Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe
-
Size
59KB
-
MD5
ece37d2d6974195c7560b88da01d4d40
-
SHA1
38787fdd246f3dabd9609b866043c9672dd1f565
-
SHA256
7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33
-
SHA512
f353acd0f7dcf9afe75791cdfb0ba1b4bd36b41ab60fce56b6337ed24d583ca9aef7ad36e9ca378d5a5b350e9f4e5c12a675faa1d36c18a66d73e7212830a7ab
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFaEud:ymb3NkkiQ3mdBjFIvIFaEQ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2516-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2992 tbhtth.exe 1652 vjppj.exe 2844 xrlrxxr.exe 1552 nbhnbb.exe 2784 vjvdd.exe 2848 ddjjj.exe 2912 rllrxfr.exe 2628 xlrfllf.exe 2656 nhhnbh.exe 1812 dvjjp.exe 1852 9dpdd.exe 2032 xlrrxfl.exe 1600 xrlxflx.exe 2416 tnbbtt.exe 348 7ppdp.exe 1440 vpjdv.exe 2892 xrrlllx.exe 2972 rlrllrf.exe 2940 tbnhnh.exe 3056 tnbntn.exe 1980 jdppp.exe 1996 pjjpj.exe 1572 lxfrrrr.exe 1856 9hbbtb.exe 1052 5bhntt.exe 556 djvdj.exe 1728 rlxflrx.exe 1944 3bbhbh.exe 1816 vvjjp.exe 2376 jvjdp.exe 1512 xrxfllx.exe 2548 frflrlx.exe 2660 nnttbh.exe 2428 hthtbh.exe 2728 dpvvj.exe 2800 dpjjv.exe 3004 7rffrxf.exe 2712 ffxllxl.exe 2840 hthhtt.exe 2716 7tbbhb.exe 2796 ddjpd.exe 2644 vjppp.exe 2132 lxflrxf.exe 2420 3frxllr.exe 2164 nnhthh.exe 2568 httntt.exe 1540 vjddd.exe 2648 vpjjd.exe 1428 rlxflfl.exe 1864 lrlxxxf.exe 1532 nhnbhn.exe 1340 tnbhbb.exe 2888 7tnbhn.exe 2200 dvjpp.exe 2668 jdpvd.exe 2256 5rfffll.exe 1656 lflrxrx.exe 1964 rfxrxxf.exe 928 nhtbbn.exe 1212 3jpjp.exe 2352 vpvdj.exe 612 7vjjv.exe 1492 fxlfrrx.exe 2460 rffxxxf.exe -
resource yara_rule behavioral1/memory/2516-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2992 2516 7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe 31 PID 2516 wrote to memory of 2992 2516 7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe 31 PID 2516 wrote to memory of 2992 2516 7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe 31 PID 2516 wrote to memory of 2992 2516 7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe 31 PID 2992 wrote to memory of 1652 2992 tbhtth.exe 32 PID 2992 wrote to memory of 1652 2992 tbhtth.exe 32 PID 2992 wrote to memory of 1652 2992 tbhtth.exe 32 PID 2992 wrote to memory of 1652 2992 tbhtth.exe 32 PID 1652 wrote to memory of 2844 1652 vjppj.exe 33 PID 1652 wrote to memory of 2844 1652 vjppj.exe 33 PID 1652 wrote to memory of 2844 1652 vjppj.exe 33 PID 1652 wrote to memory of 2844 1652 vjppj.exe 33 PID 2844 wrote to memory of 1552 2844 xrlrxxr.exe 34 PID 2844 wrote to memory of 1552 2844 xrlrxxr.exe 34 PID 2844 wrote to memory of 1552 2844 xrlrxxr.exe 34 PID 2844 wrote to memory of 1552 2844 xrlrxxr.exe 34 PID 1552 wrote to memory of 2784 1552 nbhnbb.exe 35 PID 1552 wrote to memory of 2784 1552 nbhnbb.exe 35 PID 1552 wrote to memory of 2784 1552 nbhnbb.exe 35 PID 1552 wrote to memory of 2784 1552 nbhnbb.exe 35 PID 2784 wrote to memory of 2848 2784 vjvdd.exe 36 PID 2784 wrote to memory of 2848 2784 vjvdd.exe 36 PID 2784 wrote to memory of 2848 2784 vjvdd.exe 36 PID 2784 wrote to memory of 2848 2784 vjvdd.exe 36 PID 2848 wrote to memory of 2912 2848 ddjjj.exe 37 PID 2848 wrote to memory of 