Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f7363470c3bce86c3f463a3d1d0f980N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
1f7363470c3bce86c3f463a3d1d0f980N.exe
-
Size
85KB
-
MD5
1f7363470c3bce86c3f463a3d1d0f980
-
SHA1
f7fefeafbad453a4e25372b7fccbd774497c76be
-
SHA256
c69851805e7a1e39b43576404553a57958a5ae08921d46e6094695735983cfcf
-
SHA512
3c3e54cc32a2a5d62bd4b69c9ba642a9869c6ba85d1b05e4e9e71d328897b50ae1f2f44c0c26f15c301776747ac22090bb9a68eace5d3d69f4a4db103ff64678
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vzK:ymb3NkkiQ3mdBjFo6Pfgy3dbc/zK
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2156-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/672-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 hhtnht.exe 2096 hhhthn.exe 2168 vvjpj.exe 2388 xxxrxrl.exe 2804 flrflxf.exe 2752 hbnttb.exe 2844 tbthnh.exe 2788 pjvpj.exe 2840 ffrfxfl.exe 2684 bbnhtb.exe 2088 pppvp.exe 672 vvdvj.exe 2368 5xxrlxl.exe 2036 bbntht.exe 1316 djpvp.exe 1444 xxlxrlf.exe 1188 tnnthn.exe 1652 nhtbth.exe 2908 3jppv.exe 2704 lllffxx.exe 2204 ffxfrxr.exe 1852 9ntbnh.exe 3008 jjjvj.exe 764 rrfrlfx.exe 1856 rrlxlrf.exe 1472 hnthht.exe 1860 3ppdp.exe 3016 vjdpp.exe 2128 3lrffxl.exe 1736 btnnbn.exe 2304 nbbnnn.exe 2084 7jdjj.exe 2516 rxxrxxr.exe 1572 fxfrlrf.exe 2264 llxrrll.exe 2168 3hbhtb.exe 2824 9bbtnt.exe 2448 vvdjv.exe 2980 vvppd.exe 2848 3rrfrff.exe 2640 xrlfrlr.exe 2772 hhtnhn.exe 2180 djvjd.exe 2840 7jvvj.exe 2280 lfxflrf.exe 1448 llfxrlf.exe 1480 hhttth.exe 1308 3nhbbn.exe 1368 pdpdp.exe 1916 pdvjv.exe 1700 xxfrlrf.exe 1696 5flfxrl.exe 1716 nhhtht.exe 1908 1hthhb.exe 2876 5vpdj.exe 2924 5ddjv.exe 2960 xrfxxlf.exe 3036 thhttn.exe 2320 nnbtnb.exe 2404 9tnbnb.exe 452 jdpvj.exe 2904 lfxlrfr.exe 860 1xrxrxr.exe 952 tnbnhh.exe -
resource yara_rule behavioral1/memory/2156-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/672-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2540 2156 1f7363470c3bce86c3f463a3d1d0f980N.exe 30 PID 2156 wrote to memory of 2540 2156 1f7363470c3bce86c3f463a3d1d0f980N.exe 30 PID 2156 wrote to memory of 2540 2156 1f7363470c3bce86c3f463a3d1d0f980N.exe 30 PID 2156 wrote to memory of 2540 2156 1f7363470c3bce86c3f463a3d1d0f980N.exe 30 PID 2540 wrote to memory of 2096 2540 hhtnht.exe 31 PID 2540 wrote to memory of 2096 2540 hhtnht.exe 31 PID 2540 wrote to memory of 2096 2540 hhtnht.exe 31 PID 2540 wrote to memory of 2096 2540 hhtnht.exe 31 PID 2096 wrote to memory of 2168 2096 hhhthn.exe 32 PID 2096 wrote to memory of 2168 2096 hhhthn.exe 32 PID 2096 wrote to memory of 2168 2096 hhhthn.exe 32 PID 2096 wrote to memory of 2168 2096 hhhthn.exe 32 PID 2168 wrote to memory of 2388 2168 vvjpj.exe 33 PID 2168 wrote to memory of 2388 2168 vvjpj.exe 33 PID 2168 wrote to memory of 2388 2168 vvjpj.exe 33 PID 2168 wrote to memory of 2388 2168 vvjpj.exe 33 PID 2388 wrote to memory of 2804 2388 xxxrxrl.exe 34 PID 2388 wrote to memory of 2804 2388 xxxrxrl.exe 34 PID 2388 wrote to memory of 2804 2388 xxxrxrl.exe 34 PID 2388 wrote to memory of 2804 2388 xxxrxrl.exe 34 PID 2804 wrote to memory of 2752 2804 flrflxf.exe 35 PID 2804 wrote to memory of 2752 2804 flrflxf.exe 35 PID 2804 wrote to memory of 2752 2804 flrflxf.exe 35 PID 2804 wrote to memory