Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 13:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
637d90a79bcf421348e02d8abe5e5200N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
637d90a79bcf421348e02d8abe5e5200N.exe
-
Size
71KB
-
MD5
637d90a79bcf421348e02d8abe5e5200
-
SHA1
34fae86eba14be7a4a4fd54379998e98a6d1dfda
-
SHA256
3eddd37a7962fb6d4e6ab24d84a80e81ad2559cee743a97e1c77fcf6c13be6ae
-
SHA512
cceced0e43da9e74d3c2d449c9c8ff05205c13913a6ed7ad998d6cd8c493edbbf47957b1d44e33d465079a342a024aa01f42fdca89f54fb9c8a56ddd773474c2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjp:ymb3NkkiQ3mdBjFI4VZ
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2712-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 frlxxfx.exe 2948 5rrxfxl.exe 2860 hbnhnn.exe 2612 pjvvd.exe 2620 vjjpv.exe 2724 nnbhbb.exe 1476 nbhnnb.exe 1864 1fxlrfl.exe 2440 xrlrxxr.exe 536 7nbbhn.exe 2848 vpjvj.exe 872 3rlrlrx.exe 2336 5lllfxx.exe 876 nnnnnn.exe 604 hbtnhb.exe 3012 jdpvj.exe 2296 xlfxflr.exe 2460 tbbtth.exe 1192 thhbbt.exe 3052 vjddj.exe 960 pvdvp.exe 2080 7rlrxrx.exe 1904 lflrxxf.exe 840 7hbhtb.exe 1532 btttbh.exe 2280 dvdvj.exe 1892 lfxfrxx.exe 1008 flxxfxl.exe 2184 hhhhtn.exe 2240 3dvdj.exe 2772 dpjjv.exe 2380 rlfrxlf.exe 2884 lrrflxr.exe 1580 3bhthn.exe 2556 nhbttn.exe 2572 vpjvv.exe 2016 dvppd.exe 2632 rrlfllr.exe 2108 nhbhtb.exe 2308 bttbhn.exe 1476 jdpjj.exe 2924 dvvdd.exe 3020 xxxrllr.exe 2440 tnhtbb.exe 1684 thhntb.exe 2252 vvppv.exe 1640 1pddd.exe 3056 xxrxxfl.exe 2232 5rlrffl.exe 1664 ntthnn.exe 2452 btbbtt.exe 1708 jdjjd.exe 2272 vpddd.exe 1976 9rllxlr.exe 444 xxllrrx.exe 788 ttbntb.exe 624 btbbhh.exe 2436 jdvpp.exe 908 vjddv.exe 1612 xrxrxxf.exe 1904 fxlxflr.exe 1520 1tbbbh.exe 2024 bbnntb.exe 1480 ddpvd.exe -
resource yara_rule behavioral1/memory/2712-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 637d90a79bcf421348e02d8abe5e5200N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2772 2712 637d90a79bcf421348e02d8abe5e5200N.exe 30 PID 2712 wrote to memory of 2772 2712 637d90a79bcf421348e02d8abe5e5200N.exe 30 PID 2712 wrote to memory of 2772 2712 637d90a79bcf421348e02d8abe5e5200N.exe 30 PID 2712 wrote to memory of 2772 2712 637d90a79bcf421348e02d8abe5e5200N.exe 30 PID 2772 wrote to memory of 2948 2772 frlxxfx.exe 31 PID 2772 wrote to memory of 2948 2772 frlxxfx.exe 31 PID 2772 wrote to memory of 2948 2772 frlxxfx.exe 31 PID 2772 wrote to memory of 2948 2772 frlxxfx.exe 31 PID 2948 wrote to memory of 2860 2948 5rrxfxl.exe 32 PID 2948 wrote to memory of 2860 2948 5rrxfxl.exe 32 PID 2948 wrote to memory of 2860 2948 5rrxfxl.exe 32 PID 2948 wrote to memory of 2860 2948 5rrxfxl.exe 32 PID 2860 wrote to memory of 2612 2860 hbnhnn.exe 33 PID 2860 wrote to memory of 2612 2860 hbnhnn.exe 33 PID 2860 wrote to memory of 2612 2860 hbnhnn.exe 33 PID 2860 wrote to memory of 2612 2860 hbnhnn.exe 33 PID 2612 wrote to memory of 2620 2612 pjvvd.exe 34 PID 2612 wrote to memory of 2620 2612 pjvvd.exe 34 PID 2612 wrote to memory of 2620 2612 pjvvd.exe 34 PID 2612 wrote to memory of 2620 2612 pjvvd.exe 34 PID 2620 wrote to memory of 2724 2620 vjjpv.exe 35 PID 2620 wrote to memory of 2724 2620 vjjpv.exe 35 PID 