2912 2848 ddjjj.exe 37 PID 2848 wrote to memory of 2912 2848 ddjjj.exe 37 PID 2848 wrote to memory of 2912 2848 ddjjj.exe 37 PID 2912 wrote to memory of 2628 2912 rllrxfr.exe 38 PID 2912 wrote to memory of 2628 2912 rllrxfr.exe 38 PID 2912 wrote to memory of 2628 2912 rllrxfr.exe 38 PID 2912 wrote to memory of 2628 2912 rllrxfr.exe 38 PID 2628 wrote to memory of 2656 2628 xlrfllf.exe 39 PID 2628 wrote to memory of 2656 2628 xlrfllf.exe 39 PID 2628 wrote to memory of 2656 2628 xlrfllf.exe 39 PID 2628 wrote to memory of 2656 2628 xlrfllf.exe 39 PID 2656 wrote to memory of 1812 2656 nhhnbh.exe 40 PID 2656 wrote to memory of 1812 2656 nhhnbh.exe 40 PID 2656 wrote to memory of 1812 2656 nhhnbh.exe 40 PID 2656 wrote to memory of 1812 2656 nhhnbh.exe 40 PID 1812 wrote to memory of 1852 1812 dvjjp.exe 41 PID 1812 wrote to memory of 1852 1812 dvjjp.exe 41 PID 1812 wrote to memory of 1852 1812 dvjjp.exe 41 PID 1812 wrote to memory of 1852 1812 dvjjp.exe 41 PID 1852 wrote to memory of 2032 1852 9dpdd.exe 42 PID 1852 wrote to memory of 2032 1852 9dpdd.exe 42 PID 1852 wrote to memory of 2032 1852 9dpdd.exe 42 PID 1852 wrote to memory of 2032 1852 9dpdd.exe 42 PID 2032 wrote to memory of 1600 2032 xlrrxfl.exe 43 PID 2032 wrote to memory of 1600 2032 xlrrxfl.exe 43 PID 2032 wrote to memory of 1600 2032 xlrrxfl.exe 43 PID 2032 wrote to memory of 1600 2032 xlrrxfl.exe 43 PID 1600 wrote to memory of 2416 1600 xrlxflx.exe 44 PID 1600 wrote to memory of 2416 1600 xrlxflx.exe 44 PID 1600 wrote to memory of 2416 1600 xrlxflx.exe 44 PID 1600 wrote to memory of 2416 1600 xrlxflx.exe 44 PID 2416 wrote to memory of 348 2416 tnbbtt.exe 45 PID 2416 wrote to memory of 348 2416 tnbbtt.exe 45 PID 2416 wrote to memory of 348 2416 tnbbtt.exe 45 PID 2416 wrote to memory of 348 2416 tnbbtt.exe 45 PID 348 wrote to memory of 1440 348 7ppdp.exe 46 PID 348 wrote to memory of 1440 348 7ppdp.exe 46 PID 348 wrote to memory of 1440 348 7ppdp.exe 46 PID 348 wrote to memory of 1440 348 7ppdp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe"C:\Users\Admin\AppData\Local\Temp\7ab2667c4278b21e397dd1ca2620639067f7a61d253652b9c2ef78601cebca33N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tbhtth.exec:\tbhtth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vjppj.exec:\vjppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nbhnbb.exec:\nbhnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\vjvdd.exec:\vjvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ddjjj.exec:\ddjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rllrxfr.exec:\rllrxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xlrfllf.exec:\xlrfllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\nhhnbh.exec:\nhhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dvjjp.exec:\dvjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\9dpdd.exec:\9dpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xlrrxfl.exec:\xlrrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xrlxflx.exec:\xrlxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\tnbbtt.exec:\tnbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\7ppdp.exec:\7ppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\vpjdv.exec:\vpjdv.