Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe
-
Size
65KB
-
MD5
425d153dd998d24be8e9061f34c1a380
-
SHA1
0ad1b971c8669997acd409e09534d6ba00f4e6e4
-
SHA256
e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34
-
SHA512
8762966a6c863910bd8a232b0263633ef7c8a6c614d5c44dfb6007083a4478fdb46277848d7e256956d045f91824cb4e08ed53e6b6c83f1fb83b7de369ab39bf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxij:ymb3NkkiQ3mdBjF0y7kbA
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2120-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/372-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 xxxxxfr.exe 3000 nhtnnt.exe 3048 ppddd.exe 2636 rlxrllr.exe 2680 jjvvj.exe 2752 xxflxfl.exe 2704 hthbhn.exe 2552 jddvv.exe 2784 fxllllr.exe 480 tttbtt.exe 1276 hhntbh.exe 1956 jjddp.exe 2508 jjvdp.exe 1688 xrrrffl.exe 1968 7htttt.exe 1760 hhttnn.exe 2520 jdjpv.exe 2388 xrlxffr.exe 2404 5rffxfl.exe 1040 nnhhnn.exe 2032 nhtbnt.exe 1888 dpddd.exe 956 ffrxflr.exe 1672 xrrrxxf.exe 1792 7bnntn.exe 2264 nhntnn.exe 1488 1vpvj.exe 1212 xlxxffl.exe 2044 rfflrrx.exe 2296 rlrxxxl.exe 372 hhnnbb.exe 1656 9htttb.exe 2148 5vpjj.exe 2764 fxflrxf.exe 2092 ffxllxl.exe 2684 nhnntb.exe 2680 htbntt.exe 3064 1vvdd.exe 2348 xrrxflr.exe 2700 3xrrllf.exe 2980 pddjj.exe 2192 pjpjv.exe 2260 xrxxrll.exe 1876 lfrlrrr.exe 1896 3thhtn.exe 1660 nhhbbb.exe 1940 jdjjp.exe 2508 pjjjd.exe 1624 jdjjj.exe 1516 9flxrrr.exe 1592 rrffxrx.exe 1760 9tbhnt.exe 2600 nbhttn.exe 2392 vpppj.exe 2708 vpjjj.exe 1456 pjpdd.exe 660 fxrlrll.exe 1268 xxflxlr.exe 992 bnbbtt.exe 1432 thnhnh.exe 1576 7vddj.exe 904 vpvpp.exe 2304 xllflfx.exe 1000 lflflff.exe -
resource yara_rule behavioral1/memory/2120-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/372-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2296 2120 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 31 PID 2120 wrote to memory of 2296 2120 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 31 PID 2120 wrote to memory of 2296 2120 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 31 PID 2120 wrote to memory of 2296 2120 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 31 PID 2296 wrote to memory of 3000 2296 xxxxxfr.exe 32 PID 2296 wrote to memory of 3000 2296 xxxxxfr.exe 32 PID 2296 wrote to memory of 3000 2296 xxxxxfr.exe 32 PID 2296 wrote to memory of 3000 2296 xxxxxfr.exe 32 PID 3000 wrote to memory of 3048 3000 nhtnnt.exe 33 PID 3000 wrote to memory of 3048 3000 nhtnnt.exe 33 PID 3000 wrote to memory of 3048 3000 nhtnnt.exe 33 PID 3000 wrote to memory of 3048 3000 nhtnnt.exe 33 PID 3048 wrote to memory of 2636 3048 ppddd.exe 34 PID 3048 wrote to memory of 2636 3048 ppddd.exe 34 PID 3048 wrote to memory of 2636 3048 ppddd.exe 34 PID 3048 wrote to memory of 2636 3048 ppddd.exe 34 PID 2636 wrote to memory of 2680 2636 rlxrllr.exe 35 PID 2636 wrote to memory of 2680 2636 rlxrllr.exe 35 PID 2636 wrote to memory of 2680 2636 rlxrllr.exe 35 PID 2636 wrote to memory of 2680 2636 rlxrllr.exe 35 PID 2680 wrote to memory of 2752 2680 jjvvj.exe 36 PID 2680 wrote to memory of 2752 2680 jjvvj.exe 36 PID 2680 wrote to memory of 2752 2680 jjvvj.exe 36 PID 2680 wrote to memory of 2752 2680 jjvvj.exe 36 