Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 05:37
Static task
static1
Behavioral task
behavioral1
Sample
5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe
Resource
win7-20240708-en
General
-
Target
5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe
-
Size
93KB
-
MD5
7c8bbac05092a7980d8791757ae39220
-
SHA1
bdd9dc98020e6b1cda4cde2f6ab8e1cff39f06ea
-
SHA256
5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76
-
SHA512
54353045145b217fd48c08f0966bba7d40dce285a54503eb6476250e5d01fa4fe57909df13d1775ca0828c5e0e648253ba1d770d89f32b8eec93ad753dea5a1e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xQ5s:ymb3NkkiQ3mdBjF+3TU20LQy
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2196 rllffff.exe 2224 ttbhnt.exe 4020 jdpjp.exe 4864 vdjjd.exe 3760 lfffxxr.exe 2840 xrrrrrf.exe 4868 tttttt.exe 2328 nhhbtb.exe 4624 ddjjv.exe 5116 jvjdv.exe 2548 xffxlll.exe 3808 frrlfff.exe 4040 jpdvd.exe 4052 dvvvd.exe 3152 rllffxr.exe 5104 9ntnhh.exe 3160 dpvdp.exe 1340 xrrlllf.exe 4668 ppjvv.exe 772 dvjdp.exe 2816 3lxrxxr.exe 1516 ttttnn.exe 1044 vdjdv.exe 1280 5xxrrrr.exe 1724 9flrlrl.exe 5016 nntnhn.exe 828 jddjv.exe 1604 5pdvp.exe 3576 9jpjd.exe 2760 nhtntt.exe 3512 vvvvd.exe 4208 frxrlll.exe 1184 lrxxrxx.exe 1836 3tnnnt.exe 2696 vpddd.exe 3540 7xlfxxx.exe 1888 bbnnnn.exe 4060 ffrllxx.exe 2508 frffrrr.exe 2832 9jvjd.exe 1884 7ddvp.exe 4376 pjjdv.exe 756 1rxrllf.exe 448 thhhnn.exe 532 9xlfxfx.exe 5096 3nnnhh.exe 924 3hnhhh.exe 4752 5pvjj.exe 1492 9ffxrrl.exe 1676 frrffxx.exe 1684 7btnnh.exe 2944 9jjdv.exe 116 3djdp.exe 1868 lxrlffx.exe 3148 3xxxrrr.exe 2800 hhnnhh.exe 3704 htbbbb.exe 912 dvjjd.exe 4204 vpddd.exe 4904 rrlffff.exe 3120 hthhhh.exe 4516 vjddp.exe 1540 vvdpd.exe 3152 3rllrrf.exe -
resource yara_rule behavioral2/memory/4004-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2196 4004 5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe 82 PID 4004 wrote to memory of 2196 4004 5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe 82 PID 4004 wrote to memory of 2196 4004 5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe 82 PID 2196 wrote to memory of 2224 2196 rllffff.exe 83 PID 2196 wrote to memory of 2224 2196 rllffff.exe 83 PID 2196 wrote to memory of 2224 2196 rllffff.exe 83 PID 2224 wrote to memory of 4020 2224 ttbhnt.exe 84 PID 2224 wrote to memory of 4020 2224 ttbhnt.exe 84 PID 2224 wrote to memory of 4020 2224 ttbhnt.exe 84 PID 4020 wrote to memory of 4864 4020 jdpjp.exe 85 PID 4020 wrote to memory of 4864 4020 jdpjp.exe 85 PID 4020 wrote to memory of 4864 4020 jdpjp.exe 85 PID 4864 wrote to memory of 3760 4864 vdjjd.exe 86 PID 4864 wrote to memory of 3760 4864 vdjjd.exe 86 PID 4864 wrote to memory of 3760 4864 vdjjd.exe 86 PID 3760 wrote to memory of 2840 3760 lfffxxr.exe 87 PID 3760 wrote to memory of 2840 3760 lfffxxr.exe 87 PID 3760 wrote to memory of 2840 3760 lfffxxr.exe 87 PID 2840 wrote to memory of 4868 2840 xrrrrrf.exe 88 PID 2840 wrote to memory of 4868 2840 xrrrrrf.exe 88 PID 2840 wrote to memory of 4868 2840 xrrrrrf.exe 88 PID 4868 wrote to memory of 2328 4868 tttttt.exe 89 PID 4868 wrote to memory of 2328 4868 tttttt.exe 89 PID 4868 wrote to memory of 2328 