2620 wrote to memory of 2724 2620 vjjpv.exe 35 PID 2620 wrote to memory of 2724 2620 vjjpv.exe 35 PID 2724 wrote to memory of 1476 2724 nnbhbb.exe 36 PID 2724 wrote to memory of 1476 2724 nnbhbb.exe 36 PID 2724 wrote to memory of 1476 2724 nnbhbb.exe 36 PID 2724 wrote to memory of 1476 2724 nnbhbb.exe 36 PID 1476 wrote to memory of 1864 1476 nbhnnb.exe 37 PID 1476 wrote to memory of 1864 1476 nbhnnb.exe 37 PID 1476 wrote to memory of 1864 1476 nbhnnb.exe 37 PID 1476 wrote to memory of 1864 1476 nbhnnb.exe 37 PID 1864 wrote to memory of 2440 1864 1fxlrfl.exe 38 PID 1864 wrote to memory of 2440 1864 1fxlrfl.exe 38 PID 1864 wrote to memory of 2440 1864 1fxlrfl.exe 38 PID 1864 wrote to memory of 2440 1864 1fxlrfl.exe 38 PID 2440 wrote to memory of 536 2440 xrlrxxr.exe 39 PID 2440 wrote to memory of 536 2440 xrlrxxr.exe 39 PID 2440 wrote to memory of 536 2440 xrlrxxr.exe 39 PID 2440 wrote to memory of 536 2440 xrlrxxr.exe 39 PID 536 wrote to memory of 2848 536 7nbbhn.exe 40 PID 536 wrote to memory of 2848 536 7nbbhn.exe 40 PID 536 wrote to memory of 2848 536 7nbbhn.exe 40 PID 536 wrote to memory of 2848 536 7nbbhn.exe 40 PID 2848 wrote to memory of 872 2848 vpjvj.exe 41 PID 2848 wrote to memory of 872 2848 vpjvj.exe 41 PID 2848 wrote to memory of 872 2848 vpjvj.exe 41 PID 2848 wrote to memory of 872 2848 vpjvj.exe 41 PID 872 wrote to memory of 2336 872 3rlrlrx.exe 42 PID 872 wrote to memory of 2336 872 3rlrlrx.exe 42 PID 872 wrote to memory of 2336 872 3rlrlrx.exe 42 PID 872 wrote to memory of 2336 872 3rlrlrx.exe 42 PID 2336 wrote to memory of 876 2336 5lllfxx.exe 43 PID 2336 wrote to memory of 876 2336 5lllfxx.exe 43 PID 2336 wrote to memory of 876 2336 5lllfxx.exe 43 PID 2336 wrote to memory of 876 2336 5lllfxx.exe 43 PID 876 wrote to memory of 604 876 nnnnnn.exe 44 PID 876 wrote to memory of 604 876 nnnnnn.exe 44 PID 876 wrote to memory of 604 876 nnnnnn.exe 44 PID 876 wrote to memory of 604 876 nnnnnn.exe 44 PID 604 wrote to memory of 3012 604 hbtnhb.exe 45 PID 604 wrote to memory of 3012 604 hbtnhb.exe 45 PID 604 wrote to memory of 3012 604 hbtnhb.exe 45 PID 604 wrote to memory of 3012 604 hbtnhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\637d90a79bcf421348e02d8abe5e5200N.exe"C:\Users\Admin\AppData\Local\Temp\637d90a79bcf421348e02d8abe5e5200N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\frlxxfx.exec:\frlxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\5rrxfxl.exec:\5rrxfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hbnhnn.exec:\hbnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pjvvd.exec:\pjvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vjjpv.exec:\vjjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nnbhbb.exec:\nnbhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nbhnnb.exec:\nbhnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\1fxlrfl.exec:\1fxlrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\7nbbhn.exec:\7nbbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\vpjvj.exec:\vpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3rlrlrx.exec:\3rlrlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\5lllfxx.exec:\5lllfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nnnnnn.exec:\nnnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\hbtnhb.exec:\hbtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlfxflr.exec:\xlfxflr.exe18⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tbbtth.exec:\tbbtth.