Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 02:52
Static task
static1
Behavioral task
behavioral1
Sample
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
Resource
win7-20240903-en
General
-
Target
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
-
Size
93KB
-
MD5
789612a58fd4b8deaca1dcd85daa895d
-
SHA1
2c227d9ad452da6a3e763e2ab15908f9bf545031
-
SHA256
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85
-
SHA512
888e6de09c4f9ea6e52829ddc20ef6a2530386820e4613cbe377217a004e6ca3ba3818a5b1aaac1ccbbb5f994eb32720e85d1c35cf3a9cb8da92bbede1951a79
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/A0UtgK:ymb3NkkiQ3mdBjFo73tvn+Yp99zDut
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2660-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-46-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-92-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2784 5vvvv.exe 2684 fxrxlrf.exe 2572 vjvdp.exe 2592 dvpjj.exe 2612 hbnnbt.exe 2996 jddjp.exe 2980 rlxxffr.exe 1080 rlflxff.exe 2608 1dppv.exe 1564 ppdjd.exe 1288 frlflfl.exe 2616 htntnn.exe 2860 jdvvp.exe 1928 pjvvv.exe 112 lfrxffr.exe 1568 9lfrflx.exe 2052 hbthnn.exe 1096 jjppj.exe 2164 vpdvj.exe 1104 7xffxxf.exe 1296 hhbthh.exe 2504 3tnnbb.exe 1644 7dvdj.exe 2952 5ddpv.exe 1240 llxfllr.exe 2080 7nbbhh.exe 316 7nhbhh.exe 2172 dvpvv.exe 2660 dpjpv.exe 2780 5rflfxl.exe 2908 tthbbn.exe 2712 9nhnhh.exe 2664 vjdjv.exe 2724 9rxfrrx.exe 2564 rlxfrrx.exe 1004 hhthbh.exe 2620 nhbhhh.exe 2012 dvpjp.exe 2964 pjppd.exe 2428 xrrxllr.exe 2312 rlxfrrx.exe 2532 hhbntb.exe 1816 5tnhbt.exe 2440 jdjvj.exe 1488 7pvdj.exe 2848 fxflrrx.exe 2032 frlrxrx.exe 264 bnttbh.exe 584 hbntbh.exe 1828 vpdjp.exe 2096 3jdjv.exe 2184 rlxxffr.exe 2936 9lllrxx.exe 1096 7hbhbb.exe 2164 1thntt.exe 848 jdvdj.exe 1084 jjvdp.exe 236 7lfxffl.exe 2504 7ffrlrx.exe 1396 tnbntb.exe 2136 nnhhbh.exe 2020 pjvjv.exe 2356 ppdvj.exe 316 xrxlrxf.exe -
resource yara_rule behavioral1/memory/2660-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-311-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2784 2660 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2660 wrote to memory of 2784 2660 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2660 wrote to memory of 2784 2660 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2660 wrote to memory of 2784 2660 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2784 wrote to memory of 2684 2784 5vvvv.exe 31 PID 2784 wrote to memory of 2684 2784 5vvvv.exe 31 PID 2784 wrote to memory of 2684 2784 5vvvv.exe 31 PID 2784 wrote to memory of 2684 2784 5vvvv.exe 31 PID 2684 wrote to memory of 2572 2684 fxrxlrf.exe 32 PID 2684 wrote to memory of 2572 2684 fxrxlrf.exe 32 PID 2684 wrote to memory of 2572 2684 fxrxlrf.exe 32 PID 2684 wrote to memory of 2572 2684 fxrxlrf.exe 32 PID 2572 wrote to memory of 2592 2572 vjvdp.exe 33 PID 2572 wrote to memory of 2592 2572 vjvdp.exe 33 PID 2572 wrote to memory of 2592 2572 vjvdp.exe 33 PID 2572 wrote to memory of 2592 2572 vjvdp.exe 33 PID 2592 wrote to memory of 2612 2592 dvpjj.exe 34 PID 2592 wrote to memory of 2612 2592 dvpjj.exe 34 PID 2592 wrote to memory of 2612 2592 dvpjj.exe 34 PID 2592 wrote to memory of 2612 2592 