Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74cb7fcfc9b8f047547782e7cc2787e0N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
74cb7fcfc9b8f047547782e7cc2787e0N.exe
-
Size
82KB
-
MD5
74cb7fcfc9b8f047547782e7cc2787e0
-
SHA1
0f497fb6c379a8181661983433ab52c77e0d5c39
-
SHA256
ad1ac7c4e558d189ccc2c3eb7d70f2d45251d5ad4ea978e6f3587164d9eb099c
-
SHA512
93ef1fe5a9b59a600f3163656e8eef202a99daa38686517d8560333989c123ee3c1761e8540171b2a4237799d2eda7f4a8fac2e53b9b0b0eea523c6d54b40871
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QD:ymb3NkkiQ3mdBjFIIp9L9QrrA8g
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2592-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/744-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 xxrrxfx.exe 792 tnnthn.exe 2212 rxrrffx.exe 2724 fxrxflx.exe 2844 btbhnn.exe 3020 tntnbh.exe 2896 vppvp.exe 2960 jjjpp.exe 2632 3lxfxxf.exe 808 rrlxlrl.exe 2304 nhbhtt.exe 1268 1nnhhh.exe 2964 5djpd.exe 2128 jpdpd.exe 1396 fxlfxxr.exe 2952 fflxflx.exe 1860 7rlxrxx.exe 2160 ntbttn.exe 2192 hhtbnn.exe 2468 vpdjp.exe 2532 dvjjv.exe 1380 pjddj.exe 628 rlffrxl.exe 548 3xxxflx.exe 340 tnhntb.exe 2612 nnbbhn.exe 2400 jdpdv.exe 2520 dvpvp.exe 744 fxlflxr.exe 2280 fxllxxr.exe 1592 nhbhnb.exe 2568 3nnthh.exe 2412 7pjpp.exe 1984 7jjdj.exe 2212 9xrfrlx.exe 2860 fllrlrl.exe 2788 ffxlrxl.exe 2868 nnhbnt.exe 2732 httbbt.exe 264 bbbnbt.exe 2960 7jvjp.exe 2684 ddppd.exe 808 pvjdd.exe 2380 xxlrxxl.exe 2720 rfxlflr.exe 2372 fflxllf.exe 2140 nhtbtb.exe 1340 3bnnbh.exe 1396 jdpdp.exe 1176 pjddp.exe 1628 dvjpv.exe 2920 lflxlrr.exe 1168 xxxfrrl.exe 2192 rrlfrxf.exe 1476 tthtnt.exe 796 bbhnbn.exe 1748 hbttbb.exe 1528 9jjpd.exe 2180 dvpvd.exe 2600 dvjvd.exe 304 ffrllrl.exe 2168 rfllxxf.exe 1084 3lxrxxf.exe 2268 bnnthh.exe -
resource yara_rule behavioral1/memory/2592-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/744-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-35-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2564 2592 74cb7fcfc9b8f047547782e7cc2787e0N.exe 30 PID 2592 wrote to memory of 2564 2592 74cb7fcfc9b8f047547782e7cc2787e0N.exe 30 PID 2592 wrote to memory of 2564 2592 74cb7fcfc9b8f047547782e7cc2787e0N.exe 30 PID 2592 wrote to memory of 2564 2592 74cb7fcfc9b8f047547782e7cc2787e0N.exe 30 PID 2564 wrote to memory of 792 2564 xxrrxfx.exe 31 PID 2564 wrote to memory of 792 2564 xxrrxfx.exe 31 PID 2564 wrote to memory of 792 2564 xxrrxfx.exe 31 PID 2564 wrote to memory of 792 2564 xxrrxfx.exe 31 PID 792 wrote to memory of 2212 792 tnnthn.exe 32 PID 792 wrote to memory of 2212 792 tnnthn.exe 32 PID 792 wrote to memory of 2212 792 tnnthn.exe 32 PID 792 wrote to memory of 2212 792 tnnthn.exe 32 PID 2212 wrote to memory of 2724 2212 rxrrffx.exe 33 PID 2212 wrote to memory of 2724 2212 rxrrffx.exe 33 PID 2212 wrote to memory of 2724 2212 rxrrffx.exe 33 PID 2212 wrote to memory of 2724 2212 rxrrffx.exe 33 PID 2724 wrote to memory of 2844 2724 fxrxflx.exe 34 PID 2724 wrote to memory of 2844 2724 fxrxflx.exe 34 PID 2724 wrote to memory of 2844 2724 fxrxflx.exe 34 PID 2724 wrote to memory of 2844 2724 fxrxflx.exe 34 PID 2844 wrote to memory of 3020 2844 btbhnn.exe 35 PID 2844 wrote to memory of 3020 2844 btbhnn.exe 35 PID 