Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 23:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9da72266fb5cd27bf8fccdaec67a2a0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
e9da72266fb5cd27bf8fccdaec67a2a0N.exe
-
Size
71KB
-
MD5
e9da72266fb5cd27bf8fccdaec67a2a0
-
SHA1
5599b7a2515cb9457bb2d4ac8291f684facd2c8a
-
SHA256
649fb42203103b3ebd2568941454a9fcda319f88453a2aa158774776b044039f
-
SHA512
16c1d4cc23c7575bec8edc899df882d90ddfdb820792a5224f00e7c5a94b0166f89cc851d144887ee3a7e792b9317fa79da020b517aeb81b31686d989bdcc897
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjo:ymb3NkkiQ3mdBjFI4V4
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2300-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/660-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/612-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 fxxllff.exe 2860 3rfrrff.exe 2836 7bnbbh.exe 2644 vjvvd.exe 2776 lfflfrr.exe 2664 hbthtb.exe 660 jpjdd.exe 612 lxfxxxf.exe 2524 bhnnnh.exe 1396 djvdj.exe 808 ppddd.exe 3032 lfxrffr.exe 2340 9lxxffl.exe 2364 ttnhbb.exe 1196 nbnntn.exe 848 dvvjp.exe 1372 1vjdp.exe 2520 5xrxxfr.exe 2488 nhnnnn.exe 2052 bbthnn.exe 2200 ppdvv.exe 884 jjvvd.exe 1644 rfrxxxf.exe 944 7tntbh.exe 1728 vpjdv.exe 1140 9jdjp.exe 2284 rfrllfl.exe 300 1rrrxfx.exe 1004 bhttbb.exe 2424 djpvp.exe 2796 pjpdj.exe 1760 xrllrrx.exe 2804 5lfrfll.exe 2612 9nbthn.exe 2792 7ttttn.exe 2836 vvddv.exe 2904 jdddp.exe 2636 lfrxrrx.exe 2336 5xrxfff.exe 2420 bttbhh.exe 668 7nbnhb.exe 1784 vjvpv.exe 2516 jvdvd.exe 2392 3xxxlxf.exe 2876 llxrxll.exe 572 5xxflrl.exe 2996 bnbhnt.exe 2348 hhbhnt.exe 2992 vvvjv.exe 1572 djjpj.exe 1740 fxrfllr.exe 1752 rlrxlrx.exe 1672 lxfxllx.exe 1560 3nhnbb.exe 2296 hbbhnn.exe 2672 5pdjv.exe 2304 vjvvv.exe 952 jvjjv.exe 844 fffrxfx.exe 2892 rlxxlfl.exe 1736 hbthhn.exe 1644 nhnnbt.exe 1284 7jpjp.exe 1708 dvjjv.exe -
resource yara_rule behavioral1/memory/2864-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/660-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/612-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/612-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-274-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2300 2864 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 30 PID 2864 wrote to memory of 2300 2864 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 30 PID 2864 wrote to memory of 2300 2864 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 30 PID 2864 wrote to memory of 2300 2864 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 30 PID 2300 wrote to memory of 2860 2300 fxxllff.exe 31 PID 2300 wrote to memory of 2860 2300 fxxllff.exe 31 PID 2300 wrote to memory of 2860 2300 fxxllff.exe 31 PID 2300 wrote to memory of 2860 2300 fxxllff.exe 31 PID 2860 wrote to memory of 2836 2860 3rfrrff.exe 32 PID 2860 wrote to memory of 2836 2860 3rfrrff.exe 32 PID 2860 wrote to memory of 2836 2860 3rfrrff.exe 32 PID 2860 wrote to memory of 2836 2860 3rfrrff.exe 32 PID 2836 wrote to memory of 2644 2836 7bnbbh.exe 33 PID 2836 wrote to memory of 2644 2836 7bnbbh.exe 33 PID 2836 wrote to memory of 2644 2836 7bnbbh.exe 33 PID 2836 wrote to memory of 2644 2836 7bnbbh.exe 33 PID 2644 wrote to memory of 2776 2644 vjvvd.exe 34 PID 2644 wrote to memory of 2776 2644 vjvvd.exe 34 PID 2644 wrote