dvpjj.exe 34 PID 2612 wrote to memory of 2996 2612 hbnnbt.exe 35 PID 2612 wrote to memory of 2996 2612 hbnnbt.exe 35 PID 2612 wrote to memory of 2996 2612 hbnnbt.exe 35 PID 2612 wrote to memory of 2996 2612 hbnnbt.exe 35 PID 2996 wrote to memory of 2980 2996 jddjp.exe 36 PID 2996 wrote to memory of 2980 2996 jddjp.exe 36 PID 2996 wrote to memory of 2980 2996 jddjp.exe 36 PID 2996 wrote to memory of 2980 2996 jddjp.exe 36 PID 2980 wrote to memory of 1080 2980 rlxxffr.exe 37 PID 2980 wrote to memory of 1080 2980 rlxxffr.exe 37 PID 2980 wrote to memory of 1080 2980 rlxxffr.exe 37 PID 2980 wrote to memory of 1080 2980 rlxxffr.exe 37 PID 1080 wrote to memory of 2608 1080 rlflxff.exe 38 PID 1080 wrote to memory of 2608 1080 rlflxff.exe 38 PID 1080 wrote to memory of 2608 1080 rlflxff.exe 38 PID 1080 wrote to memory of 2608 1080 rlflxff.exe 38 PID 2608 wrote to memory of 1564 2608 1dppv.exe 39 PID 2608 wrote to memory of 1564 2608 1dppv.exe 39 PID 2608 wrote to memory of 1564 2608 1dppv.exe 39 PID 2608 wrote to memory of 1564 2608 1dppv.exe 39 PID 1564 wrote to memory of 1288 1564 ppdjd.exe 40 PID 1564 wrote to memory of 1288 1564 ppdjd.exe 40 PID 1564 wrote to memory of 1288 1564 ppdjd.exe 40 PID 1564 wrote to memory of 1288 1564 ppdjd.exe 40 PID 1288 wrote to memory of 2616 1288 frlflfl.exe 41 PID 1288 wrote to memory of 2616 1288 frlflfl.exe 41 PID 1288 wrote to memory of 2616 1288 frlflfl.exe 41 PID 1288 wrote to memory of 2616 1288 frlflfl.exe 41 PID 2616 wrote to memory of 2860 2616 htntnn.exe 42 PID 2616 wrote to memory of 2860 2616 htntnn.exe 42 PID 2616 wrote to memory of 2860 2616 htntnn.exe 42 PID 2616 wrote to memory of 2860 2616 htntnn.exe 42 PID 2860 wrote to memory of 1928 2860 jdvvp.exe 43 PID 2860 wrote to memory of 1928 2860 jdvvp.exe 43 PID 2860 wrote to memory of 1928 2860 jdvvp.exe 43 PID 2860 wrote to memory of 1928 2860 jdvvp.exe 43 PID 1928 wrote to memory of 112 1928 pjvvv.exe 44 PID 1928 wrote to memory of 112 1928 pjvvv.exe 44 PID 1928 wrote to memory of 112 1928 pjvvv.exe 44 PID 1928 wrote to memory of 112 1928 pjvvv.exe 44 PID 112 wrote to memory of 1568 112 lfrxffr.exe 45 PID 112 wrote to memory of 1568 112 lfrxffr.exe 45 PID 112 wrote to memory of 1568 112 lfrxffr.exe 45 PID 112 wrote to memory of 1568 112 lfrxffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\5vvvv.exec:\5vvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vjvdp.exec:\vjvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvpjj.exec:\dvpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbnnbt.exec:\hbnnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jddjp.exec:\jddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rlxxffr.exec:\rlxxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rlflxff.exec:\rlflxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\1dppv.exec:\1dppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ppdjd.exec:\ppdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\frlflfl.exec:\frlflfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\htntnn.exec:\htntnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jdvvp.exec:\jdvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pjvvv.exec:\pjvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\lfrxffr.exec:\lfrxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\9lfrflx.exec:\9lfrflx.exe17⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbthnn.exec:\hbthnn.exe18⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jjppj.exec:\jjppj.exe19⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vpdvj.exec:\vpdvj.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7xffxxf.exec:\7xffxxf.exe21⤵
