Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 00:41
Static task
static1
Behavioral task
behavioral1
Sample
a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe
Resource
win7-20240705-en
General
-
Target
a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe
-
Size
94KB
-
MD5
716c0a035f55682028eeb717c3a0d32a
-
SHA1
fd3c7a8326ccc7fc2f5460748f1f865985ed84da
-
SHA256
a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08
-
SHA512
9cecb9e80a67230ab0df197a5b2652213b7b7a4c0002f239aed48cf4c3258b1f478ea3f3484c0ea642e09bf02a3585184d6ed2485531a75fad958e7534eaa29e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRB/:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBtt
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1940-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1028 1ttthb.exe 1668 dvppd.exe 2336 llfrxfl.exe 2724 nnhntt.exe 2840 hbtbbb.exe 2908 jddjj.exe 2952 rfrxffl.exe 2852 1lflxff.exe 2740 btntbt.exe 3064 vdpvv.exe 2864 jjpdv.exe 580 xxrfrfl.exe 2112 nhhtth.exe 2012 bnhnbb.exe 2932 1vpdj.exe 2200 jdvdj.exe 1572 xlrrrrr.exe 1360 xrlrffl.exe 2560 nnhbbt.exe 484 5nnhtt.exe 596 jjvdp.exe 1560 jjdvd.exe 444 frfrlrf.exe 2524 hbhhtt.exe 976 htnbtt.exe 820 5bhttt.exe 1844 jjdjp.exe 1460 xrllfrf.exe 1652 lfrxffl.exe 1820 bttthh.exe 1788 1htbnn.exe 1716 9jpjv.exe 1028 ffxfffr.exe 1528 lfrrxxx.exe 1668 3xlxfrx.exe 2348 tbnnnh.exe 2336 btbtbt.exe 2844 pjvvd.exe 2900 pdjdp.exe 2640 lxrrrrx.exe 2644 llflxxf.exe 2664 1bbtbt.exe 2612 htntbb.exe 2344 pddpd.exe 1552 dvpvd.exe 992 3lxxrrx.exe 1048 rlfrxfr.exe 2228 3hntnn.exe 2224 bbntbb.exe 2688 vpdpp.exe 2860 xrfxfxl.exe 1812 lfxrxrx.exe 2052 flrxxfl.exe 2364 nhthnn.exe 1696 3bttbh.exe 2088 9jdpj.exe 1112 7dvdp.exe 1580 5rrrfff.exe 648 7fxfxxl.exe 1040 bbnhtb.exe 1908 3hnbbt.exe 2172 dvpvv.exe 1468 pjppd.exe 620 3xxrffr.exe -
resource yara_rule behavioral1/memory/1940-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-264-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 1028 1940 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 30 PID 1940 wrote to memory of 1028 1940 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 30 PID 1940 wrote to memory of 1028 1940 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 30 PID 1940 wrote to memory of 1028 1940 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 30 PID 1028 wrote to memory of 1668 1028 1ttthb.exe 31 PID 1028 wrote to memory of 1668 1028 1ttthb.exe 31 PID 1028 wrote to memory of 1668 1028 1ttthb.exe 31 PID 1028 wrote to memory of 1668 1028 1ttthb.exe 31 PID 1668 wrote to memory of 2336 1668 dvppd.exe 32 PID 1668 wrote to memory of 2336 1668 dvppd.exe 32 PID 1668 wrote to memory of 2336 1668 dvppd.exe 32 PID 1668 wrote to memory of 2336 1668 dvppd.exe 32 PID 2336 wrote to memory of 2724 2336 llfrxfl.exe 33 PID 2336 wrote to memory of 2724 2336 llfrxfl.exe 33 PID 2336 wrote to memory of 2724 2336 llfrxfl.exe 33 PID 2336 wrote to memory of 2724 2336 llfrxfl.exe 33 PID 2724 wrote to memory of 2840 2724 nnhntt.exe 34 PID 2724 wrote to memory of 2840 2724 nnhntt.exe 34 PID 2724 wrote to memory of 2840 2724 nnhntt.exe 34 PID 2724 wrote to memory of 2840 2724 nnhntt.exe 34 PID 