Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 10:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
936906fa2a8175ef38863c74f9adc340N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
936906fa2a8175ef38863c74f9adc340N.exe
-
Size
75KB
-
MD5
936906fa2a8175ef38863c74f9adc340
-
SHA1
d4be1951014fc9889a424732c0ce02e2860ced20
-
SHA256
223760ba2802f9e5d4cff76fb5663492b0b7a2444883de6b20ff88f9b39bfe15
-
SHA512
6ffe3ca13ac44dd4ff6f9bb7159938a406eb2de58c77cc20eaa7063af8ee900f279310c4b2599ae122f3babe3c14aacd9b6e5c75dda94b36220788f13393cb0a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPESBV:ymb3NkkiQ3mdBjFIfvTfCD+HlQcY
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2436-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1236 9djpp.exe 264 lfrxfrf.exe 2288 5xlfxxl.exe 2476 bthntb.exe 2836 dddjj.exe 2136 7xxlflf.exe 2916 xxrlxxf.exe 536 1pdpj.exe 2636 ppjpp.exe 2384 nnhtbn.exe 1360 1vjvd.exe 1124 lrrllll.exe 2940 lffrxxf.exe 1744 5tnhnn.exe 2948 jpdvj.exe 2956 fxxxfrl.exe 3012 5lrflrr.exe 2720 bbnhbn.exe 3028 bbbnnn.exe 2432 jdvjv.exe 2160 ffrrxxf.exe 1904 nhbnbh.exe 1168 hntnnb.exe 760 pjdvj.exe 1736 3rllrxl.exe 2468 5lxflrr.exe 2124 btbntt.exe 1640 9dvvj.exe 2324 pvddd.exe 888 9llfrxr.exe 1968 hhthtn.exe 1924 ddvdp.exe 1096 pjdvv.exe 2288 xrlrxfx.exe 2768 lrxllrl.exe 2312 nhttbb.exe 2852 bbthhh.exe 2832 vpjdj.exe 2780 3lllfll.exe 2660 xrllrfr.exe 2916 nntbhh.exe 2672 tnbttb.exe 2876 1ddvd.exe 2636 dpdjd.exe 2384 xrfllrf.exe 1080 rrlxlrx.exe 2880 ppdjd.exe 828 lxrxfrx.exe 2612 fxlxrrx.exe 1744 1hhhtt.exe 3008 tnbhtb.exe 1192 pjppd.exe 1880 pjvvv.exe 2516 lfrfrrf.exe 2388 xxrrflr.exe 664 bbntbb.exe 2180 pjvpv.exe 1876 vpvdj.exe 1412 xxfrfrl.exe 1904 lxxlflr.exe 292 rlfrffl.exe 760 7ntbnt.exe 1612 3vpdd.exe 896 pjvvj.exe -
resource yara_rule behavioral1/memory/2436-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1236 2436 936906fa2a8175ef38863c74f9adc340N.exe 30 PID 2436 wrote to memory of 1236 2436 936906fa2a8175ef38863c74f9adc340N.exe 30 PID 2436 wrote to memory of 1236 2436 936906fa2a8175ef38863c74f9adc340N.exe 30 PID 2436 wrote to memory of 1236 2436 936906fa2a8175ef38863c74f9adc340N.exe 30 PID 1236 wrote to memory of 264 1236 9djpp.exe 31 PID 1236 wrote to memory of 264 1236 9djpp.exe 31 PID 1236 wrote to memory of 264 1236 9djpp.exe 31 PID 1236 wrote to memory of 264 1236 9djpp.exe 31 PID 264 wrote to memory of 2288 264 lfrxfrf.exe 32 PID 264 wrote to memory of 2288 264 lfrxfrf.exe 32 PID 264 wrote to memory of 2288 264 lfrxfrf.exe 32 PID 264 wrote to memory of 2288 264 lfrxfrf.exe 32 PID 2288 wrote to memory of 2476 2288 5xlfxxl.exe 33 PID 2288 wrote to memory of 2476 2288 5xlfxxl.exe 33 PID 2288 wrote to memory of 2476 2288 5xlfxxl.exe 33 PID 2288 wrote to memory of 2476 2288 5xlfxxl.exe 33 PID 2476 wrote to memory of 2836 2476 bthntb.exe 34 PID 2476 wrote to memory of 2836 2476 bthntb.exe 34 PID 2476 wrote to memory of 2836 2476 bthntb.exe 34 PID 2476 wrote to memory of 2836 2476 bthntb.exe 34 PID 2836 wrote to memory of 2136 2836 dddjj.exe 35 PID 2836 wrote to memory of 2136 2836 dddjj.exe 35 PID 2836 wrote to memory of 2136 2836 dddjj.exe 35 PID 2836 wrote to memory of 2136 