Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe
-
Size
65KB
-
MD5
c117e647fd185573c5a8d039a4fb48d0
-
SHA1
5e6ada561a339e0f6b25584d84d7e5c42dbf3f60
-
SHA256
d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992
-
SHA512
8fc0b601a481f8a64d12d0350789fba03b77d9f419979ec29076c799f7d1c793f3e7da1d462073841c5fb68dff6716c84e99c61ffd831669b3928e8a358093d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxw:ymb3NkkiQ3mdBjF0y7kbW
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2536-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-3407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 tbnnbt.exe 1988 flfxrxr.exe 2788 bntbnt.exe 2748 btbhtt.exe 2832 jdddp.exe 2740 frffllf.exe 2636 hthhhh.exe 2664 vjpvv.exe 2684 vpddp.exe 1016 xflrrff.exe 2936 rlllrxl.exe 1216 hbnhhh.exe 2976 vvddd.exe 2928 5frxrfr.exe 1364 5fxxxlr.exe 1440 3thntn.exe 2316 hbhhtt.exe 536 vvdvv.exe 1140 dpppd.exe 844 7xfflrx.exe 1808 rfrxxxl.exe 1636 hbtbnt.exe 852 jjvvv.exe 2564 1vjjj.exe 788 fxfxllr.exe 2344 xrlfxxl.exe 2100 thtbtt.exe 1968 dpvvd.exe 1684 lrllfxf.exe 2536 1rxfxxr.exe 2124 hbnthn.exe 2024 jvjjj.exe 1888 ddjpv.exe 2700 fxfxlfx.exe 2288 rlxfxxf.exe 2824 bthhnn.exe 2760 nhbbhh.exe 2616 pvdjj.exe 2968 frllffl.exe 2500 7lrxxxx.exe 2964 7bhthb.exe 2640 httbbb.exe 2680 vpvvj.exe 1036 vjjjp.exe 2708 ffffllx.exe 2352 rxxrlrr.exe 1904 9thhtb.exe 2864 httttt.exe 2984 pdvdd.exe 2928 llfxlxr.exe 1364 rllrfxf.exe 2324 9nbhnh.exe 2220 7htntn.exe 2396 dvdjv.exe 2252 jvpjp.exe 568 3rxxxxf.exe 1052 5llrlfl.exe 1840 thhhnt.exe 1828 bnttbb.exe 1724 nbtbbh.exe 1316 dvvdp.exe 892 jdpjj.exe 2284 1rflxxf.exe 2344 rlflllr.exe -
resource yara_rule behavioral1/memory/2536-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-3407-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2004 2536 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 30 PID 2536 wrote to memory of 2004 2536 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 30 PID 2536 wrote to memory of 2004 2536 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 30 PID 2536 wrote to memory of 2004 2536 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 30 PID 2004 wrote to memory of 1988 2004 tbnnbt.exe 31 PID 2004 wrote to memory of 1988 2004 tbnnbt.exe 31 PID 2004 wrote to memory of 1988 2004 tbnnbt.exe 31 PID 2004 wrote to memory of 1988 2004 tbnnbt.exe 31 PID 1988 wrote to memory of 2788 1988 flfxrxr.exe 32 PID 1988 wrote to memory of 2788 1988 flfxrxr.exe 32 PID 1988 wrote to memory of 2788 1988 flfxrxr.exe 32 PID 1988 wrote to memory of 2788 1988 flfxrxr.exe 32 PID 2788 wrote to memory of 2748 2788 bntbnt.exe 33 PID 2788 wrote to memory of 2748 2788 bntbnt.exe 33 PID 2788 wrote to memory of 2748 2788 bntbnt.exe 33 PID 2788 wrote to memory of 2748 2788 bntbnt.exe 33 PID 2748 wrote to memory of 2832 2748 btbhtt.exe 34 PID 2748 wrote to memory of 2832 2748 btbhtt.exe 34 PID 2748 wrote to memory of 2832 2748 btbhtt.exe 34 PID 2748 wrote to memory of 2832 2748 btbhtt.exe 34 PID 2832 wrote to memory of 2740 2832 jdddp.exe 35 PID 2832 wrote to memory of 2740 2832 jdddp.exe 35 PID 2832 wrote to memory of 2740 2832 jdddp.exe 35 PID 2832 wrote to memory of 2740 2832 jdddp.exe 