Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe
-
Size
249KB
-
MD5
68ab2052237d995237fa27851619511b
-
SHA1
01e3f308d9cc1c47158730d39a445ec149f3a9dd
-
SHA256
ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b
-
SHA512
45e0b28bf9ae053d8350ea891bd101d44e68008b2350112ac16558b8d0c10e27dc664c351cdb9a54c7d515b9d5addf097b2ac860527900171b399673df638479
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRlRg:n3C9uD6AUDCa4NYmRDg
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/632-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/632-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1204 9lxrllr.exe 2480 9pjpd.exe 2800 rffxfxl.exe 2756 nnnnhn.exe 2820 dpvvj.exe 2804 frxxxfl.exe 2784 5tnnbb.exe 2728 vjjpd.exe 2688 9httbb.exe 2504 7thhtt.exe 2792 vpvvd.exe 532 9bnhhn.exe 1524 ddjjp.exe 2704 7djvv.exe 1016 rrxllrl.exe 2308 5dpvj.exe 2212 fxllrxf.exe 2120 rlrrrxf.exe 580 bbtbhn.exe 1592 jvvvj.exe 316 fxlxffl.exe 808 htbtbt.exe 3000 1vpvd.exe 2564 xrxxfxf.exe 2196 ttbbnn.exe 1716 dvjpv.exe 2408 rfrlxxx.exe 1072 xrfrxrx.exe 2588 jdppv.exe 1604 rfrlxxl.exe 3032 xrrllrf.exe 2404 7bnnnt.exe 1568 ddjdd.exe 2480 5frlrll.exe 2824 xlrllfl.exe 2892 1nnhnt.exe 2992 thnhhb.exe 2084 ppjjd.exe 2788 pddvv.exe 2332 7frfffl.exe 1992 llrrrrr.exe 2668 tbnbbb.exe 2260 3ntnhn.exe 344 3jvjj.exe 2504 9pvpv.exe 380 7rffxxx.exe 2924 9rrrrlx.exe 2604 bhnnhh.exe 2964 jvvdd.exe 1232 ddjdj.exe 1956 7rxrxrx.exe 2192 1fllllx.exe 1792 nbnhnh.exe 1916 bthhnh.exe 2920 pjvdj.exe 1112 dpvpp.exe 1936 frxlfxx.exe 1368 xlfrrrf.exe 1160 thnttt.exe 2600 dpvvv.exe 3000 9vdpp.exe 1040 9dpjj.exe 2040 xllllfr.exe 1620 xflxxrl.exe -
resource yara_rule behavioral1/memory/632-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thtbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 1204 632 ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe 30 PID 632 wrote to memory of 1204 632 ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe 30 PID 632 wrote to memory of 1204 632 ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe 30 PID 632 wrote to memory of 1204 632 ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe 30 PID 1204 wrote to memory of 2480 1204 9lxrllr.exe 31 PID 1204 wrote to memory of 2480 1204 9lxrllr.exe 31 PID 1204 wrote to memory of 2480 1204 9lxrllr.exe 31 PID 1204 wrote to memory of 2480 1204 9lxrllr.exe 31 PID 2480 wrote to memory of 2800 2480 9pjpd.exe 32 PID 2480 wrote to memory of 2800 2480 9pjpd.exe 32 PID 2480 wrote to memory of 2800 2480 9pjpd.exe 32 PID 2480 wrote to memory of 2800 2480 9pjpd.exe 32 PID 2800 wrote to memory of 2756 2800 rffxfxl.exe 33 PID 2800 wrote to memory of 2756 2800 rffxfxl.exe 33 PID 2800 wrote to memory of 2756 2800 rffxfxl.exe 33 PID 2800 wrote to memory of 2756 2800 rffxfxl.exe 33 PID 2756 wrote to memory of 2820 2756 nnnnhn.exe 34 PID 2756 wrote to memory of 2820 2756 nnnnhn.exe 34 PID 2756 wrote to memory of 2820 2756 nnnnhn.exe 34 PID 2756 wrote to memory of 2820 2756 nnnnhn.exe 34 PID 2820 wrote to memory of 2804 2820 dpvvj.exe 35 PID 2820 wrote to memory of 2804 2820 dpvvj.exe 35 PID 2820 wrote to memory of 2804 2820 dpvvj.exe 35 PID 2820 wrote to memory of 2804 2820 dpvvj.exe 35 PID 2804 wrote