Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 08:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe
-
Size
71KB
-
MD5
97974fbc563d64f86d940a0fee75c901
-
SHA1
0eec5b7a5ce3aac283ac0efd589ea60711550d20
-
SHA256
937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1
-
SHA512
f4978c7dd00829db5972c06975c095c18bfdab0d7e31d727524e3a86815ee52e13bd2f096a3ff5eb0fb04956fbd6a31c9288c1d55f433f3cc406313ea4b114ea
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjg:ymb3NkkiQ3mdBjFI4VQ
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2644-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1300-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 1nnbnh.exe 2804 bhbtbn.exe 2560 vvvpd.exe 2652 ttthht.exe 292 3dppd.exe 1672 vpdvj.exe 2640 9fffffl.exe 2068 nhhnth.exe 1744 jdvvd.exe 2332 pjjpv.exe 1632 3rxxffr.exe 2888 fxlrfrx.exe 1300 thtbnn.exe 484 9dppd.exe 2148 jddjp.exe 2192 llxxxfr.exe 1232 bnbhnh.exe 956 hnhttt.exe 408 jvpdp.exe 2492 7xxfrrf.exe 620 hhtbnh.exe 2496 7tbtbb.exe 2484 pjddj.exe 2996 xrfrrfl.exe 780 xxxflrf.exe 1072 1bttnn.exe 1428 vpdvp.exe 1512 pjvjj.exe 1944 rfrrrrf.exe 2732 tbtbhn.exe 2944 tbthnt.exe 2372 vjvvv.exe 2804 lxlllll.exe 2584 rlxlrrl.exe 2568 7bthbh.exe 2776 hbhnbn.exe 3012 jdpvj.exe 2892 rxlrrxx.exe 1000 lxlrffl.exe 1800 7xlfllr.exe 2628 hntbtn.exe 2068 pdjjp.exe 1744 pdjjv.exe 2412 pjddj.exe 1484 xrxfflr.exe 2720 fxxlffl.exe 2888 bbthbn.exe 1712 jvjjd.exe 2152 ppvvp.exe 2968 rlxlxfl.exe 1856 fxlrxxl.exe 2288 thbhnh.exe 2980 pvvvd.exe 1960 pdjvd.exe 1208 5vvvd.exe 2400 3xrrfll.exe 2492 btnntt.exe 620 9bntbb.exe 1696 pppvv.exe 1976 rlxfllx.exe 1244 rffrffx.exe 1644 1thtbt.exe 1668 bttbbh.exe 2488 1vjvd.exe -
resource yara_rule behavioral1/memory/2644-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1300-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2768 2644 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 30 PID 2644 wrote to memory of 2768 2644 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 30 PID 2644 wrote to memory of 2768 2644 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 30 PID 2644 wrote to memory of 2768 2644 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 30 PID 2768 wrote to memory of 2804 2768 1nnbnh.exe 31 PID 2768 wrote to memory of 2804 2768 1nnbnh.exe 31 PID 2768 wrote to memory of 2804 2768 1nnbnh.exe 31 PID 2768 wrote to memory of 2804 2768 1nnbnh.exe 31 PID 2804 wrote to memory of 2560 2804 bhbtbn.exe 32 PID 2804 wrote to memory of 2560 2804 bhbtbn.exe 32 PID 2804 wrote to memory of 2560 2804 bhbtbn.exe 32 PID 2804 wrote to memory of 2560 2804 bhbtbn.exe 32 PID 2560 wrote to memory of 2652 2560 vvvpd.exe 33 PID 2560 wrote to memory of 2652 2560 vvvpd.exe 33 PID 2560 wrote to memory of 2652 2560 vvvpd.exe 33 PID 2560 wrote to memory of 2652 2560 vvvpd.exe 33 PID 2652 wrote to memory of 292 2652 ttthht.exe 34 PID 2652 wrote to memory of 292 2652 ttthht.exe 34 PID 2652 wrote to memory of 292 2652 ttthht.exe 34 PID 2652 wrote to memory of 292 2652 ttthht.exe 34 PID 292 wrote to memory of 1672 292 3dppd.exe 35 PID 292 wrote to memory of 1672 292 3dppd.exe 35 PID 292 wrote to