Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe
-
Size
71KB
-
MD5
97c2b47c015b7f2e0dff6dba3c36da50
-
SHA1
5d1612d3a43829242c9ef57b0cb978e6f4b84ea7
-
SHA256
18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362
-
SHA512
22d2d9a92f19e80072ccfd0f0b6879dee04124841b3917db2998b4b51d261f4fc840d7c8c8c42cc9b93090aa17e4c428c4037de0054b59e8ea37b09ed59d69b9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjJ:ymb3NkkiQ3mdBjFI4VZ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2768-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 lfxxrfx.exe 2804 htnnhh.exe 3040 3rrrfrx.exe 2776 hbthtt.exe 292 bnbhnn.exe 860 9dvjj.exe 2640 3rfflrf.exe 2068 thhnnn.exe 1744 jdddj.exe 692 xlxfxlx.exe 916 rlffxxl.exe 2600 9bnnnn.exe 1716 vvdvp.exe 604 rfrlxxf.exe 2764 rfxxxfl.exe 2008 1bnhbh.exe 2260 pjdvd.exe 2180 pppvj.exe 1960 xxffllx.exe 2128 xrrlxxl.exe 1984 hbtttb.exe 1808 jdjjj.exe 920 pjjjp.exe 2468 fffxxll.exe 1556 nhttht.exe 2316 hntnhb.exe 2320 3pvpv.exe 1824 lllfxxl.exe 1840 1xxxlrl.exe 2440 hbnnbb.exe 2760 dvjpv.exe 2944 djjvv.exe 2656 rlflxxl.exe 2812 htbhbb.exe 1760 nbhhtn.exe 2532 nhbhnt.exe 2616 9djvp.exe 292 vjvpp.exe 2396 xrffllr.exe 2920 bhhhtn.exe 2144 bhtbhh.exe 2796 jdppd.exe 1700 vvdvd.exe 1648 xlfrxll.exe 2056 xrffrxf.exe 2264 tthhhh.exe 2868 jdddj.exe 2784 pdppd.exe 712 lflfxfx.exe 2516 tnhnbb.exe 2964 hbnnhn.exe 2764 tntbtn.exe 2980 jvjvj.exe 2220 1vjpd.exe 1692 rfrxxxf.exe 1280 frfxxff.exe 1320 bbbhhn.exe 2492 hbnhtt.exe 1304 5vjjd.exe 1732 xrfrxfr.exe 964 rlfrxxf.exe 1368 hnttnn.exe 2468 tntbbh.exe 2240 5jjdd.exe -
resource yara_rule behavioral1/memory/2768-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2768 2644 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 30 PID 2644 wrote to memory of 2768 2644 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 30 PID 2644 wrote to memory of 2768 2644 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 30 PID 2644 wrote to memory of 2768 2644 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 30 PID 2768 wrote to memory of 2804 2768 lfxxrfx.exe 31 PID 2768 wrote to memory of 2804 2768 lfxxrfx.exe 31 PID 2768 wrote to memory of 2804 2768 lfxxrfx.exe 31 PID 2768 wrote to memory of 2804 2768 lfxxrfx.exe 31 PID 2804 wrote to memory of 3040 2804 htnnhh.exe 32 PID 2804 wrote to memory of 3040 2804 htnnhh.exe 32 PID 2804 wrote to memory of 3040 2804 htnnhh.exe 32 PID 2804 wrote to memory of 3040 2804 htnnhh.exe 32 PID 3040 wrote to memory of 2776 3040 3rrrfrx.exe 33 PID 3040 wrote to memory of 2776 3040 3rrrfrx.exe 33 PID 3040 wrote to memory of 2776 3040 3rrrfrx.exe 33 PID 3040 wrote to memory of 2776 3040 3rrrfrx.exe 33 PID 2776 wrote to memory of 292 2776 hbthtt.exe 34 PID 2776 wrote to memory of 292 2776 hbthtt.exe 34 PID 2776 wrote to memory of 292 2776 hbthtt.exe 34 PID 2776 wrote to memory of 292 2776 hbthtt.exe 34 PID 292 wrote to memory of 860 292 bnbhnn.exe 35 PID 292 wrote to memory of 860 292 bnbhnn.exe 35 PID 292 wrote to memory of 860 292 bnbhnn.exe 35 PID 292 wrote to memory of 860 292 bnbhnn.exe 35 PID 860 wrote to memory of 2640 860 9dvjj.exe 36 PID 860 wrote to memory of 