Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 08:02
Static task
static1
Behavioral task
behavioral1
Sample
ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe
Resource
win7-20240903-en
General
-
Target
ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe
-
Size
82KB
-
MD5
6fcfcac35bf540598fc997d116b3d1d0
-
SHA1
e56431278283b0e72d0a2edb7aac380bdac5f144
-
SHA256
ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453
-
SHA512
b38d4447eaf5d34275b95b86f1f54a6869cf1f4a21b26b5278e2a334568828fc07d912e06c11991d777d2f8fc51964a3e47446398b56c7d80f8af46edcfc930e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qvb:ymb3NkkiQ3mdBjFIIp9L9QrrA8A
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2012-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 hnhntb.exe 1800 jjvjj.exe 2288 7lllrrx.exe 3068 tbnthh.exe 2784 fxrrflf.exe 2704 frxxrrx.exe 2840 5nthbb.exe 2716 dvjvd.exe 2600 xlfxlrf.exe 3044 1frfllr.exe 1884 7nbttn.exe 1968 vvdvv.exe 1976 lllrfxf.exe 1828 3nttbb.exe 1812 tnhtbn.exe 1472 pjdjv.exe 2872 vpjvj.exe 1360 7xrfllr.exe 2896 xlrxffl.exe 992 5btbhn.exe 480 vpddp.exe 1416 7jdvj.exe 2940 jdjjv.exe 844 1fflxrx.exe 956 bnbbnn.exe 2124 1tnnbh.exe 1780 jddjv.exe 1608 lflrffl.exe 704 7thhhn.exe 2548 hbbhtb.exe 2084 3pddj.exe 2340 3llrrxl.exe 2220 frflxfl.exe 1524 nbnthh.exe 1496 1pjpv.exe 2324 jdjpd.exe 2720 xxxlfxl.exe 2800 5rrrxxf.exe 2712 hhhttb.exe 2740 nhhhnt.exe 2628 btnbhh.exe 2912 vjpvj.exe 2656 3lllxfl.exe 2384 xrflxff.exe 1808 xrrxflr.exe 2624 thtnhn.exe 1888 nhthbh.exe 2360 jdjvp.exe 1832 dvpvv.exe 1876 xlxxxxl.exe 2068 xrrfrrf.exe 2364 5bbnhn.exe 1816 hbnnbh.exe 1204 jdjpv.exe 2984 vvvvj.exe 1776 9fxrflr.exe 2088 7rrlrlx.exe 2180 ntbnnt.exe 1408 tnnbhh.exe 908 5dvpv.exe 1724 lfrfxxr.exe 1212 xrlrxxx.exe 844 lflrffl.exe 956 3thntt.exe -
resource yara_rule behavioral1/memory/2012-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2356 2012 ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe 30 PID 2012 wrote to memory of 2356 2012 ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe 30 PID 2012 wrote to memory of 2356 2012 ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe 30 PID 2012 wrote to memory of 2356 2012 ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe 30 PID 2356 wrote to memory of 1800 2356 hnhntb.exe 31 PID 2356 wrote to memory of 1800 2356 hnhntb.exe 31 PID 2356 wrote to memory of 1800 2356 hnhntb.exe 31 PID 2356 wrote to memory of 1800 2356 hnhntb.exe 31 PID 1800 wrote to memory of 2288 1800 jjvjj.exe 32 PID 1800 wrote to memory of 2288 1800 jjvjj.exe 32 PID 1800 wrote to memory of 2288 1800 jjvjj.exe 32 PID 1800 wrote to memory of 2288 1800 jjvjj.exe 32 PID 2288 wrote to memory of 3068 2288 7lllrrx.exe 33 PID 2288 wrote to memory of 3068 2288 7lllrrx.exe 33 PID 2288 wrote to memory of 3068 2288 7lllrrx.exe 33 PID 2288 wrote to memory of 3068 2288 7lllrrx.exe 33 PID 3068 wrote to memory of 2784 3068 tbnthh.exe 34 PID 3068 wrote to memory of 2784 3068 tbnthh.exe 34 PID 3068 wrote to memory of 2784 3068 tbnthh.exe 34 PID 3068 wrote to memory of 2784 3068 tbnthh.exe 34 PID 2784 wrote to memory of 2704 2784 fxrrflf.exe 35 PID 2784 wrote to memory of 2704 2784 fxrrflf.exe 35 PID 2784 wrote