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\thhbbt.exec:\thhbbt.exe20⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vjddj.exec:\vjddj.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
PID:960 -
\??\c:\7rlrxrx.exec:\7rlrxrx.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lflrxxf.exec:\lflrxxf.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\7hbhtb.exec:\7hbhtb.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\btttbh.exec:\btttbh.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dvdvj.exec:\dvdvj.exe27⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\flxxfxl.exec:\flxxfxl.exe29⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hhhhtn.exec:\hhhhtn.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3dvdj.exec:\3dvdj.exe31⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dpjjv.exec:\dpjjv.exe32⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlfrxlf.exec:\rlfrxlf.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lrrflxr.exec:\lrrflxr.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3bhthn.exec:\3bhthn.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nhbttn.exec:\nhbttn.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpjvv.exec:\vpjvv.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvppd.exec:\dvppd.exe38⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rrlfllr.exec:\rrlfllr.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nhbhtb.exec:\nhbhtb.exe40⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bttbhn.exec:\bttbhn.exe41⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jdpjj.exec:\jdpjj.exe42⤵
- Executes dropped EXE
PID:1476 -
\??\c:\dvvdd.exec:\dvvdd.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxxrllr.exec:\xxxrllr.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnhtbb.exec:\tnhtbb.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thhntb.exec:\thhntb.exe46⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vvppv.exec:\vvppv.exe47⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1pddd.exec:\1pddd.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xxrxxfl.exec:\xxrxxfl.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5rlrffl.exec:\5rlrffl.exe50⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ntthnn.exec:\ntthnn.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\btbbtt.exec:\btbbtt.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jdjjd.exec:\jdjjd.exe53⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vpddd.exec:\vpddd.exe54⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9rllxlr.exec:\9rllxlr.exe55⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xxllrrx.exec:\xxllrrx.exe56⤵
- Executes dropped EXE
PID:444 -
\??\c:\ttbntb.exec:\ttbntb.exe57⤵
- Executes dropped EXE
PID:788 -