2844 wrote to memory of 3020 2844 btbhnn.exe 35 PID 2844 wrote to memory of 3020 2844 btbhnn.exe 35 PID 3020 wrote to memory of 2896 3020 tntnbh.exe 36 PID 3020 wrote to memory of 2896 3020 tntnbh.exe 36 PID 3020 wrote to memory of 2896 3020 tntnbh.exe 36 PID 3020 wrote to memory of 2896 3020 tntnbh.exe 36 PID 2896 wrote to memory of 2960 2896 vppvp.exe 37 PID 2896 wrote to memory of 2960 2896 vppvp.exe 37 PID 2896 wrote to memory of 2960 2896 vppvp.exe 37 PID 2896 wrote to memory of 2960 2896 vppvp.exe 37 PID 2960 wrote to memory of 2632 2960 jjjpp.exe 38 PID 2960 wrote to memory of 2632 2960 jjjpp.exe 38 PID 2960 wrote to memory of 2632 2960 jjjpp.exe 38 PID 2960 wrote to memory of 2632 2960 jjjpp.exe 38 PID 2632 wrote to memory of 808 2632 3lxfxxf.exe 39 PID 2632 wrote to memory of 808 2632 3lxfxxf.exe 39 PID 2632 wrote to memory of 808 2632 3lxfxxf.exe 39 PID 2632 wrote to memory of 808 2632 3lxfxxf.exe 39 PID 808 wrote to memory of 2304 808 rrlxlrl.exe 40 PID 808 wrote to memory of 2304 808 rrlxlrl.exe 40 PID 808 wrote to memory of 2304 808 rrlxlrl.exe 40 PID 808 wrote to memory of 2304 808 rrlxlrl.exe 40 PID 2304 wrote to memory of 1268 2304 nhbhtt.exe 41 PID 2304 wrote to memory of 1268 2304 nhbhtt.exe 41 PID 2304 wrote to memory of 1268 2304 nhbhtt.exe 41 PID 2304 wrote to memory of 1268 2304 nhbhtt.exe 41 PID 1268 wrote to memory of 2964 1268 1nnhhh.exe 42 PID 1268 wrote to memory of 2964 1268 1nnhhh.exe 42 PID 1268 wrote to memory of 2964 1268 1nnhhh.exe 42 PID 1268 wrote to memory of 2964 1268 1nnhhh.exe 42 PID 2964 wrote to memory of 2128 2964 5djpd.exe 43 PID 2964 wrote to memory of 2128 2964 5djpd.exe 43 PID 2964 wrote to memory of 2128 2964 5djpd.exe 43 PID 2964 wrote to memory of 2128 2964 5djpd.exe 43 PID 2128 wrote to memory of 1396 2128 jpdpd.exe 44 PID 2128 wrote to memory of 1396 2128 jpdpd.exe 44 PID 2128 wrote to memory of 1396 2128 jpdpd.exe 44 PID 2128 wrote to memory of 1396 2128 jpdpd.exe 44 PID 1396 wrote to memory of 2952 1396 fxlfxxr.exe 45 PID 1396 wrote to memory of 2952 1396 fxlfxxr.exe 45 PID 1396 wrote to memory of 2952 1396 fxlfxxr.exe 45 PID 1396 wrote to memory of 2952 1396 fxlfxxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\74cb7fcfc9b8f047547782e7cc2787e0N.exe"C:\Users\Admin\AppData\Local\Temp\74cb7fcfc9b8f047547782e7cc2787e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xxrrxfx.exec:\xxrrxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tnnthn.exec:\tnnthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\rxrrffx.exec:\rxrrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\fxrxflx.exec:\fxrxflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\btbhnn.exec:\btbhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tntnbh.exec:\tntnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vppvp.exec:\vppvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jjjpp.exec:\jjjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\3lxfxxf.exec:\3lxfxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rrlxlrl.exec:\rrlxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\nhbhtt.exec:\nhbhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1nnhhh.exec:\1nnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\5djpd.exec:\5djpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\jpdpd.exec:\jpdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\fflxflx.exec:\fflxflx.exe17⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7rlxrxx.exec:\7rlxrxx.