Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40bbdb923856f2f0102acdef46ee8590N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
40bbdb923856f2f0102acdef46ee8590N.exe
-
Size
67KB
-
MD5
40bbdb923856f2f0102acdef46ee8590
-
SHA1
72257640e3b2bac86ff17cb91db5691961d0859e
-
SHA256
6a8a543a6a1dc056191b87d2a2c35d62315104cb09199a81feb1e990a303a58a
-
SHA512
54db672061107414e520b021f95199c62f401436da3751b2dd2dc42eb900231fa5e988a27b65076e737b96dfc7975c3f57db1327bfc5ab4b8d7a06233c773a7b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B5QF:ymb3NkkiQ3mdBjFI9c+F
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2096-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 bnnhhh.exe 792 pjddd.exe 2944 dvjpp.exe 2760 llffrlx.exe 2928 tntbbh.exe 2744 jjppd.exe 2644 llxlxrx.exe 2732 llffrfl.exe 2660 nhtnnn.exe 2680 vjvdd.exe 1092 frrxffl.exe 2812 lfxlrxl.exe 1404 tntnhh.exe 2156 7pddd.exe 2040 dpddj.exe 2852 xlllrxx.exe 1820 5tbbbh.exe 2824 vpjpv.exe 2276 7pddv.exe 2284 ffxrxfl.exe 2444 3rlllfl.exe 1324 5nnntb.exe 1384 5jpjp.exe 1568 pjvdj.exe 316 xrxxllx.exe 2184 hhbhnb.exe 2372 nhnthn.exe 1756 vpdvj.exe 1436 rlfrffr.exe 2368 rlflllx.exe 2996 nhnthn.exe 2500 dpvpv.exe 2152 jvpjp.exe 1580 rlflrrx.exe 2320 xrlxflx.exe 2904 nnnhbb.exe 2316 dvdpv.exe 2640 jdvvj.exe 2672 7xxfrxf.exe 2924 rlrfllr.exe 2620 thbhtn.exe 1744 nhbhhh.exe 756 vvjjj.exe 900 pjvvj.exe 1976 3rffllx.exe 2836 7frfffl.exe 1400 ttnntb.exe 2796 ttnbnb.exe 1276 jvpjp.exe 1428 3xlfflx.exe 2984 frlfrlx.exe 1588 hhthnb.exe 2132 tntthh.exe 2336 3vppv.exe 2280 pjdpp.exe 556 lfxxflx.exe 1036 1lffrfr.exe 828 1nnhhn.exe 1384 3bhbnh.exe 1168 5djdv.exe 316 dvvjv.exe 580 rfrllfr.exe 1752 tttttb.exe 2372 9btbnn.exe -
resource yara_rule behavioral1/memory/2096-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2368 2096 40bbdb923856f2f0102acdef46ee8590N.exe 31 PID 2096 wrote to memory of 2368 2096 40bbdb923856f2f0102acdef46ee8590N.exe 31 PID 2096 wrote to memory of 2368 2096 40bbdb923856f2f0102acdef46ee8590N.exe 31 PID 2096 wrote to memory of 2368 2096 40bbdb923856f2f0102acdef46ee8590N.exe 31 PID 2368 wrote to memory of 792 2368 bnnhhh.exe 32 PID 2368 wrote to memory of 792 2368 bnnhhh.exe 32 PID 2368 wrote to memory of 792 2368 bnnhhh.exe 32 PID 2368 wrote to memory of 792 2368 bnnhhh.exe 32 PID 792 wrote to memory of 2944 792 pjddd.exe 33 PID 792 wrote to memory of 2944 792 pjddd.exe 33 PID 792 wrote to memory of 2944 792 pjddd.exe 33 PID 792 wrote to memory of 2944 792 pjddd.exe 33 PID 2944 wrote to memory of 2760 2944 dvjpp.exe 34 PID 2944 wrote to memory of 2760 2944 dvjpp.exe 34 PID 2944 wrote to memory of 2760 2944 dvjpp.exe 34 PID 2944 wrote to memory of 2760 2944 dvjpp.exe 34 PID 2760 wrote to memory of 2928 2760 llffrlx.exe 35 PID 2760 wrote to memory of 2928 2760 llffrlx.exe 35 PID 2760 wrote to memory of 2928 2760 llffrlx.exe 35 PID 2760 wrote to memory of 2928 2760 llffrlx.exe 35 PID 2928 wrote to memory of 2744 2928 tntbbh.exe 36 PID 2928 wrote to memory of 2744 2928 tntbbh.exe 36 PID 2928 wrote to memory of 2744 2928 tntbbh.exe 36 PID 2928 wrote to memory of 2744 2928 tntbbh.exe 36 PID 2744 wrote to memory of 2644 2744 jjppd.exe 37 PID 2744 wrote to memory