Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe
-
Size
593KB
-
MD5
4081cbe3e7376ce450e2802b823fd6b0
-
SHA1
7e677856ae40d735168aa79bbfdc4edbb47873a9
-
SHA256
69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2
-
SHA512
4024219d4520e9868527d7cba962a53ee011e2ef753119649b4e52a6c04766e6f055bf627ba9f2560178af3aecc016e1efa8b52ffec4152f07163b7e189491d2
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayL6:n3C9Lebz+xt4vFeFmgay+
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/1840-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2288 ddjpv.exe 1612 dvjdj.exe 2700 tnbhnn.exe 2068 hbhhth.exe 2772 rlxrxrr.exe 2880 htnbbb.exe 2840 pjddv.exe 2784 9fffllx.exe 2588 7vdpp.exe 3008 jpppv.exe 1968 thbntn.exe 2488 dvjjp.exe 1272 1bnttb.exe 1944 hnnhhh.exe 1364 xrxrxxl.exe 1732 thnhhh.exe 1892 frrllrr.exe 2256 hthbbt.exe 2612 fxxxxfl.exe 2764 nbbhnn.exe 2500 dpvvp.exe 348 xrxxfll.exe 2608 9bnhnt.exe 1460 vjppv.exe 960 nhbbnn.exe 1704 pjppv.exe 396 lxrrxff.exe 1408 nnnhbn.exe 2392 llrrrrr.exe 1516 pjdpd.exe 1768 xrffxxx.exe 1608 bntnbb.exe 2440 9vjjj.exe 2604 xrfxffl.exe 2660 htbhbh.exe 2716 thhthn.exe 2664 vpddj.exe 2184 5rxlfrr.exe 2748 tnhbhn.exe 2796 tthhhn.exe 2676 dvvvj.exe 2576 fxrxffl.exe 2564 tbhnnn.exe 2984 tthbnn.exe 1208 vpddj.exe 844 lfllrff.exe 1616 bbtntt.exe 1928 btnhnn.exe 2444 jjddj.exe 2352 rlxrffl.exe 1884 nhtbhb.exe 1888 ttntbh.exe 2036 pdvdd.exe 1032 xrxfllr.exe 3004 htbhtt.exe 2704 thhhhh.exe 1480 jvddv.exe 2500 xxllrfl.exe 1744 hbnttn.exe 2204 vjjdd.exe 1648 pvddj.exe 1172 9rlrxxl.exe 1932 thhhbt.exe 2932 nhtttb.exe -
resource yara_rule behavioral1/memory/1840-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2288 1840 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 30 PID 1840 wrote to memory of 2288 1840 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 30 PID 1840 wrote to memory of 2288 1840 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 30 PID 1840 wrote to memory of 2288 1840 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 30 PID 2288 wrote to memory of 1612 2288 ddjpv.exe 31 PID 2288 wrote to memory of 1612 2288 ddjpv.exe 31 PID 2288 wrote to memory of 1612 2288 ddjpv.exe 31 PID 2288 wrote to memory of 1612 2288 ddjpv.exe 31 PID 1612 wrote to memory of 2700 1612 dvjdj.exe 32 PID 1612 wrote to memory of 2700 1612 dvjdj.exe 32 PID 1612 wrote to memory of 2700 1612 dvjdj.exe 32 PID 1612 wrote to memory of 2700 1612 dvjdj.exe 32 PID 2700 wrote to memory of 2068 2700 tnbhnn.exe 33 PID 2700 wrote to memory of 2068 2700 tnbhnn.exe 33 PID 2700 wrote to memory of 2068 2700 tnbhnn.exe 33 PID 2700 wrote to memory of 2068 2700 tnbhnn.exe 33 PID 2068 wrote to memory of 2772 2068 hbhhth.exe 34 PID 2068 wrote to memory of 2772 2068 hbhhth.exe 34 PID 2068 wrote to memory of 2772 2068 hbhhth.exe 34 PID 2068 wrote to memory of 2772 2068 hbhhth.exe 34 PID 2772 wrote to memory of 2880 2772 rlxrxrr.exe 35 PID 2772 wrote to memory of 2880 2772 rlxrxrr.exe 35 PID 2772 wrote to memory of 2880 2772 rlxrxrr.exe 35 PID 2772 wrote to memory of 2880 2772 rlxrxrr.exe 35 PID 2880 wrote to memory of 2840 2880 htnbbb.exe 36 PID 2880 wrote to memory