Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb1dd451b2b9db9dc0fa38ff7338df40N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
eb1dd451b2b9db9dc0fa38ff7338df40N.exe
-
Size
58KB
-
MD5
eb1dd451b2b9db9dc0fa38ff7338df40
-
SHA1
54584146076a91ad98cd85bec9f4d5e5e8a370a4
-
SHA256
2a5f6c55d6f55bdd593e84c6b2070e4c2daee516e2a9941a90532382741e84ca
-
SHA512
7aade709058ffdd7aef45928af520d9a7a7aeae357653fa70c682264cad6cb2aec5693c19a05382efe253bc9f515edd11df1ce4d27a969bf2d4b75c1be67f2a2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoA0:ymb3NkkiQ3mdBjFoh
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2548-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 jdvdp.exe 2328 1lfllff.exe 2796 bthtbb.exe 2752 jjjvp.exe 2764 9xlllxf.exe 2984 3fffrfr.exe 2652 btttbn.exe 2836 jpvjj.exe 1736 xrlfllr.exe 1872 lxlflxl.exe 844 tnhnnn.exe 2680 vjvvd.exe 2044 lxxrlxx.exe 1868 9xlfrrf.exe 1728 fxxfxxf.exe 1040 5bhhht.exe 1204 ddvdp.exe 2952 9rlrffl.exe 2192 rlllffl.exe 1240 1tnthh.exe 1404 tbthtn.exe 1100 dpddj.exe 708 rfxflxr.exe 1496 5rlxflr.exe 1732 hbnhnn.exe 1044 hbthtb.exe 1468 9pjdp.exe 1540 fxlrrfr.exe 2352 nhnbtb.exe 2100 tbhbhn.exe 1528 vdjpj.exe 2560 lxrlfxf.exe 2340 rlxxflr.exe 2760 tntbhn.exe 2816 hhtbbh.exe 2756 pjjjj.exe 2648 jddjd.exe 2844 fxrllrx.exe 2776 xflxlfx.exe 2872 ttbbbn.exe 2632 jddjd.exe 2612 ppjvp.exe 2140 rrlrxfl.exe 1116 xlflrrr.exe 1572 nhthth.exe 1856 httbnn.exe 1956 vvjdv.exe 1860 9ppdd.exe 2052 xxrlxfr.exe 1724 xfxxflf.exe 2908 5ntbhh.exe 1876 7nbbnn.exe 324 ddpdd.exe 2164 1jddd.exe 2072 rlfxlrx.exe 2452 xxlrrxx.exe 788 1thnnn.exe 992 nbntnt.exe 2968 vdjdd.exe 2176 lllxfxr.exe 300 fxfrffl.exe 2184 tthnbh.exe 1416 thbbbh.exe 1200 pjvpp.exe -
resource yara_rule behavioral1/memory/2548-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2408 2548 eb1dd451b2b9db9dc0fa38ff7338df40N.exe 30 PID 2548 wrote to memory of 2408 2548 eb1dd451b2b9db9dc0fa38ff7338df40N.exe 30 PID 2548 wrote to memory of 2408 2548 eb1dd451b2b9db9dc0fa38ff7338df40N.exe 30 PID 2548 wrote to memory of 2408 2548 eb1dd451b2b9db9dc0fa38ff7338df40N.exe 30 PID 2408 wrote to memory of 2328 2408 jdvdp.exe 31 PID 2408 wrote to memory of 2328 2408 jdvdp.exe 31 PID 2408 wrote to memory of 2328 2408 jdvdp.exe 31 PID 2408 wrote to memory of 2328 2408 jdvdp.exe 31 PID 2328 wrote to memory of 2796 2328 1lfllff.exe 32 PID 2328 wrote to memory of 2796 2328 1lfllff.exe 32 PID 2328 wrote to memory of 2796 2328 1lfllff.exe 32 PID 2328 wrote to memory of 2796 2328 1lfllff.exe 32 PID 2796 wrote to memory of 2752 2796 bthtbb.exe 33 PID 2796 wrote to memory of 2752 2796 bthtbb.exe 33 PID 2796 wrote to memory of 2752 2796 bthtbb.exe 33 PID 2796 wrote to memory of 2752 2796 bthtbb.exe 33 PID 2752 wrote to memory of 2764 2752 jjjvp.exe 34 PID 2752 wrote to memory of 2764 2752 jjjvp.exe 34 PID 2752 wrote to memory of 2764 2752 jjjvp.exe 34 PID 2752 wrote to memory of 2764 2752 jjjvp.exe 34 PID 2764 wrote to memory of 2984 2764 9xlllxf.exe 35 PID 2764 wrote to memory of 2984 2764 9xlllxf.exe 35 PID 2764 wrote to memory of 2984 2764 9xlllxf.exe 35 PID 2764 wrote to memory of 2984 2764 9xlllxf.exe 35 PID 2984 wrote to memory of 