Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 13:19
Static task
static1
Behavioral task
behavioral1
Sample
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe
Resource
win7-20240903-en
General
-
Target
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe
-
Size
74KB
-
MD5
c9cc7f43112a69992bd5c7adc86f70ef
-
SHA1
24bcfef4c7440ae54398e9915ee3c9643da57ca6
-
SHA256
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e
-
SHA512
569d4305f4fc15aecd0475c7e5b03207567508aa3366d62e6939d60794084f48dc9232bf44e6d1e8e85bb70043b0df34b2cac08299d0f9b813842dbd91064444
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3eD:ymb3NkkiQ3mdBjFWXkj7afo6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/2824-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2652 ffxrxrl.exe 2852 tnhbnn.exe 2664 dvpdj.exe 2548 7dpjd.exe 3016 rxfxxff.exe 480 hbtbbb.exe 568 5ppdj.exe 2892 tnttbt.exe 2424 9tnnth.exe 2392 pjvjp.exe 1836 7lfrffr.exe 2292 lfrxxrx.exe 1492 7bbthh.exe 2416 pjddd.exe 2024 pjjpp.exe 1928 5xfffxx.exe 1780 5rffflx.exe 2060 1tnhhh.exe 2288 pppdd.exe 2232 xllfrrr.exe 1404 fflfrff.exe 1560 9rfflfl.exe 1660 9bbhnn.exe 1180 pddvd.exe 1536 9pjvd.exe 2944 fxxrlfx.exe 1856 bhttbh.exe 600 hhhntn.exe 1412 jdpjp.exe 2264 1lfrrfr.exe 3060 xrfllrx.exe 2628 5bthhn.exe 2572 9tnbbt.exe 2528 pppjv.exe 1524 xxffllr.exe 2604 1xlfrll.exe 3048 9xrrflr.exe 264 tnbbbb.exe 1860 hhntbb.exe 1308 9ppvd.exe 3004 3dpdj.exe 2892 fxfrrxl.exe 1236 lfllrxf.exe 2424 1rfrrlr.exe 1448 9tbhtt.exe 1876 hbttnt.exe 2772 jjddp.exe 2596 jjjvd.exe 1420 9lxlrrx.exe 1924 rlfxflr.exe 1832 hbntbb.exe 2876 tnnttb.exe 2184 nhnhnt.exe 1352 vpdjp.exe 1864 5pdpp.exe 2144 rfrxrxx.exe 2116 lxlrrrf.exe 324 hbntbh.exe 2360 pjvvp.exe 2284 vvddd.exe 1076 xxlrrxl.exe 1296 7xrflxl.exe 1436 7rfflll.exe 1688 nhtbnt.exe -
resource yara_rule behavioral1/memory/2824-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe 30 PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe 30 PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe 30 PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe 30 PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe 31 PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe 31 PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe 31 PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe 31 PID 2852 wrote to memory of 2664 2852 tnhbnn.exe 32 PID 2852 wrote to memory of 2664 2852 tnhbnn.exe 32 PID 2852 wrote to memory of 2664 2852 tnhbnn.exe 32 PID 2852 wrote to memory of 2664 2852 tnhbnn.exe 32 PID 2664 wrote to memory of 2548 2664 dvpdj.exe 33 PID 2664 wrote to memory of 2548 2664 dvpdj.exe 33 PID 2664 wrote to memory of 2548 2664 dvpdj.exe 33 PID 2664 wrote to memory of 2548 2664 dvpdj.exe 33 PID 2548 wrote to memory of 3016 2548 7dpjd.exe 34 PID 2548 wrote to memory of 3016 2548 7dpjd.exe 34 PID 2548 wrote to memory of 3016 2548 7dpjd.exe 34 PID 2548 wrote to memory of 3016 2548 7dpjd.exe 34 PID 3016 wrote to memory of 480 3016 rxfxxff.exe 35 PID 3016 wrote to memory of 480 3016 rxfxxff.exe 35 PID 3016 wrote to memory of 480 3016 rxfxxff.exe 35 PID 3016 wrote to memory of 480 3016 rxfxxff.exe 35 PID 480 wrote to memory of 568 480 hbtbbb.exe 36 PID 480 wrote to memory of 568 480 hbtbbb.exe 36 PID 480 wrote to memory of 568 480 hbtbbb.exe 36 PID 480 wrote to memory of 568 480 hbtbbb.exe 36 PID 568 wrote to memory of 2892 568 5ppdj.exe 37 PID 568 wrote to memory of 2892 568 5ppdj.exe 37 PID 568 wrote to memory of 2892 568 5ppdj.exe 37 PID 568 wrote to memory of 2892 568 5ppdj.exe 37 PID 2892 wrote to memory of 2424 2892 tnttbt.exe 38 PID 2892 wrote to memory of 2424 2892 tnttbt.exe 38 PID 2892 wrote to memory of 2424 2892 tnttbt.exe 38 PID 2892 wrote to memory of 2424 2892 tnttbt.exe 38 PID 2424 wrote to memory of 2392 2424 9tnnth.exe 39 PID 2424 wrote to memory of 2392 2424 9tnnth.exe 39 PID 2424 wrote to memory of 2392 2424 9tnnth.exe 39 PID 2424 wrote to memory of 2392 2424 9tnnth.exe 39 PID 2392 wrote to memory of 1836 2392 pjvjp.exe 40 PID 2392 wrote to memory of 1836 2392 pjvjp.exe 40 PID 2392 wrote to memory of 1836 2392 pjvjp.exe 40 PID 2392 wrote to memory of 1836 2392 pjvjp.exe 40 PID 