35 PID 2740 wrote to memory of 2636 2740 frffllf.exe 36 PID 2740 wrote to memory of 2636 2740 frffllf.exe 36 PID 2740 wrote to memory of 2636 2740 frffllf.exe 36 PID 2740 wrote to memory of 2636 2740 frffllf.exe 36 PID 2636 wrote to memory of 2664 2636 hthhhh.exe 37 PID 2636 wrote to memory of 2664 2636 hthhhh.exe 37 PID 2636 wrote to memory of 2664 2636 hthhhh.exe 37 PID 2636 wrote to memory of 2664 2636 hthhhh.exe 37 PID 2664 wrote to memory of 2684 2664 vjpvv.exe 38 PID 2664 wrote to memory of 2684 2664 vjpvv.exe 38 PID 2664 wrote to memory of 2684 2664 vjpvv.exe 38 PID 2664 wrote to memory of 2684 2664 vjpvv.exe 38 PID 2684 wrote to memory of 1016 2684 vpddp.exe 39 PID 2684 wrote to memory of 1016 2684 vpddp.exe 39 PID 2684 wrote to memory of 1016 2684 vpddp.exe 39 PID 2684 wrote to memory of 1016 2684 vpddp.exe 39 PID 1016 wrote to memory of 2936 1016 xflrrff.exe 40 PID 1016 wrote to memory of 2936 1016 xflrrff.exe 40 PID 1016 wrote to memory of 2936 1016 xflrrff.exe 40 PID 1016 wrote to memory of 2936 1016 xflrrff.exe 40 PID 2936 wrote to memory of 1216 2936 rlllrxl.exe 41 PID 2936 wrote to memory of 1216 2936 rlllrxl.exe 41 PID 2936 wrote to memory of 1216 2936 rlllrxl.exe 41 PID 2936 wrote to memory of 1216 2936 rlllrxl.exe 41 PID 1216 wrote to memory of 2976 1216 hbnhhh.exe 42 PID 1216 wrote to memory of 2976 1216 hbnhhh.exe 42 PID 1216 wrote to memory of 2976 1216 hbnhhh.exe 42 PID 1216 wrote to memory of 2976 1216 hbnhhh.exe 42 PID 2976 wrote to memory of 2928 2976 vvddd.exe 43 PID 2976 wrote to memory of 2928 2976 vvddd.exe 43 PID 2976 wrote to memory of 2928 2976 vvddd.exe 43 PID 2976 wrote to memory of 2928 2976 vvddd.exe 43 PID 2928 wrote to memory of 1364 2928 5frxrfr.exe 44 PID 2928 wrote to memory of 1364 2928 5frxrfr.exe 44 PID 2928 wrote to memory of 1364 2928 5frxrfr.exe 44 PID 2928 wrote to memory of 1364 2928 5frxrfr.exe 44 PID 1364 wrote to memory of 1440 1364 5fxxxlr.exe 45 PID 1364 wrote to memory of 1440 1364 5fxxxlr.exe 45 PID 1364 wrote to memory of 1440 1364 5fxxxlr.exe 45 PID 1364 wrote to memory of 1440 1364 5fxxxlr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe"C:\Users\Admin\AppData\Local\Temp\d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\tbnnbt.exec:\tbnnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\flfxrxr.exec:\flfxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\bntbnt.exec:\bntbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\btbhtt.exec:\btbhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jdddp.exec:\jdddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\frffllf.exec:\frffllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hthhhh.exec:\hthhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjpvv.exec:\vjpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpddp.exec:\vpddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xflrrff.exec:\xflrrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\rlllrxl.exec:\rlllrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\hbnhhh.exec:\hbnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\vvddd.exec:\vvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5frxrfr.exec:\5frxrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\5fxxxlr.exec:\5fxxxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\3thntn.exec:\3thntn.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hbhhtt.exec:\hbhhtt.exe18⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vvdvv.exec:\vvdvv.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\dpppd.exec:\dpppd.exe20⤵
