Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe
-
Size
106KB
-
MD5
2242ae4a33111e3f17801b2528169300
-
SHA1
3a16c47aeac70b4170ef5fc6e08e140bd3786bc7
-
SHA256
be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5
-
SHA512
4608184fd314f226d52eb84d6eac49cf8cf943e29ef9dd698b95cb488d90b67a139021f565438c0945624d002c843a04cf9da0883dbe0bec9c23220fcbffbcd8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CAZ:n3C9BRo7MlrWKVT+buBGu3Pl
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2404-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2764 7nnthh.exe 2684 dpdvd.exe 2880 vppjj.exe 2724 fxflxfr.exe 2572 rllrlrr.exe 3064 bbtbtt.exe 1620 vjppp.exe 2896 hthbhh.exe 3048 7htttt.exe 1640 vpjvd.exe 1660 rlxfllr.exe 1648 nbhbhb.exe 2016 btbhnb.exe 2884 pjdjj.exe 2928 xrflrxf.exe 1584 xrxfllx.exe 2996 hbbbnh.exe 2168 jjdjv.exe 2208 xrlrxxf.exe 2228 3lfflrf.exe 2388 bnbbbb.exe 2496 7vpdj.exe 2520 9xrrxrf.exe 792 5xxrxfl.exe 2272 7nbnhh.exe 2320 hnbnbb.exe 2100 ddppv.exe 1204 ffxllrx.exe 552 nhthnt.exe 2856 3nbtnn.exe 2776 jdpvp.exe 1576 dpdpd.exe 2984 9flrfrx.exe 2880 hnnhhh.exe 2600 btbbhn.exe 2572 hbnntb.exe 1352 ddvjp.exe 2560 pjpdj.exe 2728 fxrfllx.exe 864 fxllrrx.exe 1620 7hthhh.exe 3052 hhtbnh.exe 2744 vvjvd.exe 2440 1pdjp.exe 1052 5rlxllr.exe 2544 fxrlxxl.exe 2020 nnhtbh.exe 1100 tnbhnn.exe 2368 tnhhnt.exe 2876 1jpdp.exe 2372 5jddp.exe 2376 fxrrxfl.exe 2384 7xfxrfr.exe 2216 3rxlxfl.exe 1488 nnhtbb.exe 1844 btbhhh.exe 2396 1vppp.exe 1160 vpjvv.exe 836 lfrrxxr.exe 1516 fxrflrl.exe 1020 1nnhbn.exe 2656 dvddp.exe 1560 7jddd.exe 1688 rfxlfll.exe -
resource yara_rule behavioral1/memory/2404-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2764 2404 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 31 PID 2404 wrote to memory of 2764 2404 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 31 PID 2404 wrote to memory of 2764 2404 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 31 PID 2404 wrote to memory of 2764 2404 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 31 PID 2764 wrote to memory of 2684 2764 7nnthh.exe 32 PID 2764 wrote to memory of 2684 2764 7nnthh.exe 32 PID 2764 wrote to memory of 2684 2764 7nnthh.exe 32 PID 2764 wrote to memory of 2684 2764 7nnthh.exe 32 PID 2684 wrote to memory of 2880 2684 dpdvd.exe 33 PID 2684 wrote to memory of 2880 2684 dpdvd.exe 33 PID 2684 wrote to memory of 2880 2684 dpdvd.exe 33 PID 2684 wrote to memory of 2880 2684 dpdvd.exe 33 PID 2880 wrote to memory of 2724 2880 vppjj.exe 34 PID 2880 wrote to memory of 2724 2880 vppjj.exe 34 PID 2880 wrote to memory of 2724 2880 vppjj.exe 34 PID 2880 wrote to memory of 2724 2880 vppjj.exe 34 PID 2724 wrote to memory of 2572 2724 fxflxfr.exe 35 PID 2724 wrote to memory of 2572 2724 fxflxfr.exe 35 PID 2724 wrote to memory of 2572 2724 fxflxfr.exe 35 PID 2724 wrote to memory of 2572 2724 fxflxfr.exe 35 PID 2572 wrote to memory of 3064 2572 rllrlrr.exe 36 PID 2572 wrote to memory of 3064 2572 rllrlrr.exe 36 PID 2572 wrote to memory of 3064 2572 rllrlrr.exe 36 PID 2572 wrote to memory of 3064 2572 rllrlrr.exe 36 PID 3064 wrote to memory of 