to memory of 2776 2644 vjvvd.exe 34 PID 2644 wrote to memory of 2776 2644 vjvvd.exe 34 PID 2776 wrote to memory of 2664 2776 lfflfrr.exe 35 PID 2776 wrote to memory of 2664 2776 lfflfrr.exe 35 PID 2776 wrote to memory of 2664 2776 lfflfrr.exe 35 PID 2776 wrote to memory of 2664 2776 lfflfrr.exe 35 PID 2664 wrote to memory of 660 2664 hbthtb.exe 36 PID 2664 wrote to memory of 660 2664 hbthtb.exe 36 PID 2664 wrote to memory of 660 2664 hbthtb.exe 36 PID 2664 wrote to memory of 660 2664 hbthtb.exe 36 PID 660 wrote to memory of 612 660 jpjdd.exe 37 PID 660 wrote to memory of 612 660 jpjdd.exe 37 PID 660 wrote to memory of 612 660 jpjdd.exe 37 PID 660 wrote to memory of 612 660 jpjdd.exe 37 PID 612 wrote to memory of 2524 612 lxfxxxf.exe 38 PID 612 wrote to memory of 2524 612 lxfxxxf.exe 38 PID 612 wrote to memory of 2524 612 lxfxxxf.exe 38 PID 612 wrote to memory of 2524 612 lxfxxxf.exe 38 PID 2524 wrote to memory of 1396 2524 bhnnnh.exe 39 PID 2524 wrote to memory of 1396 2524 bhnnnh.exe 39 PID 2524 wrote to memory of 1396 2524 bhnnnh.exe 39 PID 2524 wrote to memory of 1396 2524 bhnnnh.exe 39 PID 1396 wrote to memory of 808 1396 djvdj.exe 40 PID 1396 wrote to memory of 808 1396 djvdj.exe 40 PID 1396 wrote to memory of 808 1396 djvdj.exe 40 PID 1396 wrote to memory of 808 1396 djvdj.exe 40 PID 808 wrote to memory of 3032 808 ppddd.exe 41 PID 808 wrote to memory of 3032 808 ppddd.exe 41 PID 808 wrote to memory of 3032 808 ppddd.exe 41 PID 808 wrote to memory of 3032 808 ppddd.exe 41 PID 3032 wrote to memory of 2340 3032 lfxrffr.exe 42 PID 3032 wrote to memory of 2340 3032 lfxrffr.exe 42 PID 3032 wrote to memory of 2340 3032 lfxrffr.exe 42 PID 3032 wrote to memory of 2340 3032 lfxrffr.exe 42 PID 2340 wrote to memory of 2364 2340 9lxxffl.exe 43 PID 2340 wrote to memory of 2364 2340 9lxxffl.exe 43 PID 2340 wrote to memory of 2364 2340 9lxxffl.exe 43 PID 2340 wrote to memory of 2364 2340 9lxxffl.exe 43 PID 2364 wrote to memory of 1196 2364 ttnhbb.exe 44 PID 2364 wrote to memory of 1196 2364 ttnhbb.exe 44 PID 2364 wrote to memory of 1196 2364 ttnhbb.exe 44 PID 2364 wrote to memory of 1196 2364 ttnhbb.exe 44 PID 1196 wrote to memory of 848 1196 nbnntn.exe 45 PID 1196 wrote to memory of 848 1196 nbnntn.exe 45 PID 1196 wrote to memory of 848 1196 nbnntn.exe 45 PID 1196 wrote to memory of 848 1196 nbnntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9da72266fb5cd27bf8fccdaec67a2a0N.exe"C:\Users\Admin\AppData\Local\Temp\e9da72266fb5cd27bf8fccdaec67a2a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fxxllff.exec:\fxxllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\3rfrrff.exec:\3rfrrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7bnbbh.exec:\7bnbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vjvvd.exec:\vjvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\lfflfrr.exec:\lfflfrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\hbthtb.exec:\hbthtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jpjdd.exec:\jpjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\bhnnnh.exec:\bhnnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\djvdj.exec:\djvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\ppddd.exec:\ppddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\lfxrffr.exec:\lfxrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\9lxxffl.exec:\9lxxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ttnhbb.exec:\ttnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\nbnntn.exec:\nbnntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\dvvjp.exec:\dvvjp.exe17⤵