to memory of 2784 2804 frxxxfl.exe 36 PID 2804 wrote to memory of 2784 2804 frxxxfl.exe 36 PID 2804 wrote to memory of 2784 2804 frxxxfl.exe 36 PID 2804 wrote to memory of 2784 2804 frxxxfl.exe 36 PID 2784 wrote to memory of 2728 2784 5tnnbb.exe 37 PID 2784 wrote to memory of 2728 2784 5tnnbb.exe 37 PID 2784 wrote to memory of 2728 2784 5tnnbb.exe 37 PID 2784 wrote to memory of 2728 2784 5tnnbb.exe 37 PID 2728 wrote to memory of 2688 2728 vjjpd.exe 38 PID 2728 wrote to memory of 2688 2728 vjjpd.exe 38 PID 2728 wrote to memory of 2688 2728 vjjpd.exe 38 PID 2728 wrote to memory of 2688 2728 vjjpd.exe 38 PID 2688 wrote to memory of 2504 2688 9httbb.exe 39 PID 2688 wrote to memory of 2504 2688 9httbb.exe 39 PID 2688 wrote to memory of 2504 2688 9httbb.exe 39 PID 2688 wrote to memory of 2504 2688 9httbb.exe 39 PID 2504 wrote to memory of 2792 2504 7thhtt.exe 40 PID 2504 wrote to memory of 2792 2504 7thhtt.exe 40 PID 2504 wrote to memory of 2792 2504 7thhtt.exe 40 PID 2504 wrote to memory of 2792 2504 7thhtt.exe 40 PID 2792 wrote to memory of 532 2792 vpvvd.exe 41 PID 2792 wrote to memory of 532 2792 vpvvd.exe 41 PID 2792 wrote to memory of 532 2792 vpvvd.exe 41 PID 2792 wrote to memory of 532 2792 vpvvd.exe 41 PID 532 wrote to memory of 1524 532 9bnhhn.exe 42 PID 532 wrote to memory of 1524 532 9bnhhn.exe 42 PID 532 wrote to memory of 1524 532 9bnhhn.exe 42 PID 532 wrote to memory of 1524 532 9bnhhn.exe 42 PID 1524 wrote to memory of 2704 1524 ddjjp.exe 43 PID 1524 wrote to memory of 2704 1524 ddjjp.exe 43 PID 1524 wrote to memory of 2704 1524 ddjjp.exe 43 PID 1524 wrote to memory of 2704 1524 ddjjp.exe 43 PID 2704 wrote to memory of 1016 2704 7djvv.exe 44 PID 2704 wrote to memory of 1016 2704 7djvv.exe 44 PID 2704 wrote to memory of 1016 2704 7djvv.exe 44 PID 2704 wrote to memory of 1016 2704 7djvv.exe 44 PID 1016 wrote to memory of 2308 1016 rrxllrl.exe 45 PID 1016 wrote to memory of 2308 1016 rrxllrl.exe 45 PID 1016 wrote to memory of 2308 1016 rrxllrl.exe 45 PID 1016 wrote to memory of 2308 1016 rrxllrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe"C:\Users\Admin\AppData\Local\Temp\ee94acfd24e0574600c8b73c088fd15b6ec9740eac3d5a3dd4de67cb1043569b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9lxrllr.exec:\9lxrllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\9pjpd.exec:\9pjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rffxfxl.exec:\rffxfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nnnnhn.exec:\nnnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\dpvvj.exec:\dpvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\frxxxfl.exec:\frxxxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\5tnnbb.exec:\5tnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vjjpd.exec:\vjjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9httbb.exec:\9httbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7thhtt.exec:\7thhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vpvvd.exec:\vpvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9bnhhn.exec:\9bnhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\ddjjp.exec:\ddjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\7djvv.exec:\7djvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rrxllrl.exec:\rrxllrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\5dpvj.exec:\5dpvj.exe17⤵
