped EXE
PID:592 -
\??\c:\vpppj.exec:\vpppj.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vjdvd.exec:\vjdvd.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xrlxllr.exec:\xrlxllr.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rlrxxxx.exec:\rlrxxxx.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tthhtb.exec:\tthhtb.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\thtttt.exec:\thtttt.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7vpjv.exec:\7vpjv.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjjpd.exec:\pjjpd.exe36⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fxlrffl.exec:\fxlrffl.exe38⤵
- Executes dropped EXE
PID:2088 -
\??\c:\llxfllr.exec:\llxfllr.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hhthhn.exec:\hhthhn.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1nnnbt.exec:\1nnnbt.exe41⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7jpvd.exec:\7jpvd.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvdjp.exec:\jvdjp.exe43⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xxxllff.exec:\xxxllff.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlxflfx.exec:\rlxflfx.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9lrxfff.exec:\9lrxfff.exe46⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hbhntn.exec:\hbhntn.exe47⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7nhhhh.exec:\7nhhhh.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5ppdv.exec:\5ppdv.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980 -
\??\c:\pjjjd.exec:\pjjjd.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlflllr.exec:\rlflllr.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9rlfffr.exec:\9rlfffr.exe52⤵
- Executes dropped EXE
PID:2448 -
\??\c:\thtttt.exec:\thtttt.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7htbtn.exec:\7htbtn.exe54⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nbtnnh.exec:\nbtnnh.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jvjpv.exec:\jvjpv.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pjdjp.exec:\pjdjp.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe58⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lrrrlff.exec:\lrrrlff.exe59⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tnbtbn.exec:\tnbtbn.exe60⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbntnn.exec:\hbntnn.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jvddp.exec:\jvddp.exe62⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dpdvd.exec:\dpdvd.exe63⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1xlrrrx.exec:\1xlrrrx.exe64⤵
- Executes dropped EXE
PID:308 -
\??\c:\fxfrrrx.exec:\fxfrrrx.exe65⤵
- Executes dropped EXE
PID:924 -
\??\c:\tbntbn.exec:\tbntbn.exe66⤵PID:1288
-
\??\c:\1bhhnh.exec:\1bhhnh.exe67⤵PID:3024
-
\??\c:\3dpdd.exec:\3dpdd.exe68⤵PID:1552
-
\??\c:\jdpdv.exec:\jdpdv.exe69⤵PID:3040
-
\??\c:\9xlfrrx.exec:\9xlfrrx.exe70⤵PID:2568
-
\??\c:\lxrrflr.exec:\lxrrflr.exe71⤵PID:880
-
\??\c:\thhhbb.exec:\thhhbb.exe72⤵PID:2120
-
\??\c:\nhtttt.exec:\nhtttt.exe73⤵PID:2972
-
\??\c:\9nhnhh.exec:\9nhnhh.exe74⤵PID:2336
-
\??\c:\9dpvv.exec:\9dpvv.exe75⤵PID:1352
-
\??\c:\9rfflll.exec:\9rfflll.exe76⤵PID:1620
-
\??\c:\xrfrrrf.exec:\xrfrrrf.exe77⤵PID:1748
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe78⤵PID:2384
-
\??\c:\htbhnt.exec:\htbhnt.exe79⤵PID:2844
-
\??\c:\tnhnnn.exec:\tnhnnn.exe80⤵PID:3000
-
\??\c:\jdjpp.exec:\jdjpp.exe81⤵PID:2900
-
\??\c:\lfrlfrx.exec:\lfrlfrx.exe82⤵PID:2952
-
\??\c:\5xlxrlr.exec:\5xlxrlr.exe83⤵PID:2224
-
\??\c:\bthntb.exec:\bthntb.exe84⤵PID:2648
-
\??\c:\jvjjj.exec:\jvjjj.exe85⤵PID:1536
-
\??\c:\dvjjd.exec:\dvjjd.exe86⤵PID:2596
-
\??\c:\rxlrfxr.exec:\rxlrfxr.exe87⤵PID:1128
-
\??\c:\rfflxrr.exec:\rfflxrr.exe88⤵PID:2404
-
\??\c:\btnbtb.exec:\btnbtb.exe89⤵PID:1252
-
\??\c:\htbtnn.exec:\htbtnn.exe90⤵PID:2024
-
\??\c:\ppdvv.exec:\ppdvv.exe91⤵PID:2944
-
\??\c:\vdjdj.exec:\vdjdj.exe92⤵PID:560
-
\??\c:\9rflrff.exec:\9rflrff.exe93⤵PID:2928
-
\??\c:\bttbnn.exec:\bttbnn.exe94⤵PID:2308
-
\??\c:\bnnnhb.exec:\bnnnhb.exe95⤵PID:1220
-
\??\c:\3bnntb.exec:\3bnntb.exe96⤵PID:3044
-
\??\c:\ppdjp.exec:\ppdjp.exe97⤵PID:1788
-
\??\c:\xrxfrfl.exec:\xrxfrfl.exe98⤵PID:1640
-
\??\c:\xrxxflx.exec:\xrxxflx.exe99⤵PID:760
-
\??\c:\1htthb.exec:\1htthb.exe100⤵PID:1884
-
\??\c:\nnntth.exec:\nnntth.exe101⤵PID:2236
-
\??\c:\5jjjj.exec:\5jjjj.exe102⤵PID:2420
-
\??\c:\xrrxrff.exec:\xrrxrff.exe103⤵PID:1504
-
\??\c:\9fxffff.exec:\9fxffff.exe104⤵PID:1832
-
\??\c:\hntttn.exec:\hntttn.exe105⤵PID:940
-
\??\c:\hbnntt.exec:\hbnntt.exe106⤵PID:984
-
\??\c:\pjdvp.exec:\pjdvp.exe107⤵PID:608
-
\??\c:\lxlffxf.exec:\lxlffxf.exe108⤵PID:1228
-
\??\c:\9fflllr.exec:\9fflllr.exe109⤵PID:532
-
\??\c:\hbnbnn.exec:\hbnbnn.exe110⤵PID:2556
-
\??\c:\thnnnn.exec:\thnnnn.exe111⤵PID:2004
-
\??\c:\vjpjd.exec:\vjpjd.exe112⤵PID:2528
-
\??\c:\xxlrlxl.exec:\xxlrlxl.exe113⤵PID:2328
-
\??\c:\5xrflrr.exec:\5xrflrr.exe114⤵PID:2516
-
\??\c:\nhnthn.exec:\nhnthn.exe115⤵PID:2972
-
\??\c:\hbntbh.exec:\hbntbh.exe116⤵PID:1744
-
\??\c:\pjppj.exec:\pjppj.exe117⤵PID:1660
-
\??\c:\vjdpd.exec:\vjdpd.exe118⤵PID:1620
-
\??\c:\lxfflfr.exec:\lxfflfr.exe119⤵PID:2700
-
\??\c:\bthntt.exec:\bthntt.exe120⤵PID:1636
-
\??\c:\bntttn.exec:\bntttn.exe121⤵PID:2912
-
\??\c:\1dvdp.exec:\1dvdp.exe122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-