Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe
Resource
win7-20240903-en
General
-
Target
fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe
-
Size
82KB
-
MD5
2ef71c6c9977c4d36b6fc25da4472f10
-
SHA1
1ae02de6a22339f0d1ec890fab323e5dddf1c1b4
-
SHA256
fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45a
-
SHA512
49b5151f77eaa266462b33e126b8d932581e9847f6a4ed6f25e0b3d8c2582fbe447315a9146a6d9718f969298bd43ce246d7d735362db458ecf72321784bd0cf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qj:ymb3NkkiQ3mdBjFIIp9L9QrrA8C
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/584-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-3130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2344 xlxxllr.exe 276 hthbnh.exe 2728 ppppd.exe 2656 7rllllr.exe 2812 rxxrrll.exe 2820 5hnttt.exe 2800 ddvdp.exe 2552 fxlxflx.exe 3012 rfrrfxf.exe 2008 9bbbnh.exe 2432 3ntntt.exe 1040 pjddp.exe 1888 vdpjp.exe 2364 jvpvd.exe 2036 xrlrflx.exe 1020 hthhnh.exe 2536 lfxlxfr.exe 2908 htntbt.exe 2644 7nbthb.exe 1536 7dvdj.exe 1976 xrfxrff.exe 696 thttbh.exe 2504 vvjjv.exe 1612 vpdpp.exe 1008 lfrxlfl.exe 1868 frrxffr.exe 2288 dvpdp.exe 2588 jjpdv.exe 1672 xrrxrff.exe 2184 lllxlfx.exe 2336 bthhnn.exe 2344 9djjp.exe 2832 5ppjp.exe 2220 fxllffl.exe 1608 hbtbbh.exe 2700 hbtntt.exe 2704 vpddd.exe 2844 pjvvv.exe 2740 lfrxxfl.exe 2820 llrxfff.exe 2828 5tnbhh.exe 2576 hthtnn.exe 3016 pppdv.exe 1920 5vdpp.exe 2304 rlflflf.exe 1988 fxlrfll.exe 856 bthtbt.exe 1588 thtbbb.exe 948 5vvpd.exe 2524 rlxflrf.exe 1368 hhtbtb.exe 2036 bbtbnt.exe 2784 7dvvp.exe 2988 pppvj.exe 2896 lllxlfx.exe 2144 lfrxffx.exe 2948 bnthth.exe 408 nhthnb.exe 1860 pjppj.exe 1264 ddddp.exe 1640 ffxlrrf.exe 328 9bnhtb.exe 904 hnbtbb.exe 1008 dddjj.exe -
resource yara_rule behavioral1/memory/2344-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-3130-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 584 wrote to memory of 2344 584 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 31 PID 584 wrote to memory of 2344 584 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 31 PID 584 wrote to memory of 2344 584 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 31 PID 584 wrote to memory of 2344 584 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 31 PID 2344 wrote to memory of 276 2344 xlxxllr.exe 32 PID 2344 wrote to memory of 276 2344 xlxxllr.exe 32 PID 2344 wrote to memory of 276 2344 xlxxllr.exe 32 PID 2344 wrote to memory of 276 2344 xlxxllr.exe 32 PID 276 wrote to memory of 2728 276 hthbnh.exe 33 PID 276 wrote to memory of 2728 276 hthbnh.exe 33 PID 276 wrote to memory of 2728 276 hthbnh.exe 33 PID 276 wrote to memory of 2728 276 hthbnh.exe 33 PID 2728 wrote to memory of 2656 2728 ppppd.exe 34 PID 2728 wrote to memory of 2656 2728 ppppd.exe 34 PID 2728 wrote to memory of 2656 2728 ppppd.exe 34 PID 2728 wrote to memory of 2656 2728 ppppd.exe 34 PID 2656 wrote to memory of 2812 2656 7rllllr.exe 35 PID 2656 wrote to memory of 2812 2656 7rllllr.exe 35 PID 2656 wrote to memory of 2812 2656 7rllllr.exe 35 PID 2656 wrote to memory of 2812 2656 7rllllr.exe 35 PID 2812 wrote to memory of 2820 2812 rxxrrll.exe 36 PID 2812 wrote to memory of 2820 2812 rxxrrll.exe 36 PID 2812 wrote