2652 2984 3fffrfr.exe 36 PID 2984 wrote to memory of 2652 2984 3fffrfr.exe 36 PID 2984 wrote to memory of 2652 2984 3fffrfr.exe 36 PID 2984 wrote to memory of 2652 2984 3fffrfr.exe 36 PID 2652 wrote to memory of 2836 2652 btttbn.exe 37 PID 2652 wrote to memory of 2836 2652 btttbn.exe 37 PID 2652 wrote to memory of 2836 2652 btttbn.exe 37 PID 2652 wrote to memory of 2836 2652 btttbn.exe 37 PID 2836 wrote to memory of 1736 2836 jpvjj.exe 38 PID 2836 wrote to memory of 1736 2836 jpvjj.exe 38 PID 2836 wrote to memory of 1736 2836 jpvjj.exe 38 PID 2836 wrote to memory of 1736 2836 jpvjj.exe 38 PID 1736 wrote to memory of 1872 1736 xrlfllr.exe 39 PID 1736 wrote to memory of 1872 1736 xrlfllr.exe 39 PID 1736 wrote to memory of 1872 1736 xrlfllr.exe 39 PID 1736 wrote to memory of 1872 1736 xrlfllr.exe 39 PID 1872 wrote to memory of 844 1872 lxlflxl.exe 40 PID 1872 wrote to memory of 844 1872 lxlflxl.exe 40 PID 1872 wrote to memory of 844 1872 lxlflxl.exe 40 PID 1872 wrote to memory of 844 1872 lxlflxl.exe 40 PID 844 wrote to memory of 2680 844 tnhnnn.exe 41 PID 844 wrote to memory of 2680 844 tnhnnn.exe 41 PID 844 wrote to memory of 2680 844 tnhnnn.exe 41 PID 844 wrote to memory of 2680 844 tnhnnn.exe 41 PID 2680 wrote to memory of 2044 2680 vjvvd.exe 42 PID 2680 wrote to memory of 2044 2680 vjvvd.exe 42 PID 2680 wrote to memory of 2044 2680 vjvvd.exe 42 PID 2680 wrote to memory of 2044 2680 vjvvd.exe 42 PID 2044 wrote to memory of 1868 2044 lxxrlxx.exe 43 PID 2044 wrote to memory of 1868 2044 lxxrlxx.exe 43 PID 2044 wrote to memory of 1868 2044 lxxrlxx.exe 43 PID 2044 wrote to memory of 1868 2044 lxxrlxx.exe 43 PID 1868 wrote to memory of 1728 1868 9xlfrrf.exe 44 PID 1868 wrote to memory of 1728 1868 9xlfrrf.exe 44 PID 1868 wrote to memory of 1728 1868 9xlfrrf.exe 44 PID 1868 wrote to memory of 1728 1868 9xlfrrf.exe 44 PID 1728 wrote to memory of 1040 1728 fxxfxxf.exe 45 PID 1728 wrote to memory of 1040 1728 fxxfxxf.exe 45 PID 1728 wrote to memory of 1040 1728 fxxfxxf.exe 45 PID 1728 wrote to memory of 1040 1728 fxxfxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb1dd451b2b9db9dc0fa38ff7338df40N.exe"C:\Users\Admin\AppData\Local\Temp\eb1dd451b2b9db9dc0fa38ff7338df40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\jdvdp.exec:\jdvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\1lfllff.exec:\1lfllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bthtbb.exec:\bthtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jjjvp.exec:\jjjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9xlllxf.exec:\9xlllxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3fffrfr.exec:\3fffrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\btttbn.exec:\btttbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jpvjj.exec:\jpvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xrlfllr.exec:\xrlfllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\lxlflxl.exec:\lxlflxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\tnhnnn.exec:\tnhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\vjvvd.exec:\vjvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lxxrlxx.exec:\lxxrlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\9xlfrrf.exec:\9xlfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\fxxfxxf.exec:\fxxfxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\5bhhht.exec:\5bhhht.exe17⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ddvdp.exec:\ddvdp.exe18⤵