2640 860 9dvjj.exe 36 PID 860 wrote to memory of 2640 860 9dvjj.exe 36 PID 860 wrote to memory of 2640 860 9dvjj.exe 36 PID 2640 wrote to memory of 2068 2640 3rfflrf.exe 37 PID 2640 wrote to memory of 2068 2640 3rfflrf.exe 37 PID 2640 wrote to memory of 2068 2640 3rfflrf.exe 37 PID 2640 wrote to memory of 2068 2640 3rfflrf.exe 37 PID 2068 wrote to memory of 1744 2068 thhnnn.exe 38 PID 2068 wrote to memory of 1744 2068 thhnnn.exe 38 PID 2068 wrote to memory of 1744 2068 thhnnn.exe 38 PID 2068 wrote to memory of 1744 2068 thhnnn.exe 38 PID 1744 wrote to memory of 692 1744 jdddj.exe 39 PID 1744 wrote to memory of 692 1744 jdddj.exe 39 PID 1744 wrote to memory of 692 1744 jdddj.exe 39 PID 1744 wrote to memory of 692 1744 jdddj.exe 39 PID 692 wrote to memory of 916 692 xlxfxlx.exe 40 PID 692 wrote to memory of 916 692 xlxfxlx.exe 40 PID 692 wrote to memory of 916 692 xlxfxlx.exe 40 PID 692 wrote to memory of 916 692 xlxfxlx.exe 40 PID 916 wrote to memory of 2600 916 rlffxxl.exe 41 PID 916 wrote to memory of 2600 916 rlffxxl.exe 41 PID 916 wrote to memory of 2600 916 rlffxxl.exe 41 PID 916 wrote to memory of 2600 916 rlffxxl.exe 41 PID 2600 wrote to memory of 1716 2600 9bnnnn.exe 42 PID 2600 wrote to memory of 1716 2600 9bnnnn.exe 42 PID 2600 wrote to memory of 1716 2600 9bnnnn.exe 42 PID 2600 wrote to memory of 1716 2600 9bnnnn.exe 42 PID 1716 wrote to memory of 604 1716 vvdvp.exe 43 PID 1716 wrote to memory of 604 1716 vvdvp.exe 43 PID 1716 wrote to memory of 604 1716 vvdvp.exe 43 PID 1716 wrote to memory of 604 1716 vvdvp.exe 43 PID 604 wrote to memory of 2764 604 rfrlxxf.exe 44 PID 604 wrote to memory of 2764 604 rfrlxxf.exe 44 PID 604 wrote to memory of 2764 604 rfrlxxf.exe 44 PID 604 wrote to memory of 2764 604 rfrlxxf.exe 44 PID 2764 wrote to memory of 2008 2764 rfxxxfl.exe 45 PID 2764 wrote to memory of 2008 2764 rfxxxfl.exe 45 PID 2764 wrote to memory of 2008 2764 rfxxxfl.exe 45 PID 2764 wrote to memory of 2008 2764 rfxxxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe"C:\Users\Admin\AppData\Local\Temp\18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\lfxxrfx.exec:\lfxxrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\htnnhh.exec:\htnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3rrrfrx.exec:\3rrrfrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\hbthtt.exec:\hbthtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\bnbhnn.exec:\bnbhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\9dvjj.exec:\9dvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\3rfflrf.exec:\3rfflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\thhnnn.exec:\thhnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jdddj.exec:\jdddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\xlxfxlx.exec:\xlxfxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\rlffxxl.exec:\rlffxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\9bnnnn.exec:\9bnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vvdvp.exec:\vvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\rfrlxxf.exec:\rfrlxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\1bnhbh.exec:\1bnhbh.exe17⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjdvd.exec:\pjdvd.exe18⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pppvj.exec:\pppvj.