Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe
-
Size
64KB
-
MD5
51ce8c0199e3cee240748ccaaa1af470
-
SHA1
1bad9e71a2e4aab4368f352568540c0b7706fe66
-
SHA256
85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12e
-
SHA512
445c2454e77cdb70e5a816d199ed0f7f7085238666442e4c0a27c90b519f730adda046c7f64be99999c5725fc1769323b942178d742478e971644fff710e3ba3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27U:ymb3NkkiQ3mdBjFI9l
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/372-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1820 rlfflrr.exe 2220 hhnnhn.exe 2952 5vjpv.exe 880 llxxrrx.exe 2888 bnbbhn.exe 1272 ddvjp.exe 2972 llfrflx.exe 2680 ddvpd.exe 2656 1pjvv.exe 2396 frxxfff.exe 684 7frxffl.exe 1688 5thhtt.exe 2816 pjppp.exe 2936 xxfrffx.exe 2016 xxflrxr.exe 3000 hhbhnn.exe 1756 thntbh.exe 1180 jpjjv.exe 2356 rlfrllr.exe 2332 lfrflrx.exe 808 ttnhbb.exe 1636 ppvpj.exe 408 fxllfrf.exe 1236 htnbtt.exe 372 nhhtbb.exe 1676 vvpjj.exe 2548 pppdv.exe 2444 rlfxrxl.exe 1412 bbnttb.exe 2560 vvjjp.exe 2136 3fxfflx.exe 1588 xxrlxll.exe 1820 hbtntn.exe 2464 hnhnnn.exe 2720 3vvvv.exe 2952 jpvpj.exe 2780 9fxxxlx.exe 2752 lllfxlx.exe 2896 bttbnt.exe 2648 3vpjp.exe 2852 pjpvd.exe 2640 lfxlxxl.exe 2704 nnntnt.exe 380 nhnntt.exe 2028 5jddp.exe 1120 ddddv.exe 2728 5rlxllf.exe 2612 5lxlrxx.exe 2956 nhhhtt.exe 1916 nhtthn.exe 2976 ddvjp.exe 348 xxflrrf.exe 1028 rlfllrx.exe 1772 xfxrflx.exe 3056 hhbtnn.exe 2056 nhbthn.exe 2064 dvpvp.exe 2536 fxrlrrx.exe 2848 9frrrfx.exe 1924 rrfrxxl.exe 1652 hhhnbh.exe 2436 bthbnh.exe 2440 ddvdv.exe 1676 1rxlxfx.exe -
resource yara_rule behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/372-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1820 2136 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 30 PID 2136 wrote to memory of 1820 2136 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 30 PID 2136 wrote to memory of 1820 2136 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 30 PID 2136 wrote to memory of 1820 2136 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 30 PID 1820 wrote to memory of 2220 1820 rlfflrr.exe 31 PID 1820 wrote to memory of 2220 1820 rlfflrr.exe 31 PID 1820 wrote to memory of 2220 1820 rlfflrr.exe 31 PID 1820 wrote to memory of 2220 1820 rlfflrr.exe 31 PID 2220 wrote to memory of 2952 2220 hhnnhn.exe 32 PID 2220 wrote to memory of 2952 2220 hhnnhn.exe 32 PID 2220 wrote to memory of 2952 2220 hhnnhn.exe 32 PID 2220 wrote to memory of 2952 2220 hhnnhn.exe 32 PID 2952 wrote to memory of 880 2952 5vjpv.exe 33 PID 2952 wrote to memory of 880 2952 5vjpv.exe 33 PID 2952 wrote to memory of 880 2952 5vjpv.exe 33 PID 2952 wrote to memory of 880 2952 5vjpv.exe 33 PID 880 wrote to memory of 2888 880 llxxrrx.exe 34 PID 880 wrote to memory of 2888 880 llxxrrx.exe 34 PID 880 wrote to memory of 2888 880 llxxrrx.exe 34 PID 880 wrote to memory of 2888 880 llxxrrx.exe 34 PID 2888 wrote to memory of 1272 2888 bnbbhn.exe 35 PID 2888 wrote to memory of 1272 2888 bnbbhn.exe 35 PID 2888 wrote to memory of 1272 2888 bnbbhn.exe 35 PID 2888 wrote to memory of 1272 2888 bnbbhn.exe 35 PID 1272 wrote to memory of 2972 1272 ddvjp.exe 