Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe
-
Size
71KB
-
MD5
3c687c9e6027f523f3566aafd37a3b4d
-
SHA1
9b404be7c0c4b5a2c81f41f35a4905e0907973c9
-
SHA256
97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b
-
SHA512
c6504e32f1c6107e97072e25a9ceec38ce0ebe0e384cf6cc2f7575cab6c2eeec89602d90e059471751b6ab2cb1a7fdbf673f63cd812962bc1c3a29da05ac5419
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjW:ymb3NkkiQ3mdBjFI4Vm
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1956-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 btntht.exe 2668 fxffflr.exe 2980 bbbhbb.exe 2636 hbnbhn.exe 1668 vpjvp.exe 2572 rlfxlrf.exe 2016 hhnhbn.exe 760 nnhntn.exe 2212 ddpvj.exe 340 jvjpd.exe 2712 xrrfrrf.exe 764 nnhnbn.exe 324 btnbnh.exe 1756 5vvvj.exe 1924 llfrxrf.exe 836 ffflxfr.exe 2392 tthnht.exe 2156 btnbnn.exe 2244 vddvj.exe 2892 llxlxfx.exe 2932 lxlrrxl.exe 1052 hthbbh.exe 684 tnhnbb.exe 1284 vjdpv.exe 1544 lxxfrlf.exe 1388 lrrxffr.exe 3012 3nntbb.exe 980 dvpdp.exe 1324 xflfllr.exe 1692 tbthbn.exe 528 tbntbh.exe 2260 pjjpd.exe 2660 lfxfrfr.exe 2816 rfxflrf.exe 2652 tbbhbh.exe 2168 1ppjj.exe 2844 jdpvj.exe 2688 9lrrxff.exe 2532 9pdjp.exe 2568 jjjvv.exe 3052 lxfllrx.exe 2160 hbbntb.exe 2852 nnbnnb.exe 2876 5vjpj.exe 2788 pdvjp.exe 2888 llfrxlf.exe 552 htnbht.exe 764 1nhtbh.exe 2864 vvdvv.exe 1672 jddvd.exe 1144 lflllxf.exe 2132 9rrfrrx.exe 1652 nhtnht.exe 2164 3tnbhn.exe 2184 ppvvv.exe 2784 llfrxfx.exe 1056 ffllllr.exe 1040 nntbhn.exe 1552 bhtnnt.exe 1720 jjddd.exe 964 pvdjv.exe 2128 rlfrllx.exe 1544 rlxrxrx.exe 1000 5tthtb.exe -
resource yara_rule behavioral1/memory/1956-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1388-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2368 1956 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 30 PID 1956 wrote to memory of 2368 1956 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 30 PID 1956 wrote to memory of 2368 1956 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 30 PID 1956 wrote to memory of 2368 1956 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 30 PID 2368 wrote to memory of 2668 2368 btntht.exe 31 PID 2368 wrote to memory of 2668 2368 btntht.exe 31 PID 2368 wrote to memory of 2668 2368 btntht.exe 31 PID 2368 wrote to memory of 2668 2368 btntht.exe 31 PID 2668 wrote to memory of 2980 2668 fxffflr.exe 32 PID 2668 wrote to memory of 2980 2668 fxffflr.exe 32 PID 2668 wrote to memory of 2980 2668 fxffflr.exe 32 PID 2668 wrote to memory of 2980 2668 fxffflr.exe 32 PID 2980 wrote to memory of 2636 2980 bbbhbb.exe 33 PID 2980 wrote to memory of 2636 2980 bbbhbb.exe 33 PID 2980 wrote to memory of 2636 2980 bbbhbb.exe 33 PID 2980 wrote to memory of 2636 2980 bbbhbb.exe 33 PID 2636 wrote to memory of 1668 2636 hbnbhn.exe 34 PID 2636 wrote to memory of 1668 2636 hbnbhn.exe 34 PID 2636 wrote to memory of 1668 2636 hbnbhn.exe 34 PID 2636 wrote to memory of 1668 2636 hbnbhn.exe 34 PID 1668 wrote to memory of 2572 1668 vpjvp.exe 35 PID 1668 wrote to memory of 2572 1668 vpjvp.exe 35 PID 1668 wrote to memory of 2572 1668 vpjvp.exe 35 PID 1668 wrote to memory