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxffllx.exec:\xxffllx.exe20⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrrlxxl.exec:\xrrlxxl.exe21⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbtttb.exec:\hbtttb.exe22⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jdjjj.exec:\jdjjj.exe23⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjjjp.exec:\pjjjp.exe24⤵
- Executes dropped EXE
PID:920 -
\??\c:\fffxxll.exec:\fffxxll.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nhttht.exec:\nhttht.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hntnhb.exec:\hntnhb.exe27⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3pvpv.exec:\3pvpv.exe28⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lllfxxl.exec:\lllfxxl.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1xxxlrl.exec:\1xxxlrl.exe30⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hbnnbb.exec:\hbnnbb.exe31⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dvjpv.exec:\dvjpv.exe32⤵
- Executes dropped EXE
PID:2760 -
\??\c:\djjvv.exec:\djjvv.exe33⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlflxxl.exec:\rlflxxl.exe34⤵
- Executes dropped EXE
PID:2656 -
\??\c:\htbhbb.exec:\htbhbb.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nbhhtn.exec:\nbhhtn.exe36⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nhbhnt.exec:\nhbhnt.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9djvp.exec:\9djvp.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vjvpp.exec:\vjvpp.exe39⤵
- Executes dropped EXE
PID:292 -
\??\c:\xrffllr.exec:\xrffllr.exe40⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bhhhtn.exec:\bhhhtn.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bhtbhh.exec:\bhtbhh.exe42⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jdppd.exec:\jdppd.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vvdvd.exec:\vvdvd.exe44⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xlfrxll.exec:\xlfrxll.exe45⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xrffrxf.exec:\xrffrxf.exe46⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tthhhh.exec:\tthhhh.exe47⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jdddj.exec:\jdddj.exe48⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pdppd.exec:\pdppd.exe49⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lflfxfx.exec:\lflfxfx.exe50⤵
- Executes dropped EXE
PID:712 -
\??\c:\tnhnbb.exec:\tnhnbb.exe51⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbnnhn.exec:\hbnnhn.exe52⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tntbtn.exec:\tntbtn.exe53⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jvjvj.exec:\jvjvj.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1vjpd.exec:\1vjpd.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe56⤵
- Executes dropped EXE
PID:1692 -
\??\c:\frfxxff.exec:\frfxxff.exe57⤵
- Executes dropped EXE
PID:1280 -