of 2644 2744 jjppd.exe 37 PID 2744 wrote to memory of 2644 2744 jjppd.exe 37 PID 2744 wrote to memory of 2644 2744 jjppd.exe 37 PID 2644 wrote to memory of 2732 2644 llxlxrx.exe 38 PID 2644 wrote to memory of 2732 2644 llxlxrx.exe 38 PID 2644 wrote to memory of 2732 2644 llxlxrx.exe 38 PID 2644 wrote to memory of 2732 2644 llxlxrx.exe 38 PID 2732 wrote to memory of 2660 2732 llffrfl.exe 39 PID 2732 wrote to memory of 2660 2732 llffrfl.exe 39 PID 2732 wrote to memory of 2660 2732 llffrfl.exe 39 PID 2732 wrote to memory of 2660 2732 llffrfl.exe 39 PID 2660 wrote to memory of 2680 2660 nhtnnn.exe 40 PID 2660 wrote to memory of 2680 2660 nhtnnn.exe 40 PID 2660 wrote to memory of 2680 2660 nhtnnn.exe 40 PID 2660 wrote to memory of 2680 2660 nhtnnn.exe 40 PID 2680 wrote to memory of 1092 2680 vjvdd.exe 41 PID 2680 wrote to memory of 1092 2680 vjvdd.exe 41 PID 2680 wrote to memory of 1092 2680 vjvdd.exe 41 PID 2680 wrote to memory of 1092 2680 vjvdd.exe 41 PID 1092 wrote to memory of 2812 1092 frrxffl.exe 42 PID 1092 wrote to memory of 2812 1092 frrxffl.exe 42 PID 1092 wrote to memory of 2812 1092 frrxffl.exe 42 PID 1092 wrote to memory of 2812 1092 frrxffl.exe 42 PID 2812 wrote to memory of 1404 2812 lfxlrxl.exe 43 PID 2812 wrote to memory of 1404 2812 lfxlrxl.exe 43 PID 2812 wrote to memory of 1404 2812 lfxlrxl.exe 43 PID 2812 wrote to memory of 1404 2812 lfxlrxl.exe 43 PID 1404 wrote to memory of 2156 1404 tntnhh.exe 44 PID 1404 wrote to memory of 2156 1404 tntnhh.exe 44 PID 1404 wrote to memory of 2156 1404 tntnhh.exe 44 PID 1404 wrote to memory of 2156 1404 tntnhh.exe 44 PID 2156 wrote to memory of 2040 2156 7pddd.exe 45 PID 2156 wrote to memory of 2040 2156 7pddd.exe 45 PID 2156 wrote to memory of 2040 2156 7pddd.exe 45 PID 2156 wrote to memory of 2040 2156 7pddd.exe 45 PID 2040 wrote to memory of 2852 2040 dpddj.exe 46 PID 2040 wrote to memory of 2852 2040 dpddj.exe 46 PID 2040 wrote to memory of 2852 2040 dpddj.exe 46 PID 2040 wrote to memory of 2852 2040 dpddj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\40bbdb923856f2f0102acdef46ee8590N.exe"C:\Users\Admin\AppData\Local\Temp\40bbdb923856f2f0102acdef46ee8590N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\bnnhhh.exec:\bnnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pjddd.exec:\pjddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\dvjpp.exec:\dvjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\llffrlx.exec:\llffrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tntbbh.exec:\tntbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jjppd.exec:\jjppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\llxlxrx.exec:\llxlxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llffrfl.exec:\llffrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhtnnn.exec:\nhtnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vjvdd.exec:\vjvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\frrxffl.exec:\frrxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tntnhh.exec:\tntnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\7pddd.exec:\7pddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\dpddj.exec:\dpddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xlllrxx.exec:\xlllrxx.exe17⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5tbbbh.exec:\5tbbbh.exe18⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vpjpv.exec:\vpjpv.exe19⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7pddv.exec:\7pddv.