- Executes dropped EXE
PID:848 -
\??\c:\1vjdp.exec:\1vjdp.exe18⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5xrxxfr.exec:\5xrxxfr.exe19⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nhnnnn.exec:\nhnnnn.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bbthnn.exec:\bbthnn.exe21⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ppdvv.exec:\ppdvv.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jjvvd.exec:\jjvvd.exe23⤵
- Executes dropped EXE
PID:884 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe24⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7tntbh.exec:\7tntbh.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\vpjdv.exec:\vpjdv.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9jdjp.exec:\9jdjp.exe27⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rfrllfl.exec:\rfrllfl.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1rrrxfx.exec:\1rrrxfx.exe29⤵
- Executes dropped EXE
PID:300 -
\??\c:\bhttbb.exec:\bhttbb.exe30⤵
- Executes dropped EXE
PID:1004 -
\??\c:\djpvp.exec:\djpvp.exe31⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pjpdj.exec:\pjpdj.exe32⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrllrrx.exec:\xrllrrx.exe33⤵
- Executes dropped EXE
PID:1760 -
\??\c:\5lfrfll.exec:\5lfrfll.exe34⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9nbthn.exec:\9nbthn.exe35⤵
- Executes dropped EXE
PID:2612 -
\??\c:\7ttttn.exec:\7ttttn.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vvddv.exec:\vvddv.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jdddp.exec:\jdddp.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lfrxrrx.exec:\lfrxrrx.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5xrxfff.exec:\5xrxfff.exe40⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bttbhh.exec:\bttbhh.exe41⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7nbnhb.exec:\7nbnhb.exe42⤵
- Executes dropped EXE
PID:668 -
\??\c:\vjvpv.exec:\vjvpv.exe43⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jvdvd.exec:\jvdvd.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3xxxlxf.exec:\3xxxlxf.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\llxrxll.exec:\llxrxll.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5xxflrl.exec:\5xxflrl.exe47⤵
- Executes dropped EXE
PID:572 -
\??\c:\bnbhnt.exec:\bnbhnt.exe48⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hhbhnt.exec:\hhbhnt.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vvvjv.exec:\vvvjv.exe50⤵
- Executes dropped EXE
PID:2992 -
\??\c:\djjpj.exec:\djjpj.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxrfllr.exec:\fxrfllr.exe52⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rlrxlrx.exec:\rlrxlrx.exe53⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lxfxllx.exec:\lxfxllx.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3nhnbb.exec:\3nhnbb.exe55⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hbbhnn.exec:\hbbhnn.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\5pdjv.exec:\5pdjv.exe57⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjvvv.exec:\vjvvv.exe58⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jvjjv.exec:\jvjjv.exe59⤵
