Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe
-
Size
67KB
-
MD5
3d7f150d61e1b668d68ef7f24d2dbb70
-
SHA1
41a1a1bec653332adf3d3f209ca2db80075e8198
-
SHA256
9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62e
-
SHA512
55ebdcb87d2d6be2bfd5e608062f303fe0699a251864d696dc01f5186e08aa19d2cc4c8ff78d049f6e5db2862471bf9bed3401916636468ffc15f9dc515b33b4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfo4o:ymb3NkkiQ3mdBjFI9cqfVo
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2088-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 ltjnjn.exe 2784 lhtnh.exe 2820 fbfvprv.exe 2244 rrdbp.exe 2724 fntfpl.exe 2608 nlddlxl.exe 2168 rthdhfn.exe 2420 ndhvtp.exe 2356 thpft.exe 2944 pvbnxt.exe 1488 bfdvvh.exe 2104 rjjbhf.exe 2392 hnvbn.exe 540 hthdx.exe 2296 fllfxn.exe 2220 pdlfhh.exe 2136 jbdftr.exe 2376 flnjt.exe 2924 fjhjj.exe 336 jvjldh.exe 1512 rbtjnbn.exe 1812 nnlhb.exe 1460 vhhpdf.exe 2996 bpnjhp.exe 1936 hrvlbd.exe 2036 ppvttxb.exe 2404 llplx.exe 2528 djdhxn.exe 1524 hnjrd.exe 1960 dhbbp.exe 2288 txvblh.exe 2500 bntrfj.exe 2684 fjtrbv.exe 2780 nhnxn.exe 2660 thptjbj.exe 2784 pfrrbj.exe 2884 lpfxtr.exe 2792 lvfdlfj.exe 2692 bfnrrl.exe 2568 vptff.exe 2956 ftxhhjv.exe 1692 vljbjt.exe 924 hlrjv.exe 2168 hfllf.exe 2348 hvvpjb.exe 2544 hrtlvn.exe 2128 bdvjx.exe 2944 ttbprtv.exe 1672 rvfvjnv.exe 1236 nhtvx.exe 884 fbnfjn.exe 2000 rnjrp.exe 664 ntrxvjj.exe 2140 nhvbnt.exe 2300 tbtnv.exe 2344 vxbdjhj.exe 1964 xfrjxh.exe 2188 lfbpj.exe 2412 vtbhn.exe 336 jbflpl.exe 1512 rxtln.exe 2936 fdxjn.exe 996 pldvbv.exe 1952 bhtft.exe -
resource yara_rule behavioral1/memory/2088-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnfbfvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdjvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxbnxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxjvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lblnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btjlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnfdbpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjxrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfnvfpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbdfpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdffdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnvdbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjfvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vflvlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrbtnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfrnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrljhrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2072 2088 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 30 PID 2088 wrote to memory of 2072 2088 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 30 PID 2088 wrote to memory of 2072 2088 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 30 PID 2088 wrote to memory of 2072 2088 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 30 PID 2072 wrote to memory of 2784 2072 ltjnjn.exe 31 PID 2072 wrote to memory of 2784 2072 ltjnjn.exe 31 PID 2072 wrote to memory of 2784 2072 ltjnjn.exe 31 PID 2072 wrote to memory of 2784 2072 ltjnjn.exe 31 PID 2784 wrote to memory of 2820 2784 lhtnh.exe 32 PID 2784 wrote to memory of 2820 2784 lhtnh.exe 32 PID 2784 wrote to memory of 2820 2784 lhtnh.exe 32 PID 2784 wrote to memory of 2820 