memory of 1672 292 3dppd.exe 35 PID 292 wrote to memory of 1672 292 3dppd.exe 35 PID 1672 wrote to memory of 2640 1672 vpdvj.exe 36 PID 1672 wrote to memory of 2640 1672 vpdvj.exe 36 PID 1672 wrote to memory of 2640 1672 vpdvj.exe 36 PID 1672 wrote to memory of 2640 1672 vpdvj.exe 36 PID 2640 wrote to memory of 2068 2640 9fffffl.exe 37 PID 2640 wrote to memory of 2068 2640 9fffffl.exe 37 PID 2640 wrote to memory of 2068 2640 9fffffl.exe 37 PID 2640 wrote to memory of 2068 2640 9fffffl.exe 37 PID 2068 wrote to memory of 1744 2068 nhhnth.exe 38 PID 2068 wrote to memory of 1744 2068 nhhnth.exe 38 PID 2068 wrote to memory of 1744 2068 nhhnth.exe 38 PID 2068 wrote to memory of 1744 2068 nhhnth.exe 38 PID 1744 wrote to memory of 2332 1744 jdvvd.exe 39 PID 1744 wrote to memory of 2332 1744 jdvvd.exe 39 PID 1744 wrote to memory of 2332 1744 jdvvd.exe 39 PID 1744 wrote to memory of 2332 1744 jdvvd.exe 39 PID 2332 wrote to memory of 1632 2332 pjjpv.exe 40 PID 2332 wrote to memory of 1632 2332 pjjpv.exe 40 PID 2332 wrote to memory of 1632 2332 pjjpv.exe 40 PID 2332 wrote to memory of 1632 2332 pjjpv.exe 40 PID 1632 wrote to memory of 2888 1632 3rxxffr.exe 41 PID 1632 wrote to memory of 2888 1632 3rxxffr.exe 41 PID 1632 wrote to memory of 2888 1632 3rxxffr.exe 41 PID 1632 wrote to memory of 2888 1632 3rxxffr.exe 41 PID 2888 wrote to memory of 1300 2888 fxlrfrx.exe 42 PID 2888 wrote to memory of 1300 2888 fxlrfrx.exe 42 PID 2888 wrote to memory of 1300 2888 fxlrfrx.exe 42 PID 2888 wrote to memory of 1300 2888 fxlrfrx.exe 42 PID 1300 wrote to memory of 484 1300 thtbnn.exe 43 PID 1300 wrote to memory of 484 1300 thtbnn.exe 43 PID 1300 wrote to memory of 484 1300 thtbnn.exe 43 PID 1300 wrote to memory of 484 1300 thtbnn.exe 43 PID 484 wrote to memory of 2148 484 9dppd.exe 44 PID 484 wrote to memory of 2148 484 9dppd.exe 44 PID 484 wrote to memory of 2148 484 9dppd.exe 44 PID 484 wrote to memory of 2148 484 9dppd.exe 44 PID 2148 wrote to memory of 2192 2148 jddjp.exe 45 PID 2148 wrote to memory of 2192 2148 jddjp.exe 45 PID 2148 wrote to memory of 2192 2148 jddjp.exe 45 PID 2148 wrote to memory of 2192 2148 jddjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe"C:\Users\Admin\AppData\Local\Temp\937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1nnbnh.exec:\1nnbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bhbtbn.exec:\bhbtbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vvvpd.exec:\vvvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ttthht.exec:\ttthht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3dppd.exec:\3dppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\vpdvj.exec:\vpdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\9fffffl.exec:\9fffffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nhhnth.exec:\nhhnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jdvvd.exec:\jdvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\pjjpv.exec:\pjjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\3rxxffr.exec:\3rxxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\thtbnn.exec:\thtbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\9dppd.exec:\9dppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\jddjp.exec:\jddjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\llxxxfr.exec:\llxxxfr.exe17⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bnbhnh.exec:\bnbhnh.exe18⤵