- Executes dropped EXE
PID:2308 -
\??\c:\fxllrxf.exec:\fxllrxf.exe18⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bbtbhn.exec:\bbtbhn.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\jvvvj.exec:\jvvvj.exe21⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fxlxffl.exec:\fxlxffl.exe22⤵
- Executes dropped EXE
PID:316 -
\??\c:\htbtbt.exec:\htbtbt.exe23⤵
- Executes dropped EXE
PID:808 -
\??\c:\1vpvd.exec:\1vpvd.exe24⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xrxxfxf.exec:\xrxxfxf.exe25⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ttbbnn.exec:\ttbbnn.exe26⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dvjpv.exec:\dvjpv.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe28⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xrfrxrx.exec:\xrfrxrx.exe29⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jdppv.exec:\jdppv.exe30⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rfrlxxl.exec:\rfrlxxl.exe31⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xrrllrf.exec:\xrrllrf.exe32⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7bnnnt.exec:\7bnnnt.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddjdd.exec:\ddjdd.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5frlrll.exec:\5frlrll.exe35⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xlrllfl.exec:\xlrllfl.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1nnhnt.exec:\1nnhnt.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\thnhhb.exec:\thnhhb.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ppjjd.exec:\ppjjd.exe39⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pddvv.exec:\pddvv.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\7frfffl.exec:\7frfffl.exe41⤵
- Executes dropped EXE
PID:2332 -
\??\c:\llrrrrr.exec:\llrrrrr.exe42⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tbnbbb.exec:\tbnbbb.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3ntnhn.exec:\3ntnhn.exe44⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3jvjj.exec:\3jvjj.exe45⤵
- Executes dropped EXE
PID:344 -
\??\c:\9pvpv.exec:\9pvpv.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7rffxxx.exec:\7rffxxx.exe47⤵
- Executes dropped EXE
PID:380 -
\??\c:\9rrrrlx.exec:\9rrrrlx.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bhnnhh.exec:\bhnnhh.exe49⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvvdd.exec:\jvvdd.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ddjdj.exec:\ddjdj.exe51⤵
- Executes dropped EXE
PID:1232 -
\??\c:\7rxrxrx.exec:\7rxrxrx.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1fllllx.exec:\1fllllx.exe53⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbnhnh.exec:\nbnhnh.exe54⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bthhnh.exec:\bthhnh.exe55⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pjvdj.exec:\pjvdj.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dpvpp.exec:\dpvpp.exe57⤵
- Executes dropped EXE
PID:1112 -
