Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f856cefe3efe416d097d4ca81a17120N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7f856cefe3efe416d097d4ca81a17120N.exe
-
Size
71KB
-
MD5
7f856cefe3efe416d097d4ca81a17120
-
SHA1
3bf1b6d3ee1b1a4947259807fe79f2e7bb71fad9
-
SHA256
d315eede554e0207c397c71d2b5566817b05487b2fd34f7d7482b945f38804a8
-
SHA512
abdc88f5984eb06d4aeefe15a370e67d599587e4a7623c0972d864d7b33fe125a699397cbc53be518a0a400cd6bb2aaa802b7dc6a44ca81b78c5b28036c01bbd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjj:ymb3NkkiQ3mdBjFI4VT
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2324-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-1105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 1rlrrxx.exe 2320 hbnhbb.exe 2992 jpdvj.exe 2740 lxrrffl.exe 2912 jdppv.exe 2808 9ddjv.exe 2668 fxlrrxx.exe 2544 nhbhbh.exe 2984 jddpp.exe 888 vpjpv.exe 1752 lfrxllx.exe 1812 nhbbhh.exe 696 nhbbnn.exe 2020 vppvp.exe 628 lxfxfff.exe 1976 xxxxxfr.exe 2092 hbntbh.exe 2708 jjvjp.exe 2100 rrlrffr.exe 2212 lfllrlr.exe 1092 nhtbnt.exe 2628 vdpdd.exe 1684 rlxxxff.exe 2056 rrxrrfx.exe 952 hhbnbb.exe 1576 tnhhtb.exe 3016 jjvdd.exe 2468 7frlllr.exe 2084 1btbnt.exe 2616 tnhnhh.exe 2012 7ppdp.exe 1564 9rllllr.exe 2320 lxlfrlx.exe 3048 hbtbhb.exe 2992 nhnnth.exe 2824 1vjjv.exe 2688 3djdd.exe 2860 fxlrfff.exe 2556 1rrrxlf.exe 2704 ntbhhh.exe 2644 bttbnn.exe 2420 ddvdj.exe 2984 dpppp.exe 1724 xrllrrl.exe 2764 xrlrfrf.exe 996 nntbtt.exe 1232 nhtbnb.exe 1652 pjddv.exe 852 9vvpd.exe 1268 rrrxffr.exe 1352 hbtbbh.exe 1676 pppdp.exe 2348 vvppd.exe 672 xxxlxxr.exe 2104 ttnbhh.exe 2340 ttnnnb.exe 1672 vvvdd.exe 1236 vjdvd.exe 708 dvdjp.exe 1344 xrrrrrf.exe 1036 lfrrxxf.exe 1680 tnbhhn.exe 2924 bnbbbb.exe 1576 jvjjj.exe -
resource yara_rule behavioral1/memory/2324-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/696-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-1105-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2024 2324 7f856cefe3efe416d097d4ca81a17120N.exe 31 PID 2324 wrote to memory of 2024 2324 7f856cefe3efe416d097d4ca81a17120N.exe 31 PID 2324 wrote to memory of 2024 2324 7f856cefe3efe416d097d4ca81a17120N.exe 31 PID 2324 wrote to memory of 2024 2324 7f856cefe3efe416d097d4ca81a17120N.exe 31 PID 2024 wrote to memory of 2320 2024 1rlrrxx.exe 32 PID 2024 wrote to memory of 2320 2024 1rlrrxx.exe 32 PID 2024 wrote to memory of 2320 2024 1rlrrxx.exe 32 PID 2024 wrote to memory of 2320 2024 1rlrrxx.exe 32 PID 2320 wrote to memory of 2992 2320 hbnhbb.exe 33 PID 2320 wrote to memory of 2992 2320 hbnhbb.exe 33 PID 2320 wrote to memory of 2992 2320 hbnhbb.exe 33 PID 2320 wrote to memory of 2992 2320 hbnhbb.exe 33 PID 2992 wrote to memory of 2740 2992 jpdvj.exe 34 PID 2992 wrote to memory of 2740 2992 jpdvj.exe 34 PID 2992 wrote to memory of 2740 2992 jpdvj.exe 34 PID 2992 wrote to memory of 2740 2992 jpdvj.exe 34 PID 2740 wrote to memory of 2912 2740 lxrrffl.exe 35 PID 2740 wrote to memory of 2912 2740 lxrrffl.exe 35 PID 2740 wrote to memory of 2912 2740 lxrrffl.exe 35 PID 2740 wrote to memory of 2912 2740 lxrrffl.exe 35 PID 2912 wrote to memory of 2808 2912 jdppv.exe 36 PID 2912 wrote to