1620 3064 bbtbtt.exe 37 PID 3064 wrote to memory of 1620 3064 bbtbtt.exe 37 PID 3064 wrote to memory of 1620 3064 bbtbtt.exe 37 PID 3064 wrote to memory of 1620 3064 bbtbtt.exe 37 PID 1620 wrote to memory of 2896 1620 vjppp.exe 38 PID 1620 wrote to memory of 2896 1620 vjppp.exe 38 PID 1620 wrote to memory of 2896 1620 vjppp.exe 38 PID 1620 wrote to memory of 2896 1620 vjppp.exe 38 PID 2896 wrote to memory of 3048 2896 hthbhh.exe 39 PID 2896 wrote to memory of 3048 2896 hthbhh.exe 39 PID 2896 wrote to memory of 3048 2896 hthbhh.exe 39 PID 2896 wrote to memory of 3048 2896 hthbhh.exe 39 PID 3048 wrote to memory of 1640 3048 7htttt.exe 40 PID 3048 wrote to memory of 1640 3048 7htttt.exe 40 PID 3048 wrote to memory of 1640 3048 7htttt.exe 40 PID 3048 wrote to memory of 1640 3048 7htttt.exe 40 PID 1640 wrote to memory of 1660 1640 vpjvd.exe 41 PID 1640 wrote to memory of 1660 1640 vpjvd.exe 41 PID 1640 wrote to memory of 1660 1640 vpjvd.exe 41 PID 1640 wrote to memory of 1660 1640 vpjvd.exe 41 PID 1660 wrote to memory of 1648 1660 rlxfllr.exe 42 PID 1660 wrote to memory of 1648 1660 rlxfllr.exe 42 PID 1660 wrote to memory of 1648 1660 rlxfllr.exe 42 PID 1660 wrote to memory of 1648 1660 rlxfllr.exe 42 PID 1648 wrote to memory of 2016 1648 nbhbhb.exe 43 PID 1648 wrote to memory of 2016 1648 nbhbhb.exe 43 PID 1648 wrote to memory of 2016 1648 nbhbhb.exe 43 PID 1648 wrote to memory of 2016 1648 nbhbhb.exe 43 PID 2016 wrote to memory of 2884 2016 btbhnb.exe 44 PID 2016 wrote to memory of 2884 2016 btbhnb.exe 44 PID 2016 wrote to memory of 2884 2016 btbhnb.exe 44 PID 2016 wrote to memory of 2884 2016 btbhnb.exe 44 PID 2884 wrote to memory of 2928 2884 pjdjj.exe 45 PID 2884 wrote to memory of 2928 2884 pjdjj.exe 45 PID 2884 wrote to memory of 2928 2884 pjdjj.exe 45 PID 2884 wrote to memory of 2928 2884 pjdjj.exe 45 PID 2928 wrote to memory of 1584 2928 xrflrxf.exe 46 PID 2928 wrote to memory of 1584 2928 xrflrxf.exe 46 PID 2928 wrote to memory of 1584 2928 xrflrxf.exe 46 PID 2928 wrote to memory of 1584 2928 xrflrxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe"C:\Users\Admin\AppData\Local\Temp\be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\7nnthh.exec:\7nnthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dpdvd.exec:\dpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vppjj.exec:\vppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxflxfr.exec:\fxflxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rllrlrr.exec:\rllrlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbtbtt.exec:\bbtbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vjppp.exec:\vjppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hthbhh.exec:\hthbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\7htttt.exec:\7htttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vpjvd.exec:\vpjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\rlxfllr.exec:\rlxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\nbhbhb.exec:\nbhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\btbhnb.exec:\btbhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\pjdjj.exec:\pjdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xrflrxf.exec:\xrflrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xrxfllx.exec:\xrxfllx.