4868 tttttt.exe 89 PID 2328 wrote to memory of 4624 2328 nhhbtb.exe 90 PID 2328 wrote to memory of 4624 2328 nhhbtb.exe 90 PID 2328 wrote to memory of 4624 2328 nhhbtb.exe 90 PID 4624 wrote to memory of 5116 4624 ddjjv.exe 91 PID 4624 wrote to memory of 5116 4624 ddjjv.exe 91 PID 4624 wrote to memory of 5116 4624 ddjjv.exe 91 PID 5116 wrote to memory of 2548 5116 jvjdv.exe 92 PID 5116 wrote to memory of 2548 5116 jvjdv.exe 92 PID 5116 wrote to memory of 2548 5116 jvjdv.exe 92 PID 2548 wrote to memory of 3808 2548 xffxlll.exe 93 PID 2548 wrote to memory of 3808 2548 xffxlll.exe 93 PID 2548 wrote to memory of 3808 2548 xffxlll.exe 93 PID 3808 wrote to memory of 4040 3808 frrlfff.exe 94 PID 3808 wrote to memory of 4040 3808 frrlfff.exe 94 PID 3808 wrote to memory of 4040 3808 frrlfff.exe 94 PID 4040 wrote to memory of 4052 4040 jpdvd.exe 95 PID 4040 wrote to memory of 4052 4040 jpdvd.exe 95 PID 4040 wrote to memory of 4052 4040 jpdvd.exe 95 PID 4052 wrote to memory of 3152 4052 dvvvd.exe 96 PID 4052 wrote to memory of 3152 4052 dvvvd.exe 96 PID 4052 wrote to memory of 3152 4052 dvvvd.exe 96 PID 3152 wrote to memory of 5104 3152 rllffxr.exe 97 PID 3152 wrote to memory of 5104 3152 rllffxr.exe 97 PID 3152 wrote to memory of 5104 3152 rllffxr.exe 97 PID 5104 wrote to memory of 3160 5104 9ntnhh.exe 98 PID 5104 wrote to memory of 3160 5104 9ntnhh.exe 98 PID 5104 wrote to memory of 3160 5104 9ntnhh.exe 98 PID 3160 wrote to memory of 1340 3160 dpvdp.exe 99 PID 3160 wrote to memory of 1340 3160 dpvdp.exe 99 PID 3160 wrote to memory of 1340 3160 dpvdp.exe 99 PID 1340 wrote to memory of 4668 1340 xrrlllf.exe 100 PID 1340 wrote to memory of 4668 1340 xrrlllf.exe 100 PID 1340 wrote to memory of 4668 1340 xrrlllf.exe 100 PID 4668 wrote to memory of 772 4668 ppjvv.exe 101 PID 4668 wrote to memory of 772 4668 ppjvv.exe 101 PID 4668 wrote to memory of 772 4668 ppjvv.exe 101 PID 772 wrote to memory of 2816 772 dvjdp.exe 102 PID 772 wrote to memory of 2816 772 dvjdp.exe 102 PID 772 wrote to memory of 2816 772 dvjdp.exe 102 PID 2816 wrote to memory of 1516 2816 3lxrxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe"C:\Users\Admin\AppData\Local\Temp\5c8febe6cfa4254758def157de243766a85a5d94b76301a987c328ceb88f4c76N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\rllffff.exec:\rllffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ttbhnt.exec:\ttbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jdpjp.exec:\jdpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\vdjjd.exec:\vdjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\lfffxxr.exec:\lfffxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tttttt.exec:\tttttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\nhhbtb.exec:\nhhbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ddjjv.exec:\ddjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\jvjdv.exec:\jvjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\xffxlll.exec:\xffxlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\frrlfff.exec:\frrlfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\jpdvd.exec:\jpdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\dvvvd.exec:\dvvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\rllffxr.exec:\rllffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\9ntnhh.exec:\9ntnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\dpvdp.exec:\dpvdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\xrrlllf.exec:\xrrlllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\ppjvv.exec:\ppjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\dvjdp.exec:\dvjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\3lxrxxr.exec:\3lxrxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ttttnn.exec:\ttttnn.exe23⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vdjdv.exec:\vdjdv.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5xxrrrr.exec:\5xxrrrr.exe25⤵
- Executes dropped EXE
PID:1280 -
\??\c:\9flrlrl.exec:\9flrlrl.exe26⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nntnhn.exec:\nntnhn.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\jddjv.exec:\jddjv.exe28⤵
- Executes dropped EXE
PID:828 -
\??\c:\5pdvp.exec:\5pdvp.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9jpjd.exec:\9jpjd.exe30⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nhtntt.exec:\nhtntt.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vvvvd.exec:\vvvvd.exe32⤵
- Executes dropped EXE
PID:3512 -
\??\c:\frxrlll.exec:\frxrlll.exe33⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lrxxrxx.exec:\lrxxrxx.exe34⤵
- Executes dropped EXE
PID:1184 -
\??\c:\3tnnnt.exec:\3tnnnt.exe35⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vpddd.exec:\vpddd.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7xlfxxx.exec:\7xlfxxx.exe37⤵
- Executes dropped EXE
PID:3540 -
\??\c:\bbnnnn.exec:\bbnnnn.exe38⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ffrllxx.exec:\ffrllxx.exe39⤵
- Executes dropped EXE
PID:4060 -
\??\c:\frffrrr.exec:\frffrrr.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9jvjd.exec:\9jvjd.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7ddvp.exec:\7ddvp.exe42⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pjjdv.exec:\pjjdv.exe43⤵
- Executes dropped EXE
PID:4376 -
\??\c:\1rxrllf.exec:\1rxrllf.exe44⤵
- Executes dropped EXE
PID:756 -
\??\c:\thhhnn.exec:\thhhnn.exe45⤵
- Executes dropped EXE
PID:448 -
\??\c:\9xlfxfx.exec:\9xlfxfx.exe46⤵
- Executes dropped EXE
PID:532 -
\??\c:\3nnnhh.exec:\3nnnhh.exe47⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3hnhhh.exec:\3hnhhh.exe48⤵
- Executes dropped EXE
PID:924 -
\??\c:\5pvjj.exec:\5pvjj.exe49⤵
- Executes dropped EXE
PID:4752 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe50⤵
- Executes dropped EXE
PID:1492 -
\??\c:\frrffxx.exec:\frrffxx.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7btnnh.exec:\7btnnh.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9jjdv.exec:\9jjdv.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\3djdp.exec:\3djdp.exe54⤵
- Executes dropped EXE
PID:116 -
\??\c:\lxrlffx.exec:\lxrlffx.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe56⤵
- Executes dropped EXE
PID:3148 -
\??\c:\hhnnhh.exec:\hhnnhh.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\htbbbb.exec:\htbbbb.exe58⤵
- Executes dropped EXE
PID:3704 -
\??\c:\dvjjd.exec:\dvjjd.exe59⤵
