Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fecfe2ce715c2e01aedfacf2036e9440N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
fecfe2ce715c2e01aedfacf2036e9440N.exe
-
Size
65KB
-
MD5
fecfe2ce715c2e01aedfacf2036e9440
-
SHA1
8b9733f0cf590e244e23e51acafb24f6bff5cfa6
-
SHA256
03fc86ed07231b32ed56cddb0de78bd4359dcd3c93bf8b8078f99fec4422b0f1
-
SHA512
13bdb7bf711961ac1d940522c8f30b3e004f7449c309b9ade40329b553f683d6cf93a41d05729b81ff0c1023afb10c808f4f248958ae9b2dee8628d0196f20e5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe/:ymb3NkkiQ3mdBjF0y7kbU/
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2504-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2032 xxlxlrf.exe 2792 btbhht.exe 2748 tnhhnt.exe 2804 dpddd.exe 2764 lfrrffr.exe 2628 bnhhnt.exe 2600 ppdpj.exe 2724 pdpvd.exe 1840 3lffffr.exe 856 xrxxllr.exe 2432 tnnnbn.exe 1248 vjpvd.exe 2348 ddppd.exe 3016 3rlrrrl.exe 1932 3nhnnb.exe 1420 bnntnt.exe 1736 pppdj.exe 576 xrxfrxr.exe 864 ntbhnn.exe 1028 3nbbhh.exe 404 jdvjv.exe 2320 rrlxrxr.exe 1352 3ttbnb.exe 480 tttbbb.exe 2436 vvjvv.exe 2412 rrflrxf.exe 2168 nhbbnn.exe 2364 1jpvp.exe 1044 vpdjp.exe 2076 7rxfflr.exe 2336 xxxfrfl.exe 2112 bbtthh.exe 2968 nhbtbn.exe 2160 jjvjj.exe 2820 dppvv.exe 2728 ffxrflr.exe 2720 1fllrll.exe 2796 7hhbth.exe 3056 pjddp.exe 2616 jvdvp.exe 2632 xxxllrx.exe 3004 xrxrxxx.exe 1680 5nhhhn.exe 636 1htnbn.exe 1992 vvvjd.exe 856 vdvpd.exe 1980 fxrfrxx.exe 2052 lxlrflf.exe 2904 tnhhbn.exe 1996 jjvjp.exe 1604 3dvpd.exe 1564 jdjjp.exe 1420 lfrxrxl.exe 2176 btntbb.exe 2580 hbtbnt.exe 2120 jvjvd.exe 2284 pjvvj.exe 1028 3xrrfrr.exe 2084 1llllrl.exe 972 hbttbt.exe 696 hhtnhh.exe 1544 pvjjv.exe 1276 dvdjp.exe 2324 lflxffr.exe -
resource yara_rule behavioral1/memory/2504-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2032 2504 fecfe2ce715c2e01aedfacf2036e9440N.exe 30 PID 2504 wrote to memory of 2032 2504 fecfe2ce715c2e01aedfacf2036e9440N.exe 30 PID 2504 wrote to memory of 2032 2504 fecfe2ce715c2e01aedfacf2036e9440N.exe 30 PID 2504 wrote to memory of 2032 2504 fecfe2ce715c2e01aedfacf2036e9440N.exe 30 PID 2032 wrote to memory of 2792 2032 xxlxlrf.exe 31 PID 2032 wrote to memory of 2792 2032 xxlxlrf.exe 31 PID 2032 wrote to memory of 2792 2032 xxlxlrf.exe 31 PID 2032 wrote to memory of 2792 2032 xxlxlrf.exe 31 PID 2792 wrote to memory of 2748 2792 btbhht.exe 32 PID 2792 wrote to memory of 2748 2792 btbhht.exe 32 PID 2792 wrote to memory of 2748 2792 btbhht.exe 32 PID 2792 wrote to memory of 2748 2792 btbhht.exe 32 PID 2748 wrote to memory of 2804 2748 tnhhnt.exe 33 PID 2748 wrote to memory of 2804 2748 tnhhnt.exe 33 PID 2748 wrote to memory of 2804 2748 tnhhnt.exe 33 PID 2748 wrote to memory of 2804 2748 tnhhnt.exe 33 PID 2804 wrote to memory of 2764 2804 dpddd.exe 34 PID 2804 wrote to memory of 2764 2804 dpddd.exe 34 PID 2804 wrote to memory of 2764 2804 dpddd.exe 34 PID 2804 wrote to memory of 2764 2804 dpddd.exe 34 PID 2764 wrote to memory of 2628 2764 lfrrffr.exe 35 PID 2764 wrote to memory of 2628 2764 lfrrffr.exe 35 PID 2764 wrote to memory of 2628 2764 lfrrffr.exe 35 PID 2764 wrote to memory of 2628 2764 lfrrffr.exe 35 PID 2628 wrote to memory of 2600 2628 bnhhnt.exe 36 PID 2628 