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ffxrxfl.exec:\ffxrxfl.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3rlllfl.exec:\3rlllfl.exe22⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5nnntb.exec:\5nnntb.exe23⤵
- Executes dropped EXE
PID:1324 -
\??\c:\5jpjp.exec:\5jpjp.exe24⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjvdj.exec:\pjvdj.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xrxxllx.exec:\xrxxllx.exe26⤵
- Executes dropped EXE
PID:316 -
\??\c:\hhbhnb.exec:\hhbhnb.exe27⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhnthn.exec:\nhnthn.exe28⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpdvj.exec:\vpdvj.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlfrffr.exec:\rlfrffr.exe30⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rlflllx.exec:\rlflllx.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhnthn.exec:\nhnthn.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dpvpv.exec:\dpvpv.exe33⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jvpjp.exec:\jvpjp.exe34⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlflrrx.exec:\rlflrrx.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xrlxflx.exec:\xrlxflx.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnnhbb.exec:\nnnhbb.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dvdpv.exec:\dvdpv.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jdvvj.exec:\jdvvj.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7xxfrxf.exec:\7xxfrxf.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlrfllr.exec:\rlrfllr.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\thbhtn.exec:\thbhtn.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nhbhhh.exec:\nhbhhh.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvjjj.exec:\vvjjj.exe44⤵
- Executes dropped EXE
PID:756 -
\??\c:\pjvvj.exec:\pjvvj.exe45⤵
- Executes dropped EXE
PID:900 -
\??\c:\3rffllx.exec:\3rffllx.exe46⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7frfffl.exec:\7frfffl.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ttnntb.exec:\ttnntb.exe48⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ttnbnb.exec:\ttnbnb.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jvpjp.exec:\jvpjp.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\3xlfflx.exec:\3xlfflx.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\frlfrlx.exec:\frlfrlx.exe52⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hhthnb.exec:\hhthnb.exe53⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tntthh.exec:\tntthh.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3vppv.exec:\3vppv.exe55⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pjdpp.exec:\pjdpp.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lfxxflx.exec:\lfxxflx.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\1lffrfr.exec:\1lffrfr.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\1nnhhn.exec:\1nnhhn.exe59⤵