of 2752 2804 flrflxf.exe 35 PID 2752 wrote to memory of 2844 2752 hbnttb.exe 36 PID 2752 wrote to memory of 2844 2752 hbnttb.exe 36 PID 2752 wrote to memory of 2844 2752 hbnttb.exe 36 PID 2752 wrote to memory of 2844 2752 hbnttb.exe 36 PID 2844 wrote to memory of 2788 2844 tbthnh.exe 37 PID 2844 wrote to memory of 2788 2844 tbthnh.exe 37 PID 2844 wrote to memory of 2788 2844 tbthnh.exe 37 PID 2844 wrote to memory of 2788 2844 tbthnh.exe 37 PID 2788 wrote to memory of 2840 2788 pjvpj.exe 38 PID 2788 wrote to memory of 2840 2788 pjvpj.exe 38 PID 2788 wrote to memory of 2840 2788 pjvpj.exe 38 PID 2788 wrote to memory of 2840 2788 pjvpj.exe 38 PID 2840 wrote to memory of 2684 2840 ffrfxfl.exe 39 PID 2840 wrote to memory of 2684 2840 ffrfxfl.exe 39 PID 2840 wrote to memory of 2684 2840 ffrfxfl.exe 39 PID 2840 wrote to memory of 2684 2840 ffrfxfl.exe 39 PID 2684 wrote to memory of 2088 2684 bbnhtb.exe 40 PID 2684 wrote to memory of 2088 2684 bbnhtb.exe 40 PID 2684 wrote to memory of 2088 2684 bbnhtb.exe 40 PID 2684 wrote to memory of 2088 2684 bbnhtb.exe 40 PID 2088 wrote to memory of 672 2088 pppvp.exe 41 PID 2088 wrote to memory of 672 2088 pppvp.exe 41 PID 2088 wrote to memory of 672 2088 pppvp.exe 41 PID 2088 wrote to memory of 672 2088 pppvp.exe 41 PID 672 wrote to memory of 2368 672 vvdvj.exe 42 PID 672 wrote to memory of 2368 672 vvdvj.exe 42 PID 672 wrote to memory of 2368 672 vvdvj.exe 42 PID 672 wrote to memory of 2368 672 vvdvj.exe 42 PID 2368 wrote to memory of 2036 2368 5xxrlxl.exe 43 PID 2368 wrote to memory of 2036 2368 5xxrlxl.exe 43 PID 2368 wrote to memory of 2036 2368 5xxrlxl.exe 43 PID 2368 wrote to memory of 2036 2368 5xxrlxl.exe 43 PID 2036 wrote to memory of 1316 2036 bbntht.exe 44 PID 2036 wrote to memory of 1316 2036 bbntht.exe 44 PID 2036 wrote to memory of 1316 2036 bbntht.exe 44 PID 2036 wrote to memory of 1316 2036 bbntht.exe 44 PID 1316 wrote to memory of 1444 1316 djpvp.exe 45 PID 1316 wrote to memory of 1444 1316 djpvp.exe 45 PID 1316 wrote to memory of 1444 1316 djpvp.exe 45 PID 1316 wrote to memory of 1444 1316 djpvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f7363470c3bce86c3f463a3d1d0f980N.exe"C:\Users\Admin\AppData\Local\Temp\1f7363470c3bce86c3f463a3d1d0f980N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\hhtnht.exec:\hhtnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hhhthn.exec:\hhhthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vvjpj.exec:\vvjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xxxrxrl.exec:\xxxrxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\flrflxf.exec:\flrflxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hbnttb.exec:\hbnttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\tbthnh.exec:\tbthnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pjvpj.exec:\pjvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\ffrfxfl.exec:\ffrfxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\bbnhtb.exec:\bbnhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pppvp.exec:\pppvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vvdvj.exec:\vvdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\5xxrlxl.exec:\5xxrlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bbntht.exec:\bbntht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\djpvp.exec:\djpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\xxlxrlf.exec:\xxlxrlf.exe17⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tnnthn.exec:\tnnthn.exe18⤵