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xrrlllx.exec:\xrrlllx.exe18⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlrllrf.exec:\rlrllrf.exe19⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tbnhnh.exec:\tbnhnh.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnbntn.exec:\tnbntn.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\jdppp.exec:\jdppp.exe22⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pjjpj.exec:\pjjpj.exe23⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lxfrrrr.exec:\lxfrrrr.exe24⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9hbbtb.exec:\9hbbtb.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5bhntt.exec:\5bhntt.exe26⤵
- Executes dropped EXE
PID:1052 -
\??\c:\djvdj.exec:\djvdj.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:556 -
\??\c:\rlxflrx.exec:\rlxflrx.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3bbhbh.exec:\3bbhbh.exe29⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vvjjp.exec:\vvjjp.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jvjdp.exec:\jvjdp.exe31⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xrxfllx.exec:\xrxfllx.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\frflrlx.exec:\frflrlx.exe33⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nnttbh.exec:\nnttbh.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hthtbh.exec:\hthtbh.exe35⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dpvvj.exec:\dpvvj.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dpjjv.exec:\dpjjv.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7rffrxf.exec:\7rffrxf.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\ffxllxl.exec:\ffxllxl.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hthhtt.exec:\hthhtt.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7tbbhb.exec:\7tbbhb.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ddjpd.exec:\ddjpd.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjppp.exec:\vjppp.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lxflrxf.exec:\lxflrxf.exe44⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3frxllr.exec:\3frxllr.exe45⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nnhthh.exec:\nnhthh.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\httntt.exec:\httntt.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vjddd.exec:\vjddd.exe48⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpjjd.exec:\vpjjd.exe49⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rlxflfl.exec:\rlxflfl.exe50⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lrlxxxf.exec:\lrlxxxf.exe51⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nhnbhn.exec:\nhnbhn.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tnbhbb.exec:\tnbhbb.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\7tnbhn.exec:\7tnbhn.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvjpp.exec:\dvjpp.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdpvd.exec:\jdpvd.exe56⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5rfffll.exec:\5rfffll.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lflrxrx.exec:\lflrxrx.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhtbbn.exec:\nhtbbn.exe60⤵