to memory of 2704 2784 fxrrflf.exe 35 PID 2784 wrote to memory of 2704 2784 fxrrflf.exe 35 PID 2704 wrote to memory of 2840 2704 frxxrrx.exe 36 PID 2704 wrote to memory of 2840 2704 frxxrrx.exe 36 PID 2704 wrote to memory of 2840 2704 frxxrrx.exe 36 PID 2704 wrote to memory of 2840 2704 frxxrrx.exe 36 PID 2840 wrote to memory of 2716 2840 5nthbb.exe 37 PID 2840 wrote to memory of 2716 2840 5nthbb.exe 37 PID 2840 wrote to memory of 2716 2840 5nthbb.exe 37 PID 2840 wrote to memory of 2716 2840 5nthbb.exe 37 PID 2716 wrote to memory of 2600 2716 dvjvd.exe 38 PID 2716 wrote to memory of 2600 2716 dvjvd.exe 38 PID 2716 wrote to memory of 2600 2716 dvjvd.exe 38 PID 2716 wrote to memory of 2600 2716 dvjvd.exe 38 PID 2600 wrote to memory of 3044 2600 xlfxlrf.exe 39 PID 2600 wrote to memory of 3044 2600 xlfxlrf.exe 39 PID 2600 wrote to memory of 3044 2600 xlfxlrf.exe 39 PID 2600 wrote to memory of 3044 2600 xlfxlrf.exe 39 PID 3044 wrote to memory of 1884 3044 1frfllr.exe 40 PID 3044 wrote to memory of 1884 3044 1frfllr.exe 40 PID 3044 wrote to memory of 1884 3044 1frfllr.exe 40 PID 3044 wrote to memory of 1884 3044 1frfllr.exe 40 PID 1884 wrote to memory of 1968 1884 7nbttn.exe 41 PID 1884 wrote to memory of 1968 1884 7nbttn.exe 41 PID 1884 wrote to memory of 1968 1884 7nbttn.exe 41 PID 1884 wrote to memory of 1968 1884 7nbttn.exe 41 PID 1968 wrote to memory of 1976 1968 vvdvv.exe 42 PID 1968 wrote to memory of 1976 1968 vvdvv.exe 42 PID 1968 wrote to memory of 1976 1968 vvdvv.exe 42 PID 1968 wrote to memory of 1976 1968 vvdvv.exe 42 PID 1976 wrote to memory of 1828 1976 lllrfxf.exe 43 PID 1976 wrote to memory of 1828 1976 lllrfxf.exe 43 PID 1976 wrote to memory of 1828 1976 lllrfxf.exe 43 PID 1976 wrote to memory of 1828 1976 lllrfxf.exe 43 PID 1828 wrote to memory of 1812 1828 3nttbb.exe 44 PID 1828 wrote to memory of 1812 1828 3nttbb.exe 44 PID 1828 wrote to memory of 1812 1828 3nttbb.exe 44 PID 1828 wrote to memory of 1812 1828 3nttbb.exe 44 PID 1812 wrote to memory of 1472 1812 tnhtbn.exe 45 PID 1812 wrote to memory of 1472 1812 tnhtbn.exe 45 PID 1812 wrote to memory of 1472 1812 tnhtbn.exe 45 PID 1812 wrote to memory of 1472 1812 tnhtbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe"C:\Users\Admin\AppData\Local\Temp\ac3b33e063b87b4078a8c1407e48870a5d3403d832c0b7a489ea3a84b1c7b453N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hnhntb.exec:\hnhntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\jjvjj.exec:\jjvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\7lllrrx.exec:\7lllrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tbnthh.exec:\tbnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\fxrrflf.exec:\fxrrflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\frxxrrx.exec:\frxxrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5nthbb.exec:\5nthbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dvjvd.exec:\dvjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xlfxlrf.exec:\xlfxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\1frfllr.exec:\1frfllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\7nbttn.exec:\7nbttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\vvdvv.exec:\vvdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\lllrfxf.exec:\lllrfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\3nttbb.exec:\3nttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\tnhtbn.exec:\tnhtbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\pjdjv.exec:\pjdjv.exe17⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vpjvj.exec:\vpjvj.exe18⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7xrfllr.exec:\7xrfllr.exe19⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xlrxffl.exec:\xlrxffl.exe20⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5btbhn.exec:\5btbhn.exe21⤵
- Executes dropped EXE
PID:992 -
\??\c:\vpddp.exec:\vpddp.exe22⤵
- Executes dropped EXE
PID:480 -
\??\c:\7jdvj.exec:\7jdvj.exe23⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jdjjv.exec:\jdjjv.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1fflxrx.exec:\1fflxrx.exe25⤵
- Executes dropped EXE
PID:844 -
\??\c:\bnbbnn.exec:\bnbbnn.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\1tnnbh.exec:\1tnnbh.exe27⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jddjv.exec:\jddjv.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lflrffl.exec:\lflrffl.exe29⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7thhhn.exec:\7thhhn.exe30⤵
- Executes dropped EXE
PID:704 -
\??\c:\hbbhtb.exec:\hbbhtb.exe31⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3pddj.exec:\3pddj.exe32⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3llrrxl.exec:\3llrrxl.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\frflxfl.exec:\frflxfl.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nbnthh.exec:\nbnthh.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1pjpv.exec:\1pjpv.exe36⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdjpd.exec:\jdjpd.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5rrrxxf.exec:\5rrrxxf.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hhhttb.exec:\hhhttb.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhhhnt.exec:\nhhhnt.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\btnbhh.exec:\btnbhh.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vjpvj.exec:\vjpvj.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3lllxfl.exec:\3lllxfl.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xrflxff.exec:\xrflxff.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xrrxflr.exec:\xrrxflr.exe46⤵
- Executes dropped EXE
PID:1808 -
\??\c:\thtnhn.exec:\thtnhn.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\nhthbh.exec:\nhthbh.exe48⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jdjvp.exec:\jdjvp.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dvpvv.exec:\dvpvv.exe50⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xlxxxxl.exec:\xlxxxxl.exe51⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe52⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5bbnhn.exec:\5bbnhn.exe53⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hbnnbh.exec:\hbnnbh.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdjpv.exec:\jdjpv.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvvvj.exec:\vvvvj.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9fxrflr.exec:\9fxrflr.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7rrlrlx.exec:\7rrlrlx.exe58⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ntbnnt.exec:\ntbnnt.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tnnbhh.exec:\tnnbhh.exe60⤵
