Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-10-2024 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe
-
Size
71KB
-
MD5
a4673542dd6d0e4ac70ea604f3a3f08c
-
SHA1
8e0fd2b5ad6bcf355fc81943b1924396d531c724
-
SHA256
d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee
-
SHA512
9a57b62249a2e758322b146deb733b45e8d0dad1ae1c33d549c1aad59d334f04de2c8cbf81d20252acf80608e0d56f1dc165fb21ad80ec3c20e2ef1decfb407e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj5hq:ymb3NkkiQ3mdBjFI4Vq
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1728 7vdvv.exe 2376 pdjdv.exe 2296 lxxrxxr.exe 2740 9pjjp.exe 2716 dvddp.exe 2872 lrxxffx.exe 2728 xllfxfl.exe 2608 3btbbt.exe 2300 dpvvd.exe 1400 dpjvv.exe 2004 dvjpd.exe 1044 lflllll.exe 1344 5lxfrlx.exe 1304 9thttb.exe 2896 hthbhb.exe 1500 bntbbh.exe 2916 vpppp.exe 2188 jjppp.exe 1624 7dpdj.exe 2196 1flfffl.exe 1396 fxrrxxf.exe 2572 thtbhh.exe 828 nhbbbh.exe 888 7nbhbb.exe 2268 dpjpv.exe 2448 9vjjv.exe 1408 rlrfxfr.exe 1528 frfrxrr.exe 1560 rlxlflr.exe 2532 nhtnbb.exe 2944 nhtbnt.exe 1900 jpvjd.exe 1508 pjvpd.exe 1832 lxllffl.exe 2092 rrflflr.exe 2424 rxlfxlr.exe 2828 nhthnn.exe 2696 tnbbnb.exe 2968 vppvd.exe 2764 xxlxllx.exe 2712 lfxlflx.exe 1668 tnbhnn.exe 2300 1httbb.exe 2032 pppdj.exe 1724 1lflxlx.exe 2500 rrfrlxf.exe 3040 bbntht.exe 1540 bbthtt.exe 1012 9pdvd.exe 2912 vjvdd.exe 2908 fxrrrfr.exe 664 llfrlxl.exe 2660 ttnbth.exe 2564 pjdjj.exe 3028 rfxfllr.exe 1740 bthntb.exe 2476 nnhnhn.exe 1068 7jvdp.exe 1664 ppddp.exe 828 llrxlxl.exe 924 ttntnt.exe 744 hhbhnn.exe 824 pvpvj.exe 2148 rlxxlxf.exe -
resource yara_rule behavioral1/memory/3004-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-102-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 1728 3004 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 30 PID 3004 wrote to memory of 1728 3004 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 30 PID 3004 wrote to memory of 1728 3004 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 30 PID 3004 wrote to memory of 1728 3004 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 30 PID 1728 wrote to memory of 2376 1728 7vdvv.exe 31 PID 1728 wrote to memory of 2376 1728 7vdvv.exe 31 PID 1728 wrote to memory of 2376 1728 7vdvv.exe 31 PID 1728 wrote to memory of 2376 1728 7vdvv.exe 31 PID 2376 wrote to memory of 2296 2376 pdjdv.exe 32 PID 2376 wrote to memory of 2296 2376 pdjdv.exe 32 PID 2376 wrote to memory of 2296 2376 pdjdv.exe 32 PID 2376 wrote to memory of 2296 2376 pdjdv.exe 32 PID 2296 wrote to memory of 2740 2296 lxxrxxr.exe 33 PID 2296 wrote to memory of 2740 2296 lxxrxxr.exe 33 PID 2296 wrote to memory of 2740 2296 lxxrxxr.exe 33 PID 2296 wrote to memory of 2740 2296 lxxrxxr.exe 33 PID 2740 wrote to memory of 2716 2740 9pjjp.exe 34 PID 2740 wrote to memory of 2716 2740 9pjjp.exe 34 PID 2740 wrote to memory of 2716 2740 9pjjp.exe 34 PID 2740 wrote to memory of 2716 2740 9pjjp.exe 34 PID 2716 wrote to memory of 2872 2716 dvddp.exe 35 PID 2716 wrote to memory of 2872 2716 dvddp.exe 35 PID 2716 wrote to memory of 2872 2716 dvddp.exe 35 PID 2716 wrote to memory of 2872 2716 dvddp.exe 35 PID 2872 wrote to memory of 2728 