- Executes dropped EXE
PID:928 -
\??\c:\3jpjp.exec:\3jpjp.exe61⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vpvdj.exec:\vpvdj.exe62⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7vjjv.exec:\7vjjv.exe63⤵
- Executes dropped EXE
PID:612 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe64⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rffxxxf.exec:\rffxxxf.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\btbnbn.exec:\btbnbn.exe66⤵PID:1208
-
\??\c:\3nbtbt.exec:\3nbtbt.exe67⤵PID:944
-
\??\c:\jdjpp.exec:\jdjpp.exe68⤵PID:2456
-
\??\c:\pvvvp.exec:\pvvvp.exe69⤵PID:2384
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe70⤵PID:1516
-
\??\c:\1rfffxl.exec:\1rfffxl.exe71⤵PID:836
-
\??\c:\frlrxfx.exec:\frlrxfx.exe72⤵PID:1164
-
\??\c:\btbhnn.exec:\btbhnn.exe73⤵PID:1632
-
\??\c:\thbbnn.exec:\thbbnn.exe74⤵PID:2024
-
\??\c:\5dppv.exec:\5dppv.exe75⤵PID:2804
-
\??\c:\djddj.exec:\djddj.exe76⤵PID:2820
-
\??\c:\7rflrxl.exec:\7rflrxl.exe77⤵PID:2704
-
\??\c:\lfrxflr.exec:\lfrxflr.exe78⤵PID:2684
-
\??\c:\nbbbhh.exec:\nbbbhh.exe79⤵PID:2808
-
\??\c:\nhntbb.exec:\nhntbb.exe80⤵PID:2948
-
\??\c:\pjpvd.exec:\pjpvd.exe81⤵PID:2828
-
\??\c:\dvppv.exec:\dvppv.exe82⤵PID:2752
-
\??\c:\fxxfxxl.exec:\fxxfxxl.exe83⤵PID:2160
-
\??\c:\rlxflrx.exec:\rlxflrx.exe84⤵PID:2132
-
\??\c:\tthnbh.exec:\tthnbh.exe85⤵PID:1812
-
\??\c:\bnbhhh.exec:\bnbhhh.exe86⤵PID:1460
-
\??\c:\dvjpj.exec:\dvjpj.exe87⤵PID:340
-
\??\c:\3jpvv.exec:\3jpvv.exe88⤵PID:2920
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe89⤵PID:2648
-
\??\c:\xlxffxl.exec:\xlxffxl.exe90⤵PID:2136
-
\??\c:\thtbbb.exec:\thtbbb.exe91⤵PID:1792
-
\??\c:\9nhntb.exec:\9nhntb.exe92⤵PID:1236
-
\??\c:\nttbbt.exec:\nttbbt.exe93⤵PID:2756
-
\??\c:\vjvdp.exec:\vjvdp.exe94⤵PID:2272
-
\??\c:\pdpdv.exec:\pdpdv.exe95⤵PID:112
-
\??\c:\frrrlll.exec:\frrrlll.exe96⤵PID:2972
-
\??\c:\3frxfff.exec:\3frxfff.exe97⤵PID:1224
-
\??\c:\bbnbth.exec:\bbnbth.exe98⤵PID:2964
-
\??\c:\nbtbtb.exec:\nbtbtb.exe99⤵PID:1888
-
\??\c:\pjpdj.exec:\pjpdj.exe100⤵PID:952
-
\??\c:\1djjj.exec:\1djjj.exe101⤵PID:980
-
\??\c:\llxlxrf.exec:\llxlxrf.exe102⤵PID:1828
-
\??\c:\lflxffl.exec:\lflxffl.exe103⤵PID:1672
-
\??\c:\bntnhn.exec:\bntnhn.exe104⤵PID:1492
-
\??\c:\thhbhh.exec:\thhbhh.exe105⤵PID:2464
-
\??\c:\ttnnnt.exec:\ttnnnt.exe106⤵PID:1780
-
\??\c:\jvvvv.exec:\jvvvv.exe107⤵PID:1944
-
\??\c:\5vppv.exec:\5vppv.exe108⤵PID:1816
-
\??\c:\xrxrlrx.exec:\xrxrlrx.exe109⤵PID:1620
-
\??\c:\1rflxxr.exec:\1rflxxr.exe110⤵PID:1616
-
\??\c:\tnnhhn.exec:\tnnhhn.exe111⤵PID:2120
-
\??\c:\bbntbb.exec:\bbntbb.exe112⤵PID:2992
-
\??\c:\dpvvd.exec:\dpvvd.exe113⤵PID:2000
-
\??\c:\jjpvp.exec:\jjpvp.exe114⤵PID:2660
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe115⤵PID:2728
-
\??\c:\1lxxffr.exec:\1lxxffr.exe116⤵PID:2792
-
\??\c:\btbhnn.exec:\btbhnn.exe117⤵PID:2832
-
\??\c:\hbnttb.exec:\hbnttb.exe118⤵PID:3004
-
\??\c:\pdddd.exec:\pdddd.exe119⤵PID:2748
-
\??\c:\1vvjv.exec:\1vvjv.exe120⤵PID:2212
-
\??\c:\7xlllrl.exec:\7xlllrl.exe121⤵PID:2632
-
\??\c:\rxfxxxf.exec:\rxfxxxf.exe122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-