\??\c:\frxlfxx.exec:\frxlfxx.exe58⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xlfrrrf.exec:\xlfrrrf.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\thnttt.exec:\thnttt.exe60⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dpvvv.exec:\dpvvv.exe61⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9vdpp.exec:\9vdpp.exe62⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9dpjj.exec:\9dpjj.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xllllfr.exec:\xllllfr.exe64⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xflxxrl.exec:\xflxxrl.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hthhnt.exec:\hthhnt.exe66⤵PID:1508
-
\??\c:\bnthnh.exec:\bnthnh.exe67⤵PID:2408
-
\??\c:\1jddj.exec:\1jddj.exe68⤵PID:2508
-
\??\c:\1xlfxrr.exec:\1xlfxrr.exe69⤵PID:632
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe70⤵PID:1944
-
\??\c:\3bhbbb.exec:\3bhbbb.exe71⤵PID:3056
-
\??\c:\5nbthh.exec:\5nbthh.exe72⤵PID:1204
-
\??\c:\dvdvj.exec:\dvdvj.exe73⤵PID:3024
-
\??\c:\pjpdv.exec:\pjpdv.exe74⤵PID:1568
-
\??\c:\1fxfrxf.exec:\1fxfrxf.exe75⤵PID:2436
-
\??\c:\xfxlfxr.exec:\xfxlfxr.exe76⤵PID:2876
-
\??\c:\nbhhnn.exec:\nbhhnn.exe77⤵PID:3004
-
\??\c:\nbnthh.exec:\nbnthh.exe78⤵PID:2992
-
\??\c:\1djjj.exec:\1djjj.exe79⤵PID:1048
-
\??\c:\vjddv.exec:\vjddv.exe80⤵PID:2976
-
\??\c:\lfllfxx.exec:\lfllfxx.exe81⤵PID:2332
-
\??\c:\nbhnnn.exec:\nbhnnn.exe82⤵PID:2812
-
\??\c:\7nbbtt.exec:\7nbbtt.exe83⤵PID:2680
-
\??\c:\9bnhtn.exec:\9bnhtn.exe84⤵PID:1644
-
\??\c:\vjjjd.exec:\vjjjd.exe85⤵PID:1012
-
\??\c:\3rrrrlr.exec:\3rrrrlr.exe86⤵
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\5rllxxf.exec:\5rllxxf.exe87⤵PID:3048
-
\??\c:\3nbhnn.exec:\3nbhnn.exe88⤵PID:2912
-
\??\c:\bbhntb.exec:\bbhntb.exe89⤵PID:2884
-
\??\c:\ppdjp.exec:\ppdjp.exe90⤵PID:2972
-
\??\c:\pjvvd.exec:\pjvvd.exe91⤵PID:2880
-
\??\c:\jppdd.exec:\jppdd.exe92⤵PID:1532
-
\??\c:\lffrxrr.exec:\lffrxrr.exe93⤵PID:2656
-
\??\c:\lflxfxx.exec:\lflxfxx.exe94⤵PID:2592
-
\??\c:\bnnhbb.exec:\bnnhbb.exe95⤵PID:1916
-
\??\c:\thnnhb.exec:\thnnhb.exe96⤵PID:2920
-
\??\c:\jjpdv.exec:\jjpdv.exe97⤵PID:2356
-
\??\c:\1dpjd.exec:\1dpjd.exe98⤵PID:2464
-
\??\c:\lxlfrrr.exec:\lxlfrrr.exe99⤵PID:796
-
\??\c:\rfrxfxx.exec:\rfrxfxx.exe100⤵PID:1160
-
\??\c:\htnnnn.exec:\htnnnn.exe101⤵PID:2596
-
\??\c:\hbnbnh.exec:\hbnbnh.exe102⤵
- System Location Discovery: System Language Discovery
PID:3000 -
\??\c:\jjdjd.exec:\jjdjd.exe103⤵PID:960
-
\??\c:\jpvpp.exec:\jpvpp.exe104⤵PID:2416
-
\??\c:\3ffrlff.exec:\3ffrlff.exe105⤵PID:2128
-
\??\c:\1frrrfl.exec:\1frrrfl.exe106⤵PID:2180
-
\??\c:\9btbnn.exec:\9btbnn.exe107⤵PID:2016
-
\??\c:\jpdvv.exec:\jpdvv.exe108⤵PID:2508
-
\??\c:\jdpjv.exec:\jdpjv.exe109⤵PID:1980
-
\??\c:\1dpdd.exec:\1dpdd.exe110⤵PID:3044
-
\??\c:\xxfxfxx.exec:\xxfxfxx.exe111⤵PID:3032
-
\??\c:\lfllllf.exec:\lfllllf.exe112⤵PID:1204
-
\??\c:\ntbnhb.exec:\ntbnhb.exe113⤵PID:2404
-
\??\c:\1vdpp.exec:\1vdpp.exe114⤵PID:2828
-
\??\c:\1vjjj.exec:\1vjjj.exe115⤵PID:2480
-
\??\c:\rflllff.exec:\rflllff.exe116⤵PID:2824
-
\??\c:\xrxflrr.exec:\xrxflrr.exe117⤵PID:2892
-
\??\c:\xlfxlll.exec:\xlfxlll.exe118⤵PID:2988
-
\??\c:\bbbtnh.exec:\bbbtnh.exe119⤵PID:2084
-
\??\c:\jdpjj.exec:\jdpjj.exe120⤵PID:2632
-
\??\c:\7jpjd.exec:\7jpjd.exe121⤵PID:1992
-
\??\c:\9frllll.exec:\9frllll.exe122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-