2872 lrxxffx.exe 36 PID 2872 wrote to memory of 2728 2872 lrxxffx.exe 36 PID 2872 wrote to memory of 2728 2872 lrxxffx.exe 36 PID 2872 wrote to memory of 2728 2872 lrxxffx.exe 36 PID 2728 wrote to memory of 2608 2728 xllfxfl.exe 37 PID 2728 wrote to memory of 2608 2728 xllfxfl.exe 37 PID 2728 wrote to memory of 2608 2728 xllfxfl.exe 37 PID 2728 wrote to memory of 2608 2728 xllfxfl.exe 37 PID 2608 wrote to memory of 2300 2608 3btbbt.exe 38 PID 2608 wrote to memory of 2300 2608 3btbbt.exe 38 PID 2608 wrote to memory of 2300 2608 3btbbt.exe 38 PID 2608 wrote to memory of 2300 2608 3btbbt.exe 38 PID 2300 wrote to memory of 1400 2300 dpvvd.exe 39 PID 2300 wrote to memory of 1400 2300 dpvvd.exe 39 PID 2300 wrote to memory of 1400 2300 dpvvd.exe 39 PID 2300 wrote to memory of 1400 2300 dpvvd.exe 39 PID 1400 wrote to memory of 2004 1400 dpjvv.exe 40 PID 1400 wrote to memory of 2004 1400 dpjvv.exe 40 PID 1400 wrote to memory of 2004 1400 dpjvv.exe 40 PID 1400 wrote to memory of 2004 1400 dpjvv.exe 40 PID 2004 wrote to memory of 1044 2004 dvjpd.exe 41 PID 2004 wrote to memory of 1044 2004 dvjpd.exe 41 PID 2004 wrote to memory of 1044 2004 dvjpd.exe 41 PID 2004 wrote to memory of 1044 2004 dvjpd.exe 41 PID 1044 wrote to memory of 1344 1044 lflllll.exe 42 PID 1044 wrote to memory of 1344 1044 lflllll.exe 42 PID 1044 wrote to memory of 1344 1044 lflllll.exe 42 PID 1044 wrote to memory of 1344 1044 lflllll.exe 42 PID 1344 wrote to memory of 1304 1344 5lxfrlx.exe 43 PID 1344 wrote to memory of 1304 1344 5lxfrlx.exe 43 PID 1344 wrote to memory of 1304 1344 5lxfrlx.exe 43 PID 1344 wrote to memory of 1304 1344 5lxfrlx.exe 43 PID 1304 wrote to memory of 2896 1304 9thttb.exe 44 PID 1304 wrote to memory of 2896 1304 9thttb.exe 44 PID 1304 wrote to memory of 2896 1304 9thttb.exe 44 PID 1304 wrote to memory of 2896 1304 9thttb.exe 44 PID 2896 wrote to memory of 1500 2896 hthbhb.exe 45 PID 2896 wrote to memory of 1500 2896 hthbhb.exe 45 PID 2896 wrote to memory of 1500 2896 hthbhb.exe 45 PID 2896 wrote to memory of 1500 2896 hthbhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe"C:\Users\Admin\AppData\Local\Temp\d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\7vdvv.exec:\7vdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\pdjdv.exec:\pdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\9pjjp.exec:\9pjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dvddp.exec:\dvddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lrxxffx.exec:\lrxxffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xllfxfl.exec:\xllfxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\3btbbt.exec:\3btbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dpvvd.exec:\dpvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\dpjvv.exec:\dpjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\dvjpd.exec:\dvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\lflllll.exec:\lflllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\5lxfrlx.exec:\5lxfrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\9thttb.exec:\9thttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\hthbhb.exec:\hthbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bntbbh.exec:\bntbbh.exe17⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vpppp.exec:\vpppp.exe18⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jjppp.exec:\jjppp.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7dpdj.exec:\7dpdj.exe20⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1flfffl.exec:\1flfffl.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe22⤵