- Executes dropped EXE
PID:952 -
\??\c:\fffrxfx.exec:\fffrxfx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844 -
\??\c:\rlxxlfl.exec:\rlxxlfl.exe61⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbthhn.exec:\hbthhn.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhnnbt.exec:\nhnnbt.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7jpjp.exec:\7jpjp.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dvjjv.exec:\dvjjv.exe65⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xllxxrr.exec:\xllxxrr.exe66⤵PID:1140
-
\??\c:\rrfrlff.exec:\rrfrlff.exe67⤵PID:1636
-
\??\c:\jvjpv.exec:\jvjpv.exe68⤵PID:1444
-
\??\c:\pddpj.exec:\pddpj.exe69⤵PID:3060
-
\??\c:\lfllrll.exec:\lfllrll.exe70⤵PID:1216
-
\??\c:\rffrlxx.exec:\rffrlxx.exe71⤵PID:2732
-
\??\c:\tbbnnb.exec:\tbbnnb.exe72⤵PID:1628
-
\??\c:\hbnnnh.exec:\hbnnnh.exe73⤵PID:2800
-
\??\c:\jpvvp.exec:\jpvvp.exe74⤵PID:2728
-
\??\c:\1pddd.exec:\1pddd.exe75⤵PID:2408
-
\??\c:\xlxrrll.exec:\xlxrrll.exe76⤵PID:2692
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe77⤵PID:2652
-
\??\c:\nhtbhb.exec:\nhtbhb.exe78⤵PID:2600
-
\??\c:\nbbhhb.exec:\nbbhhb.exe79⤵PID:2680
-
\??\c:\bnntnh.exec:\bnntnh.exe80⤵PID:2656
-
\??\c:\pdjjd.exec:\pdjjd.exe81⤵PID:1592
-
\??\c:\ppvdv.exec:\ppvdv.exe82⤵PID:1136
-
\??\c:\xllxxrr.exec:\xllxxrr.exe83⤵PID:2108
-
\??\c:\9lxflfl.exec:\9lxflfl.exe84⤵PID:612
-
\??\c:\bnnhnn.exec:\bnnhnn.exe85⤵PID:2024
-
\??\c:\nbhhbt.exec:\nbhhbt.exe86⤵PID:1564
-
\??\c:\nbnhnb.exec:\nbnhnb.exe87⤵PID:1548
-
\??\c:\5jvpj.exec:\5jvpj.exe88⤵PID:3012
-
\??\c:\vvjjv.exec:\vvjjv.exe89⤵PID:3032
-
\??\c:\lflfxxr.exec:\lflfxxr.exe90⤵PID:1528
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe91⤵PID:2164
-
\??\c:\hbhbtt.exec:\hbhbtt.exe92⤵PID:648
-
\??\c:\nbbtnh.exec:\nbbtnh.exe93⤵PID:1740
-
\??\c:\pdppp.exec:\pdppp.exe94⤵PID:1936
-
\??\c:\xfrffxx.exec:\xfrffxx.exe95⤵PID:584
-
\??\c:\frfxfff.exec:\frfxfff.exe96⤵PID:2088
-
\??\c:\hnhbbt.exec:\hnhbbt.exe97⤵PID:1968
-
\??\c:\httttt.exec:\httttt.exe98⤵PID:2020
-
\??\c:\dvvpp.exec:\dvvpp.exe99⤵PID:2444
-
\??\c:\jvpjp.exec:\jvpjp.exe100⤵PID:1180
-
\??\c:\djpdv.exec:\djpdv.exe101⤵PID:1712
-
\??\c:\xlrllxf.exec:\xlrllxf.exe102⤵PID:696
-
\??\c:\rfxxffx.exec:\rfxxffx.exe103⤵PID:1532
-
\??\c:\hthnnh.exec:\hthnnh.exe104⤵PID:1728
-
\??\c:\thnnnn.exec:\thnnnn.exe105⤵PID:3052
-
\??\c:\vjvjp.exec:\vjvjp.exe106⤵PID:2928
-
\??\c:\dppjj.exec:\dppjj.exe107⤵
- System Location Discovery: System Language Discovery
PID:1140 -
\??\c:\frxfffx.exec:\frxfffx.exe108⤵PID:880
-
\??\c:\frllrff.exec:\frllrff.exe109⤵PID:1424
-
\??\c:\9thhhh.exec:\9thhhh.exe110⤵PID:1620
-
\??\c:\1hhtbn.exec:\1hhtbn.exe111⤵PID:2424
-
\??\c:\7pvpp.exec:\7pvpp.exe112⤵PID:2708
-
\??\c:\vddvd.exec:\vddvd.exe113⤵PID:2760
-
\??\c:\vjvvv.exec:\vjvvv.exe114⤵PID:3068
-
\??\c:\rflllll.exec:\rflllll.exe115⤵PID:2884
-
\??\c:\rffrrlf.exec:\rffrrlf.exe116⤵PID:2968
-
\??\c:\bnhhhh.exec:\bnhhhh.exe117⤵PID:2660
-
\??\c:\htbttn.exec:\htbttn.exe118⤵PID:2624
-
\??\c:\jvvdd.exec:\jvvdd.exe119⤵PID:2772
-
\??\c:\vdjpj.exec:\vdjpj.exe120⤵PID:2560
-
\??\c:\dddpp.exec:\dddpp.exe121⤵PID:2656
-
\??\c:\1rllfxx.exec:\1rllfxx.exe122⤵PID:828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-