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ntbttn.exec:\ntbttn.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hhtbnn.exec:\hhtbnn.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vpdjp.exec:\vpdjp.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dvjjv.exec:\dvjjv.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pjddj.exec:\pjddj.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rlffrxl.exec:\rlffrxl.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\3xxxflx.exec:\3xxxflx.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\tnhntb.exec:\tnhntb.exe26⤵
- Executes dropped EXE
PID:340 -
\??\c:\nnbbhn.exec:\nnbbhn.exe27⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdpdv.exec:\jdpdv.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dvpvp.exec:\dvpvp.exe29⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fxlflxr.exec:\fxlflxr.exe30⤵
- Executes dropped EXE
PID:744 -
\??\c:\fxllxxr.exec:\fxllxxr.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nhbhnb.exec:\nhbhnb.exe32⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3nnthh.exec:\3nnthh.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\7pjpp.exec:\7pjpp.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7jjdj.exec:\7jjdj.exe35⤵
- Executes dropped EXE
PID:1984 -
\??\c:\9xrfrlx.exec:\9xrfrlx.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fllrlrl.exec:\fllrlrl.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nnhbnt.exec:\nnhbnt.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\httbbt.exec:\httbbt.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bbbnbt.exec:\bbbnbt.exe41⤵
- Executes dropped EXE
PID:264 -
\??\c:\7jvjp.exec:\7jvjp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\ddppd.exec:\ddppd.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pvjdd.exec:\pvjdd.exe44⤵
- Executes dropped EXE
PID:808 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe45⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rfxlflr.exec:\rfxlflr.exe46⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fflxllf.exec:\fflxllf.exe47⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhtbtb.exec:\nhtbtb.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3bnnbh.exec:\3bnnbh.exe49⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jdpdp.exec:\jdpdp.exe50⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pjddp.exec:\pjddp.exe51⤵
- Executes dropped EXE
PID:1176 -
\??\c:\dvjpv.exec:\dvjpv.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lflxlrr.exec:\lflxlrr.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xxxfrrl.exec:\xxxfrrl.exe54⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rrlfrxf.exec:\rrlfrxf.exe55⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tthtnt.exec:\tthtnt.exe56⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bbhnbn.exec:\bbhnbn.exe57⤵
- Executes dropped EXE
PID:796 -