1836 wrote to memory of 2292 1836 7lfrffr.exe 41 PID 1836 wrote to memory of 2292 1836 7lfrffr.exe 41 PID 1836 wrote to memory of 2292 1836 7lfrffr.exe 41 PID 1836 wrote to memory of 2292 1836 7lfrffr.exe 41 PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 42 PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 42 PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 42 PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 42 PID 1492 wrote to memory of 2416 1492 7bbthh.exe 43 PID 1492 wrote to memory of 2416 1492 7bbthh.exe 43 PID 1492 wrote to memory of 2416 1492 7bbthh.exe 43 PID 1492 wrote to memory of 2416 1492 7bbthh.exe 43 PID 2416 wrote to memory of 2024 2416 pjddd.exe 44 PID 2416 wrote to memory of 2024 2416 pjddd.exe 44 PID 2416 wrote to memory of 2024 2416 pjddd.exe 44 PID 2416 wrote to memory of 2024 2416 pjddd.exe 44 PID 2024 wrote to memory of 1928 2024 pjjpp.exe 45 PID 2024 wrote to memory of 1928 2024 pjjpp.exe 45 PID 2024 wrote to memory of 1928 2024 pjjpp.exe 45 PID 2024 wrote to memory of 1928 2024 pjjpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe"C:\Users\Admin\AppData\Local\Temp\7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ffxrxrl.exec:\ffxrxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\tnhbnn.exec:\tnhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dvpdj.exec:\dvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7dpjd.exec:\7dpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rxfxxff.exec:\rxfxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hbtbbb.exec:\hbtbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\5ppdj.exec:\5ppdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\tnttbt.exec:\tnttbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9tnnth.exec:\9tnnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\pjvjp.exec:\pjvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\7lfrffr.exec:\7lfrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\7bbthh.exec:\7bbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\pjddd.exec:\pjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjjpp.exec:\pjjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5xfffxx.exec:\5xfffxx.exe17⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5rffflx.exec:\5rffflx.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1tnhhh.exec:\1tnhhh.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pppdd.exec:\pppdd.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xllfrrr.exec:\xllfrrr.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fflfrff.exec:\fflfrff.exe22⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9rfflfl.exec:\9rfflfl.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9bbhnn.exec:\9bbhnn.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pddvd.exec:\pddvd.exe25⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9pjvd.exec:\9pjvd.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\bhttbh.exec:\bhttbh.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhhntn.exec:\hhhntn.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\jdpjp.exec:\jdpjp.exe30⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1lfrrfr.exec:\1lfrrfr.exe31⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrfllrx.exec:\xrfllrx.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5bthhn.exec:\5bthhn.exe33⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9tnbbt.exec:\9tnbbt.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pppjv.exec:\pppjv.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xxffllr.exec:\xxffllr.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1xlfrll.exec:\1xlfrll.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9xrrflr.exec:\9xrrflr.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tnbbbb.exec:\tnbbbb.exe39⤵
- Executes dropped EXE
PID:264 -
\??\c:\hhntbb.exec:\hhntbb.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9ppvd.exec:\9ppvd.exe41⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3dpdj.exec:\3dpdj.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fxfrrxl.exec:\fxfrrxl.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lfllrxf.exec:\lfllrxf.exe44⤵