- Executes dropped EXE
PID:1188 -
\??\c:\nhtbth.exec:\nhtbth.exe19⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3jppv.exec:\3jppv.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lllffxx.exec:\lllffxx.exe21⤵
- Executes dropped EXE
PID:2704 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe22⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9ntbnh.exec:\9ntbnh.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jjjvj.exec:\jjjvj.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rrfrlfx.exec:\rrfrlfx.exe25⤵
- Executes dropped EXE
PID:764 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe26⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hnthht.exec:\hnthht.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\3ppdp.exec:\3ppdp.exe28⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vjdpp.exec:\vjdpp.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3lrffxl.exec:\3lrffxl.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btnnbn.exec:\btnnbn.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbbnnn.exec:\nbbnnn.exe32⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7jdjj.exec:\7jdjj.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxxrxxr.exec:\rxxrxxr.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fxfrlrf.exec:\fxfrlrf.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\llxrrll.exec:\llxrrll.exe36⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3hbhtb.exec:\3hbhtb.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9bbtnt.exec:\9bbtnt.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vvdjv.exec:\vvdjv.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\vvppd.exec:\vvppd.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3rrfrff.exec:\3rrfrff.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrlfrlr.exec:\xrlfrlr.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhtnhn.exec:\hhtnhn.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\djvjd.exec:\djvjd.exe44⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7jvvj.exec:\7jvvj.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lfxflrf.exec:\lfxflrf.exe46⤵
- Executes dropped EXE
PID:2280 -
\??\c:\llfxrlf.exec:\llfxrlf.exe47⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hhttth.exec:\hhttth.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\3nhbbn.exec:\3nhbbn.exe49⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pdpdp.exec:\pdpdp.exe50⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pdvjv.exec:\pdvjv.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xxfrlrf.exec:\xxfrlrf.exe52⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5flfxrl.exec:\5flfxrl.exe53⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhhtht.exec:\nhhtht.exe54⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1hthhb.exec:\1hthhb.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5vpdj.exec:\5vpdj.exe56⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5ddjv.exec:\5ddjv.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xrfxxlf.exec:\xrfxxlf.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\thhttn.exec:\thhttn.exe59⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nnbtnb.exec:\nnbtnb.exe60⤵