of 2572 1668 vpjvp.exe 35 PID 2572 wrote to memory of 2016 2572 rlfxlrf.exe 36 PID 2572 wrote to memory of 2016 2572 rlfxlrf.exe 36 PID 2572 wrote to memory of 2016 2572 rlfxlrf.exe 36 PID 2572 wrote to memory of 2016 2572 rlfxlrf.exe 36 PID 2016 wrote to memory of 760 2016 hhnhbn.exe 37 PID 2016 wrote to memory of 760 2016 hhnhbn.exe 37 PID 2016 wrote to memory of 760 2016 hhnhbn.exe 37 PID 2016 wrote to memory of 760 2016 hhnhbn.exe 37 PID 760 wrote to memory of 2212 760 nnhntn.exe 38 PID 760 wrote to memory of 2212 760 nnhntn.exe 38 PID 760 wrote to memory of 2212 760 nnhntn.exe 38 PID 760 wrote to memory of 2212 760 nnhntn.exe 38 PID 2212 wrote to memory of 340 2212 ddpvj.exe 39 PID 2212 wrote to memory of 340 2212 ddpvj.exe 39 PID 2212 wrote to memory of 340 2212 ddpvj.exe 39 PID 2212 wrote to memory of 340 2212 ddpvj.exe 39 PID 340 wrote to memory of 2712 340 jvjpd.exe 40 PID 340 wrote to memory of 2712 340 jvjpd.exe 40 PID 340 wrote to memory of 2712 340 jvjpd.exe 40 PID 340 wrote to memory of 2712 340 jvjpd.exe 40 PID 2712 wrote to memory of 764 2712 xrrfrrf.exe 41 PID 2712 wrote to memory of 764 2712 xrrfrrf.exe 41 PID 2712 wrote to memory of 764 2712 xrrfrrf.exe 41 PID 2712 wrote to memory of 764 2712 xrrfrrf.exe 41 PID 764 wrote to memory of 324 764 nnhnbn.exe 42 PID 764 wrote to memory of 324 764 nnhnbn.exe 42 PID 764 wrote to memory of 324 764 nnhnbn.exe 42 PID 764 wrote to memory of 324 764 nnhnbn.exe 42 PID 324 wrote to memory of 1756 324 btnbnh.exe 43 PID 324 wrote to memory of 1756 324 btnbnh.exe 43 PID 324 wrote to memory of 1756 324 btnbnh.exe 43 PID 324 wrote to memory of 1756 324 btnbnh.exe 43 PID 1756 wrote to memory of 1924 1756 5vvvj.exe 44 PID 1756 wrote to memory of 1924 1756 5vvvj.exe 44 PID 1756 wrote to memory of 1924 1756 5vvvj.exe 44 PID 1756 wrote to memory of 1924 1756 5vvvj.exe 44 PID 1924 wrote to memory of 836 1924 llfrxrf.exe 45 PID 1924 wrote to memory of 836 1924 llfrxrf.exe 45 PID 1924 wrote to memory of 836 1924 llfrxrf.exe 45 PID 1924 wrote to memory of 836 1924 llfrxrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe"C:\Users\Admin\AppData\Local\Temp\97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\btntht.exec:\btntht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\fxffflr.exec:\fxffflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bbbhbb.exec:\bbbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hbnbhn.exec:\hbnbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vpjvp.exec:\vpjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hhnhbn.exec:\hhnhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\nnhntn.exec:\nnhntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\ddpvj.exec:\ddpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\jvjpd.exec:\jvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nnhnbn.exec:\nnhnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\btnbnh.exec:\btnbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\5vvvj.exec:\5vvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\llfrxrf.exec:\llfrxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\ffflxfr.exec:\ffflxfr.exe17⤵