- Executes dropped EXE
PID:1140 -
\??\c:\7xfflrx.exec:\7xfflrx.exe21⤵
- Executes dropped EXE
PID:844 -
\??\c:\rfrxxxl.exec:\rfrxxxl.exe22⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hbtbnt.exec:\hbtbnt.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jjvvv.exec:\jjvvv.exe24⤵
- Executes dropped EXE
PID:852 -
\??\c:\1vjjj.exec:\1vjjj.exe25⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fxfxllr.exec:\fxfxllr.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\xrlfxxl.exec:\xrlfxxl.exe27⤵
- Executes dropped EXE
PID:2344 -
\??\c:\thtbtt.exec:\thtbtt.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dpvvd.exec:\dpvvd.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lrllfxf.exec:\lrllfxf.exe30⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1rxfxxr.exec:\1rxfxxr.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hbnthn.exec:\hbnthn.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jvjjj.exec:\jvjjj.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ddjpv.exec:\ddjpv.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\fxfxlfx.exec:\fxfxlfx.exe35⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rlxfxxf.exec:\rlxfxxf.exe36⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bthhnn.exec:\bthhnn.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nhbbhh.exec:\nhbbhh.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pvdjj.exec:\pvdjj.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\frllffl.exec:\frllffl.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7lrxxxx.exec:\7lrxxxx.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7bhthb.exec:\7bhthb.exe42⤵
- Executes dropped EXE
PID:2964 -
\??\c:\httbbb.exec:\httbbb.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpvvj.exec:\vpvvj.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vjjjp.exec:\vjjjp.exe45⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ffffllx.exec:\ffffllx.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\rxxrlrr.exec:\rxxrlrr.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9thhtb.exec:\9thhtb.exe48⤵
- Executes dropped EXE
PID:1904 -
\??\c:\httttt.exec:\httttt.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pdvdd.exec:\pdvdd.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\llfxlxr.exec:\llfxlxr.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rllrfxf.exec:\rllrfxf.exe52⤵
- Executes dropped EXE
PID:1364 -
\??\c:\9nbhnh.exec:\9nbhnh.exe53⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7htntn.exec:\7htntn.exe54⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvdjv.exec:\dvdjv.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvpjp.exec:\jvpjp.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3rxxxxf.exec:\3rxxxxf.exe57⤵
- Executes dropped EXE
PID:568 -
\??\c:\5llrlfl.exec:\5llrlfl.exe58⤵
- Executes dropped EXE