\??\c:\hbttbb.exec:\hbttbb.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9jjpd.exec:\9jjpd.exe59⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dvpvd.exec:\dvpvd.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dvjvd.exec:\dvjvd.exe61⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ffrllrl.exec:\ffrllrl.exe62⤵
- Executes dropped EXE
PID:304 -
\??\c:\rfllxxf.exec:\rfllxxf.exe63⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3lxrxxf.exec:\3lxrxxf.exe64⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bnnthh.exec:\bnnthh.exe65⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nbnnbb.exec:\nbnnbb.exe66⤵PID:2520
-
\??\c:\hbhnbh.exec:\hbhnbh.exe67⤵PID:2116
-
\??\c:\vpvdp.exec:\vpvdp.exe68⤵PID:1584
-
\??\c:\jjjvj.exec:\jjjvj.exe69⤵PID:1676
-
\??\c:\3vjpd.exec:\3vjpd.exe70⤵PID:2420
-
\??\c:\fxxfllx.exec:\fxxfllx.exe71⤵PID:2464
-
\??\c:\9rlxrxf.exec:\9rlxrxf.exe72⤵PID:2716
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe73⤵PID:2900
-
\??\c:\1bbnbn.exec:\1bbnbn.exe74⤵PID:2060
-
\??\c:\3hnnnt.exec:\3hnnnt.exe75⤵PID:1908
-
\??\c:\bbbnhn.exec:\bbbnhn.exe76⤵PID:292
-
\??\c:\dvvvd.exec:\dvvvd.exe77⤵PID:2756
-
\??\c:\ddpvd.exec:\ddpvd.exe78⤵PID:2656
-
\??\c:\5jpjp.exec:\5jpjp.exe79⤵PID:2904
-
\??\c:\lfrflrl.exec:\lfrflrl.exe80⤵PID:2172
-
\??\c:\rffrffl.exec:\rffrffl.exe81⤵PID:2752
-
\??\c:\nhhntb.exec:\nhhntb.exe82⤵PID:2492
-
\??\c:\bthttb.exec:\bthttb.exe83⤵PID:660
-
\??\c:\btttbb.exec:\btttbb.exe84⤵PID:2036
-
\??\c:\vpvdv.exec:\vpvdv.exe85⤵PID:2380
-
\??\c:\pvjpd.exec:\pvjpd.exe86⤵PID:2408
-
\??\c:\dpdvv.exec:\dpdvv.exe87⤵PID:1720
-
\??\c:\dpdpd.exec:\dpdpd.exe88⤵PID:2972
-
\??\c:\xrrxrxl.exec:\xrrxrxl.exe89⤵PID:2220
-
\??\c:\flxxrlf.exec:\flxxrlf.exe90⤵PID:2952
-
\??\c:\1nnbbb.exec:\1nnbbb.exe91⤵PID:1180
-
\??\c:\bhttnn.exec:\bhttnn.exe92⤵PID:2744
-
\??\c:\thnthb.exec:\thnthb.exe93⤵PID:2056
-
\??\c:\jjdpp.exec:\jjdpp.exe94⤵PID:1892
-
\??\c:\7ppjd.exec:\7ppjd.exe95⤵PID:2468
-
\??\c:\dpjjj.exec:\dpjjj.exe96⤵PID:348
-
\??\c:\ffflxxr.exec:\ffflxxr.exe97⤵PID:3068
-
\??\c:\1frfrfr.exec:\1frfrfr.exe98⤵PID:1532
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe99⤵PID:628
-
\??\c:\nbbbtt.exec:\nbbbtt.exe100⤵PID:956
-
\??\c:\tbhbbb.exec:\tbhbbb.exe101⤵PID:340
-
\??\c:\dvddp.exec:\dvddp.exe102⤵PID:532
-
\??\c:\djjjp.exec:\djjjp.exe103⤵PID:544
-
\??\c:\rlflrlx.exec:\rlflrlx.exe104⤵PID:1124
-
\??\c:\5fxlllx.exec:\5fxlllx.exe105⤵PID:2204
-
\??\c:\htnhnn.exec:\htnhnn.exe106⤵PID:2272
-
\??\c:\7bnbnt.exec:\7bnbnt.exe107⤵PID:296
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe108⤵PID:1728
-
\??\c:\hhbthh.exec:\hhbthh.exe109⤵PID:2544
-
\??\c:\hbttnn.exec:\hbttnn.exe110⤵PID:1548
-
\??\c:\vpdpd.exec:\vpdpd.exe111⤵PID:2560
-
\??\c:\tththn.exec:\tththn.exe112⤵PID:2536
-
\??\c:\jdvvj.exec:\jdvvj.exe113⤵PID:1444
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe114⤵PID:2780
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe115⤵PID:2856
-
\??\c:\bhttnt.exec:\bhttnt.exe116⤵PID:2484
-
\??\c:\vvjdp.exec:\vvjdp.exe117⤵PID:2668
-
\??\c:\jvpvp.exec:\jvpvp.exe118⤵PID:2776
-
\??\c:\fxfflxf.exec:\fxfflxf.exe119⤵PID:2732
-
\??\c:\3btnhh.exec:\3btnhh.exe120⤵PID:2648
-
\??\c:\hhbnbn.exec:\hhbnbn.exe121⤵PID:2644
-
\??\c:\vpvvd.exec:\vpvvd.exe122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-