- Executes dropped EXE
PID:1396 -
\??\c:\thtbhh.exec:\thtbhh.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhbbbh.exec:\nhbbbh.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\7nbhbb.exec:\7nbhbb.exe25⤵
- Executes dropped EXE
PID:888 -
\??\c:\dpjpv.exec:\dpjpv.exe26⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9vjjv.exec:\9vjjv.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rlrfxfr.exec:\rlrfxfr.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\frfrxrr.exec:\frfrxrr.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlxlflr.exec:\rlxlflr.exe30⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nhtnbb.exec:\nhtnbb.exe31⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nhtbnt.exec:\nhtbnt.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jpvjd.exec:\jpvjd.exe33⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pjvpd.exec:\pjvpd.exe34⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lxllffl.exec:\lxllffl.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\rrflflr.exec:\rrflflr.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxlfxlr.exec:\rxlfxlr.exe37⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nhthnn.exec:\nhthnn.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnbbnb.exec:\tnbbnb.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vppvd.exec:\vppvd.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xxlxllx.exec:\xxlxllx.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lfxlflx.exec:\lfxlflx.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnbhnn.exec:\tnbhnn.exe43⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1httbb.exec:\1httbb.exe44⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pppdj.exec:\pppdj.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1lflxlx.exec:\1lflxlx.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrfrlxf.exec:\rrfrlxf.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bbntht.exec:\bbntht.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\bbthtt.exec:\bbthtt.exe49⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9pdvd.exec:\9pdvd.exe50⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vjvdd.exec:\vjvdd.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxrrrfr.exec:\fxrrrfr.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\llfrlxl.exec:\llfrlxl.exe53⤵
- Executes dropped EXE
PID:664 -
\??\c:\ttnbth.exec:\ttnbth.exe54⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjdjj.exec:\pjdjj.exe55⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rfxfllr.exec:\rfxfllr.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bthntb.exec:\bthntb.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nnhnhn.exec:\nnhnhn.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7jvdp.exec:\7jvdp.exe59⤵