2840 wrote to memory of 2908 2840 hbtbbb.exe 35 PID 2840 wrote to memory of 2908 2840 hbtbbb.exe 35 PID 2840 wrote to memory of 2908 2840 hbtbbb.exe 35 PID 2840 wrote to memory of 2908 2840 hbtbbb.exe 35 PID 2908 wrote to memory of 2952 2908 jddjj.exe 36 PID 2908 wrote to memory of 2952 2908 jddjj.exe 36 PID 2908 wrote to memory of 2952 2908 jddjj.exe 36 PID 2908 wrote to memory of 2952 2908 jddjj.exe 36 PID 2952 wrote to memory of 2852 2952 rfrxffl.exe 37 PID 2952 wrote to memory of 2852 2952 rfrxffl.exe 37 PID 2952 wrote to memory of 2852 2952 rfrxffl.exe 37 PID 2952 wrote to memory of 2852 2952 rfrxffl.exe 37 PID 2852 wrote to memory of 2740 2852 1lflxff.exe 38 PID 2852 wrote to memory of 2740 2852 1lflxff.exe 38 PID 2852 wrote to memory of 2740 2852 1lflxff.exe 38 PID 2852 wrote to memory of 2740 2852 1lflxff.exe 38 PID 2740 wrote to memory of 3064 2740 btntbt.exe 39 PID 2740 wrote to memory of 3064 2740 btntbt.exe 39 PID 2740 wrote to memory of 3064 2740 btntbt.exe 39 PID 2740 wrote to memory of 3064 2740 btntbt.exe 39 PID 3064 wrote to memory of 2864 3064 vdpvv.exe 40 PID 3064 wrote to memory of 2864 3064 vdpvv.exe 40 PID 3064 wrote to memory of 2864 3064 vdpvv.exe 40 PID 3064 wrote to memory of 2864 3064 vdpvv.exe 40 PID 2864 wrote to memory of 580 2864 jjpdv.exe 41 PID 2864 wrote to memory of 580 2864 jjpdv.exe 41 PID 2864 wrote to memory of 580 2864 jjpdv.exe 41 PID 2864 wrote to memory of 580 2864 jjpdv.exe 41 PID 580 wrote to memory of 2112 580 xxrfrfl.exe 42 PID 580 wrote to memory of 2112 580 xxrfrfl.exe 42 PID 580 wrote to memory of 2112 580 xxrfrfl.exe 42 PID 580 wrote to memory of 2112 580 xxrfrfl.exe 42 PID 2112 wrote to memory of 2012 2112 nhhtth.exe 43 PID 2112 wrote to memory of 2012 2112 nhhtth.exe 43 PID 2112 wrote to memory of 2012 2112 nhhtth.exe 43 PID 2112 wrote to memory of 2012 2112 nhhtth.exe 43 PID 2012 wrote to memory of 2932 2012 bnhnbb.exe 44 PID 2012 wrote to memory of 2932 2012 bnhnbb.exe 44 PID 2012 wrote to memory of 2932 2012 bnhnbb.exe 44 PID 2012 wrote to memory of 2932 2012 bnhnbb.exe 44 PID 2932 wrote to memory of 2200 2932 1vpdj.exe 45 PID 2932 wrote to memory of 2200 2932 1vpdj.exe 45 PID 2932 wrote to memory of 2200 2932 1vpdj.exe 45 PID 2932 wrote to memory of 2200 2932 1vpdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe"C:\Users\Admin\AppData\Local\Temp\a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\1ttthb.exec:\1ttthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\dvppd.exec:\dvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\llfrxfl.exec:\llfrxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nnhntt.exec:\nnhntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hbtbbb.exec:\hbtbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jddjj.exec:\jddjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rfrxffl.exec:\rfrxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\1lflxff.exec:\1lflxff.