- Executes dropped EXE
PID:1104 -
\??\c:\hhbthh.exec:\hhbthh.exe22⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3tnnbb.exec:\3tnnbb.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7dvdj.exec:\7dvdj.exe24⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5ddpv.exec:\5ddpv.exe25⤵
- Executes dropped EXE
PID:2952 -
\??\c:\llxfllr.exec:\llxfllr.exe26⤵
- Executes dropped EXE
PID:1240 -
\??\c:\7nbbhh.exec:\7nbbhh.exe27⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7nhbhh.exec:\7nhbhh.exe28⤵
- Executes dropped EXE
PID:316 -
\??\c:\dvpvv.exec:\dvpvv.exe29⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dpjpv.exec:\dpjpv.exe30⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5rflfxl.exec:\5rflfxl.exe31⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tthbbn.exec:\tthbbn.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9nhnhh.exec:\9nhnhh.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vjdjv.exec:\vjdjv.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9rxfrrx.exec:\9rxfrrx.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe36⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hhthbh.exec:\hhthbh.exe37⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nhbhhh.exec:\nhbhhh.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\dvpjp.exec:\dvpjp.exe39⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjppd.exec:\pjppd.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrrxllr.exec:\xrrxllr.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe42⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hhbntb.exec:\hhbntb.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5tnhbt.exec:\5tnhbt.exe44⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdjvj.exec:\jdjvj.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7pvdj.exec:\7pvdj.exe46⤵
- Executes dropped EXE
PID:1488 -
\??\c:\fxflrrx.exec:\fxflrrx.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\frlrxrx.exec:\frlrxrx.exe48⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnttbh.exec:\bnttbh.exe49⤵
- Executes dropped EXE
PID:264 -
\??\c:\hbntbh.exec:\hbntbh.exe50⤵
- Executes dropped EXE
PID:584 -
\??\c:\vpdjp.exec:\vpdjp.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3jdjv.exec:\3jdjv.exe52⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rlxxffr.exec:\rlxxffr.exe53⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9lllrxx.exec:\9lllrxx.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7hbhbb.exec:\7hbhbb.exe55⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1thntt.exec:\1thntt.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jdvdj.exec:\jdvdj.exe57⤵
- Executes dropped EXE
PID:848 -
\??\c:\jjvdp.exec:\jjvdp.exe58⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7lfxffl.exec:\7lfxffl.exe59⤵