memory of 2808 2912 jdppv.exe 36 PID 2912 wrote to memory of 2808 2912 jdppv.exe 36 PID 2912 wrote to memory of 2808 2912 jdppv.exe 36 PID 2808 wrote to memory of 2668 2808 9ddjv.exe 37 PID 2808 wrote to memory of 2668 2808 9ddjv.exe 37 PID 2808 wrote to memory of 2668 2808 9ddjv.exe 37 PID 2808 wrote to memory of 2668 2808 9ddjv.exe 37 PID 2668 wrote to memory of 2544 2668 fxlrrxx.exe 38 PID 2668 wrote to memory of 2544 2668 fxlrrxx.exe 38 PID 2668 wrote to memory of 2544 2668 fxlrrxx.exe 38 PID 2668 wrote to memory of 2544 2668 fxlrrxx.exe 38 PID 2544 wrote to memory of 2984 2544 nhbhbh.exe 39 PID 2544 wrote to memory of 2984 2544 nhbhbh.exe 39 PID 2544 wrote to memory of 2984 2544 nhbhbh.exe 39 PID 2544 wrote to memory of 2984 2544 nhbhbh.exe 39 PID 2984 wrote to memory of 888 2984 jddpp.exe 40 PID 2984 wrote to memory of 888 2984 jddpp.exe 40 PID 2984 wrote to memory of 888 2984 jddpp.exe 40 PID 2984 wrote to memory of 888 2984 jddpp.exe 40 PID 888 wrote to memory of 1752 888 vpjpv.exe 41 PID 888 wrote to memory of 1752 888 vpjpv.exe 41 PID 888 wrote to memory of 1752 888 vpjpv.exe 41 PID 888 wrote to memory of 1752 888 vpjpv.exe 41 PID 1752 wrote to memory of 1812 1752 lfrxllx.exe 42 PID 1752 wrote to memory of 1812 1752 lfrxllx.exe 42 PID 1752 wrote to memory of 1812 1752 lfrxllx.exe 42 PID 1752 wrote to memory of 1812 1752 lfrxllx.exe 42 PID 1812 wrote to memory of 696 1812 nhbbhh.exe 43 PID 1812 wrote to memory of 696 1812 nhbbhh.exe 43 PID 1812 wrote to memory of 696 1812 nhbbhh.exe 43 PID 1812 wrote to memory of 696 1812 nhbbhh.exe 43 PID 696 wrote to memory of 2020 696 nhbbnn.exe 44 PID 696 wrote to memory of 2020 696 nhbbnn.exe 44 PID 696 wrote to memory of 2020 696 nhbbnn.exe 44 PID 696 wrote to memory of 2020 696 nhbbnn.exe 44 PID 2020 wrote to memory of 628 2020 vppvp.exe 45 PID 2020 wrote to memory of 628 2020 vppvp.exe 45 PID 2020 wrote to memory of 628 2020 vppvp.exe 45 PID 2020 wrote to memory of 628 2020 vppvp.exe 45 PID 628 wrote to memory of 1976 628 lxfxfff.exe 46 PID 628 wrote to memory of 1976 628 lxfxfff.exe 46 PID 628 wrote to memory of 1976 628 lxfxfff.exe 46 PID 628 wrote to memory of 1976 628 lxfxfff.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f856cefe3efe416d097d4ca81a17120N.exe"C:\Users\Admin\AppData\Local\Temp\7f856cefe3efe416d097d4ca81a17120N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\1rlrrxx.exec:\1rlrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\hbnhbb.exec:\hbnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jpdvj.exec:\jpdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lxrrffl.exec:\lxrrffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jdppv.exec:\jdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9ddjv.exec:\9ddjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhbhbh.exec:\nhbhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jddpp.exec:\jddpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vpjpv.exec:\vpjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\lfrxllx.exec:\lfrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nhbbhh.exec:\nhbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\nhbbnn.exec:\nhbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\vppvp.exec:\vppvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\lxfxfff.exec:\lxfxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\xxxxxfr.exec:\xxxxxfr.exe17⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hbntbh.exec:\hbntbh.