- Executes dropped EXE
PID:1204 -
\??\c:\9rlrffl.exec:\9rlrffl.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlllffl.exec:\rlllffl.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1tnthh.exec:\1tnthh.exe21⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tbthtn.exec:\tbthtn.exe22⤵
- Executes dropped EXE
PID:1404 -
\??\c:\dpddj.exec:\dpddj.exe23⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rfxflxr.exec:\rfxflxr.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\5rlxflr.exec:\5rlxflr.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hbnhnn.exec:\hbnhnn.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbthtb.exec:\hbthtb.exe27⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9pjdp.exec:\9pjdp.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fxlrrfr.exec:\fxlrrfr.exe29⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nhnbtb.exec:\nhnbtb.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tbhbhn.exec:\tbhbhn.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vdjpj.exec:\vdjpj.exe32⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lxrlfxf.exec:\lxrlfxf.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rlxxflr.exec:\rlxxflr.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tntbhn.exec:\tntbhn.exe35⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hhtbbh.exec:\hhtbbh.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjjjj.exec:\pjjjj.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jddjd.exec:\jddjd.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\fxrllrx.exec:\fxrllrx.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xflxlfx.exec:\xflxlfx.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ttbbbn.exec:\ttbbbn.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jddjd.exec:\jddjd.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ppjvp.exec:\ppjvp.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe44⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xlflrrr.exec:\xlflrrr.exe45⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nhthth.exec:\nhthth.exe46⤵
- Executes dropped EXE
PID:1572 -
\??\c:\httbnn.exec:\httbnn.exe47⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vvjdv.exec:\vvjdv.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9ppdd.exec:\9ppdd.exe49⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xxrlxfr.exec:\xxrlxfr.exe50⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xfxxflf.exec:\xfxxflf.exe51⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5ntbhh.exec:\5ntbhh.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\7nbbnn.exec:\7nbbnn.exe53⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ddpdd.exec:\ddpdd.exe54⤵
- Executes dropped EXE
PID:324 -
\??\c:\1jddd.exec:\1jddd.exe55⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xxlrrxx.exec:\xxlrrxx.exe57⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1thnnn.exec:\1thnnn.exe58⤵