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hbbbnh.exec:\hbbbnh.exe18⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjdjv.exec:\jjdjv.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3lfflrf.exec:\3lfflrf.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bnbbbb.exec:\bnbbbb.exe22⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7vpdj.exec:\7vpdj.exe23⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9xrrxrf.exec:\9xrrxrf.exe24⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5xxrxfl.exec:\5xxrxfl.exe25⤵
- Executes dropped EXE
PID:792 -
\??\c:\7nbnhh.exec:\7nbnhh.exe26⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hnbnbb.exec:\hnbnbb.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ddppv.exec:\ddppv.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ffxllrx.exec:\ffxllrx.exe29⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nhthnt.exec:\nhthnt.exe30⤵
- Executes dropped EXE
PID:552 -
\??\c:\3nbtnn.exec:\3nbtnn.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jdpvp.exec:\jdpvp.exe32⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpdpd.exec:\dpdpd.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9flrfrx.exec:\9flrfrx.exe34⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hnnhhh.exec:\hnnhhh.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btbbhn.exec:\btbbhn.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\hbnntb.exec:\hbnntb.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ddvjp.exec:\ddvjp.exe38⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pjpdj.exec:\pjpdj.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxrfllx.exec:\fxrfllx.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxllrrx.exec:\fxllrrx.exe41⤵
- Executes dropped EXE
PID:864 -
\??\c:\7hthhh.exec:\7hthhh.exe42⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hhtbnh.exec:\hhtbnh.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vvjvd.exec:\vvjvd.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1pdjp.exec:\1pdjp.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5rlxllr.exec:\5rlxllr.exe46⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nnhtbh.exec:\nnhtbh.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnbhnn.exec:\tnbhnn.exe49⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tnhhnt.exec:\tnhhnt.exe50⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1jpdp.exec:\1jpdp.exe51⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5jddp.exec:\5jddp.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7xfxrfr.exec:\7xfxrfr.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3rxlxfl.exec:\3rxlxfl.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nnhtbb.exec:\nnhtbb.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\btbhhh.exec:\btbhhh.exe57⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1vppp.exec:\1vppp.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vpjvv.exec:\vpjvv.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe60⤵