PID:1052 -
\??\c:\thhhnt.exec:\thhhnt.exe59⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bnttbb.exec:\bnttbb.exe60⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nbtbbh.exec:\nbtbbh.exe61⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvvdp.exec:\dvvdp.exe62⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jdpjj.exec:\jdpjj.exe63⤵
- Executes dropped EXE
PID:892 -
\??\c:\1rflxxf.exec:\1rflxxf.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rlflllr.exec:\rlflllr.exe65⤵
- Executes dropped EXE
PID:2344 -
\??\c:\thtthb.exec:\thtthb.exe66⤵PID:2176
-
\??\c:\3bhbtt.exec:\3bhbtt.exe67⤵PID:1772
-
\??\c:\pdvpv.exec:\pdvpv.exe68⤵PID:1964
-
\??\c:\7jvvv.exec:\7jvvv.exe69⤵PID:2092
-
\??\c:\rfllrrx.exec:\rfllrrx.exe70⤵
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe71⤵PID:2560
-
\??\c:\9hbbnb.exec:\9hbbnb.exe72⤵PID:1512
-
\??\c:\bntnhb.exec:\bntnhb.exe73⤵PID:1608
-
\??\c:\dpvpv.exec:\dpvpv.exe74⤵PID:2920
-
\??\c:\7pdvv.exec:\7pdvv.exe75⤵PID:2700
-
\??\c:\5vddd.exec:\5vddd.exe76⤵PID:2288
-
\??\c:\lfrrfrf.exec:\lfrrfrf.exe77⤵PID:2752
-
\??\c:\3rlrllx.exec:\3rlrllx.exe78⤵PID:2760
-
\??\c:\thtnbb.exec:\thtnbb.exe79⤵PID:2616
-
\??\c:\nhtttb.exec:\nhtttb.exe80⤵PID:2772
-
\??\c:\bnthhb.exec:\bnthhb.exe81⤵PID:2608
-
\??\c:\jdjjp.exec:\jdjjp.exe82⤵PID:2964
-
\??\c:\lxllxxf.exec:\lxllxxf.exe83⤵PID:2652
-
\??\c:\frflrrx.exec:\frflrrx.exe84⤵PID:2680
-
\??\c:\hnhhnn.exec:\hnhhnn.exe85⤵PID:2988
-
\??\c:\hhtbhn.exec:\hhtbhn.exe86⤵PID:2708
-
\??\c:\jvdvv.exec:\jvdvv.exe87⤵PID:1640
-
\??\c:\9pvvj.exec:\9pvvj.exe88⤵PID:1460
-
\??\c:\3pvvv.exec:\3pvvv.exe89⤵PID:2504
-
\??\c:\xlxrffl.exec:\xlxrffl.exe90⤵PID:2972
-
\??\c:\7rflrrl.exec:\7rflrrl.exe91⤵PID:756
-
\??\c:\3nbhnh.exec:\3nbhnh.exe92⤵PID:1796
-
\??\c:\bhtbtt.exec:\bhtbtt.exe93⤵PID:2324
-
\??\c:\5vddd.exec:\5vddd.exe94⤵PID:2276
-
\??\c:\9jdvp.exec:\9jdvp.exe95⤵PID:2396
-
\??\c:\dvdvd.exec:\dvdvd.exe96⤵PID:1712
-
\??\c:\flrxrlr.exec:\flrxrlr.exe97⤵PID:1548
-
\??\c:\xrllllr.exec:\xrllllr.exe98⤵PID:1332
-
\??\c:\thnthb.exec:\thnthb.exe99⤵PID:1840
-
\??\c:\nhntbb.exec:\nhntbb.exe100⤵PID:2084
-
\??\c:\1hnntt.exec:\1hnntt.exe101⤵PID:1724
-
\??\c:\vjpvv.exec:\vjpvv.exe102⤵PID:904
-
\??\c:\1jdvv.exec:\1jdvv.exe103⤵PID:636
-
\??\c:\7rflffl.exec:\7rflffl.exe104⤵PID:2444
-
\??\c:\frrrrlr.exec:\frrrrlr.exe105⤵PID:1884
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe106⤵PID:1500
-
\??\c:\tbtnbh.exec:\tbtnbh.exe107⤵PID:2392
-
\??\c:\hbhhnn.exec:\hbhhnn.exe108⤵PID:2216
-
\??\c:\dppdv.exec:\dppdv.exe109⤵PID:1692
-
\??\c:\3dppp.exec:\3dppp.exe110⤵PID:2356
-
\??\c:\9vpdj.exec:\9vpdj.exe111⤵PID:2560
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe112⤵PID:1488
-
\??\c:\xlrrrfl.exec:\xlrrrfl.exe113⤵PID:2376
-
\??\c:\1tnnnn.exec:\1tnnnn.exe114⤵PID:2468
-
\??\c:\5bhthb.exec:\5bhthb.exe115⤵PID:2700
-
\??\c:\bntbbt.exec:\bntbbt.exe116⤵PID:2900
-
\??\c:\pjjpp.exec:\pjjpp.exe117⤵PID:2280
-
\??\c:\jvddv.exec:\jvddv.exe118⤵PID:3044
-
\??\c:\frxxfff.exec:\frxxfff.exe119⤵PID:2724
-
\??\c:\9lxrffr.exec:\9lxrffr.exe120⤵PID:2776
-
\??\c:\httthh.exec:\httthh.exe121⤵PID:1740
-
\??\c:\tntthh.exec:\tntthh.exe122⤵PID:1240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-