\??\c:\bbbhhn.exec:\bbbhhn.exe58⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hbnhtt.exec:\hbnhtt.exe59⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5vjjd.exec:\5vjjd.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe62⤵
- Executes dropped EXE
PID:964 -
\??\c:\hnttnn.exec:\hnttnn.exe63⤵
- Executes dropped EXE
PID:1368 -
\??\c:\tntbbh.exec:\tntbbh.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\5jjdd.exec:\5jjdd.exe65⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pdppd.exec:\pdppd.exe66⤵PID:2236
-
\??\c:\rlxflrx.exec:\rlxflrx.exe67⤵PID:2460
-
\??\c:\1fflxfl.exec:\1fflxfl.exe68⤵PID:2464
-
\??\c:\nhnhhh.exec:\nhnhhh.exe69⤵PID:1824
-
\??\c:\7bntbb.exec:\7bntbb.exe70⤵PID:1944
-
\??\c:\pjjpd.exec:\pjjpd.exe71⤵PID:2744
-
\??\c:\dvppj.exec:\dvppj.exe72⤵PID:1600
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe73⤵PID:2760
-
\??\c:\frllllr.exec:\frllllr.exe74⤵PID:2372
-
\??\c:\xrxxllr.exec:\xrxxllr.exe75⤵PID:2560
-
\??\c:\nhnntn.exec:\nhnntn.exe76⤵PID:2592
-
\??\c:\tnbntn.exec:\tnbntn.exe77⤵PID:2552
-
\??\c:\vpjjp.exec:\vpjjp.exe78⤵PID:2548
-
\??\c:\jdvdj.exec:\jdvdj.exe79⤵PID:2168
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe80⤵PID:2900
-
\??\c:\lrlfrrf.exec:\lrlfrrf.exe81⤵PID:3028
-
\??\c:\hbtbbh.exec:\hbtbbh.exe82⤵PID:2920
-
\??\c:\bhthbh.exec:\bhthbh.exe83⤵PID:2628
-
\??\c:\tntbhn.exec:\tntbhn.exe84⤵PID:584
-
\??\c:\3jpvd.exec:\3jpvd.exe85⤵PID:1160
-
\??\c:\dvdvj.exec:\dvdvj.exe86⤵PID:1648
-
\??\c:\7xxxrxr.exec:\7xxxrxr.exe87⤵PID:2348
-
\??\c:\rlrflll.exec:\rlrflll.exe88⤵PID:2264
-
\??\c:\hhbnbh.exec:\hhbnbh.exe89⤵PID:2888
-
\??\c:\bthttt.exec:\bthttt.exe90⤵PID:1724
-
\??\c:\tnbhnt.exec:\tnbhnt.exe91⤵PID:2956
-
\??\c:\pjjjv.exec:\pjjjv.exe92⤵PID:2516
-
\??\c:\jddpv.exec:\jddpv.exe93⤵PID:1856
-
\??\c:\xrffllr.exec:\xrffllr.exe94⤵
- System Location Discovery: System Language Discovery
PID:1880 -
\??\c:\7xxxfrx.exec:\7xxxfrx.exe95⤵PID:1240
-
\??\c:\7llfffx.exec:\7llfffx.exe96⤵PID:2220
-
\??\c:\tnhtbb.exec:\tnhtbb.exe97⤵PID:2100
-
\??\c:\bthnbb.exec:\bthnbb.exe98⤵PID:1280
-
\??\c:\pjvvv.exec:\pjvvv.exe99⤵PID:2416
-
\??\c:\9jdjj.exec:\9jdjj.exe100⤵PID:2492
-
\??\c:\ppdjj.exec:\ppdjj.exe101⤵PID:888
-
\??\c:\fxxxffl.exec:\fxxxffl.exe102⤵PID:1732
-
\??\c:\9ffllxf.exec:\9ffllxf.exe103⤵PID:1244
-
\??\c:\nhbbhn.exec:\nhbbhn.exe104⤵PID:1536
-
\??\c:\5htthn.exec:\5htthn.exe105⤵PID:2468
-
\??\c:\5bhhhh.exec:\5bhhhh.exe106⤵PID:2240
-
\??\c:\vpddv.exec:\vpddv.exe107⤵PID:2236
-
\??\c:\pvjjj.exec:\pvjjj.exe108⤵PID:900
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe109⤵PID:2464
-
\??\c:\9xllrrf.exec:\9xllrrf.exe110⤵PID:1824
-
\??\c:\1bttbb.exec:\1bttbb.exe111⤵PID:1944
-
\??\c:\hbnnnn.exec:\hbnnnn.exe112⤵PID:2744
-
\??\c:\bbbhnh.exec:\bbbhnh.exe113⤵PID:2832
-
\??\c:\3jvvd.exec:\3jvvd.exe114⤵PID:2768
-
\??\c:\vvvjd.exec:\vvvjd.exe115⤵PID:1528
-
\??\c:\pjvdv.exec:\pjvdv.exe116⤵PID:2880
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe117⤵PID:2592
-
\??\c:\llxfflr.exec:\llxfflr.exe118⤵PID:2552
-
\??\c:\tthnbh.exec:\tthnbh.exe119⤵PID:2208
-
\??\c:\7hbbnt.exec:\7hbbnt.exe120⤵PID:1664
-
\??\c:\htntbn.exec:\htntbn.exe121⤵PID:2576
-
\??\c:\1pddd.exec:\1pddd.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-