2784 lhtnh.exe 32 PID 2820 wrote to memory of 2244 2820 fbfvprv.exe 33 PID 2820 wrote to memory of 2244 2820 fbfvprv.exe 33 PID 2820 wrote to memory of 2244 2820 fbfvprv.exe 33 PID 2820 wrote to memory of 2244 2820 fbfvprv.exe 33 PID 2244 wrote to memory of 2724 2244 rrdbp.exe 34 PID 2244 wrote to memory of 2724 2244 rrdbp.exe 34 PID 2244 wrote to memory of 2724 2244 rrdbp.exe 34 PID 2244 wrote to memory of 2724 2244 rrdbp.exe 34 PID 2724 wrote to memory of 2608 2724 fntfpl.exe 35 PID 2724 wrote to memory of 2608 2724 fntfpl.exe 35 PID 2724 wrote to memory of 2608 2724 fntfpl.exe 35 PID 2724 wrote to memory of 2608 2724 fntfpl.exe 35 PID 2608 wrote to memory of 2168 2608 nlddlxl.exe 36 PID 2608 wrote to memory of 2168 2608 nlddlxl.exe 36 PID 2608 wrote to memory of 2168 2608 nlddlxl.exe 36 PID 2608 wrote to memory of 2168 2608 nlddlxl.exe 36 PID 2168 wrote to memory of 2420 2168 rthdhfn.exe 37 PID 2168 wrote to memory of 2420 2168 rthdhfn.exe 37 PID 2168 wrote to memory of 2420 2168 rthdhfn.exe 37 PID 2168 wrote to memory of 2420 2168 rthdhfn.exe 37 PID 2420 wrote to memory of 2356 2420 ndhvtp.exe 38 PID 2420 wrote to memory of 2356 2420 ndhvtp.exe 38 PID 2420 wrote to memory of 2356 2420 ndhvtp.exe 38 PID 2420 wrote to memory of 2356 2420 ndhvtp.exe 38 PID 2356 wrote to memory of 2944 2356 thpft.exe 39 PID 2356 wrote to memory of 2944 2356 thpft.exe 39 PID 2356 wrote to memory of 2944 2356 thpft.exe 39 PID 2356 wrote to memory of 2944 2356 thpft.exe 39 PID 2944 wrote to memory of 1488 2944 pvbnxt.exe 40 PID 2944 wrote to memory of 1488 2944 pvbnxt.exe 40 PID 2944 wrote to memory of 1488 2944 pvbnxt.exe 40 PID 2944 wrote to memory of 1488 2944 pvbnxt.exe 40 PID 1488 wrote to memory of 2104 1488 bfdvvh.exe 41 PID 1488 wrote to memory of 2104 1488 bfdvvh.exe 41 PID 1488 wrote to memory of 2104 1488 bfdvvh.exe 41 PID 1488 wrote to memory of 2104 1488 bfdvvh.exe 41 PID 2104 wrote to memory of 2392 2104 rjjbhf.exe 42 PID 2104 wrote to memory of 2392 2104 rjjbhf.exe 42 PID 2104 wrote to memory of 2392 2104 rjjbhf.exe 42 PID 2104 wrote to memory of 2392 2104 rjjbhf.exe 42 PID 2392 wrote to memory of 540 2392 hnvbn.exe 43 PID 2392 wrote to memory of 540 2392 hnvbn.exe 43 PID 2392 wrote to memory of 540 2392 hnvbn.exe 43 PID 2392 wrote to memory of 540 2392 hnvbn.exe 43 PID 540 wrote to memory of 2296 540 hthdx.exe 44 PID 540 wrote to memory of 2296 540 hthdx.exe 44 PID 540 wrote to memory of 2296 540 hthdx.exe 44 PID 540 wrote to memory of 2296 540 hthdx.exe 44 PID 2296 wrote to memory of 2220 2296 fllfxn.exe 45 PID 2296 wrote to memory of 2220 2296 fllfxn.exe 45 PID 2296 wrote to memory of 2220 2296 fllfxn.exe 45 PID 2296 wrote to memory of 2220 2296 fllfxn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe"C:\Users\Admin\AppData\Local\Temp\9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ltjnjn.exec:\ltjnjn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lhtnh.exec:\lhtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fbfvprv.exec:\fbfvprv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrdbp.exec:\rrdbp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\fntfpl.exec:\fntfpl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nlddlxl.exec:\nlddlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rthdhfn.exec:\rthdhfn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ndhvtp.exec:\ndhvtp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\thpft.exec:\thpft.