to memory of 2820 2812 rxxrrll.exe 36 PID 2812 wrote to memory of 2820 2812 rxxrrll.exe 36 PID 2820 wrote to memory of 2800 2820 5hnttt.exe 37 PID 2820 wrote to memory of 2800 2820 5hnttt.exe 37 PID 2820 wrote to memory of 2800 2820 5hnttt.exe 37 PID 2820 wrote to memory of 2800 2820 5hnttt.exe 37 PID 2800 wrote to memory of 2552 2800 ddvdp.exe 38 PID 2800 wrote to memory of 2552 2800 ddvdp.exe 38 PID 2800 wrote to memory of 2552 2800 ddvdp.exe 38 PID 2800 wrote to memory of 2552 2800 ddvdp.exe 38 PID 2552 wrote to memory of 3012 2552 fxlxflx.exe 39 PID 2552 wrote to memory of 3012 2552 fxlxflx.exe 39 PID 2552 wrote to memory of 3012 2552 fxlxflx.exe 39 PID 2552 wrote to memory of 3012 2552 fxlxflx.exe 39 PID 3012 wrote to memory of 2008 3012 rfrrfxf.exe 40 PID 3012 wrote to memory of 2008 3012 rfrrfxf.exe 40 PID 3012 wrote to memory of 2008 3012 rfrrfxf.exe 40 PID 3012 wrote to memory of 2008 3012 rfrrfxf.exe 40 PID 2008 wrote to memory of 2432 2008 9bbbnh.exe 41 PID 2008 wrote to memory of 2432 2008 9bbbnh.exe 41 PID 2008 wrote to memory of 2432 2008 9bbbnh.exe 41 PID 2008 wrote to memory of 2432 2008 9bbbnh.exe 41 PID 2432 wrote to memory of 1040 2432 3ntntt.exe 42 PID 2432 wrote to memory of 1040 2432 3ntntt.exe 42 PID 2432 wrote to memory of 1040 2432 3ntntt.exe 42 PID 2432 wrote to memory of 1040 2432 3ntntt.exe 42 PID 1040 wrote to memory of 1888 1040 pjddp.exe 43 PID 1040 wrote to memory of 1888 1040 pjddp.exe 43 PID 1040 wrote to memory of 1888 1040 pjddp.exe 43 PID 1040 wrote to memory of 1888 1040 pjddp.exe 43 PID 1888 wrote to memory of 2364 1888 vdpjp.exe 44 PID 1888 wrote to memory of 2364 1888 vdpjp.exe 44 PID 1888 wrote to memory of 2364 1888 vdpjp.exe 44 PID 1888 wrote to memory of 2364 1888 vdpjp.exe 44 PID 2364 wrote to memory of 2036 2364 jvpvd.exe 45 PID 2364 wrote to memory of 2036 2364 jvpvd.exe 45 PID 2364 wrote to memory of 2036 2364 jvpvd.exe 45 PID 2364 wrote to memory of 2036 2364 jvpvd.exe 45 PID 2036 wrote to memory of 1020 2036 xrlrflx.exe 46 PID 2036 wrote to memory of 1020 2036 xrlrflx.exe 46 PID 2036 wrote to memory of 1020 2036 xrlrflx.exe 46 PID 2036 wrote to memory of 1020 2036 xrlrflx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe"C:\Users\Admin\AppData\Local\Temp\fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\xlxxllr.exec:\xlxxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\hthbnh.exec:\hthbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\ppppd.exec:\ppppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7rllllr.exec:\7rllllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\rxxrrll.exec:\rxxrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5hnttt.exec:\5hnttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ddvdp.exec:\ddvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\fxlxflx.exec:\fxlxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\rfrrfxf.exec:\rfrrfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\9bbbnh.exec:\9bbbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\3ntntt.exec:\3ntntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\pjddp.exec:\pjddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\vdpjp.exec:\vdpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\jvpvd.exec:\jvpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\xrlrflx.exec:\xrlrflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hthhnh.exec:\hthhnh.exe17⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe18⤵