of 2840 2880 htnbbb.exe 36 PID 2880 wrote to memory of 2840 2880 htnbbb.exe 36 PID 2880 wrote to memory of 2840 2880 htnbbb.exe 36 PID 2840 wrote to memory of 2784 2840 pjddv.exe 37 PID 2840 wrote to memory of 2784 2840 pjddv.exe 37 PID 2840 wrote to memory of 2784 2840 pjddv.exe 37 PID 2840 wrote to memory of 2784 2840 pjddv.exe 37 PID 2784 wrote to memory of 2588 2784 9fffllx.exe 38 PID 2784 wrote to memory of 2588 2784 9fffllx.exe 38 PID 2784 wrote to memory of 2588 2784 9fffllx.exe 38 PID 2784 wrote to memory of 2588 2784 9fffllx.exe 38 PID 2588 wrote to memory of 3008 2588 7vdpp.exe 39 PID 2588 wrote to memory of 3008 2588 7vdpp.exe 39 PID 2588 wrote to memory of 3008 2588 7vdpp.exe 39 PID 2588 wrote to memory of 3008 2588 7vdpp.exe 39 PID 3008 wrote to memory of 1968 3008 jpppv.exe 40 PID 3008 wrote to memory of 1968 3008 jpppv.exe 40 PID 3008 wrote to memory of 1968 3008 jpppv.exe 40 PID 3008 wrote to memory of 1968 3008 jpppv.exe 40 PID 1968 wrote to memory of 2488 1968 thbntn.exe 41 PID 1968 wrote to memory of 2488 1968 thbntn.exe 41 PID 1968 wrote to memory of 2488 1968 thbntn.exe 41 PID 1968 wrote to memory of 2488 1968 thbntn.exe 41 PID 2488 wrote to memory of 1272 2488 dvjjp.exe 42 PID 2488 wrote to memory of 1272 2488 dvjjp.exe 42 PID 2488 wrote to memory of 1272 2488 dvjjp.exe 42 PID 2488 wrote to memory of 1272 2488 dvjjp.exe 42 PID 1272 wrote to memory of 1944 1272 1bnttb.exe 43 PID 1272 wrote to memory of 1944 1272 1bnttb.exe 43 PID 1272 wrote to memory of 1944 1272 1bnttb.exe 43 PID 1272 wrote to memory of 1944 1272 1bnttb.exe 43 PID 1944 wrote to memory of 1364 1944 hnnhhh.exe 44 PID 1944 wrote to memory of 1364 1944 hnnhhh.exe 44 PID 1944 wrote to memory of 1364 1944 hnnhhh.exe 44 PID 1944 wrote to memory of 1364 1944 hnnhhh.exe 44 PID 1364 wrote to memory of 1732 1364 xrxrxxl.exe 45 PID 1364 wrote to memory of 1732 1364 xrxrxxl.exe 45 PID 1364 wrote to memory of 1732 1364 xrxrxxl.exe 45 PID 1364 wrote to memory of 1732 1364 xrxrxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe"C:\Users\Admin\AppData\Local\Temp\69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\ddjpv.exec:\ddjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\dvjdj.exec:\dvjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\tnbhnn.exec:\tnbhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hbhhth.exec:\hbhhth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rlxrxrr.exec:\rlxrxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\htnbbb.exec:\htnbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pjddv.exec:\pjddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\9fffllx.exec:\9fffllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7vdpp.exec:\7vdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jpppv.exec:\jpppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\thbntn.exec:\thbntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\dvjjp.exec:\dvjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\1bnttb.exec:\1bnttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\hnnhhh.exec:\hnnhhh.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\xrxrxxl.exec:\xrxrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\thnhhh.exec:\thnhhh.exe17⤵