PID 2752 wrote to memory of 2704 2752 xxflxfl.exe 37 PID 2752 wrote to memory of 2704 2752 xxflxfl.exe 37 PID 2752 wrote to memory of 2704 2752 xxflxfl.exe 37 PID 2752 wrote to memory of 2704 2752 xxflxfl.exe 37 PID 2704 wrote to memory of 2552 2704 hthbhn.exe 38 PID 2704 wrote to memory of 2552 2704 hthbhn.exe 38 PID 2704 wrote to memory of 2552 2704 hthbhn.exe 38 PID 2704 wrote to memory of 2552 2704 hthbhn.exe 38 PID 2552 wrote to memory of 2784 2552 jddvv.exe 39 PID 2552 wrote to memory of 2784 2552 jddvv.exe 39 PID 2552 wrote to memory of 2784 2552 jddvv.exe 39 PID 2552 wrote to memory of 2784 2552 jddvv.exe 39 PID 2784 wrote to memory of 480 2784 fxllllr.exe 40 PID 2784 wrote to memory of 480 2784 fxllllr.exe 40 PID 2784 wrote to memory of 480 2784 fxllllr.exe 40 PID 2784 wrote to memory of 480 2784 fxllllr.exe 40 PID 480 wrote to memory of 1276 480 tttbtt.exe 41 PID 480 wrote to memory of 1276 480 tttbtt.exe 41 PID 480 wrote to memory of 1276 480 tttbtt.exe 41 PID 480 wrote to memory of 1276 480 tttbtt.exe 41 PID 1276 wrote to memory of 1956 1276 hhntbh.exe 42 PID 1276 wrote to memory of 1956 1276 hhntbh.exe 42 PID 1276 wrote to memory of 1956 1276 hhntbh.exe 42 PID 1276 wrote to memory of 1956 1276 hhntbh.exe 42 PID 1956 wrote to memory of 2508 1956 jjddp.exe 43 PID 1956 wrote to memory of 2508 1956 jjddp.exe 43 PID 1956 wrote to memory of 2508 1956 jjddp.exe 43 PID 1956 wrote to memory of 2508 1956 jjddp.exe 43 PID 2508 wrote to memory of 1688 2508 jjvdp.exe 44 PID 2508 wrote to memory of 1688 2508 jjvdp.exe 44 PID 2508 wrote to memory of 1688 2508 jjvdp.exe 44 PID 2508 wrote to memory of 1688 2508 jjvdp.exe 44 PID 1688 wrote to memory of 1968 1688 xrrrffl.exe 45 PID 1688 wrote to memory of 1968 1688 xrrrffl.exe 45 PID 1688 wrote to memory of 1968 1688 xrrrffl.exe 45 PID 1688 wrote to memory of 1968 1688 xrrrffl.exe 45 PID 1968 wrote to memory of 1760 1968 7htttt.exe 46 PID 1968 wrote to memory of 1760 1968 7htttt.exe 46 PID 1968 wrote to memory of 1760 1968 7htttt.exe 46 PID 1968 wrote to memory of 1760 1968 7htttt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe"C:\Users\Admin\AppData\Local\Temp\e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xxxxxfr.exec:\xxxxxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\nhtnnt.exec:\nhtnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ppddd.exec:\ppddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rlxrllr.exec:\rlxrllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jjvvj.exec:\jjvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xxflxfl.exec:\xxflxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hthbhn.exec:\hthbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jddvv.exec:\jddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\fxllllr.exec:\fxllllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tttbtt.exec:\tttbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\hhntbh.exec:\hhntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\jjddp.exec:\jjddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\jjvdp.exec:\jjvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xrrrffl.exec:\xrrrffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\7htttt.exec:\7htttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\hhttnn.exec:\hhttnn.exe17⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdjpv.exec:\jdjpv.exe18⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xrlxffr.exec:\xrlxffr.exe19⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5rffxfl.exec:\5rffxfl.