36 PID 1272 wrote to memory of 2972 1272 ddvjp.exe 36 PID 1272 wrote to memory of 2972 1272 ddvjp.exe 36 PID 1272 wrote to memory of 2972 1272 ddvjp.exe 36 PID 2972 wrote to memory of 2680 2972 llfrflx.exe 37 PID 2972 wrote to memory of 2680 2972 llfrflx.exe 37 PID 2972 wrote to memory of 2680 2972 llfrflx.exe 37 PID 2972 wrote to memory of 2680 2972 llfrflx.exe 37 PID 2680 wrote to memory of 2656 2680 ddvpd.exe 38 PID 2680 wrote to memory of 2656 2680 ddvpd.exe 38 PID 2680 wrote to memory of 2656 2680 ddvpd.exe 38 PID 2680 wrote to memory of 2656 2680 ddvpd.exe 38 PID 2656 wrote to memory of 2396 2656 1pjvv.exe 39 PID 2656 wrote to memory of 2396 2656 1pjvv.exe 39 PID 2656 wrote to memory of 2396 2656 1pjvv.exe 39 PID 2656 wrote to memory of 2396 2656 1pjvv.exe 39 PID 2396 wrote to memory of 684 2396 frxxfff.exe 40 PID 2396 wrote to memory of 684 2396 frxxfff.exe 40 PID 2396 wrote to memory of 684 2396 frxxfff.exe 40 PID 2396 wrote to memory of 684 2396 frxxfff.exe 40 PID 684 wrote to memory of 1688 684 7frxffl.exe 41 PID 684 wrote to memory of 1688 684 7frxffl.exe 41 PID 684 wrote to memory of 1688 684 7frxffl.exe 41 PID 684 wrote to memory of 1688 684 7frxffl.exe 41 PID 1688 wrote to memory of 2816 1688 5thhtt.exe 42 PID 1688 wrote to memory of 2816 1688 5thhtt.exe 42 PID 1688 wrote to memory of 2816 1688 5thhtt.exe 42 PID 1688 wrote to memory of 2816 1688 5thhtt.exe 42 PID 2816 wrote to memory of 2936 2816 pjppp.exe 43 PID 2816 wrote to memory of 2936 2816 pjppp.exe 43 PID 2816 wrote to memory of 2936 2816 pjppp.exe 43 PID 2816 wrote to memory of 2936 2816 pjppp.exe 43 PID 2936 wrote to memory of 2016 2936 xxfrffx.exe 44 PID 2936 wrote to memory of 2016 2936 xxfrffx.exe 44 PID 2936 wrote to memory of 2016 2936 xxfrffx.exe 44 PID 2936 wrote to memory of 2016 2936 xxfrffx.exe 44 PID 2016 wrote to memory of 3000 2016 xxflrxr.exe 45 PID 2016 wrote to memory of 3000 2016 xxflrxr.exe 45 PID 2016 wrote to memory of 3000 2016 xxflrxr.exe 45 PID 2016 wrote to memory of 3000 2016 xxflrxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe"C:\Users\Admin\AppData\Local\Temp\85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\rlfflrr.exec:\rlfflrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hhnnhn.exec:\hhnnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\5vjpv.exec:\5vjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\llxxrrx.exec:\llxxrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\bnbbhn.exec:\bnbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ddvjp.exec:\ddvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\llfrflx.exec:\llfrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\ddvpd.exec:\ddvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1pjvv.exec:\1pjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\frxxfff.exec:\frxxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\7frxffl.exec:\7frxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\5thhtt.exec:\5thhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\pjppp.exec:\pjppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xxfrffx.exec:\xxfrffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xxflrxr.exec:\xxflrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\hhbhnn.exec:\hhbhnn.exe17⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thntbh.exec:\thntbh.