- Executes dropped EXE
PID:912 -
\??\c:\vpddd.exec:\vpddd.exe60⤵
- Executes dropped EXE
PID:4204 -
\??\c:\rrlffff.exec:\rrlffff.exe61⤵
- Executes dropped EXE
PID:4904 -
\??\c:\hthhhh.exec:\hthhhh.exe62⤵
- Executes dropped EXE
PID:3120 -
\??\c:\vjddp.exec:\vjddp.exe63⤵
- Executes dropped EXE
PID:4516 -
\??\c:\vvdpd.exec:\vvdpd.exe64⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3rllrrf.exec:\3rllrrf.exe65⤵
- Executes dropped EXE
PID:3152 -
\??\c:\llxrfff.exec:\llxrfff.exe66⤵PID:4404
-
\??\c:\bhntbh.exec:\bhntbh.exe67⤵PID:852
-
\??\c:\dvvjd.exec:\dvvjd.exe68⤵PID:3312
-
\??\c:\frffxxx.exec:\frffxxx.exe69⤵PID:4668
-
\??\c:\bbnnnn.exec:\bbnnnn.exe70⤵PID:3672
-
\??\c:\9vdjd.exec:\9vdjd.exe71⤵
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\ddddv.exec:\ddddv.exe72⤵PID:4672
-
\??\c:\lflfffl.exec:\lflfffl.exe73⤵
- System Location Discovery: System Language Discovery
PID:3368 -
\??\c:\hntttt.exec:\hntttt.exe74⤵PID:2228
-
\??\c:\nhnhbh.exec:\nhnhbh.exe75⤵PID:1280
-
\??\c:\jjdjp.exec:\jjdjp.exe76⤵PID:3484
-
\??\c:\7rxrlrx.exec:\7rxrlrx.exe77⤵PID:2276
-
\??\c:\1flrrxx.exec:\1flrrxx.exe78⤵PID:3940
-
\??\c:\bntntn.exec:\bntntn.exe79⤵PID:828
-
\??\c:\nntbbn.exec:\nntbbn.exe80⤵PID:4328
-
\??\c:\9jjjd.exec:\9jjjd.exe81⤵PID:740
-
\??\c:\lflllrr.exec:\lflllrr.exe82⤵PID:1220
-
\??\c:\ntbbtt.exec:\ntbbtt.exe83⤵PID:2852
-
\??\c:\nbhhbh.exec:\nbhhbh.exe84⤵PID:4660
-
\??\c:\1jvvv.exec:\1jvvv.exe85⤵PID:3240
-
\??\c:\pddjj.exec:\pddjj.exe86⤵PID:2264
-
\??\c:\fllfxff.exec:\fllfxff.exe87⤵PID:2024
-
\??\c:\9ffffll.exec:\9ffffll.exe88⤵PID:2200
-
\??\c:\nhnttt.exec:\nhnttt.exe89⤵PID:388
-
\??\c:\vppvv.exec:\vppvv.exe90⤵PID:1436
-
\??\c:\7vjdv.exec:\7vjdv.exe91⤵PID:1072
-
\??\c:\fffxrxx.exec:\fffxrxx.exe92⤵PID:548
-
\??\c:\rxxlffx.exec:\rxxlffx.exe93⤵PID:4840
-
\??\c:\bnnhhh.exec:\bnnhhh.exe94⤵PID:4444
-
\??\c:\djvjd.exec:\djvjd.exe95⤵PID:4288
-
\??\c:\pdppj.exec:\pdppj.exe96⤵PID:2044
-
\??\c:\rrrrlll.exec:\rrrrlll.exe97⤵PID:4376
-
\??\c:\hhhnht.exec:\hhhnht.exe98⤵PID:2768
-
\??\c:\1btnnn.exec:\1btnnn.exe99⤵PID:4876
-
\??\c:\djpjd.exec:\djpjd.exe100⤵PID:532
-
\??\c:\xxrlllf.exec:\xxrlllf.exe101⤵PID:992
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe102⤵PID:3760
-
\??\c:\nhhhhh.exec:\nhhhhh.exe103⤵PID:1296
-
\??\c:\dpvpd.exec:\dpvpd.exe104⤵PID:3984
-
\??\c:\jvddv.exec:\jvddv.exe105⤵PID:4416
-
\??\c:\fllxxrr.exec:\fllxxrr.exe106⤵PID:956
-
\??\c:\ffxlfxl.exec:\ffxlfxl.exe107⤵PID:2840
-
\??\c:\3tnntb.exec:\3tnntb.exe108⤵PID:1012
-
\??\c:\3tbtnn.exec:\3tbtnn.exe109⤵PID:2752
-
\??\c:\dvpjj.exec:\dvpjj.exe110⤵PID:3404
-
\??\c:\1rxfxff.exec:\1rxfxff.exe111⤵PID:2260
-
\??\c:\lrrllll.exec:\lrrllll.exe112⤵PID:2136
-
\??\c:\thhthh.exec:\thhthh.exe113⤵PID:2240
-
\??\c:\btbbnb.exec:\btbbnb.exe114⤵PID:1424
-
\??\c:\5dpdj.exec:\5dpdj.exe115⤵PID:1176
-
\??\c:\9ddvv.exec:\9ddvv.exe116⤵PID:852
-
\??\c:\btbtbb.exec:\btbtbb.exe117⤵PID:1340
-
\??\c:\vvvvj.exec:\vvvvj.exe118⤵PID:3836
-
\??\c:\djpjj.exec:\djpjj.exe119⤵PID:4012
-
\??\c:\9xxxxff.exec:\9xxxxff.exe120⤵PID:1768
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe121⤵PID:3628
-
\??\c:\nnntnn.exec:\nnntnn.exe122⤵PID:3736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-