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\btntbt.exec:\btntbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vdpvv.exec:\vdpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\jjpdv.exec:\jjpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xxrfrfl.exec:\xxrfrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\nhhtth.exec:\nhhtth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\bnhnbb.exec:\bnhnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\1vpdj.exec:\1vpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\jdvdj.exec:\jdvdj.exe17⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xrlrffl.exec:\xrlrffl.exe19⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nnhbbt.exec:\nnhbbt.exe20⤵
- Executes dropped EXE
PID:2560 -
\??\c:\5nnhtt.exec:\5nnhtt.exe21⤵
- Executes dropped EXE
PID:484 -
\??\c:\jjvdp.exec:\jjvdp.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\jjdvd.exec:\jjdvd.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\frfrlrf.exec:\frfrlrf.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\hbhhtt.exec:\hbhhtt.exe25⤵
- Executes dropped EXE
PID:2524 -
\??\c:\htnbtt.exec:\htnbtt.exe26⤵
- Executes dropped EXE
PID:976 -
\??\c:\5bhttt.exec:\5bhttt.exe27⤵
- Executes dropped EXE
PID:820 -
\??\c:\jjdjp.exec:\jjdjp.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xrllfrf.exec:\xrllfrf.exe29⤵
- Executes dropped EXE
PID:1460 -
\??\c:\lfrxffl.exec:\lfrxffl.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bttthh.exec:\bttthh.exe31⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1htbnn.exec:\1htbnn.exe32⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9jpjv.exec:\9jpjv.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ffxfffr.exec:\ffxfffr.exe34⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3xlxfrx.exec:\3xlxfrx.exe36⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tbnnnh.exec:\tbnnnh.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\btbtbt.exec:\btbtbt.exe38⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pjvvd.exec:\pjvvd.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pdjdp.exec:\pdjdp.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\llflxxf.exec:\llflxxf.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1bbtbt.exec:\1bbtbt.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\htntbb.exec:\htntbb.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pddpd.exec:\pddpd.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dvpvd.exec:\dvpvd.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3lxxrrx.exec:\3lxxrrx.exe47⤵
- Executes dropped EXE
PID:992 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe48⤵
- Executes dropped EXE
PID:1048 -
\??\c:\3hntnn.exec:\3hntnn.exe49⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bbntbb.exec:\bbntbb.exe50⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpdpp.exec:\vpdpp.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xrfxfxl.exec:\xrfxfxl.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe53⤵
- Executes dropped EXE
PID:1812 -
\??\c:\flrxxfl.exec:\flrxxfl.exe54⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nhthnn.exec:\nhthnn.exe55⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3bttbh.exec:\3bttbh.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9jdpj.exec:\9jdpj.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7dvdp.exec:\7dvdp.exe58⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5rrrfff.exec:\5rrrfff.exe59⤵