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pvbnxt.exec:\pvbnxt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bfdvvh.exec:\bfdvvh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\rjjbhf.exec:\rjjbhf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\hnvbn.exec:\hnvbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\hthdx.exec:\hthdx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fllfxn.exec:\fllfxn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\pdlfhh.exec:\pdlfhh.exe17⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jbdftr.exec:\jbdftr.exe18⤵
- Executes dropped EXE
PID:2136 -
\??\c:\flnjt.exec:\flnjt.exe19⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fjhjj.exec:\fjhjj.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvjldh.exec:\jvjldh.exe21⤵
- Executes dropped EXE
PID:336 -
\??\c:\rbtjnbn.exec:\rbtjnbn.exe22⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nnlhb.exec:\nnlhb.exe23⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vhhpdf.exec:\vhhpdf.exe24⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bpnjhp.exec:\bpnjhp.exe25⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hrvlbd.exec:\hrvlbd.exe26⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ppvttxb.exec:\ppvttxb.exe27⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llplx.exec:\llplx.exe28⤵
- Executes dropped EXE
PID:2404 -
\??\c:\djdhxn.exec:\djdhxn.exe29⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hnjrd.exec:\hnjrd.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dhbbp.exec:\dhbbp.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\txvblh.exec:\txvblh.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bntrfj.exec:\bntrfj.exe33⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fjtrbv.exec:\fjtrbv.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684 -
\??\c:\nhnxn.exec:\nhnxn.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\thptjbj.exec:\thptjbj.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pfrrbj.exec:\pfrrbj.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lpfxtr.exec:\lpfxtr.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lvfdlfj.exec:\lvfdlfj.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bfnrrl.exec:\bfnrrl.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vptff.exec:\vptff.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ftxhhjv.exec:\ftxhhjv.exe42⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vljbjt.exec:\vljbjt.exe43⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hlrjv.exec:\hlrjv.exe44⤵
- Executes dropped EXE
PID:924 -
\??\c:\hfllf.exec:\hfllf.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hvvpjb.exec:\hvvpjb.exe46⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hrtlvn.exec:\hrtlvn.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bdvjx.exec:\bdvjx.exe48⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ttbprtv.exec:\ttbprtv.exe49⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rvfvjnv.exec:\rvfvjnv.exe50⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nhtvx.exec:\nhtvx.exe51⤵
- Executes dropped EXE
PID:1236 -
\??\c:\fbnfjn.exec:\fbnfjn.exe52⤵
- Executes dropped EXE
PID:884 -
\??\c:\rnjrp.exec:\rnjrp.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ntrxvjj.exec:\ntrxvjj.exe54⤵