\??\c:\btbbhh.exec:\btbbhh.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\jdvpp.exec:\jdvpp.exe59⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vjddv.exec:\vjddv.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe61⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fxlxflr.exec:\fxlxflr.exe62⤵
- Executes dropped EXE
PID:1904 -
\??\c:\1tbbbh.exec:\1tbbbh.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\bbnntb.exec:\bbnntb.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ddpvd.exec:\ddpvd.exe65⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ppvjj.exec:\ppvjj.exe66⤵PID:296
-
\??\c:\ffrxxfr.exec:\ffrxxfr.exe67⤵PID:1748
-
\??\c:\1lxfxxf.exec:\1lxfxxf.exe68⤵PID:900
-
\??\c:\ttnbhn.exec:\ttnbhn.exe69⤵PID:2756
-
\??\c:\btbhhn.exec:\btbhhn.exe70⤵PID:2752
-
\??\c:\pjjpp.exec:\pjjpp.exe71⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\3ddjp.exec:\3ddjp.exe72⤵PID:1960
-
\??\c:\lfflrxf.exec:\lfflrxf.exe73⤵PID:2784
-
\??\c:\xllrxxf.exec:\xllrxxf.exe74⤵PID:2776
-
\??\c:\bthntt.exec:\bthntt.exe75⤵PID:1704
-
\??\c:\hhtbbb.exec:\hhtbbb.exe76⤵PID:2576
-
\??\c:\htbbnt.exec:\htbbnt.exe77⤵PID:2556
-
\??\c:\jdjjp.exec:\jdjjp.exe78⤵PID:3032
-
\??\c:\9fxrxfl.exec:\9fxrxfl.exe79⤵PID:2388
-
\??\c:\5xflflr.exec:\5xflflr.exe80⤵PID:2624
-
\??\c:\tnhntb.exec:\tnhntb.exe81⤵PID:1964
-
\??\c:\nnbtbb.exec:\nnbtbb.exe82⤵PID:1600
-
\??\c:\tnnnnn.exec:\tnnnnn.exe83⤵PID:2540
-
\??\c:\vjdvv.exec:\vjdvv.exe84⤵PID:588
-
\??\c:\9lfflfr.exec:\9lfflfr.exe85⤵PID:2792
-
\??\c:\lxflrlr.exec:\lxflrlr.exe86⤵PID:544
-
\??\c:\7xllrrf.exec:\7xllrrf.exe87⤵PID:2908
-
\??\c:\nntntt.exec:\nntntt.exe88⤵PID:2068
-
\??\c:\nhhhhh.exec:\nhhhhh.exe89⤵
- System Location Discovery: System Language Discovery
PID:1172 -
\??\c:\jdpvv.exec:\jdpvv.exe90⤵PID:572
-
\??\c:\1lfxfxl.exec:\1lfxfxl.exe91⤵PID:2944
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe92⤵PID:2160
-
\??\c:\9rxrxxf.exec:\9rxrxxf.exe93⤵PID:1180
-
\??\c:\bntntt.exec:\bntntt.exe94⤵PID:1492
-
\??\c:\pvjvp.exec:\pvjvp.exe95⤵PID:2484
-
\??\c:\3dppv.exec:\3dppv.exe96⤵PID:2904
-
\??\c:\fxfllxl.exec:\fxfllxl.exe97⤵PID:1608
-
\??\c:\llxxflr.exec:\llxxflr.exe98⤵PID:2920
-
\??\c:\xxxxfrf.exec:\xxxxfrf.exe99⤵PID:1056
-
\??\c:\hbhttt.exec:\hbhttt.exe100⤵PID:2264
-
\??\c:\hbnhnn.exec:\hbnhnn.exe101⤵PID:2352
-
\??\c:\vvpdp.exec:\vvpdp.exe102⤵PID:1808
-
\??\c:\pvvdd.exec:\pvvdd.exe103⤵PID:3060
-
\??\c:\9lrrxfl.exec:\9lrrxfl.exe104⤵PID:2076
-
\??\c:\rlffllx.exec:\rlffllx.exe105⤵PID:2092
-
\??\c:\bthhhh.exec:\bthhhh.exe106⤵PID:2012
-
\??\c:\tnhtbb.exec:\tnhtbb.exe107⤵PID:772
-
\??\c:\dvjjd.exec:\dvjjd.exe108⤵PID:2196
-
\??\c:\ppvjd.exec:\ppvjd.exe109⤵PID:2712
-
\??\c:\rxfrrxl.exec:\rxfrrxl.exe110⤵PID:2820
-
\??\c:\lflxflx.exec:\lflxflx.exe111⤵PID:2824
-
\??\c:\9rlrxrf.exec:\9rlrxrf.exe112⤵PID:2380
-
\??\c:\hthttt.exec:\hthttt.exe113⤵PID:2876
-
\??\c:\3htnnb.exec:\3htnnb.exe114⤵PID:2800
-
\??\c:\jjvvd.exec:\jjvvd.exe115⤵PID:2588
-
\??\c:\jddjj.exec:\jddjj.exe116⤵PID:1456
-
\??\c:\fffrlll.exec:\fffrlll.exe117⤵PID:2236
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe118⤵PID:1116
-
\??\c:\bthnbb.exec:\bthnbb.exe119⤵PID:1484
-
\??\c:\tnhbhn.exec:\tnhbhn.exe120⤵PID:2192
-
\??\c:\1htbtb.exec:\1htbtb.exe121⤵PID:2324
-
\??\c:\7djpv.exec:\7djpv.exe122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-