- Executes dropped EXE
PID:2536 -
\??\c:\htntbt.exec:\htntbt.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7nbthb.exec:\7nbthb.exe20⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7dvdj.exec:\7dvdj.exe21⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrfxrff.exec:\xrfxrff.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\thttbh.exec:\thttbh.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\vvjjv.exec:\vvjjv.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vpdpp.exec:\vpdpp.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe26⤵
- Executes dropped EXE
PID:1008 -
\??\c:\frrxffr.exec:\frrxffr.exe27⤵
- Executes dropped EXE
PID:1868 -
\??\c:\dvpdp.exec:\dvpdp.exe28⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jjpdv.exec:\jjpdv.exe29⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrrxrff.exec:\xrrxrff.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lllxlfx.exec:\lllxlfx.exe31⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bthhnn.exec:\bthhnn.exe32⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9djjp.exec:\9djjp.exe33⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5ppjp.exec:\5ppjp.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fxllffl.exec:\fxllffl.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbtbbh.exec:\hbtbbh.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbtntt.exec:\hbtntt.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjvvv.exec:\pjvvv.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lfrxxfl.exec:\lfrxxfl.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\llrxfff.exec:\llrxfff.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5tnbhh.exec:\5tnbhh.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hthtnn.exec:\hthtnn.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pppdv.exec:\pppdv.exe44⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5vdpp.exec:\5vdpp.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlflflf.exec:\rlflflf.exe46⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fxlrfll.exec:\fxlrfll.exe47⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bthtbt.exec:\bthtbt.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\thtbbb.exec:\thtbbb.exe49⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5vvpd.exec:\5vvpd.exe50⤵
- Executes dropped EXE
PID:948 -
\??\c:\rlxflrf.exec:\rlxflrf.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhtbtb.exec:\hhtbtb.exe52⤵
- Executes dropped EXE
PID:1368 -
\??\c:\bbtbnt.exec:\bbtbnt.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7dvvp.exec:\7dvvp.exe54⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pppvj.exec:\pppvj.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lllxlfx.exec:\lllxlfx.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lfrxffx.exec:\lfrxffx.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bnthth.exec:\bnthth.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhthnb.exec:\nhthnb.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\pjppj.exec:\pjppj.exe60⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ddddp.exec:\ddddp.exe61⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ffxlrrf.exec:\ffxlrrf.exe62⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9bnhtb.exec:\9bnhtb.exe63⤵