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jpjjv.exec:\jpjjv.exe19⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rlfrllr.exec:\rlfrllr.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lfrflrx.exec:\lfrflrx.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ttnhbb.exec:\ttnhbb.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\ppvpj.exec:\ppvpj.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fxllfrf.exec:\fxllfrf.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\htnbtt.exec:\htnbtt.exe25⤵
- Executes dropped EXE
PID:1236 -
\??\c:\nhhtbb.exec:\nhhtbb.exe26⤵
- Executes dropped EXE
PID:372 -
\??\c:\vvpjj.exec:\vvpjj.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pppdv.exec:\pppdv.exe28⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rlfxrxl.exec:\rlfxrxl.exe29⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bbnttb.exec:\bbnttb.exe30⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vvjjp.exec:\vvjjp.exe31⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3fxfflx.exec:\3fxfflx.exe32⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xxrlxll.exec:\xxrlxll.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hbtntn.exec:\hbtntn.exe34⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hnhnnn.exec:\hnhnnn.exe35⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3vvvv.exec:\3vvvv.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jpvpj.exec:\jpvpj.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9fxxxlx.exec:\9fxxxlx.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lllfxlx.exec:\lllfxlx.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bttbnt.exec:\bttbnt.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3vpjp.exec:\3vpjp.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjpvd.exec:\pjpvd.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nnntnt.exec:\nnntnt.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhnntt.exec:\nhnntt.exe45⤵
- Executes dropped EXE
PID:380 -
\??\c:\5jddp.exec:\5jddp.exe46⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ddddv.exec:\ddddv.exe47⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5rlxllf.exec:\5rlxllf.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5lxlrxx.exec:\5lxlrxx.exe49⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhhhtt.exec:\nhhhtt.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nhtthn.exec:\nhtthn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\ddvjp.exec:\ddvjp.exe52⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xxflrrf.exec:\xxflrrf.exe53⤵
- Executes dropped EXE
PID:348 -
\??\c:\rlfllrx.exec:\rlfllrx.exe54⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xfxrflx.exec:\xfxrflx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