- Executes dropped EXE
PID:236 -
\??\c:\7ffrlrx.exec:\7ffrlrx.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbntb.exec:\tnbntb.exe61⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nnhhbh.exec:\nnhhbh.exe62⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjvjv.exec:\pjvjv.exe63⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ppdvj.exec:\ppdvj.exe64⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe65⤵
- Executes dropped EXE
PID:316 -
\??\c:\5xxllxr.exec:\5xxllxr.exe66⤵PID:2344
-
\??\c:\7btnth.exec:\7btnth.exe67⤵PID:2692
-
\??\c:\7htntb.exec:\7htntb.exe68⤵PID:2788
-
\??\c:\9jdpv.exec:\9jdpv.exe69⤵PID:1688
-
\??\c:\frfrfrl.exec:\frfrfrl.exe70⤵PID:2676
-
\??\c:\9ffllrf.exec:\9ffllrf.exe71⤵PID:2772
-
\??\c:\bnbtbt.exec:\bnbtbt.exe72⤵PID:2568
-
\??\c:\bbtbtt.exec:\bbtbtt.exe73⤵PID:2716
-
\??\c:\hbhhhn.exec:\hbhhhn.exe74⤵PID:2588
-
\??\c:\jdpdj.exec:\jdpdj.exe75⤵PID:1516
-
\??\c:\dddpj.exec:\dddpj.exe76⤵PID:1652
-
\??\c:\5llrrxl.exec:\5llrrxl.exe77⤵PID:1796
-
\??\c:\9nnnbb.exec:\9nnnbb.exe78⤵PID:1868
-
\??\c:\hbtbnn.exec:\hbtbnn.exe79⤵PID:2188
-
\??\c:\dvjjv.exec:\dvjjv.exe80⤵PID:2160
-
\??\c:\pjppd.exec:\pjppd.exe81⤵PID:1328
-
\??\c:\lxxxffl.exec:\lxxxffl.exe82⤵PID:708
-
\??\c:\3xlxflr.exec:\3xlxflr.exe83⤵PID:2088
-
\??\c:\nnnntt.exec:\nnnntt.exe84⤵PID:800
-
\??\c:\9nhthn.exec:\9nhthn.exe85⤵PID:1664
-
\??\c:\bhnntb.exec:\bhnntb.exe86⤵PID:1760
-
\??\c:\vvpvv.exec:\vvpvv.exe87⤵PID:532
-
\??\c:\7xxrxrx.exec:\7xxrxrx.exe88⤵PID:2524
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe89⤵PID:1120
-
\??\c:\1tnhtn.exec:\1tnhtn.exe90⤵PID:2200
-
\??\c:\hbbthn.exec:\hbbthn.exe91⤵PID:2404
-
\??\c:\ppjjd.exec:\ppjjd.exe92⤵PID:2764
-
\??\c:\pjvvd.exec:\pjvvd.exe93⤵PID:2920
-
\??\c:\1xlrxxl.exec:\1xlrxxl.exe94⤵PID:2220
-
\??\c:\5lxlxxx.exec:\5lxlxxx.exe95⤵PID:700
-
\??\c:\btnntb.exec:\btnntb.exe96⤵PID:1880
-
\??\c:\bntnhb.exec:\bntnhb.exe97⤵PID:464
-
\??\c:\vjddd.exec:\vjddd.exe98⤵PID:2500
-
\??\c:\ppddp.exec:\ppddp.exe99⤵PID:2212
-
\??\c:\xrfrffr.exec:\xrfrffr.exe100⤵PID:1740
-
\??\c:\7llxllx.exec:\7llxllx.exe101⤵PID:1996
-
\??\c:\bbhttn.exec:\bbhttn.exe102⤵PID:1380
-
\??\c:\thhnnn.exec:\thhnnn.exe103⤵PID:672
-
\??\c:\vjvdv.exec:\vjvdv.exe104⤵PID:2328
-
\??\c:\3vvvd.exec:\3vvvd.exe105⤵PID:3060
-
\??\c:\5lfrllr.exec:\5lfrllr.exe106⤵PID:2412
-
\??\c:\1fxfxxf.exec:\1fxfxxf.exe107⤵PID:1592
-
\??\c:\5hhbnt.exec:\5hhbnt.exe108⤵PID:2904
-
\??\c:\nnhhbb.exec:\nnhhbb.exe109⤵PID:2784
-
\??\c:\3pddp.exec:\3pddp.exe110⤵PID:2884
-
\??\c:\5pjdp.exec:\5pjdp.exe111⤵PID:2856
-
\??\c:\rllrflx.exec:\rllrflx.exe112⤵PID:2556
-
\??\c:\5llrflr.exec:\5llrflr.exe113⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\7ntbnn.exec:\7ntbnn.exe114⤵PID:1640
-
\??\c:\ddvdj.exec:\ddvdj.exe115⤵PID:304
-
\??\c:\dvppv.exec:\dvppv.exe116⤵PID:2996
-
\??\c:\9rrxffl.exec:\9rrxffl.exe117⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\rrxfffx.exec:\rrxfffx.exe118⤵PID:2152
-
\??\c:\1ntthb.exec:\1ntthb.exe119⤵PID:2832
-
\??\c:\9thbhn.exec:\9thbhn.exe120⤵PID:652
-
\??\c:\hbhtnn.exec:\hbhtnn.exe121⤵PID:1884
-
\??\c:\jdvjp.exec:\jdvjp.exe122⤵PID:596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-