wrote to memory of 2600 2628 bnhhnt.exe 36 PID 2628 wrote to memory of 2600 2628 bnhhnt.exe 36 PID 2628 wrote to memory of 2600 2628 bnhhnt.exe 36 PID 2600 wrote to memory of 2724 2600 ppdpj.exe 37 PID 2600 wrote to memory of 2724 2600 ppdpj.exe 37 PID 2600 wrote to memory of 2724 2600 ppdpj.exe 37 PID 2600 wrote to memory of 2724 2600 ppdpj.exe 37 PID 2724 wrote to memory of 1840 2724 pdpvd.exe 38 PID 2724 wrote to memory of 1840 2724 pdpvd.exe 38 PID 2724 wrote to memory of 1840 2724 pdpvd.exe 38 PID 2724 wrote to memory of 1840 2724 pdpvd.exe 38 PID 1840 wrote to memory of 856 1840 3lffffr.exe 39 PID 1840 wrote to memory of 856 1840 3lffffr.exe 39 PID 1840 wrote to memory of 856 1840 3lffffr.exe 39 PID 1840 wrote to memory of 856 1840 3lffffr.exe 39 PID 856 wrote to memory of 2432 856 xrxxllr.exe 40 PID 856 wrote to memory of 2432 856 xrxxllr.exe 40 PID 856 wrote to memory of 2432 856 xrxxllr.exe 40 PID 856 wrote to memory of 2432 856 xrxxllr.exe 40 PID 2432 wrote to memory of 1248 2432 tnnnbn.exe 41 PID 2432 wrote to memory of 1248 2432 tnnnbn.exe 41 PID 2432 wrote to memory of 1248 2432 tnnnbn.exe 41 PID 2432 wrote to memory of 1248 2432 tnnnbn.exe 41 PID 1248 wrote to memory of 2348 1248 vjpvd.exe 42 PID 1248 wrote to memory of 2348 1248 vjpvd.exe 42 PID 1248 wrote to memory of 2348 1248 vjpvd.exe 42 PID 1248 wrote to memory of 2348 1248 vjpvd.exe 42 PID 2348 wrote to memory of 3016 2348 ddppd.exe 43 PID 2348 wrote to memory of 3016 2348 ddppd.exe 43 PID 2348 wrote to memory of 3016 2348 ddppd.exe 43 PID 2348 wrote to memory of 3016 2348 ddppd.exe 43 PID 3016 wrote to memory of 1932 3016 3rlrrrl.exe 44 PID 3016 wrote to memory of 1932 3016 3rlrrrl.exe 44 PID 3016 wrote to memory of 1932 3016 3rlrrrl.exe 44 PID 3016 wrote to memory of 1932 3016 3rlrrrl.exe 44 PID 1932 wrote to memory of 1420 1932 3nhnnb.exe 45 PID 1932 wrote to memory of 1420 1932 3nhnnb.exe 45 PID 1932 wrote to memory of 1420 1932 3nhnnb.exe 45 PID 1932 wrote to memory of 1420 1932 3nhnnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fecfe2ce715c2e01aedfacf2036e9440N.exe"C:\Users\Admin\AppData\Local\Temp\fecfe2ce715c2e01aedfacf2036e9440N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xxlxlrf.exec:\xxlxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\btbhht.exec:\btbhht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tnhhnt.exec:\tnhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\dpddd.exec:\dpddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lfrrffr.exec:\lfrrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bnhhnt.exec:\bnhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\ppdpj.exec:\ppdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdpvd.exec:\pdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3lffffr.exec:\3lffffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\xrxxllr.exec:\xrxxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\tnnnbn.exec:\tnnnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\vjpvd.exec:\vjpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\ddppd.exec:\ddppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3rlrrrl.exec:\3rlrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\3nhnnb.exec:\3nhnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\bnntnt.exec:\bnntnt.exe17⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pppdj.exec:\pppdj.exe18⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrxfrxr.exec:\xrxfrxr.exe19⤵