- Executes dropped EXE
PID:2320 -
\??\c:\9tnbnb.exec:\9tnbnb.exe61⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdpvj.exec:\jdpvj.exe62⤵
- Executes dropped EXE
PID:452 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1xrxrxr.exec:\1xrxrxr.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\tnbnhh.exec:\tnbnhh.exe65⤵
- Executes dropped EXE
PID:952 -
\??\c:\bttnnh.exec:\bttnnh.exe66⤵PID:1140
-
\??\c:\7pjjd.exec:\7pjjd.exe67⤵PID:1644
-
\??\c:\vpppv.exec:\vpppv.exe68⤵PID:2348
-
\??\c:\5ffllxf.exec:\5ffllxf.exe69⤵PID:1632
-
\??\c:\1fxrfrx.exec:\1fxrfrx.exe70⤵PID:332
-
\??\c:\3hhhnn.exec:\3hhhnn.exe71⤵PID:2416
-
\??\c:\ttntnb.exec:\ttntnb.exe72⤵PID:3028
-
\??\c:\djjvp.exec:\djjvp.exe73⤵PID:2344
-
\??\c:\vvjjj.exec:\vvjjj.exe74⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\fxlxffr.exec:\fxlxffr.exe75⤵PID:1684
-
\??\c:\llfxlrf.exec:\llfxlrf.exe76⤵PID:3044
-
\??\c:\btnthh.exec:\btnthh.exe77⤵PID:2712
-
\??\c:\tnnhnt.exec:\tnnhnt.exe78⤵PID:2832
-
\??\c:\5ppvp.exec:\5ppvp.exe79⤵PID:2812
-
\??\c:\1ppjv.exec:\1ppjv.exe80⤵PID:2736
-
\??\c:\ffrlfff.exec:\ffrlfff.exe81⤵PID:2980
-
\??\c:\rrlxlxf.exec:\rrlxlxf.exe82⤵PID:2948
-
\??\c:\hnnnnb.exec:\hnnnnb.exe83⤵PID:2696
-
\??\c:\thtbnt.exec:\thtbnt.exe84⤵PID:2600
-
\??\c:\pjvdj.exec:\pjvdj.exe85⤵PID:3048
-
\??\c:\9jjjp.exec:\9jjjp.exe86⤵PID:2532
-
\??\c:\xllxrrf.exec:\xllxrrf.exe87⤵PID:2088
-
\??\c:\xxlfrfr.exec:\xxlfrfr.exe88⤵PID:584
-
\??\c:\bttbtt.exec:\bttbtt.exe89⤵PID:672
-
\??\c:\nhthht.exec:\nhthht.exe90⤵PID:1688
-
\??\c:\jvpvp.exec:\jvpvp.exe91⤵PID:1368
-
\??\c:\1dvdv.exec:\1dvdv.exe92⤵PID:1388
-
\??\c:\3jvdv.exec:\3jvdv.exe93⤵PID:2024
-
\??\c:\lrlrflf.exec:\lrlrflf.exe94⤵PID:1792
-
\??\c:\rrfxrxx.exec:\rrfxrxx.exe95⤵PID:844
-
\??\c:\ttbnhn.exec:\ttbnhn.exe96⤵PID:2872
-
\??\c:\hbnhnb.exec:\hbnhnb.exe97⤵PID:2472
-
\??\c:\pvjpj.exec:\pvjpj.exe98⤵PID:2252
-
\??\c:\1vdvj.exec:\1vdvj.exe99⤵PID:2204
-
\??\c:\5lxfrxl.exec:\5lxfrxl.exe100⤵PID:2492
-
\??\c:\lffrlrl.exec:\lffrlrl.exe101⤵PID:3004
-
\??\c:\nnnbtn.exec:\nnnbtn.exe102⤵PID:1932
-
\??\c:\hbttnb.exec:\hbttnb.exe103⤵PID:1964
-
\??\c:\jdvjd.exec:\jdvjd.exe104⤵PID:1768
-
\??\c:\jvjjd.exec:\jvjjd.exe105⤵PID:1772
-
\??\c:\ffflxlx.exec:\ffflxlx.exe106⤵PID:1844
-
\??\c:\hhnbth.exec:\hhnbth.exe107⤵
- System Location Discovery: System Language Discovery
PID:2972 -
\??\c:\7htthn.exec:\7htthn.exe108⤵PID:2236
-
\??\c:\dvvjj.exec:\dvvjj.exe109⤵PID:1648
-
\??\c:\jdjpj.exec:\jdjpj.exe110⤵PID:328
-
\??\c:\lffrrfr.exec:\lffrrfr.exe111⤵PID:2552
-
\??\c:\rlffllx.exec:\rlffllx.exe112⤵PID:2540
-
\??\c:\ntnbbb.exec:\ntnbbb.exe113⤵PID:2308
-
\??\c:\bthnbb.exec:\bthnbb.exe114⤵PID:2524
-
\??\c:\hbthbn.exec:\hbthbn.exe115⤵PID:2016
-
\??\c:\dvpdp.exec:\dvpdp.exe116⤵PID:2264
-
\??\c:\dvjvp.exec:\dvjvp.exe117⤵PID:2820
-
\??\c:\llxlffr.exec:\llxlffr.exe118⤵PID:2740
-
\??\c:\rrlrlrr.exec:\rrlrlrr.exe119⤵PID:2124
-
\??\c:\5nnbnb.exec:\5nnbnb.exe120⤵PID:2752
-
\??\c:\btntnb.exec:\btntnb.exe121⤵PID:2988
-
\??\c:\vpdpp.exec:\vpdpp.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-