2836 dddjj.exe 35 PID 2136 wrote to memory of 2916 2136 7xxlflf.exe 36 PID 2136 wrote to memory of 2916 2136 7xxlflf.exe 36 PID 2136 wrote to memory of 2916 2136 7xxlflf.exe 36 PID 2136 wrote to memory of 2916 2136 7xxlflf.exe 36 PID 2916 wrote to memory of 536 2916 xxrlxxf.exe 37 PID 2916 wrote to memory of 536 2916 xxrlxxf.exe 37 PID 2916 wrote to memory of 536 2916 xxrlxxf.exe 37 PID 2916 wrote to memory of 536 2916 xxrlxxf.exe 37 PID 536 wrote to memory of 2636 536 1pdpj.exe 38 PID 536 wrote to memory of 2636 536 1pdpj.exe 38 PID 536 wrote to memory of 2636 536 1pdpj.exe 38 PID 536 wrote to memory of 2636 536 1pdpj.exe 38 PID 2636 wrote to memory of 2384 2636 ppjpp.exe 39 PID 2636 wrote to memory of 2384 2636 ppjpp.exe 39 PID 2636 wrote to memory of 2384 2636 ppjpp.exe 39 PID 2636 wrote to memory of 2384 2636 ppjpp.exe 39 PID 2384 wrote to memory of 1360 2384 nnhtbn.exe 40 PID 2384 wrote to memory of 1360 2384 nnhtbn.exe 40 PID 2384 wrote to memory of 1360 2384 nnhtbn.exe 40 PID 2384 wrote to memory of 1360 2384 nnhtbn.exe 40 PID 1360 wrote to memory of 1124 1360 1vjvd.exe 41 PID 1360 wrote to memory of 1124 1360 1vjvd.exe 41 PID 1360 wrote to memory of 1124 1360 1vjvd.exe 41 PID 1360 wrote to memory of 1124 1360 1vjvd.exe 41 PID 1124 wrote to memory of 2940 1124 lrrllll.exe 42 PID 1124 wrote to memory of 2940 1124 lrrllll.exe 42 PID 1124 wrote to memory of 2940 1124 lrrllll.exe 42 PID 1124 wrote to memory of 2940 1124 lrrllll.exe 42 PID 2940 wrote to memory of 1744 2940 lffrxxf.exe 43 PID 2940 wrote to memory of 1744 2940 lffrxxf.exe 43 PID 2940 wrote to memory of 1744 2940 lffrxxf.exe 43 PID 2940 wrote to memory of 1744 2940 lffrxxf.exe 43 PID 1744 wrote to memory of 2948 1744 5tnhnn.exe 44 PID 1744 wrote to memory of 2948 1744 5tnhnn.exe 44 PID 1744 wrote to memory of 2948 1744 5tnhnn.exe 44 PID 1744 wrote to memory of 2948 1744 5tnhnn.exe 44 PID 2948 wrote to memory of 2956 2948 jpdvj.exe 45 PID 2948 wrote to memory of 2956 2948 jpdvj.exe 45 PID 2948 wrote to memory of 2956 2948 jpdvj.exe 45 PID 2948 wrote to memory of 2956 2948 jpdvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\936906fa2a8175ef38863c74f9adc340N.exe"C:\Users\Admin\AppData\Local\Temp\936906fa2a8175ef38863c74f9adc340N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9djpp.exec:\9djpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\5xlfxxl.exec:\5xlfxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\bthntb.exec:\bthntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dddjj.exec:\dddjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7xxlflf.exec:\7xxlflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\xxrlxxf.exec:\xxrlxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\1pdpj.exec:\1pdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\ppjpp.exec:\ppjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nnhtbn.exec:\nnhtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\1vjvd.exec:\1vjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\lrrllll.exec:\lrrllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\lffrxxf.exec:\lffrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5tnhnn.exec:\5tnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\jpdvj.exec:\jpdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\fxxxfrl.exec:\fxxxfrl.exe17⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5lrflrr.exec:\5lrflrr.exe18⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bbnhbn.exec:\bbnhbn.exe19⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbbnnn.exec:\bbbnnn.exe20⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdvjv.exec:\jdvjv.exe21⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nhbnbh.exec:\nhbnbh.exe23⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hntnnb.exec:\hntnnb.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pjdvj.exec:\pjdvj.exe25⤵
- Executes dropped EXE
PID:760 -
\??\c:\3rllrxl.exec:\3rllrxl.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5lxflrr.exec:\5lxflrr.exe27⤵
- Executes dropped EXE
PID:2468 -
\??\c:\btbntt.exec:\btbntt.exe28⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9dvvj.exec:\9dvvj.exe29⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pvddd.exec:\pvddd.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9llfrxr.exec:\9llfrxr.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\hhthtn.exec:\hhthtn.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\ddvdp.exec:\ddvdp.exe33⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjdvv.exec:\pjdvv.exe34⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe35⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lrxllrl.exec:\lrxllrl.exe36⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhttbb.exec:\nhttbb.exe37⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bbthhh.exec:\bbthhh.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vpjdj.exec:\vpjdj.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3lllfll.exec:\3lllfll.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrllrfr.exec:\xrllrfr.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nntbhh.exec:\nntbhh.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tnbttb.exec:\tnbttb.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1ddvd.exec:\1ddvd.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dpdjd.exec:\dpdjd.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrfllrf.exec:\xrfllrf.exe46⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe47⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ppdjd.exec:\ppdjd.exe48⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lxrxfrx.exec:\lxrxfrx.exe49⤵
- Executes dropped EXE
PID:828 -
\??\c:\fxlxrrx.exec:\fxlxrrx.exe50⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1hhhtt.exec:\1hhhtt.exe51⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tnbhtb.exec:\tnbhtb.exe52⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pjppd.exec:\pjppd.exe53⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pjvvv.exec:\pjvvv.exe54⤵
- Executes dropped EXE
PID:1880 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xxrrflr.exec:\xxrrflr.exe56⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bbntbb.exec:\bbntbb.exe57⤵
- Executes dropped EXE
PID:664 -