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nnhhnn.exec:\nnhhnn.exe21⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nhtbnt.exec:\nhtbnt.exe22⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dpddd.exec:\dpddd.exe23⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ffrxflr.exec:\ffrxflr.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe25⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7bnntn.exec:\7bnntn.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nhntnn.exec:\nhntnn.exe27⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1vpvj.exec:\1vpvj.exe28⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xlxxffl.exec:\xlxxffl.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rfflrrx.exec:\rfflrrx.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hhnnbb.exec:\hhnnbb.exe32⤵
- Executes dropped EXE
PID:372 -
\??\c:\9htttb.exec:\9htttb.exe33⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5vpjj.exec:\5vpjj.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxflrxf.exec:\fxflrxf.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ffxllxl.exec:\ffxllxl.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nhnntb.exec:\nhnntb.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\htbntt.exec:\htbntt.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\1vvdd.exec:\1vvdd.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\xrrxflr.exec:\xrrxflr.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3xrrllf.exec:\3xrrllf.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pddjj.exec:\pddjj.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pjpjv.exec:\pjpjv.exe43⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrxxrll.exec:\xrxxrll.exe44⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe45⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3thhtn.exec:\3thhtn.exe46⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nhhbbb.exec:\nhhbbb.exe47⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdjjp.exec:\jdjjp.exe48⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjjjd.exec:\pjjjd.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jdjjj.exec:\jdjjj.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9flxrrr.exec:\9flxrrr.exe51⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rrffxrx.exec:\rrffxrx.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9tbhnt.exec:\9tbhnt.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nbhttn.exec:\nbhttn.exe54⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpppj.exec:\vpppj.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vpjjj.exec:\vpjjj.exe56⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjpdd.exec:\pjpdd.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\fxrlrll.exec:\fxrlrll.exe58⤵
- Executes dropped EXE
PID:660 -