- Executes dropped EXE
PID:1236 -
\??\c:\1rfrrlr.exec:\1rfrrlr.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\9tbhtt.exec:\9tbhtt.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbttnt.exec:\hbttnt.exe47⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jjddp.exec:\jjddp.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jjjvd.exec:\jjjvd.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9lxlrrx.exec:\9lxlrrx.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rlfxflr.exec:\rlfxflr.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hbntbb.exec:\hbntbb.exe52⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tnnttb.exec:\tnnttb.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhnhnt.exec:\nhnhnt.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vpdjp.exec:\vpdjp.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5pdpp.exec:\5pdpp.exe56⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rfrxrxx.exec:\rfrxrxx.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbntbh.exec:\hbntbh.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\pjvvp.exec:\pjvvp.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vvddd.exec:\vvddd.exe61⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxlrrxl.exec:\xxlrrxl.exe62⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7xrflxl.exec:\7xrflxl.exe63⤵
- Executes dropped EXE
PID:1296 -
\??\c:\7rfflll.exec:\7rfflll.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nhtbnt.exec:\nhtbnt.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bthhtb.exec:\bthhtb.exe66⤵PID:3032
-
\??\c:\vvjpp.exec:\vvjpp.exe67⤵PID:3008
-
\??\c:\ppvvv.exec:\ppvvv.exe68⤵PID:1920
-
\??\c:\3lffflx.exec:\3lffflx.exe69⤵
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\xrxxflx.exec:\xrxxflx.exe70⤵PID:2536
-
\??\c:\7bnhbn.exec:\7bnhbn.exe71⤵PID:2684
-
\??\c:\hhtntt.exec:\hhtntt.exe72⤵PID:3060
-
\??\c:\hhtnnt.exec:\hhtnnt.exe73⤵PID:1396
-
\??\c:\dvdvd.exec:\dvdvd.exe74⤵PID:2852
-
\??\c:\1dvvv.exec:\1dvvv.exe75⤵PID:1528
-
\??\c:\lflrfxl.exec:\lflrfxl.exe76⤵PID:2600
-
\??\c:\llflxfl.exec:\llflxfl.exe77⤵PID:2696
-
\??\c:\tnbbhn.exec:\tnbbhn.exe78⤵PID:532
-
\??\c:\nnttbh.exec:\nnttbh.exe79⤵PID:1984
-
\??\c:\vvppp.exec:\vvppp.exe80⤵PID:1568
-
\??\c:\jdvvd.exec:\jdvvd.exe81⤵PID:1408
-
\??\c:\fxrxflr.exec:\fxrxflr.exe82⤵PID:2980
-
\??\c:\xffxlrx.exec:\xffxlrx.exe83⤵PID:644
-
\??\c:\bbthtb.exec:\bbthtb.exe84⤵PID:2180
-
\??\c:\tnhnbh.exec:\tnhnbh.exe85⤵PID:1368
-
\??\c:\ppjvd.exec:\ppjvd.exe86⤵PID:1980
-
\??\c:\3jvdd.exec:\3jvdd.exe87⤵PID:1256
-
\??\c:\rlllllr.exec:\rlllllr.exe88⤵PID:1724
-
\??\c:\5llxffx.exec:\5llxffx.exe89⤵PID:524
-
\??\c:\5btnbb.exec:\5btnbb.exe90⤵PID:2376
-
\??\c:\bthhnn.exec:\bthhnn.exe91⤵PID:1948
-
\??\c:\pjvvv.exec:\pjvvv.exe92⤵PID:1928
-
\??\c:\dvddv.exec:\dvddv.exe93⤵PID:2208
-
\??\c:\9fxrxxf.exec:\9fxrxxf.exe94⤵PID:1960
-
\??\c:\5flfrll.exec:\5flfrll.exe95⤵PID:2060
-
\??\c:\tbnnbn.exec:\tbnnbn.exe96⤵PID:664
-
\??\c:\bttbhh.exec:\bttbhh.exe97⤵PID:868
-
\??\c:\ppvvv.exec:\ppvvv.exe98⤵PID:1100
-
\??\c:\jdddp.exec:\jdddp.exe99⤵PID:2448
-
\??\c:\ffffllx.exec:\ffffllx.exe100⤵PID:3012
-
\??\c:\rrxfrfl.exec:\rrxfrfl.exe101⤵PID:2100
-
\??\c:\tnttbb.exec:\tnttbb.exe102⤵PID:1660
-
\??\c:\3bbnbh.exec:\3bbnbh.exe103⤵PID:1696
-
\??\c:\3dpvd.exec:\3dpvd.exe104⤵PID:328
-
\??\c:\7dvjp.exec:\7dvjp.exe105⤵PID:2352
-
\??\c:\rxrxrrf.exec:\rxrxrrf.exe106⤵PID:3024
-
\??\c:\lflrffl.exec:\lflrffl.exe107⤵PID:988
-
\??\c:\rrlrxff.exec:\rrlrxff.exe108⤵PID:1432
-
\??\c:\7nhntb.exec:\7nhntb.exe109⤵PID:2296
-
\??\c:\7jdjp.exec:\7jdjp.exe110⤵PID:2832
-
\??\c:\jjvvv.exec:\jjvvv.exe111⤵PID:2908
-
\??\c:\rlxrrxl.exec:\rlxrrxl.exe112⤵PID:2688
-
\??\c:\1fxfxfx.exec:\1fxfxfx.exe113⤵PID:2836
-
\??\c:\ttbnbn.exec:\ttbnbn.exe114⤵PID:2700
-
\??\c:\ttnnhh.exec:\ttnnhh.exe115⤵PID:2592
-
\??\c:\jjdjv.exec:\jjdjv.exe116⤵PID:2548
-
\??\c:\dddvd.exec:\dddvd.exe117⤵PID:2544
-
\??\c:\ppdjp.exec:\ppdjp.exe118⤵PID:2988
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe119⤵PID:628
-
\??\c:\ffflllx.exec:\ffflllx.exe120⤵PID:2884
-
\??\c:\3bbnnt.exec:\3bbnnt.exe121⤵PID:1852
-
\??\c:\nhbbnn.exec:\nhbbnn.exe122⤵PID:1840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-