\??\c:\pjvpv.exec:\pjvpv.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vpvdj.exec:\vpvdj.exe59⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xxfrfrl.exec:\xxfrfrl.exe60⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lxxlflr.exec:\lxxlflr.exe61⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rlfrffl.exec:\rlfrffl.exe62⤵
- Executes dropped EXE
PID:292 -
\??\c:\7ntbnt.exec:\7ntbnt.exe63⤵
- Executes dropped EXE
PID:760 -
\??\c:\3vpdd.exec:\3vpdd.exe64⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjvvj.exec:\pjvvj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\3xlxrxl.exec:\3xlxrxl.exe66⤵PID:2536
-
\??\c:\frlxfff.exec:\frlxfff.exe67⤵PID:2152
-
\??\c:\1ntnbn.exec:\1ntnbn.exe68⤵PID:1852
-
\??\c:\5hnhtb.exec:\5hnhtb.exe69⤵PID:1440
-
\??\c:\ppvpd.exec:\ppvpd.exe70⤵PID:2012
-
\??\c:\7lrrrlr.exec:\7lrrrlr.exe71⤵PID:1236
-
\??\c:\fffflff.exec:\fffflff.exe72⤵PID:2000
-
\??\c:\nbbhnt.exec:\nbbhnt.exe73⤵PID:2580
-
\??\c:\9bbnbn.exec:\9bbnbn.exe74⤵PID:2548
-
\??\c:\pvjdj.exec:\pvjdj.exe75⤵PID:2736
-
\??\c:\vpjpv.exec:\vpjpv.exe76⤵PID:2820
-
\??\c:\jdvvj.exec:\jdvvj.exe77⤵PID:2400
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe78⤵PID:2872
-
\??\c:\rrfxflx.exec:\rrfxflx.exe79⤵PID:2816
-
\??\c:\1nnbnb.exec:\1nnbnb.exe80⤵PID:2136
-
\??\c:\7nhntn.exec:\7nhntn.exe81⤵PID:2764
-
\??\c:\jjppp.exec:\jjppp.exe82⤵PID:2740
-
\??\c:\vjvvv.exec:\vjvvv.exe83⤵PID:2688
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe84⤵PID:1224
-
\??\c:\frfrllr.exec:\frfrllr.exe85⤵PID:2628
-
\??\c:\bnbthn.exec:\bnbthn.exe86⤵PID:1508
-
\??\c:\7vvdd.exec:\7vvdd.exe87⤵PID:3004
-
\??\c:\9pddp.exec:\9pddp.exe88⤵PID:1728
-
\??\c:\ddjvd.exec:\ddjvd.exe89⤵PID:2972
-
\??\c:\3xfxflx.exec:\3xfxflx.exe90⤵PID:3000
-
\??\c:\btbhbh.exec:\btbhbh.exe91⤵PID:2588
-
\??\c:\1tbtnn.exec:\1tbtnn.exe92⤵PID:1884
-
\??\c:\jdvvj.exec:\jdvvj.exe93⤵PID:1444
-
\??\c:\dvdpp.exec:\dvdpp.exe94⤵PID:2720
-
\??\c:\lfrfllx.exec:\lfrfllx.exe95⤵PID:2608
-
\??\c:\llrxrlx.exec:\llrxrlx.exe96⤵PID:752
-
\??\c:\hnbhht.exec:\hnbhht.exe97⤵PID:2084
-
\??\c:\3bthnb.exec:\3bthnb.exe98⤵PID:1128
-
\??\c:\jddjj.exec:\jddjj.exe99⤵PID:448
-
\??\c:\pdjpv.exec:\pdjpv.exe100⤵PID:1904
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe101⤵PID:1800
-
\??\c:\tthnht.exec:\tthnht.exe102⤵PID:1584
-
\??\c:\3hhbnn.exec:\3hhbnn.exe103⤵PID:2096
-
\??\c:\pjppv.exec:\pjppv.exe104⤵PID:2584
-
\??\c:\pvjdd.exec:\pvjdd.exe105⤵PID:2056
-
\??\c:\llrffxx.exec:\llrffxx.exe106⤵PID:1864
-
\??\c:\rrlxflr.exec:\rrlxflr.exe107⤵PID:2540
-
\??\c:\7ffrfff.exec:\7ffrfff.exe108⤵PID:2244
-
\??\c:\tbhbnt.exec:\tbhbnt.exe109⤵PID:2060
-
\??\c:\nhntbb.exec:\nhntbb.exe110⤵PID:1208
-
\??\c:\vpvdp.exec:\vpvdp.exe111⤵PID:1924
-
\??\c:\3ddpj.exec:\3ddpj.exe112⤵PID:1936
-
\??\c:\xfrrfxr.exec:\xfrrfxr.exe113⤵PID:2480
-
\??\c:\lfxxfll.exec:\lfxxfll.exe114⤵PID:876
-
\??\c:\nhbthn.exec:\nhbthn.exe115⤵PID:1652
-
\??\c:\9hntnt.exec:\9hntnt.exe116⤵PID:2772
-
\??\c:\pjjjj.exec:\pjjjj.exe117⤵PID:2856
-
\??\c:\jdvdp.exec:\jdvdp.exe118⤵PID:3068
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe119⤵PID:2988
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe120⤵PID:1212
-
\??\c:\fllrxrl.exec:\fllrxrl.exe121⤵PID:2800
-
\??\c:\nhtbtb.exec:\nhtbtb.exe122⤵PID:1220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-