- Executes dropped EXE
PID:576 -
\??\c:\ntbhnn.exec:\ntbhnn.exe20⤵
- Executes dropped EXE
PID:864 -
\??\c:\3nbbhh.exec:\3nbbhh.exe21⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jdvjv.exec:\jdvjv.exe22⤵
- Executes dropped EXE
PID:404 -
\??\c:\rrlxrxr.exec:\rrlxrxr.exe23⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3ttbnb.exec:\3ttbnb.exe24⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tttbbb.exec:\tttbbb.exe25⤵
- Executes dropped EXE
PID:480 -
\??\c:\vvjvv.exec:\vvjvv.exe26⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrflrxf.exec:\rrflrxf.exe27⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhbbnn.exec:\nhbbnn.exe28⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1jpvp.exec:\1jpvp.exe29⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vpdjp.exec:\vpdjp.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7rxfflr.exec:\7rxfflr.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xxxfrfl.exec:\xxxfrfl.exe32⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bbtthh.exec:\bbtthh.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nhbtbn.exec:\nhbtbn.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjvjj.exec:\jjvjj.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dppvv.exec:\dppvv.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ffxrflr.exec:\ffxrflr.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1fllrll.exec:\1fllrll.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7hhbth.exec:\7hhbth.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pjddp.exec:\pjddp.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvdvp.exec:\jvdvp.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xxxllrx.exec:\xxxllrx.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrxrxxx.exec:\xrxrxxx.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5nhhhn.exec:\5nhhhn.exe44⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1htnbn.exec:\1htnbn.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\vvvjd.exec:\vvvjd.exe46⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vdvpd.exec:\vdvpd.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\fxrfrxx.exec:\fxrfrxx.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lxlrflf.exec:\lxlrflf.exe49⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnhhbn.exec:\tnhhbn.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jjvjp.exec:\jjvjp.exe51⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3dvpd.exec:\3dvpd.exe52⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jdjjp.exec:\jdjjp.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\lfrxrxl.exec:\lfrxrxl.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\btntbb.exec:\btntbb.exe55⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hbtbnt.exec:\hbtbnt.exe56⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jvjvd.exec:\jvjvd.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pjvvj.exec:\pjvvj.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3xrrfrr.exec:\3xrrfrr.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1llllrl.exec:\1llllrl.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbttbt.exec:\hbttbt.exe61⤵