- Executes dropped EXE
PID:788 -
\??\c:\nbntnt.exec:\nbntnt.exe59⤵
- Executes dropped EXE
PID:992 -
\??\c:\vdjdd.exec:\vdjdd.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lllxfxr.exec:\lllxfxr.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxfrffl.exec:\fxfrffl.exe62⤵
- Executes dropped EXE
PID:300 -
\??\c:\tthnbh.exec:\tthnbh.exe63⤵
- Executes dropped EXE
PID:2184 -
\??\c:\thbbbh.exec:\thbbbh.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pjvpp.exec:\pjvpp.exe65⤵
- Executes dropped EXE
PID:1200 -
\??\c:\jvddv.exec:\jvddv.exe66⤵PID:1244
-
\??\c:\frxllrf.exec:\frxllrf.exe67⤵PID:2516
-
\??\c:\rlfrlrl.exec:\rlfrlrl.exe68⤵PID:2152
-
\??\c:\3hhnbb.exec:\3hhnbb.exe69⤵PID:1032
-
\??\c:\nhbhhn.exec:\nhbhhn.exe70⤵PID:2068
-
\??\c:\1ddpd.exec:\1ddpd.exe71⤵PID:1508
-
\??\c:\vpdvv.exec:\vpdvv.exe72⤵PID:2540
-
\??\c:\xllllll.exec:\xllllll.exe73⤵PID:2252
-
\??\c:\flllfff.exec:\flllfff.exe74⤵PID:2812
-
\??\c:\thtbbh.exec:\thtbbh.exe75⤵PID:2720
-
\??\c:\1vvvd.exec:\1vvvd.exe76⤵PID:2816
-
\??\c:\vjvvp.exec:\vjvvp.exe77⤵PID:2736
-
\??\c:\fxlflfr.exec:\fxlflfr.exe78⤵PID:2648
-
\??\c:\7lffrxf.exec:\7lffrxf.exe79⤵PID:2748
-
\??\c:\hbtbhn.exec:\hbtbhn.exe80⤵PID:2420
-
\??\c:\httttt.exec:\httttt.exe81⤵PID:2668
-
\??\c:\vvvvv.exec:\vvvvv.exe82⤵PID:3068
-
\??\c:\pjppp.exec:\pjppp.exe83⤵PID:1412
-
\??\c:\xxlxxrr.exec:\xxlxxrr.exe84⤵PID:2024
-
\??\c:\rrfrfxf.exec:\rrfrfxf.exe85⤵PID:1972
-
\??\c:\hhtnbn.exec:\hhtnbn.exe86⤵PID:1864
-
\??\c:\htbbbb.exec:\htbbbb.exe87⤵PID:1668
-
\??\c:\nhtntn.exec:\nhtntn.exe88⤵PID:2032
-
\??\c:\vjvdd.exec:\vjvdd.exe89⤵PID:2044
-
\??\c:\vppvd.exec:\vppvd.exe90⤵PID:1648
-
\??\c:\fxlfffl.exec:\fxlfffl.exe91⤵PID:1356
-
\??\c:\9rfrrlx.exec:\9rfrrlx.exe92⤵PID:2908
-
\??\c:\5hbhnh.exec:\5hbhnh.exe93⤵PID:1512
-
\??\c:\nttbtb.exec:\nttbtb.exe94⤵PID:2472
-
\??\c:\ddppp.exec:\ddppp.exe95⤵PID:2500
-
\??\c:\vjvdj.exec:\vjvdj.exe96⤵PID:1900
-
\??\c:\xrffxxf.exec:\xrffxxf.exe97⤵PID:592
-
\??\c:\frfrrll.exec:\frfrrll.exe98⤵PID:3016
-
\??\c:\nnhthh.exec:\nnhthh.exe99⤵PID:1404
-
\??\c:\tnbtnn.exec:\tnbtnn.exe100⤵PID:1184
-
\??\c:\dvppv.exec:\dvppv.exe101⤵PID:1892
-
\??\c:\1dddd.exec:\1dddd.exe102⤵PID:1944
-
\??\c:\dvjjj.exec:\dvjjj.exe103⤵PID:1940
-
\??\c:\5rffffl.exec:\5rffffl.exe104⤵PID:2292
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe105⤵PID:2520
-
\??\c:\tnttbb.exec:\tnttbb.exe106⤵PID:1244
-
\??\c:\nhntbb.exec:\nhntbb.exe107⤵PID:2516
-
\??\c:\pjddd.exec:\pjddd.exe108⤵PID:2352
-
\??\c:\7pjjd.exec:\7pjjd.exe109⤵PID:2972
-
\??\c:\jpjjv.exec:\jpjjv.exe110⤵PID:2068
-
\??\c:\frlxxxx.exec:\frlxxxx.exe111⤵PID:2556
-
\??\c:\3fllflr.exec:\3fllflr.exe112⤵PID:1852
-
\??\c:\hbnnhn.exec:\hbnnhn.exe113⤵PID:2892
-
\??\c:\tnnnnn.exec:\tnnnnn.exe114⤵PID:2832
-
\??\c:\dvpjp.exec:\dvpjp.exe115⤵PID:2620
-
\??\c:\pjvvj.exec:\pjvvj.exe116⤵PID:2772
-
\??\c:\xxxfxlx.exec:\xxxfxlx.exe117⤵PID:2940
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe118⤵PID:2648
-
\??\c:\tbnhht.exec:\tbnhht.exe119⤵PID:2884
-
\??\c:\thttnt.exec:\thttnt.exe120⤵PID:2732
-
\??\c:\dvvjv.exec:\dvvjv.exe121⤵PID:2488
-
\??\c:\jdppj.exec:\jdppj.exe122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-