- Executes dropped EXE
PID:828 -
\??\c:\3bhbnh.exec:\3bhbnh.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\5djdv.exec:\5djdv.exe61⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dvvjv.exec:\dvvjv.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\rfrllfr.exec:\rfrllfr.exe63⤵
- Executes dropped EXE
PID:580 -
\??\c:\tttttb.exec:\tttttb.exe64⤵
- Executes dropped EXE
PID:1752 -
\??\c:\9btbnn.exec:\9btbnn.exe65⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jdppd.exec:\jdppd.exe66⤵PID:2548
-
\??\c:\7jdvv.exec:\7jdvv.exe67⤵PID:3040
-
\??\c:\1xlrrxx.exec:\1xlrrxx.exe68⤵PID:2396
-
\??\c:\llxrxxf.exec:\llxrxxf.exe69⤵PID:2592
-
\??\c:\btbbht.exec:\btbbht.exe70⤵PID:2948
-
\??\c:\tnhbtb.exec:\tnhbtb.exe71⤵PID:2768
-
\??\c:\dvpdj.exec:\dvpdj.exe72⤵PID:2728
-
\??\c:\pjdpv.exec:\pjdpv.exe73⤵PID:2920
-
\??\c:\rlxfxll.exec:\rlxfxll.exe74⤵PID:2752
-
\??\c:\tntbhn.exec:\tntbhn.exe75⤵PID:2492
-
\??\c:\nnhntt.exec:\nnhntt.exe76⤵PID:2764
-
\??\c:\vpjdj.exec:\vpjdj.exe77⤵PID:2860
-
\??\c:\pjppv.exec:\pjppv.exe78⤵PID:2756
-
\??\c:\rrllrrf.exec:\rrllrrf.exe79⤵PID:1696
-
\??\c:\btntnt.exec:\btntnt.exe80⤵PID:2660
-
\??\c:\hbbhhh.exec:\hbbhhh.exe81⤵PID:1856
-
\??\c:\7djpd.exec:\7djpd.exe82⤵PID:2828
-
\??\c:\vjppv.exec:\vjppv.exe83⤵PID:2000
-
\??\c:\1xrxlxf.exec:\1xrxlxf.exe84⤵PID:796
-
\??\c:\tnbbbh.exec:\tnbbbh.exe85⤵PID:1936
-
\??\c:\thnnnt.exec:\thnnnt.exe86⤵PID:2856
-
\??\c:\dpvdj.exec:\dpvdj.exe87⤵PID:1988
-
\??\c:\vvjvd.exec:\vvjvd.exe88⤵PID:376
-
\??\c:\1fffrfr.exec:\1fffrfr.exe89⤵PID:2844
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe90⤵PID:2864
-
\??\c:\ttttht.exec:\ttttht.exe91⤵PID:2656
-
\??\c:\hbthnn.exec:\hbthnn.exe92⤵PID:2276
-
\??\c:\5jdpv.exec:\5jdpv.exe93⤵PID:2968
-
\??\c:\xfxxrxl.exec:\xfxxrxl.exe94⤵PID:2376
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe95⤵
- System Location Discovery: System Language Discovery
PID:688 -
\??\c:\nnnthn.exec:\nnnthn.exe96⤵PID:1592
-
\??\c:\7htttt.exec:\7htttt.exe97⤵PID:1508
-
\??\c:\9ddjd.exec:\9ddjd.exe98⤵PID:1568
-
\??\c:\jdvjp.exec:\jdvjp.exe99⤵PID:1760
-
\??\c:\lfllxxl.exec:\lfllxxl.exe100⤵PID:1860
-
\??\c:\lflxlrf.exec:\lflxlrf.exe101⤵
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\ttnnbh.exec:\ttnnbh.exe102⤵PID:268
-
\??\c:\7ppdp.exec:\7ppdp.exe103⤵PID:2540
-
\??\c:\jdvdp.exec:\jdvdp.exe104⤵PID:2248
-
\??\c:\rlrxffr.exec:\rlrxffr.exe105⤵PID:2116
-
\??\c:\9rrrffr.exec:\9rrrffr.exe106⤵PID:1796
-
\??\c:\7hntth.exec:\7hntth.exe107⤵PID:2112
-
\??\c:\thnnth.exec:\thnnth.exe108⤵PID:2500
-
\??\c:\jjjjj.exec:\jjjjj.exe109⤵PID:1552
-
\??\c:\ddvvj.exec:\ddvvj.exe110⤵PID:2760
-
\??\c:\lfflrxl.exec:\lfflrxl.exe111⤵PID:1584
-
\??\c:\7rrxflr.exec:\7rrxflr.exe112⤵PID:2624
-
\??\c:\tthtnb.exec:\tthtnb.exe113⤵PID:2872
-
\??\c:\tnhhth.exec:\tnhhth.exe114⤵PID:2976
-
\??\c:\3vvpd.exec:\3vvpd.exe115⤵PID:2628
-
\??\c:\fxxxflr.exec:\fxxxflr.exe116⤵PID:2816
-
\??\c:\lllxlrx.exec:\lllxlrx.exe117⤵PID:2788
-
\??\c:\3tnnbt.exec:\3tnnbt.exe118⤵PID:2036
-
\??\c:\hthhnt.exec:\hthhnt.exe119⤵PID:2632
-
\??\c:\1vpvd.exec:\1vpvd.exe120⤵PID:2688
-
\??\c:\pjddj.exec:\pjddj.exe121⤵PID:1028
-
\??\c:\xrlllrf.exec:\xrlllrf.exe122⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-