- Executes dropped EXE
PID:328 -
\??\c:\hnbtbb.exec:\hnbtbb.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\dddjj.exec:\dddjj.exe65⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vpdpd.exec:\vpdpd.exe66⤵PID:2140
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe67⤵PID:2408
-
\??\c:\rrxlxlr.exec:\rrxlxlr.exe68⤵PID:2188
-
\??\c:\bbtbnt.exec:\bbtbnt.exe69⤵PID:2252
-
\??\c:\9hbhbh.exec:\9hbhbh.exe70⤵PID:888
-
\??\c:\vvdvj.exec:\vvdvj.exe71⤵PID:2100
-
\??\c:\ddvpj.exec:\ddvpj.exe72⤵PID:3000
-
\??\c:\rlxxflr.exec:\rlxxflr.exe73⤵PID:2132
-
\??\c:\3lxxrxr.exec:\3lxxrxr.exe74⤵PID:2632
-
\??\c:\nntnnh.exec:\nntnnh.exe75⤵PID:3036
-
\??\c:\btnnhn.exec:\btnnhn.exe76⤵PID:1504
-
\??\c:\vpdjv.exec:\vpdjv.exe77⤵PID:2680
-
\??\c:\pddjv.exec:\pddjv.exe78⤵PID:2736
-
\??\c:\7rxfrxr.exec:\7rxfrxr.exe79⤵PID:2416
-
\??\c:\7ffxflx.exec:\7ffxflx.exe80⤵PID:2668
-
\??\c:\bbhttb.exec:\bbhttb.exe81⤵PID:2556
-
\??\c:\hbbbhh.exec:\hbbbhh.exe82⤵PID:2548
-
\??\c:\jjjpj.exec:\jjjpj.exe83⤵PID:2648
-
\??\c:\vpdjd.exec:\vpdjd.exe84⤵PID:2552
-
\??\c:\rrrxllx.exec:\rrrxllx.exe85⤵PID:3028
-
\??\c:\rllfflf.exec:\rllfflf.exe86⤵PID:2620
-
\??\c:\xxxlfrr.exec:\xxxlfrr.exe87⤵PID:2008
-
\??\c:\tntbtt.exec:\tntbtt.exe88⤵PID:1900
-
\??\c:\nnbnnt.exec:\nnbnnt.exe89⤵PID:736
-
\??\c:\dvpvj.exec:\dvpvj.exe90⤵
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\1pddp.exec:\1pddp.exe91⤵PID:2368
-
\??\c:\ffrllfx.exec:\ffrllfx.exe92⤵PID:1568
-
\??\c:\fxllflf.exec:\fxllflf.exe93⤵PID:624
-
\??\c:\5bnnbt.exec:\5bnnbt.exe94⤵PID:2776
-
\??\c:\tthnbn.exec:\tthnbn.exe95⤵PID:2028
-
\??\c:\5ppdd.exec:\5ppdd.exe96⤵PID:2636
-
\??\c:\jdvdp.exec:\jdvdp.exe97⤵PID:2080
-
\??\c:\jvpvv.exec:\jvpvv.exe98⤵PID:2756
-
\??\c:\rllxfrx.exec:\rllxfrx.exe99⤵PID:1624
-
\??\c:\7rlfffr.exec:\7rlfffr.exe100⤵PID:2652
-
\??\c:\9tnbtb.exec:\9tnbtb.exe101⤵PID:1664
-
\??\c:\5hhhtb.exec:\5hhhtb.exe102⤵PID:1592
-
\??\c:\1vvjj.exec:\1vvjj.exe103⤵PID:2164
-
\??\c:\dvjjv.exec:\dvjjv.exe104⤵PID:864
-
\??\c:\fxlrflr.exec:\fxlrflr.exe105⤵PID:980
-
\??\c:\llflffr.exec:\llflffr.exe106⤵PID:1736
-
\??\c:\hhtthn.exec:\hhtthn.exe107⤵PID:236
-
\??\c:\nttnht.exec:\nttnht.exe108⤵PID:880
-
\??\c:\hhtnhh.exec:\hhtnhh.exe109⤵PID:752
-
\??\c:\jdjvj.exec:\jdjvj.exe110⤵PID:1432
-
\??\c:\vpdjv.exec:\vpdjv.exe111⤵PID:496
-
\??\c:\3xffxxr.exec:\3xffxxr.exe112⤵PID:1356
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe113⤵PID:1668
-
\??\c:\9xlfrfl.exec:\9xlfrfl.exe114⤵PID:2072
-
\??\c:\nnbntb.exec:\nnbntb.exe115⤵PID:276
-
\??\c:\5hbbhn.exec:\5hbbhn.exe116⤵
- System Location Discovery: System Language Discovery
PID:1456 -
\??\c:\jdvjv.exec:\jdvjv.exe117⤵PID:2692
-
\??\c:\dvpdj.exec:\dvpdj.exe118⤵PID:2656
-
\??\c:\ffxfflf.exec:\ffxfflf.exe119⤵PID:2684
-
\??\c:\fffxrfx.exec:\fffxrfx.exe120⤵PID:2932
-
\??\c:\3ntbbb.exec:\3ntbbb.exe121⤵PID:3060
-
\??\c:\bbbtht.exec:\bbbtht.exe122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-