- Executes dropped EXE
PID:1232 -
\??\c:\hnhttt.exec:\hnhttt.exe19⤵
- Executes dropped EXE
PID:956 -
\??\c:\jvpdp.exec:\jvpdp.exe20⤵
- Executes dropped EXE
PID:408 -
\??\c:\7xxfrrf.exec:\7xxfrrf.exe21⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhtbnh.exec:\hhtbnh.exe22⤵
- Executes dropped EXE
PID:620 -
\??\c:\7tbtbb.exec:\7tbtbb.exe23⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjddj.exec:\pjddj.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrfrrfl.exec:\xrfrrfl.exe25⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xxxflrf.exec:\xxxflrf.exe26⤵
- Executes dropped EXE
PID:780 -
\??\c:\1bttnn.exec:\1bttnn.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vpdvp.exec:\vpdvp.exe28⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pjvjj.exec:\pjvjj.exe29⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tbtbhn.exec:\tbtbhn.exe31⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tbthnt.exec:\tbthnt.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vjvvv.exec:\vjvvv.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lxlllll.exec:\lxlllll.exe34⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlxlrrl.exec:\rlxlrrl.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7bthbh.exec:\7bthbh.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbhnbn.exec:\hbhnbn.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jdpvj.exec:\jdpvj.exe38⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rxlrrxx.exec:\rxlrrxx.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxlrffl.exec:\lxlrffl.exe40⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7xlfllr.exec:\7xlfllr.exe41⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hntbtn.exec:\hntbtn.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pdjjp.exec:\pdjjp.exe43⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pdjjv.exec:\pdjjv.exe44⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pjddj.exec:\pjddj.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrxfflr.exec:\xrxfflr.exe46⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fxxlffl.exec:\fxxlffl.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbthbn.exec:\bbthbn.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jvjjd.exec:\jvjjd.exe49⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ppvvp.exec:\ppvvp.exe50⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe52⤵
- Executes dropped EXE
PID:1856 -
\??\c:\thbhnh.exec:\thbhnh.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pvvvd.exec:\pvvvd.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pdjvd.exec:\pdjvd.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5vvvd.exec:\5vvvd.exe56⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3xrrfll.exec:\3xrrfll.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\btnntt.exec:\btnntt.exe58⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9bntbb.exec:\9bntbb.exe59⤵