- Executes dropped EXE
PID:836 -
\??\c:\tthnht.exec:\tthnht.exe18⤵
- Executes dropped EXE
PID:2392 -
\??\c:\btnbnn.exec:\btnbnn.exe19⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vddvj.exec:\vddvj.exe20⤵
- Executes dropped EXE
PID:2244 -
\??\c:\llxlxfx.exec:\llxlxfx.exe21⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxlrrxl.exec:\lxlrrxl.exe22⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hthbbh.exec:\hthbbh.exe23⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tnhnbb.exec:\tnhnbb.exe24⤵
- Executes dropped EXE
PID:684 -
\??\c:\vjdpv.exec:\vjdpv.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lxxfrlf.exec:\lxxfrlf.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lrrxffr.exec:\lrrxffr.exe27⤵
- Executes dropped EXE
PID:1388 -
\??\c:\3nntbb.exec:\3nntbb.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvpdp.exec:\dvpdp.exe29⤵
- Executes dropped EXE
PID:980 -
\??\c:\xflfllr.exec:\xflfllr.exe30⤵
- Executes dropped EXE
PID:1324 -
\??\c:\tbthbn.exec:\tbthbn.exe31⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tbntbh.exec:\tbntbh.exe32⤵
- Executes dropped EXE
PID:528 -
\??\c:\pjjpd.exec:\pjjpd.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rfxflrf.exec:\rfxflrf.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tbbhbh.exec:\tbbhbh.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1ppjj.exec:\1ppjj.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdpvj.exec:\jdpvj.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9lrrxff.exec:\9lrrxff.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9pdjp.exec:\9pdjp.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jjjvv.exec:\jjjvv.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lxfllrx.exec:\lxfllrx.exe42⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hbbntb.exec:\hbbntb.exe43⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nnbnnb.exec:\nnbnnb.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5vjpj.exec:\5vjpj.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pdvjp.exec:\pdvjp.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\llfrxlf.exec:\llfrxlf.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\htnbht.exec:\htnbht.exe48⤵
- Executes dropped EXE
PID:552 -
\??\c:\1nhtbh.exec:\1nhtbh.exe49⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvdvv.exec:\vvdvv.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jddvd.exec:\jddvd.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lflllxf.exec:\lflllxf.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\9rrfrrx.exec:\9rrfrrx.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nhtnht.exec:\nhtnht.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3tnbhn.exec:\3tnbhn.exe55⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppvvv.exec:\ppvvv.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\llfrxfx.exec:\llfrxfx.exe57⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ffllllr.exec:\ffllllr.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nntbhn.exec:\nntbhn.exe59⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bhtnnt.exec:\bhtnnt.exe60⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jjddd.exec:\jjddd.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pvdjv.exec:\pvdjv.exe62⤵