\??\c:\xxflxlr.exec:\xxflxlr.exe59⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bnbbtt.exec:\bnbbtt.exe60⤵
- Executes dropped EXE
PID:992 -
\??\c:\thnhnh.exec:\thnhnh.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7vddj.exec:\7vddj.exe62⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vpvpp.exec:\vpvpp.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\xllflfx.exec:\xllflfx.exe64⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lflflff.exec:\lflflff.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\3nttbb.exec:\3nttbb.exe66⤵PID:488
-
\??\c:\7hnhhh.exec:\7hnhhh.exe67⤵PID:1596
-
\??\c:\thhhhb.exec:\thhhhb.exe68⤵PID:1980
-
\??\c:\1vdvv.exec:\1vdvv.exe69⤵PID:2968
-
\??\c:\pddvv.exec:\pddvv.exe70⤵PID:3000
-
\??\c:\5rlfffl.exec:\5rlfffl.exe71⤵PID:1548
-
\??\c:\xrxlrlr.exec:\xrxlrlr.exe72⤵PID:1544
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe73⤵PID:3044
-
\??\c:\tnbbhh.exec:\tnbbhh.exe74⤵PID:2168
-
\??\c:\nhhhbb.exec:\nhhhbb.exe75⤵PID:2920
-
\??\c:\jdpdv.exec:\jdpdv.exe76⤵PID:2908
-
\??\c:\vjppp.exec:\vjppp.exe77⤵PID:2692
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe78⤵
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\lflxxxf.exec:\lflxxxf.exe79⤵PID:2888
-
\??\c:\1bntbt.exec:\1bntbt.exe80⤵PID:2324
-
\??\c:\btbbhh.exec:\btbbhh.exe81⤵PID:2544
-
\??\c:\5pjjj.exec:\5pjjj.exe82⤵PID:2988
-
\??\c:\vjvpv.exec:\vjvpv.exe83⤵PID:1700
-
\??\c:\rlrlfff.exec:\rlrlfff.exe84⤵PID:1644
-
\??\c:\1rllrlr.exec:\1rllrlr.exe85⤵PID:1848
-
\??\c:\9tbbhn.exec:\9tbbhn.exe86⤵PID:1896
-
\??\c:\5hbbhn.exec:\5hbbhn.exe87⤵PID:2332
-
\??\c:\vpppp.exec:\vpppp.exe88⤵PID:1956
-
\??\c:\1pppp.exec:\1pppp.exe89⤵PID:1144
-
\??\c:\fxrxfxl.exec:\fxrxfxl.exe90⤵PID:1968
-
\??\c:\lrxfrxl.exec:\lrxfrxl.exe91⤵PID:1232
-
\??\c:\hbnhnn.exec:\hbnhnn.exe92⤵PID:2860
-
\??\c:\5bhttb.exec:\5bhttb.exe93⤵PID:2036
-
\??\c:\vjppp.exec:\vjppp.exe94⤵PID:2572
-
\??\c:\frfrrll.exec:\frfrrll.exe95⤵PID:2416
-
\??\c:\rflllrx.exec:\rflllrx.exe96⤵PID:2400
-
\??\c:\btbhhb.exec:\btbhhb.exe97⤵PID:2808
-
\??\c:\7nhttb.exec:\7nhttb.exe98⤵PID:1228
-
\??\c:\pjjpp.exec:\pjjpp.exe99⤵PID:952
-
\??\c:\vvppd.exec:\vvppd.exe100⤵PID:1684
-
\??\c:\5rxlllr.exec:\5rxlllr.exe101⤵PID:1948
-
\??\c:\xxrxxxf.exec:\xxrxxxf.exe102⤵PID:2068
-
\??\c:\9thnnt.exec:\9thnnt.exe103⤵PID:596
-
\??\c:\hhnbbb.exec:\hhnbbb.exe104⤵PID:3052
-
\??\c:\jjdpj.exec:\jjdpj.exe105⤵PID:896
-
\??\c:\3pddp.exec:\3pddp.exe106⤵PID:2164
-
\??\c:\5rxxlfl.exec:\5rxxlfl.exe107⤵PID:2044
-
\??\c:\1frxxxf.exec:\1frxxxf.exe108⤵PID:2120
-
\??\c:\hbhhhh.exec:\hbhhhh.exe109⤵PID:2108
-
\??\c:\9hbhnt.exec:\9hbhnt.exe110⤵PID:372
-
\??\c:\pjvdp.exec:\pjvdp.exe111⤵PID:2800
-
\??\c:\jdppp.exec:\jdppp.exe112⤵PID:2732
-
\??\c:\3xllrrx.exec:\3xllrrx.exe113⤵
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\rrxfrxf.exec:\rrxfrxf.exe114⤵PID:2640
-
\??\c:\thttnt.exec:\thttnt.exe115⤵PID:2688
-
\??\c:\tnbbhh.exec:\tnbbhh.exe116⤵PID:2908
-
\??\c:\btbnbb.exec:\btbnbb.exe117⤵PID:2568
-
\??\c:\jjpdp.exec:\jjpdp.exe118⤵PID:2736
-
\??\c:\pdjdd.exec:\pdjdd.exe119⤵PID:2556
-
\??\c:\ffrflrf.exec:\ffrflrf.exe120⤵PID:1852
-
\??\c:\xlrxlfl.exec:\xlrxlfl.exe121⤵PID:2576
-
\??\c:\nhhntn.exec:\nhhntn.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-