- Executes dropped EXE
PID:836 -
\??\c:\fxrflrl.exec:\fxrflrl.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1nnhbn.exec:\1nnhbn.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dvddp.exec:\dvddp.exe63⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7jddd.exec:\7jddd.exe64⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rfxlfll.exec:\rfxlfll.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxrfrxx.exec:\fxrfrxx.exe66⤵PID:1092
-
\??\c:\3bnbbh.exec:\3bnbbh.exe67⤵PID:1364
-
\??\c:\5hnbnb.exec:\5hnbnb.exe68⤵PID:2132
-
\??\c:\vpvvv.exec:\vpvvv.exe69⤵PID:2716
-
\??\c:\lfllrlx.exec:\lfllrlx.exe70⤵PID:2856
-
\??\c:\1rxlrrf.exec:\1rxlrrf.exe71⤵PID:1592
-
\??\c:\7tnntn.exec:\7tnntn.exe72⤵PID:2152
-
\??\c:\nhtntt.exec:\nhtntt.exe73⤵PID:2864
-
\??\c:\vpvdj.exec:\vpvdj.exe74⤵PID:2828
-
\??\c:\vpvvd.exec:\vpvvd.exe75⤵PID:2720
-
\??\c:\vpjpp.exec:\vpjpp.exe76⤵PID:2604
-
\??\c:\fxrfflx.exec:\fxrfflx.exe77⤵PID:2224
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe78⤵PID:2220
-
\??\c:\nhbntt.exec:\nhbntt.exe79⤵PID:324
-
\??\c:\tntthh.exec:\tntthh.exe80⤵PID:2736
-
\??\c:\pjdpp.exec:\pjdpp.exe81⤵PID:1468
-
\??\c:\jdpvv.exec:\jdpvv.exe82⤵PID:2124
-
\??\c:\5xlrxfx.exec:\5xlrxfx.exe83⤵PID:3036
-
\??\c:\5llrxfl.exec:\5llrxfl.exe84⤵PID:2356
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe85⤵PID:304
-
\??\c:\thtbhh.exec:\thtbhh.exe86⤵PID:2812
-
\??\c:\tntbht.exec:\tntbht.exe87⤵PID:588
-
\??\c:\dddvv.exec:\dddvv.exe88⤵PID:2868
-
\??\c:\5ppdj.exec:\5ppdj.exe89⤵PID:2648
-
\??\c:\1fxfllr.exec:\1fxfllr.exe90⤵PID:1196
-
\??\c:\lfllxxl.exec:\lfllxxl.exe91⤵PID:604
-
\??\c:\5tntbb.exec:\5tntbb.exe92⤵PID:2372
-
\??\c:\tthnbh.exec:\tthnbh.exe93⤵PID:2212
-
\??\c:\5vdvj.exec:\5vdvj.exe94⤵PID:2384
-
\??\c:\vpddj.exec:\vpddj.exe95⤵PID:1856
-
\??\c:\fxrfffl.exec:\fxrfffl.exe96⤵PID:2424
-
\??\c:\rrxfxll.exec:\rrxfxll.exe97⤵PID:1980
-
\??\c:\lfffxfr.exec:\lfffxfr.exe98⤵PID:2140
-
\??\c:\ttnnbb.exec:\ttnnbb.exe99⤵PID:2484
-
\??\c:\nhbntb.exec:\nhbntb.exe100⤵PID:1548
-
\??\c:\tnbbbb.exec:\tnbbbb.exe101⤵PID:2808
-
\??\c:\dvddj.exec:\dvddj.exe102⤵PID:2128
-
\??\c:\ppddv.exec:\ppddv.exe103⤵PID:3024
-
\??\c:\xrfllfl.exec:\xrfllfl.exe104⤵PID:2328
-
\??\c:\lxllrrx.exec:\lxllrrx.exe105⤵PID:2100
-
\??\c:\nnhtbh.exec:\nnhtbh.exe106⤵PID:1092
-
\??\c:\1bhbhh.exec:\1bhbhh.exe107⤵PID:2104
-
\??\c:\vpdpp.exec:\vpdpp.exe108⤵PID:2480
-
\??\c:\pvdjv.exec:\pvdjv.exe109⤵PID:2704
-
\??\c:\5ddvd.exec:\5ddvd.exe110⤵PID:2776
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe111⤵PID:2684
-
\??\c:\xlxfrrr.exec:\xlxfrrr.exe112⤵PID:2840
-
\??\c:\7thbhh.exec:\7thbhh.exe113⤵PID:2672
-
\??\c:\bbthnh.exec:\bbthnh.exe114⤵PID:2836
-
\??\c:\jdppv.exec:\jdppv.exe115⤵PID:2632
-
\??\c:\3dvdp.exec:\3dvdp.exe116⤵PID:2712
-
\??\c:\ffxxflf.exec:\ffxxflf.exe117⤵PID:3064
-
\??\c:\fxfllxl.exec:\fxfllxl.exe118⤵PID:3056
-
\??\c:\3nthnt.exec:\3nthnt.exe119⤵PID:1068
-
\??\c:\tthbhn.exec:\tthbhn.exe120⤵PID:1468
-
\??\c:\5nbnnn.exec:\5nbnnn.exe121⤵PID:1800
-
\??\c:\vvvdp.exec:\vvvdp.exe122⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-