- Executes dropped EXE
PID:964 -
\??\c:\rlfrllx.exec:\rlfrllx.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5tthtb.exec:\5tthtb.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pvdvd.exec:\pvdvd.exe66⤵PID:1648
-
\??\c:\jdvpv.exec:\jdvpv.exe67⤵PID:1480
-
\??\c:\lllflrx.exec:\lllflrx.exe68⤵PID:772
-
\??\c:\fffrllf.exec:\fffrllf.exe69⤵PID:2444
-
\??\c:\bhhnnt.exec:\bhhnnt.exe70⤵PID:1068
-
\??\c:\nnhbht.exec:\nnhbht.exe71⤵PID:1692
-
\??\c:\vvvdp.exec:\vvvdp.exe72⤵PID:2380
-
\??\c:\ddvvv.exec:\ddvvv.exe73⤵PID:2368
-
\??\c:\lfrfrfl.exec:\lfrfrfl.exe74⤵PID:2624
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe75⤵PID:2716
-
\??\c:\hhbtnb.exec:\hhbtnb.exe76⤵PID:2552
-
\??\c:\bbthth.exec:\bbthth.exe77⤵PID:2924
-
\??\c:\vpdpd.exec:\vpdpd.exe78⤵PID:2564
-
\??\c:\pjpdp.exec:\pjpdp.exe79⤵PID:1668
-
\??\c:\xxxlflx.exec:\xxxlflx.exe80⤵PID:2592
-
\??\c:\ttnhnb.exec:\ttnhnb.exe81⤵PID:2756
-
\??\c:\hhhthh.exec:\hhhthh.exe82⤵PID:3060
-
\??\c:\vvppd.exec:\vvppd.exe83⤵PID:2060
-
\??\c:\1dpvd.exec:\1dpvd.exe84⤵PID:2580
-
\??\c:\lxlrffl.exec:\lxlrffl.exe85⤵PID:2772
-
\??\c:\5tnnnh.exec:\5tnnnh.exe86⤵PID:2796
-
\??\c:\dvjvv.exec:\dvjvv.exe87⤵PID:2416
-
\??\c:\jddvp.exec:\jddvp.exe88⤵PID:544
-
\??\c:\xxrlllr.exec:\xxrlllr.exe89⤵PID:3024
-
\??\c:\nnnhth.exec:\nnnhth.exe90⤵PID:1800
-
\??\c:\vjjpd.exec:\vjjpd.exe91⤵PID:2500
-
\??\c:\5dddd.exec:\5dddd.exe92⤵PID:1744
-
\??\c:\fllxrfl.exec:\fllxrfl.exe93⤵PID:1148
-
\??\c:\nhtbnt.exec:\nhtbnt.exe94⤵PID:2992
-
\??\c:\5hnntt.exec:\5hnntt.exe95⤵PID:2072
-
\??\c:\jjjvd.exec:\jjjvd.exe96⤵PID:2148
-
\??\c:\dvvdd.exec:\dvvdd.exe97⤵PID:428
-
\??\c:\xlxxflr.exec:\xlxxflr.exe98⤵
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\xrrrfxr.exec:\xrrrfxr.exe99⤵PID:2908
-
\??\c:\nttntb.exec:\nttntb.exe100⤵PID:992
-
\??\c:\vdvpj.exec:\vdvpj.exe101⤵PID:936
-
\??\c:\9vdjj.exec:\9vdjj.exe102⤵PID:1772
-
\??\c:\9flflff.exec:\9flflff.exe103⤵PID:1984
-
\??\c:\btnthh.exec:\btnthh.exe104⤵PID:2024
-
\??\c:\tbbntn.exec:\tbbntn.exe105⤵PID:2064
-
\??\c:\pvpjv.exec:\pvpjv.exe106⤵PID:680
-
\??\c:\pppdp.exec:\pppdp.exe107⤵PID:1500
-
\??\c:\7xfffxx.exec:\7xfffxx.exe108⤵PID:2952
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe109⤵PID:1636
-
\??\c:\3rrlrxf.exec:\3rrlrxf.exe110⤵PID:2460
-
\??\c:\bhthbh.exec:\bhthbh.exe111⤵PID:1956
-
\??\c:\vjjjp.exec:\vjjjp.exe112⤵PID:2728
-
\??\c:\dpvjv.exec:\dpvjv.exe113⤵PID:2812
-
\??\c:\1xxxxll.exec:\1xxxxll.exe114⤵PID:2804
-
\??\c:\xxlxxfx.exec:\xxlxxfx.exe115⤵PID:2828
-
\??\c:\dvdpj.exec:\dvdpj.exe116⤵PID:2656
-
\??\c:\jvppj.exec:\jvppj.exe117⤵
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\rrflxfl.exec:\rrflxfl.exe118⤵PID:2528
-
\??\c:\1frxfxr.exec:\1frxfxr.exe119⤵PID:2548
-
\??\c:\rrfrrrx.exec:\rrfrrrx.exe120⤵PID:2088
-
\??\c:\3hbhhn.exec:\3hbhhn.exe121⤵PID:1676
-
\??\c:\7nbtbh.exec:\7nbtbh.exe122⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-