- Executes dropped EXE
PID:664 -
\??\c:\nhvbnt.exec:\nhvbnt.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tbtnv.exec:\tbtnv.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vxbdjhj.exec:\vxbdjhj.exe57⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xfrjxh.exec:\xfrjxh.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lfbpj.exec:\lfbpj.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vtbhn.exec:\vtbhn.exe60⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jbflpl.exec:\jbflpl.exe61⤵
- Executes dropped EXE
PID:336 -
\??\c:\rxtln.exec:\rxtln.exe62⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fdxjn.exec:\fdxjn.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pldvbv.exec:\pldvbv.exe64⤵
- Executes dropped EXE
PID:996 -
\??\c:\bhtft.exec:\bhtft.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pvrvdt.exec:\pvrvdt.exe66⤵PID:1332
-
\??\c:\xhrfxvh.exec:\xhrfxvh.exe67⤵PID:2284
-
\??\c:\xfpvv.exec:\xfpvv.exe68⤵PID:1956
-
\??\c:\rfddb.exec:\rfddb.exe69⤵PID:2024
-
\??\c:\tdpbr.exec:\tdpbr.exe70⤵PID:2928
-
\??\c:\xhxjnft.exec:\xhxjnft.exe71⤵PID:2324
-
\??\c:\xxjxpp.exec:\xxjxpp.exe72⤵PID:1524
-
\??\c:\phtlx.exec:\phtlx.exe73⤵PID:1724
-
\??\c:\blpxxfj.exec:\blpxxfj.exe74⤵PID:2292
-
\??\c:\hflvnv.exec:\hflvnv.exe75⤵PID:2320
-
\??\c:\lrdfhvb.exec:\lrdfhvb.exe76⤵PID:2768
-
\??\c:\djnhl.exec:\djnhl.exe77⤵PID:2072
-
\??\c:\hbxlxxh.exec:\hbxlxxh.exe78⤵PID:2312
-
\??\c:\pnbrnl.exec:\pnbrnl.exe79⤵PID:2828
-
\??\c:\rvhlp.exec:\rvhlp.exe80⤵PID:2644
-
\??\c:\thfjf.exec:\thfjf.exe81⤵PID:2728
-
\??\c:\pxppv.exec:\pxppv.exe82⤵PID:2612
-
\??\c:\vtbltj.exec:\vtbltj.exe83⤵PID:2628
-
\??\c:\pdffrb.exec:\pdffrb.exe84⤵PID:2120
-
\??\c:\rvfxn.exec:\rvfxn.exe85⤵PID:2540
-
\??\c:\fxrtlf.exec:\fxrtlf.exe86⤵PID:2656
-
\??\c:\ntdnjf.exec:\ntdnjf.exe87⤵PID:2896
-
\??\c:\jbrpr.exec:\jbrpr.exe88⤵PID:836
-
\??\c:\nhtnnb.exec:\nhtnnb.exe89⤵PID:2356
-
\??\c:\dldrvdn.exec:\dldrvdn.exe90⤵PID:2852
-
\??\c:\bttft.exec:\bttft.exe91⤵PID:628
-
\??\c:\lhxflv.exec:\lhxflv.exe92⤵PID:2216
-
\??\c:\rvpvt.exec:\rvpvt.exe93⤵PID:568
-
\??\c:\fbdbj.exec:\fbdbj.exe94⤵PID:2392
-
\??\c:\xjpjtb.exec:\xjpjtb.exe95⤵PID:1152
-
\??\c:\vnrbxtv.exec:\vnrbxtv.exe96⤵PID:3040
-
\??\c:\ftppv.exec:\ftppv.exe97⤵PID:2056
-
\??\c:\bnnhvh.exec:\bnnhvh.exe98⤵PID:1688
-
\??\c:\bjlvnv.exec:\bjlvnv.exe99⤵PID:3036
-
\??\c:\fxrxvp.exec:\fxrxvp.exe100⤵PID:2060
-
\??\c:\thpppf.exec:\thpppf.exe101⤵PID:1924
-
\??\c:\hrrtxhx.exec:\hrrtxhx.exe102⤵PID:900
-
\??\c:\jjrpn.exec:\jjrpn.exe103⤵PID:1084
-
\??\c:\vftjhdb.exec:\vftjhdb.exe104⤵PID:2304
-
\??\c:\htxjjx.exec:\htxjjx.exe105⤵PID:1476
-
\??\c:\rxfrf.exec:\rxfrf.exe106⤵PID:1780
-
\??\c:\nfbxpr.exec:\nfbxpr.exe107⤵PID:2996
-
\??\c:\vtdpp.exec:\vtdpp.exe108⤵PID:1652
-
\??\c:\hfxdhfb.exec:\hfxdhfb.exe109⤵PID:2952
-
\??\c:\htbjdbf.exec:\htbjdbf.exe110⤵PID:2384
-
\??\c:\dffvlf.exec:\dffvlf.exe111⤵PID:2948
-
\??\c:\xbfdt.exec:\xbfdt.exe112⤵PID:692
-
\??\c:\plbtx.exec:\plbtx.exe113⤵PID:1852
-
\??\c:\lbhrn.exec:\lbhrn.exe114⤵PID:2892
-
\??\c:\fjxpjr.exec:\fjxpjr.exe115⤵PID:1580
-
\??\c:\lthnv.exec:\lthnv.exe116⤵PID:1536
-
\??\c:\nnljn.exec:\nnljn.exe117⤵PID:1864
-
\??\c:\bfphvn.exec:\bfphvn.exe118⤵PID:2756
-
\??\c:\fpffrdn.exec:\fpffrdn.exe119⤵PID:2688
-
\??\c:\vtxlfr.exec:\vtxlfr.exe120⤵PID:2888
-
\??\c:\fbhbrx.exec:\fbhbrx.exe121⤵PID:2584
-
\??\c:\drrnr.exec:\drrnr.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-