- Executes dropped EXE
PID:1732 -
\??\c:\frrllrr.exec:\frrllrr.exe18⤵
- Executes dropped EXE
PID:1892 -
\??\c:\hthbbt.exec:\hthbbt.exe19⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxxxxfl.exec:\fxxxxfl.exe20⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbbhnn.exec:\nbbhnn.exe21⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dpvvp.exec:\dpvvp.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrxxfll.exec:\xrxxfll.exe23⤵
- Executes dropped EXE
PID:348 -
\??\c:\9bnhnt.exec:\9bnhnt.exe24⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vjppv.exec:\vjppv.exe25⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nhbbnn.exec:\nhbbnn.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\pjppv.exec:\pjppv.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lxrrxff.exec:\lxrrxff.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\nnnhbn.exec:\nnnhbn.exe29⤵
- Executes dropped EXE
PID:1408 -
\??\c:\llrrrrr.exec:\llrrrrr.exe30⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjdpd.exec:\pjdpd.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrffxxx.exec:\xrffxxx.exe32⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bntnbb.exec:\bntnbb.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9vjjj.exec:\9vjjj.exe34⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrfxffl.exec:\xrfxffl.exe35⤵
- Executes dropped EXE
PID:2604 -
\??\c:\htbhbh.exec:\htbhbh.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\thhthn.exec:\thhthn.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpddj.exec:\vpddj.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5rxlfrr.exec:\5rxlfrr.exe39⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnhbhn.exec:\tnhbhn.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tthhhn.exec:\tthhhn.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\dvvvj.exec:\dvvvj.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\fxrxffl.exec:\fxrxffl.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tbhnnn.exec:\tbhnnn.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\tthbnn.exec:\tthbnn.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpddj.exec:\vpddj.exe46⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lfllrff.exec:\lfllrff.exe47⤵
- Executes dropped EXE
PID:844 -
\??\c:\bbtntt.exec:\bbtntt.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\btnhnn.exec:\btnhnn.exe49⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jjddj.exec:\jjddj.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rlxrffl.exec:\rlxrffl.exe51⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhtbhb.exec:\nhtbhb.exe52⤵
- Executes dropped EXE
PID:1884 -
\??\c:\ttntbh.exec:\ttntbh.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pdvdd.exec:\pdvdd.exe54⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrxfllr.exec:\xrxfllr.exe55⤵
- Executes dropped EXE
PID:1032 -
\??\c:\htbhtt.exec:\htbhtt.exe56⤵
- Executes dropped EXE
PID:3004 -