- Executes dropped EXE
PID:1068 -
\??\c:\ppddp.exec:\ppddp.exe60⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llrxlxl.exec:\llrxlxl.exe61⤵
- Executes dropped EXE
PID:828 -
\??\c:\ttntnt.exec:\ttntnt.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\hhbhnn.exec:\hhbhnn.exe63⤵
- Executes dropped EXE
PID:744 -
\??\c:\pvpvj.exec:\pvpvj.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\rlxxlxf.exec:\rlxxlxf.exe65⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ffrlxfl.exec:\ffrlxfl.exe66⤵PID:404
-
\??\c:\3ddjv.exec:\3ddjv.exe67⤵PID:1224
-
\??\c:\rrllrxl.exec:\rrllrxl.exe68⤵PID:1944
-
\??\c:\rlflrxr.exec:\rlflrxr.exe69⤵PID:1588
-
\??\c:\5nnthn.exec:\5nnthn.exe70⤵PID:3060
-
\??\c:\1pppp.exec:\1pppp.exe71⤵PID:2944
-
\??\c:\vpjpj.exec:\vpjpj.exe72⤵PID:1520
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe73⤵PID:2536
-
\??\c:\ffxflxf.exec:\ffxflxf.exe74⤵PID:2780
-
\??\c:\bnbbbb.exec:\bnbbbb.exe75⤵PID:2308
-
\??\c:\ppvvv.exec:\ppvvv.exe76⤵PID:2092
-
\??\c:\5dvvj.exec:\5dvvj.exe77⤵PID:2820
-
\??\c:\7jpvv.exec:\7jpvv.exe78⤵PID:2464
-
\??\c:\xrfrrrf.exec:\xrfrrrf.exe79⤵PID:2620
-
\??\c:\thbhnt.exec:\thbhnt.exe80⤵PID:2968
-
\??\c:\nbnttn.exec:\nbnttn.exe81⤵PID:2656
-
\??\c:\pdpjj.exec:\pdpjj.exe82⤵PID:2320
-
\??\c:\jvddj.exec:\jvddj.exe83⤵PID:2788
-
\??\c:\fflllrx.exec:\fflllrx.exe84⤵PID:2596
-
\??\c:\fxrflff.exec:\fxrflff.exe85⤵PID:1864
-
\??\c:\1thnnh.exec:\1thnnh.exe86⤵PID:2004
-
\??\c:\btntbn.exec:\btntbn.exe87⤵PID:1656
-
\??\c:\ddpjv.exec:\ddpjv.exe88⤵PID:236
-
\??\c:\1vpdv.exec:\1vpdv.exe89⤵PID:2120
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe90⤵PID:1896
-
\??\c:\5flllfr.exec:\5flllfr.exe91⤵PID:1688
-
\??\c:\3tnnhh.exec:\3tnnhh.exe92⤵PID:2876
-
\??\c:\9thtbt.exec:\9thtbt.exe93⤵PID:1184
-
\??\c:\dvppd.exec:\dvppd.exe94⤵PID:2328
-
\??\c:\rrfrflr.exec:\rrfrflr.exe95⤵PID:1736
-
\??\c:\9lrllrl.exec:\9lrllrl.exe96⤵PID:1456
-
\??\c:\ththnt.exec:\ththnt.exe97⤵PID:600
-
\??\c:\7bbbhn.exec:\7bbbhn.exe98⤵PID:2456
-
\??\c:\vpdvj.exec:\vpdvj.exe99⤵PID:1196
-
\??\c:\9ppvj.exec:\9ppvj.exe100⤵PID:1504
-
\??\c:\lfflrxf.exec:\lfflrxf.exe101⤵PID:1936
-
\??\c:\rllfllr.exec:\rllfllr.exe102⤵PID:2372
-
\??\c:\7htntt.exec:\7htntt.exe103⤵PID:2512
-
\??\c:\hnthtt.exec:\hnthtt.exe104⤵PID:2948
-
\??\c:\hbhnnt.exec:\hbhnnt.exe105⤵PID:2164
-
\??\c:\dvdjp.exec:\dvdjp.exe106⤵PID:884
-
\??\c:\fxlrffl.exec:\fxlrffl.exe107⤵PID:1840
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe108⤵PID:2008
-
\??\c:\xrrlxrx.exec:\xrrlxrx.exe109⤵PID:3056
-
\??\c:\7tbnth.exec:\7tbnth.exe110⤵PID:2232
-
\??\c:\nbhnbt.exec:\nbhnbt.exe111⤵PID:2524
-
\??\c:\jdvjj.exec:\jdvjj.exe112⤵PID:2940
-
\??\c:\vpddd.exec:\vpddd.exe113⤵PID:2796
-
\??\c:\rxxlrlx.exec:\rxxlrlx.exe114⤵PID:1420
-
\??\c:\1lrxflr.exec:\1lrxflr.exe115⤵PID:2428
-
\??\c:\ttbtnt.exec:\ttbtnt.exe116⤵PID:2956
-
\??\c:\1thntb.exec:\1thntb.exe117⤵PID:2816
-
\??\c:\ppjjd.exec:\ppjjd.exe118⤵PID:2820
-
\??\c:\3jvjp.exec:\3jvjp.exe119⤵PID:2708
-
\??\c:\lflrxfr.exec:\lflrxfr.exe120⤵PID:1960
-
\??\c:\bthhhn.exec:\bthhhn.exe121⤵PID:2832
-
\??\c:\7nnntt.exec:\7nnntt.exe122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-