- Executes dropped EXE
PID:620 -
\??\c:\pppvv.exec:\pppvv.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlxfllx.exec:\rlxfllx.exe61⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rffrffx.exec:\rffrffx.exe62⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1thtbt.exec:\1thtbt.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bttbbh.exec:\bttbbh.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1vjvd.exec:\1vjvd.exe65⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jvddj.exec:\jvddj.exe66⤵PID:1948
-
\??\c:\frffrrf.exec:\frffrrf.exe67⤵PID:2000
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe68⤵PID:1372
-
\??\c:\nbhnbh.exec:\nbhnbh.exe69⤵PID:2672
-
\??\c:\7httht.exec:\7httht.exe70⤵PID:2116
-
\??\c:\9jdjp.exec:\9jdjp.exe71⤵PID:2724
-
\??\c:\vvvjd.exec:\vvvjd.exe72⤵PID:2564
-
\??\c:\7xllxfl.exec:\7xllxfl.exe73⤵PID:2372
-
\??\c:\frxrflx.exec:\frxrflx.exe74⤵PID:2560
-
\??\c:\bnbhnh.exec:\bnbhnh.exe75⤵PID:2596
-
\??\c:\tnhbbt.exec:\tnhbbt.exe76⤵PID:2568
-
\??\c:\pjvdj.exec:\pjvdj.exe77⤵PID:2776
-
\??\c:\5jjdj.exec:\5jjdj.exe78⤵PID:2924
-
\??\c:\xrxlxlx.exec:\xrxlxlx.exe79⤵PID:2340
-
\??\c:\7xxllll.exec:\7xxllll.exe80⤵PID:2856
-
\??\c:\nnbhtn.exec:\nnbhtn.exe81⤵PID:1800
-
\??\c:\hbhnnn.exec:\hbhnnn.exe82⤵PID:2040
-
\??\c:\ddppv.exec:\ddppv.exe83⤵PID:2068
-
\??\c:\dvjpd.exec:\dvjpd.exe84⤵PID:1744
-
\??\c:\9rllrrf.exec:\9rllrrf.exe85⤵PID:2412
-
\??\c:\1xxfxxl.exec:\1xxfxxl.exe86⤵PID:2852
-
\??\c:\xrllrrr.exec:\xrllrrr.exe87⤵PID:2720
-
\??\c:\3ttttb.exec:\3ttttb.exe88⤵PID:2888
-
\??\c:\tnhhtt.exec:\tnhhtt.exe89⤵PID:1712
-
\??\c:\jjdjj.exec:\jjdjj.exe90⤵PID:2152
-
\??\c:\jdvpj.exec:\jdvpj.exe91⤵PID:2968
-
\??\c:\7lxllrx.exec:\7lxllrx.exe92⤵PID:1856
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe93⤵PID:2288
-
\??\c:\lfrxfxl.exec:\lfrxfxl.exe94⤵PID:1108
-
\??\c:\hbbhhn.exec:\hbbhhn.exe95⤵PID:1960
-
\??\c:\tnbhnt.exec:\tnbhnt.exe96⤵PID:1984
-
\??\c:\ddvdp.exec:\ddvdp.exe97⤵PID:2400
-
\??\c:\vdpdj.exec:\vdpdj.exe98⤵PID:2492
-
\??\c:\5rffxrx.exec:\5rffxrx.exe99⤵PID:620
-
\??\c:\5rrxlrf.exec:\5rrxlrf.exe100⤵PID:2508
-
\??\c:\7rlfrxl.exec:\7rlfrxl.exe101⤵PID:1976
-
\??\c:\btntht.exec:\btntht.exe102⤵PID:2404
-
\??\c:\btthtt.exec:\btthtt.exe103⤵PID:2448
-
\??\c:\vjvpp.exec:\vjvpp.exe104⤵PID:1072
-
\??\c:\djddp.exec:\djddp.exe105⤵PID:2488
-
\??\c:\7pvvj.exec:\7pvvj.exe106⤵PID:1948
-
\??\c:\xxlrrrf.exec:\xxlrrrf.exe107⤵PID:2000
-
\??\c:\xxxlrlr.exec:\xxxlrlr.exe108⤵PID:2696
-
\??\c:\ttbbtt.exec:\ttbbtt.exe109⤵PID:1576
-
\??\c:\7nnnth.exec:\7nnnth.exe110⤵PID:2748
-
\??\c:\9llxffl.exec:\9llxffl.exe111⤵PID:2872
-
\??\c:\9rrlxfr.exec:\9rrlxfr.exe112⤵PID:2708
-
\??\c:\bnhnnh.exec:\bnhnnh.exe113⤵PID:2548
-
\??\c:\hnttbb.exec:\hnttbb.exe114⤵PID:2612
-
\??\c:\jjvvd.exec:\jjvvd.exe115⤵PID:2588
-
\??\c:\7jjdj.exec:\7jjdj.exe116⤵PID:2900
-
\??\c:\rrrrffl.exec:\rrrrffl.exe117⤵PID:3000
-
\??\c:\lxlrrrl.exec:\lxlrrrl.exe118⤵PID:2144
-
\??\c:\9nbbnn.exec:\9nbbnn.exe119⤵PID:584
-
\??\c:\hntbhh.exec:\hntbhh.exe120⤵PID:2024
-
\??\c:\9jjpv.exec:\9jjpv.exe121⤵PID:692
-
\??\c:\vpddd.exec:\vpddd.exe122⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-