\??\c:\hhbtnn.exec:\hhbtnn.exe56⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nhbthn.exec:\nhbthn.exe57⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvpvp.exec:\dvpvp.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe59⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9frrrfx.exec:\9frrrfx.exe60⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrfrxxl.exec:\rrfrxxl.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hhhnbh.exec:\hhhnbh.exe62⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bthbnh.exec:\bthbnh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436 -
\??\c:\ddvdv.exec:\ddvdv.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1rxlxfx.exec:\1rxlxfx.exe65⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xllrxrx.exec:\xllrxrx.exe66⤵PID:1408
-
\??\c:\btbnbb.exec:\btbnbb.exe67⤵PID:1908
-
\??\c:\bthttb.exec:\bthttb.exe68⤵PID:2156
-
\??\c:\vpjpj.exec:\vpjpj.exe69⤵PID:2252
-
\??\c:\pjpjv.exec:\pjpjv.exe70⤵PID:2560
-
\??\c:\fxfllff.exec:\fxfllff.exe71⤵PID:1724
-
\??\c:\rlxlxlx.exec:\rlxlxlx.exe72⤵PID:1612
-
\??\c:\hhhhtb.exec:\hhhhtb.exe73⤵PID:1656
-
\??\c:\hbbnbn.exec:\hbbnbn.exe74⤵PID:1632
-
\??\c:\9jvvj.exec:\9jvvj.exe75⤵PID:2220
-
\??\c:\1rllrrl.exec:\1rllrrl.exe76⤵PID:2860
-
\??\c:\fxrfxlx.exec:\fxrfxlx.exe77⤵PID:2448
-
\??\c:\bbtbnb.exec:\bbtbnb.exe78⤵PID:2632
-
\??\c:\ntnnbh.exec:\ntnnbh.exe79⤵PID:2200
-
\??\c:\5jjjv.exec:\5jjjv.exe80⤵PID:2652
-
\??\c:\pppdp.exec:\pppdp.exe81⤵PID:320
-
\??\c:\rrffllr.exec:\rrffllr.exe82⤵PID:2800
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe83⤵PID:2764
-
\??\c:\btnnbh.exec:\btnnbh.exe84⤵PID:2584
-
\??\c:\5hbnbh.exec:\5hbnbh.exe85⤵PID:2468
-
\??\c:\vpjvv.exec:\vpjvv.exe86⤵PID:2932
-
\??\c:\vvjpd.exec:\vvjpd.exe87⤵PID:1972
-
\??\c:\lfrxfrr.exec:\lfrxfrr.exe88⤵PID:3008
-
\??\c:\flfrlxf.exec:\flfrlxf.exe89⤵PID:2872
-
\??\c:\ttnbth.exec:\ttnbth.exe90⤵PID:2936
-
\??\c:\1nhhtb.exec:\1nhhtb.exe91⤵PID:2944
-
\??\c:\5vvjp.exec:\5vvjp.exe92⤵PID:1664
-
\??\c:\pjvpj.exec:\pjvpj.exe93⤵PID:2520
-
\??\c:\llflrrf.exec:\llflrrf.exe94⤵PID:1756
-
\??\c:\rlxfllr.exec:\rlxfllr.exe95⤵PID:1988
-
\??\c:\hhhnbt.exec:\hhhnbt.exe96⤵PID:3052
-
\??\c:\hbntbb.exec:\hbntbb.exe97⤵PID:3048
-
\??\c:\jjdpj.exec:\jjdpj.exe98⤵PID:2556
-
\??\c:\pjjjp.exec:\pjjjp.exe99⤵PID:2536
-
\??\c:\rrlxlfx.exec:\rrlxlfx.exe100⤵PID:2848
-
\??\c:\fxrlxlr.exec:\fxrlxlr.exe101⤵PID:2304
-
\??\c:\bnhthn.exec:\bnhthn.exe102⤵PID:1652
-
\??\c:\1btbbb.exec:\1btbbb.exe103⤵PID:3036
-
\??\c:\pjvvv.exec:\pjvvv.exe104⤵PID:1732
-
\??\c:\ppvdv.exec:\ppvdv.exe105⤵PID:988
-
\??\c:\9fxffrf.exec:\9fxffrf.exe106⤵PID:1284
-
\??\c:\ffllxxl.exec:\ffllxxl.exe107⤵PID:2284
-
\??\c:\nnnbnt.exec:\nnnbnt.exe108⤵PID:2420
-
\??\c:\3bbthh.exec:\3bbthh.exe109⤵PID:2340
-
\??\c:\vppvp.exec:\vppvp.exe110⤵PID:588
-
\??\c:\djvvj.exec:\djvvj.exe111⤵PID:740
-
\??\c:\ffrlxfr.exec:\ffrlxfr.exe112⤵PID:1376
-
\??\c:\fxflxxl.exec:\fxflxxl.exe113⤵PID:1904
-
\??\c:\hhbtbh.exec:\hhbtbh.exe114⤵PID:2248
-
\??\c:\nhnthh.exec:\nhnthh.exe115⤵PID:2464
-
\??\c:\jjjdj.exec:\jjjdj.exe116⤵PID:880
-
\??\c:\ppjpd.exec:\ppjpd.exe117⤵PID:2732
-
\??\c:\3lflflr.exec:\3lflflr.exe118⤵PID:2632
-
\??\c:\rlxfxxx.exec:\rlxfxxx.exe119⤵PID:2900
-
\??\c:\bbbhbh.exec:\bbbhbh.exe120⤵PID:1444
-
\??\c:\bbtbnt.exec:\bbtbnt.exe121⤵PID:2852
-
\??\c:\jdvjd.exec:\jdvjd.exe122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-