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jjvjp.exec:\jjvjp.exe19⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rrlrffr.exec:\rrlrffr.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lfllrlr.exec:\lfllrlr.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhtbnt.exec:\nhtbnt.exe22⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vdpdd.exec:\vdpdd.exe23⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlxxxff.exec:\rlxxxff.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe25⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hhbnbb.exec:\hhbnbb.exe26⤵
- Executes dropped EXE
PID:952 -
\??\c:\tnhhtb.exec:\tnhhtb.exe27⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jjvdd.exec:\jjvdd.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7frlllr.exec:\7frlllr.exe29⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1btbnt.exec:\1btbnt.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnhnhh.exec:\tnhnhh.exe31⤵
- Executes dropped EXE
PID:2616 -
\??\c:\7ppdp.exec:\7ppdp.exe32⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9rllllr.exec:\9rllllr.exe33⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lxlfrlx.exec:\lxlfrlx.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbtbhb.exec:\hbtbhb.exe35⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nhnnth.exec:\nhnnth.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1vjjv.exec:\1vjjv.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3djdd.exec:\3djdd.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxlrfff.exec:\fxlrfff.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1rrrxlf.exec:\1rrrxlf.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ntbhhh.exec:\ntbhhh.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bttbnn.exec:\bttbnn.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddvdj.exec:\ddvdj.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dpppp.exec:\dpppp.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xrllrrl.exec:\xrllrrl.exe45⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nntbtt.exec:\nntbtt.exe47⤵
- Executes dropped EXE
PID:996 -
\??\c:\nhtbnb.exec:\nhtbnb.exe48⤵
- Executes dropped EXE
PID:1232 -
\??\c:\pjddv.exec:\pjddv.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9vvpd.exec:\9vvpd.exe50⤵
- Executes dropped EXE
PID:852 -
\??\c:\rrrxffr.exec:\rrrxffr.exe51⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hbtbbh.exec:\hbtbbh.exe52⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pppdp.exec:\pppdp.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vvppd.exec:\vvppd.exe54⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe55⤵
- Executes dropped EXE
PID:672 -
\??\c:\ttnbhh.exec:\ttnbhh.exe56⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ttnnnb.exec:\ttnnnb.exe57⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvvdd.exec:\vvvdd.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vjdvd.exec:\vjdvd.exe59⤵