\??\c:\thhhhh.exec:\thhhhh.exe57⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jvddv.exec:\jvddv.exe58⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xxllrfl.exec:\xxllrfl.exe59⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hbnttn.exec:\hbnttn.exe60⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vjjdd.exec:\vjjdd.exe61⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pvddj.exec:\pvddj.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9rlrxxl.exec:\9rlrxxl.exe63⤵
- Executes dropped EXE
PID:1172 -
\??\c:\thhhbt.exec:\thhhbt.exe64⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nhtttb.exec:\nhtttb.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vjvvd.exec:\vjvvd.exe66⤵PID:2104
-
\??\c:\lrfxflf.exec:\lrfxflf.exe67⤵PID:2280
-
\??\c:\rlxllll.exec:\rlxllll.exe68⤵PID:1964
-
\??\c:\htbbhb.exec:\htbbhb.exe69⤵PID:2552
-
\??\c:\dppvd.exec:\dppvd.exe70⤵PID:2872
-
\??\c:\rlrflxf.exec:\rlrflxf.exe71⤵PID:2800
-
\??\c:\lffffll.exec:\lffffll.exe72⤵PID:2116
-
\??\c:\bthnnn.exec:\bthnnn.exe73⤵PID:2436
-
\??\c:\vpvdv.exec:\vpvdv.exe74⤵PID:868
-
\??\c:\frllxxf.exec:\frllxxf.exe75⤵PID:2640
-
\??\c:\nbnntn.exec:\nbnntn.exe76⤵PID:2620
-
\??\c:\1bbhnb.exec:\1bbhnb.exe77⤵PID:2712
-
\??\c:\vpjpv.exec:\vpjpv.exe78⤵PID:2372
-
\??\c:\lllxlfl.exec:\lllxlfl.exe79⤵PID:2540
-
\??\c:\ttbnhh.exec:\ttbnhh.exe80⤵PID:284
-
\??\c:\9vjvj.exec:\9vjvj.exe81⤵PID:2840
-
\??\c:\vdjpd.exec:\vdjpd.exe82⤵PID:2584
-
\??\c:\7rlrrrx.exec:\7rlrrrx.exe83⤵PID:3020
-
\??\c:\5bbhht.exec:\5bbhht.exe84⤵PID:1876
-
\??\c:\pdvjv.exec:\pdvjv.exe85⤵PID:3008
-
\??\c:\xxxrfxf.exec:\xxxrfxf.exe86⤵PID:1960
-
\??\c:\1fxffll.exec:\1fxffll.exe87⤵PID:1664
-
\??\c:\hbnnhn.exec:\hbnnhn.exe88⤵PID:2248
-
\??\c:\pjppv.exec:\pjppv.exe89⤵PID:1980
-
\??\c:\5lxrrrr.exec:\5lxrrrr.exe90⤵PID:2304
-
\??\c:\tnnnbt.exec:\tnnnbt.exe91⤵PID:1860
-
\??\c:\5htnnh.exec:\5htnnh.exe92⤵PID:1864
-
\??\c:\vvjjp.exec:\vvjjp.exe93⤵PID:1708
-
\??\c:\3hbhhh.exec:\3hbhhh.exe94⤵PID:2964
-
\??\c:\hbntbt.exec:\hbntbt.exe95⤵PID:2256
-
\??\c:\1pvpp.exec:\1pvpp.exe96⤵PID:2952
-
\??\c:\rfrffrr.exec:\rfrffrr.exe97⤵PID:2756
-
\??\c:\5btntn.exec:\5btntn.exe98⤵PID:2580
-
\??\c:\3nnhhn.exec:\3nnhhn.exe99⤵PID:1400
-
\??\c:\pvjjp.exec:\pvjjp.exe100⤵PID:348
-
\??\c:\lfrxflr.exec:\lfrxflr.exe101⤵PID:1504
-
\??\c:\3bntnn.exec:\3bntnn.exe102⤵PID:1288
-
\??\c:\ntbhth.exec:\ntbhth.exe103⤵PID:1844
-
\??\c:\pjppj.exec:\pjppj.exe104⤵PID:3044
-
\??\c:\lxrlflf.exec:\lxrlflf.exe105⤵PID:2164
-
\??\c:\flfrrxl.exec:\flfrrxl.exe106⤵PID:3052
-
\??\c:\htnnhb.exec:\htnnhb.exe107⤵PID:2052
-
\??\c:\dpppv.exec:\dpppv.exe108⤵PID:2224
-
\??\c:\xrxxlll.exec:\xrxxlll.exe109⤵PID:2552
-
\??\c:\xfflrxr.exec:\xfflrxr.exe110⤵PID:1872
-
\??\c:\bbthnt.exec:\bbthnt.exe111⤵PID:2136
-
\??\c:\jdddv.exec:\jdddv.exe112⤵PID:2448
-
\??\c:\jdddd.exec:\jdddd.exe113⤵PID:2868
-
\??\c:\lflrrxl.exec:\lflrrxl.exe114⤵PID:2652
-
\??\c:\nhhhbt.exec:\nhhhbt.exe115⤵PID:2724
-
\??\c:\5dpvp.exec:\5dpvp.exe116⤵PID:2708
-
\??\c:\jdppp.exec:\jdppp.exe117⤵PID:2740
-
\??\c:\lfrxxlf.exec:\lfrxxlf.exe118⤵PID:2656
-
\??\c:\tnnnnn.exec:\tnnnnn.exe119⤵PID:2536
-
\??\c:\3pvpp.exec:\3pvpp.exe120⤵PID:2832
-
\??\c:\xxllrxf.exec:\xxllrxf.exe121⤵PID:2532
-
\??\c:\bnhtth.exec:\bnhtth.exe122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-