- Executes dropped EXE
PID:972 -
\??\c:\hhtnhh.exec:\hhtnhh.exe62⤵
- Executes dropped EXE
PID:696 -
\??\c:\pvjjv.exec:\pvjjv.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dvdjp.exec:\dvdjp.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\lflxffr.exec:\lflxffr.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe66⤵PID:2260
-
\??\c:\nhbntt.exec:\nhbntt.exe67⤵PID:1776
-
\??\c:\djvpj.exec:\djvpj.exe68⤵PID:2980
-
\??\c:\7vjjv.exec:\7vjjv.exe69⤵PID:900
-
\??\c:\rrfllxf.exec:\rrfllxf.exe70⤵PID:2520
-
\??\c:\lxffrfx.exec:\lxffrfx.exe71⤵PID:2080
-
\??\c:\bhbthb.exec:\bhbthb.exe72⤵PID:2180
-
\??\c:\tntntn.exec:\tntntn.exe73⤵PID:2376
-
\??\c:\pvpvj.exec:\pvpvj.exe74⤵PID:2712
-
\??\c:\dpdvd.exec:\dpdvd.exe75⤵PID:2792
-
\??\c:\rflrlrr.exec:\rflrlrr.exe76⤵
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\xlxxxlr.exec:\xlxxxlr.exe77⤵PID:2608
-
\??\c:\nbnttn.exec:\nbnttn.exe78⤵PID:2848
-
\??\c:\ddpdv.exec:\ddpdv.exe79⤵PID:2764
-
\??\c:\dpppp.exec:\dpppp.exe80⤵PID:1988
-
\??\c:\xxflfrl.exec:\xxflfrl.exe81⤵PID:3056
-
\??\c:\7llfrrf.exec:\7llfrrf.exe82⤵PID:2668
-
\??\c:\thbhht.exec:\thbhht.exe83⤵PID:280
-
\??\c:\nhtbhn.exec:\nhtbhn.exe84⤵PID:1220
-
\??\c:\dvpdj.exec:\dvpdj.exe85⤵PID:1840
-
\??\c:\5jjvj.exec:\5jjvj.exe86⤵PID:1304
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe87⤵PID:1712
-
\??\c:\lrrlrfx.exec:\lrrlrfx.exe88⤵PID:1252
-
\??\c:\3hhnbn.exec:\3hhnbn.exe89⤵PID:1108
-
\??\c:\hnthnb.exec:\hnthnb.exe90⤵PID:2348
-
\??\c:\3jvpp.exec:\3jvpp.exe91⤵PID:1152
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe92⤵PID:1520
-
\??\c:\llfflrf.exec:\llfflrf.exe93⤵PID:1604
-
\??\c:\httttb.exec:\httttb.exe94⤵PID:2124
-
\??\c:\ttthnb.exec:\ttthnb.exe95⤵PID:532
-
\??\c:\pjppd.exec:\pjppd.exe96⤵PID:2132
-
\??\c:\1vpdj.exec:\1vpdj.exe97⤵PID:2580
-
\??\c:\lrrfxll.exec:\lrrfxll.exe98⤵PID:956
-
\??\c:\bbbtnb.exec:\bbbtnb.exe99⤵PID:2164
-
\??\c:\tnttbn.exec:\tnttbn.exe100⤵PID:2016
-
\??\c:\5vpvp.exec:\5vpvp.exe101⤵PID:2320
-
\??\c:\jpdvv.exec:\jpdvv.exe102⤵PID:616
-
\??\c:\flxlfxr.exec:\flxlfxr.exe103⤵PID:1020
-
\??\c:\5xrxxff.exec:\5xrxxff.exe104⤵PID:548
-
\??\c:\tbbbnn.exec:\tbbbnn.exe105⤵PID:2096
-
\??\c:\hbbnnt.exec:\hbbnnt.exe106⤵PID:748
-
\??\c:\9dpvv.exec:\9dpvv.exe107⤵PID:2168
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe108⤵PID:1652
-
\??\c:\flffxlf.exec:\flffxlf.exe109⤵PID:2184
-
\??\c:\nbthhn.exec:\nbthhn.exe110⤵PID:2460
-
\??\c:\1nbbhn.exec:\1nbbhn.exe111⤵PID:2876
-
\??\c:\jpddv.exec:\jpddv.exe112⤵PID:2336
-
\??\c:\7pddp.exec:\7pddp.exe113⤵PID:1596
-
\??\c:\1fflfll.exec:\1fflfll.exe114⤵PID:2968
-
\??\c:\fxllxxf.exec:\fxllxxf.exe115⤵PID:2832
-
\??\c:\hbhnbb.exec:\hbhnbb.exe116⤵PID:2944
-
\??\c:\bnthhh.exec:\bnthhh.exe117⤵PID:2928
-
\??\c:\dvjvp.exec:\dvjvp.exe118⤵PID:2704
-
\??\c:\vjdpp.exec:\vjdpp.exe119⤵PID:2700
-
\??\c:\xrflrlx.exec:\xrflrlx.exe120⤵PID:2596
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe121⤵PID:2620
-
\??\c:\tthntb.exec:\tthntb.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-