- Executes dropped EXE
PID:1580 -
\??\c:\7fxfxxl.exec:\7fxfxxl.exe60⤵
- Executes dropped EXE
PID:648 -
\??\c:\bbnhtb.exec:\bbnhtb.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3hnbbt.exec:\3hnbbt.exe62⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvpvv.exec:\dvpvv.exe63⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pjppd.exec:\pjppd.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\3xxrffr.exec:\3xxrffr.exe65⤵
- Executes dropped EXE
PID:620 -
\??\c:\fxllxfl.exec:\fxllxfl.exe66⤵PID:2496
-
\??\c:\bbnnnt.exec:\bbnnnt.exe67⤵PID:1052
-
\??\c:\jpvpj.exec:\jpvpj.exe68⤵PID:2300
-
\??\c:\9dpvv.exec:\9dpvv.exe69⤵PID:328
-
\??\c:\rfrlllr.exec:\rfrlllr.exe70⤵PID:1916
-
\??\c:\5hbnbb.exec:\5hbnbb.exe71⤵PID:1652
-
\??\c:\bhbhbh.exec:\bhbhbh.exe72⤵PID:1796
-
\??\c:\1jpdd.exec:\1jpdd.exe73⤵PID:1744
-
\??\c:\jvjdj.exec:\jvjdj.exe74⤵PID:1328
-
\??\c:\rllllll.exec:\rllllll.exe75⤵PID:2408
-
\??\c:\frxxrrr.exec:\frxxrrr.exe76⤵PID:2136
-
\??\c:\hthnhb.exec:\hthnhb.exe77⤵PID:2448
-
\??\c:\1thnbh.exec:\1thnbh.exe78⤵PID:2328
-
\??\c:\3djdv.exec:\3djdv.exe79⤵PID:2828
-
\??\c:\rlflrxx.exec:\rlflrxx.exe80⤵PID:2748
-
\??\c:\rlxffrr.exec:\rlxffrr.exe81⤵PID:1992
-
\??\c:\bnbhbt.exec:\bnbhbt.exe82⤵PID:2904
-
\??\c:\3bttbb.exec:\3bttbb.exe83⤵PID:2832
-
\??\c:\dvdjj.exec:\dvdjj.exe84⤵PID:2944
-
\??\c:\1jvpp.exec:\1jvpp.exe85⤵PID:2360
-
\??\c:\5lrrrll.exec:\5lrrrll.exe86⤵PID:2680
-
\??\c:\xllrfxf.exec:\xllrfxf.exe87⤵PID:1980
-
\??\c:\9rlrrrr.exec:\9rlrrrr.exe88⤵PID:2856
-
\??\c:\bbhhhh.exec:\bbhhhh.exe89⤵PID:1496
-
\??\c:\5nhbhh.exec:\5nhbhh.exe90⤵PID:580
-
\??\c:\vjjjd.exec:\vjjjd.exe91⤵PID:1592
-
\??\c:\djpjd.exec:\djpjd.exe92⤵PID:2112
-
\??\c:\rrffllx.exec:\rrffllx.exe93⤵PID:2936
-
\??\c:\xllrrlr.exec:\xllrrlr.exe94⤵PID:2716
-
\??\c:\7hhhnn.exec:\7hhhnn.exe95⤵PID:2016
-
\??\c:\tttbtt.exec:\tttbtt.exe96⤵PID:1832
-
\??\c:\pjjvj.exec:\pjjvj.exe97⤵PID:2176
-
\??\c:\1pdpv.exec:\1pdpv.exe98⤵PID:2064
-
\??\c:\rflrfxf.exec:\rflrfxf.exe99⤵PID:604
-
\??\c:\5fxrxrr.exec:\5fxrxrr.exe100⤵PID:320
-
\??\c:\5thhnt.exec:\5thhnt.exe101⤵PID:3008
-
\??\c:\bnthnt.exec:\bnthnt.exe102⤵PID:2036
-
\??\c:\hthtnn.exec:\hthtnn.exe103⤵PID:376
-
\??\c:\vjjjj.exec:\vjjjj.exe104⤵PID:408
-
\??\c:\dvdjj.exec:\dvdjj.exe105⤵PID:1568
-
\??\c:\xllffxx.exec:\xllffxx.exe106⤵PID:1004
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe107⤵PID:1856
-
\??\c:\7hbttt.exec:\7hbttt.exe108⤵PID:3056
-
\??\c:\htbbbb.exec:\htbbbb.exe109⤵PID:2164
-
\??\c:\1jpjj.exec:\1jpjj.exe110⤵PID:1756
-
\??\c:\pdjdv.exec:\pdjdv.exe111⤵PID:1808
-
\??\c:\flrrlll.exec:\flrrlll.exe112⤵PID:1432
-
\??\c:\ffrfxxr.exec:\ffrfxxr.exe113⤵PID:2472
-
\??\c:\rffxffl.exec:\rffxffl.exe114⤵PID:2276
-
\??\c:\7tbhtt.exec:\7tbhtt.exe115⤵PID:1368
-
\??\c:\5hnhhb.exec:\5hnhhb.exe116⤵
- System Location Discovery: System Language Discovery
PID:2420 -
\??\c:\1jpjj.exec:\1jpjj.exe117⤵PID:1648
-
\??\c:\3vdvv.exec:\3vdvv.exe118⤵PID:2800
-
\??\c:\frllrlr.exec:\frllrlr.exe119⤵PID:2220
-
\??\c:\frxxxlr.exec:\frxxxlr.exe120⤵PID:3000
-
\??\c:\thtnbt.exec:\thtnbt.exe121⤵PID:2752
-
\??\c:\nhnbhb.exec:\nhnbhb.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-