- Executes dropped EXE
PID:1236 -
\??\c:\dvdjp.exec:\dvdjp.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:708 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe62⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tnbhhn.exec:\tnbhhn.exe63⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bnbbbb.exec:\bnbbbb.exe64⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvjjj.exec:\jvjjj.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vvppd.exec:\vvppd.exe66⤵PID:2204
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe67⤵PID:3040
-
\??\c:\ffrxlrr.exec:\ffrxlrr.exe68⤵PID:2324
-
\??\c:\1tnnbh.exec:\1tnnbh.exe69⤵PID:1548
-
\??\c:\7tnbnt.exec:\7tnbnt.exe70⤵PID:2256
-
\??\c:\9pddj.exec:\9pddj.exe71⤵PID:2156
-
\??\c:\ddjpd.exec:\ddjpd.exe72⤵PID:2728
-
\??\c:\9lxxffl.exec:\9lxxffl.exe73⤵PID:3064
-
\??\c:\1rrxxxl.exec:\1rrxxxl.exe74⤵PID:2660
-
\??\c:\5hnnnn.exec:\5hnnnn.exe75⤵PID:2800
-
\??\c:\btntbb.exec:\btntbb.exe76⤵PID:2740
-
\??\c:\vpjvp.exec:\vpjvp.exe77⤵PID:2912
-
\??\c:\pdpvv.exec:\pdpvv.exe78⤵PID:1992
-
\??\c:\xxlrrrx.exec:\xxlrrrx.exe79⤵PID:2576
-
\??\c:\xrlrxxx.exec:\xrlrxxx.exe80⤵PID:2556
-
\??\c:\llxlxfr.exec:\llxlxfr.exe81⤵PID:2536
-
\??\c:\ntbhnh.exec:\ntbhnh.exe82⤵PID:2980
-
\??\c:\5vvdj.exec:\5vvdj.exe83⤵PID:1112
-
\??\c:\3dddd.exec:\3dddd.exe84⤵PID:2632
-
\??\c:\9lxxxfl.exec:\9lxxxfl.exe85⤵PID:2776
-
\??\c:\1rxlflx.exec:\1rxlflx.exe86⤵PID:2764
-
\??\c:\9rfflrx.exec:\9rfflrx.exe87⤵PID:304
-
\??\c:\nnhnhn.exec:\nnhnhn.exe88⤵PID:2336
-
\??\c:\5jpjj.exec:\5jpjj.exe89⤵PID:1764
-
\??\c:\dvpvp.exec:\dvpvp.exe90⤵PID:1980
-
\??\c:\9fffrlr.exec:\9fffrlr.exe91⤵PID:1768
-
\??\c:\fxllrxf.exec:\fxllrxf.exe92⤵PID:2856
-
\??\c:\xrlrlrl.exec:\xrlrlrl.exe93⤵PID:2880
-
\??\c:\nhtnbh.exec:\nhtnbh.exe94⤵PID:2348
-
\??\c:\pjppp.exec:\pjppp.exe95⤵PID:1484
-
\??\c:\pjvdp.exec:\pjvdp.exe96⤵PID:1640
-
\??\c:\ffxrrrf.exec:\ffxrrrf.exe97⤵PID:1032
-
\??\c:\3rlxffl.exec:\3rlxffl.exe98⤵PID:2408
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe99⤵PID:316
-
\??\c:\7tnbbb.exec:\7tnbbb.exe100⤵PID:1292
-
\??\c:\9btttb.exec:\9btttb.exe101⤵PID:1496
-
\??\c:\djjjj.exec:\djjjj.exe102⤵PID:908
-
\??\c:\1dvpd.exec:\1dvpd.exe103⤵PID:2428
-
\??\c:\xrffllx.exec:\xrffllx.exe104⤵
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe105⤵PID:1908
-
\??\c:\btnnnt.exec:\btnnnt.exe106⤵PID:2204
-
\??\c:\hbtbhb.exec:\hbtbhb.exe107⤵PID:2904
-
\??\c:\1pjvd.exec:\1pjvd.exe108⤵PID:1052
-
\??\c:\llxfflx.exec:\llxfflx.exe109⤵PID:2832
-
\??\c:\xxlxrfl.exec:\xxlxrfl.exe110⤵PID:2256
-
\??\c:\nhtthh.exec:\nhtthh.exe111⤵PID:1564
-
\??\c:\bttbhn.exec:\bttbhn.exe112⤵PID:2624
-
\??\c:\pdjjv.exec:\pdjjv.exe113⤵PID:1944
-
\??\c:\jdppv.exec:\jdppv.exe114⤵PID:2656
-
\??\c:\rlxxflr.exec:\rlxxflr.exe115⤵PID:2636
-
\??\c:\7rrxllr.exec:\7rrxllr.exe116⤵PID:2560
-
\??\c:\hhthhn.exec:\hhthhn.exe117⤵PID:2752
-
\??\c:\hbnntb.exec:\hbnntb.exe118⤵PID:3004
-
\??\c:\5ddjv.exec:\5ddjv.exe119⤵PID:2668
-
\??\c:\pjdvd.exec:\pjdvd.exe120⤵PID:532
-
\??\c:\xxlrflx.exec:\xxlrflx.exe121⤵PID:2580
-
\??\c:\9fxfllr.exec:\9fxfllr.exe122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-