- Executes dropped EXE
PID:1408 -
\??\c:\5dvpv.exec:\5dvpv.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\lfrfxxr.exec:\lfrfxxr.exe62⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrlrxxx.exec:\xrlrxxx.exe63⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lflrffl.exec:\lflrffl.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\3thntt.exec:\3thntt.exe65⤵
- Executes dropped EXE
PID:956 -
\??\c:\3hnnth.exec:\3hnnth.exe66⤵PID:1896
-
\??\c:\dvvdj.exec:\dvvdj.exe67⤵PID:3052
-
\??\c:\vvjpv.exec:\vvjpv.exe68⤵PID:1412
-
\??\c:\llxrffl.exec:\llxrffl.exe69⤵PID:1608
-
\??\c:\9lfflll.exec:\9lfflll.exe70⤵PID:1736
-
\??\c:\tnbbtn.exec:\tnbbtn.exe71⤵PID:2472
-
\??\c:\btbnbb.exec:\btbnbb.exe72⤵PID:2012
-
\??\c:\vvjjd.exec:\vvjjd.exe73⤵PID:2900
-
\??\c:\ppddp.exec:\ppddp.exe74⤵PID:2408
-
\??\c:\7xlfffl.exec:\7xlfffl.exe75⤵PID:2152
-
\??\c:\3xflxfl.exec:\3xflxfl.exe76⤵PID:2288
-
\??\c:\9rlrrxl.exec:\9rlrrxl.exe77⤵PID:2184
-
\??\c:\hhbhnn.exec:\hhbhnn.exe78⤵PID:3064
-
\??\c:\vpdjp.exec:\vpdjp.exe79⤵PID:2796
-
\??\c:\jdvjj.exec:\jdvjj.exe80⤵PID:2916
-
\??\c:\lfllfff.exec:\lfllfff.exe81⤵PID:2076
-
\??\c:\1lfrlxf.exec:\1lfrlxf.exe82⤵PID:2620
-
\??\c:\1rrfrxf.exec:\1rrfrxf.exe83⤵PID:2816
-
\??\c:\hhhnbb.exec:\hhhnbb.exe84⤵PID:2644
-
\??\c:\tntbhn.exec:\tntbhn.exe85⤵PID:2600
-
\??\c:\7jvjv.exec:\7jvjv.exe86⤵PID:1972
-
\??\c:\jjvpv.exec:\jjvpv.exe87⤵PID:3016
-
\??\c:\rfrrffl.exec:\rfrrffl.exe88⤵PID:1420
-
\??\c:\rlflrrf.exec:\rlflrrf.exe89⤵PID:1844
-
\??\c:\thbhtb.exec:\thbhtb.exe90⤵PID:328
-
\??\c:\9hbnhn.exec:\9hbnhn.exe91⤵PID:1240
-
\??\c:\htbbhh.exec:\htbbhh.exe92⤵PID:1828
-
\??\c:\pjvdp.exec:\pjvdp.exe93⤵PID:1456
-
\??\c:\fxlxxlx.exec:\fxlxxlx.exe94⤵PID:2028
-
\??\c:\1xlxxfr.exec:\1xlxxfr.exe95⤵PID:1200
-
\??\c:\xlxrrxx.exec:\xlxrrxx.exe96⤵PID:296
-
\??\c:\nbbtnt.exec:\nbbtnt.exe97⤵PID:2888
-
\??\c:\7vpdj.exec:\7vpdj.exe98⤵PID:2896
-
\??\c:\dpjjv.exec:\dpjjv.exe99⤵PID:784
-
\??\c:\9ddpd.exec:\9ddpd.exe100⤵PID:2236
-
\??\c:\lrlxrfl.exec:\lrlxrfl.exe101⤵PID:2300
-
\??\c:\7rlrffl.exec:\7rlrffl.exe102⤵PID:2560
-
\??\c:\7bnttt.exec:\7bnttt.exe103⤵PID:2552
-
\??\c:\hhnnnt.exec:\hhnnnt.exe104⤵PID:1092
-
\??\c:\jvdjv.exec:\jvdjv.exe105⤵PID:1304
-
\??\c:\dpvpd.exec:\dpvpd.exe106⤵PID:324
-
\??\c:\lfxrffr.exec:\lfxrffr.exe107⤵PID:2908
-
\??\c:\flrflxl.exec:\flrflxl.exe108⤵PID:2952
-
\??\c:\htbhtb.exec:\htbhtb.exe109⤵PID:2328
-
\??\c:\tnthnt.exec:\tnthnt.exe110⤵PID:3048
-
\??\c:\hbbhnt.exec:\hbbhnt.exe111⤵PID:888
-
\??\c:\7jdjv.exec:\7jdjv.exe112⤵PID:2092
-
\??\c:\ppjvj.exec:\ppjvj.exe113⤵PID:2084
-
\??\c:\9lflrxf.exec:\9lflrxf.exe114⤵PID:2664
-
\??\c:\7xrfrxf.exec:\7xrfrxf.exe115⤵PID:1892
-
\??\c:\nbntht.exec:\nbntht.exe116⤵PID:2292
-
\??\c:\btbhtt.exec:\btbhtt.exe117⤵PID:2672
-
\??\c:\vpjdp.exec:\vpjdp.exe118⤵PID:3008
-
\??\c:\9jjpd.exec:\9jjpd.exe119⤵PID:2708
-
\??\c:\3rfrxxf.exec:\3rfrxxf.exe120⤵PID:2784
-
\??\c:\lfxlxlf.exec:\lfxlxlf.exe121⤵PID:2728
-
\??\c:\ttnttb.exec:\ttnttb.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-