Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19d0c65482ad77c6385914b10c736e40N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
19d0c65482ad77c6385914b10c736e40N.exe
-
Size
92KB
-
MD5
19d0c65482ad77c6385914b10c736e40
-
SHA1
c2e2acca004dc77bc83a2d304255f57ac706ba17
-
SHA256
56910911ada561beacb746c62f51ad8e5e8df7b933b33395b4daeef6c2a1aa8a
-
SHA512
39ba708b0e5a2099480bc06c16403cf12b075efaf33ddd6437db8180430f9367e0f3143278466977f39c0b8b5eb7a88219b2f11c4a3d1af1bc1b09048cb7dca3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLn9q:ymb3NkkiQ3mdBjFIi/REUZnKlb94h
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2772-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-22-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 9rffrlf.exe 2536 1ffflrr.exe 2820 5thhht.exe 2432 pdpvj.exe 2600 flfxxlx.exe 2724 lfrxfxl.exe 1456 btbhnb.exe 2588 7pvpv.exe 2828 ffxrxlx.exe 1368 7lxxllr.exe 1740 nhnnbb.exe 1672 pjvdj.exe 1084 pjppv.exe 984 7xrlflr.exe 760 hhbnbh.exe 1688 jddpv.exe 2832 pdpjv.exe 3056 9lxfrxf.exe 1656 lxrrrxr.exe 808 tnhhnt.exe 2236 vppvd.exe 964 1jpjp.exe 2116 xfrxxxf.exe 1492 fxrxxxf.exe 1652 nnhhbb.exe 2496 3hbtbb.exe 1868 pjpdj.exe 1188 vpddj.exe 872 fxlfxfl.exe 1704 thbbtt.exe 2792 bnbhhn.exe 2680 pjdjv.exe 2992 5xllrlr.exe 2692 fxfrxxf.exe 2804 nhntbb.exe 2532 3ntntt.exe 2952 pjjvj.exe 2696 lfrlllr.exe 1476 frrxflr.exe 2572 bnnbbb.exe 1456 9bnntb.exe 2928 pjpjp.exe 2416 pjvpv.exe 1924 xrrfxlx.exe 2008 rlrrxrf.exe 2316 hbnntt.exe 2444 thtttt.exe 1372 dpvdd.exe 1752 vpppd.exe 380 rrllxxf.exe 3028 5xlxfxf.exe 2308 9nnbbb.exe 2508 tnbnhh.exe 1936 thhbtn.exe 2208 vpjpp.exe 2144 5vdjj.exe 336 dpjdj.exe 2236 5fxrllr.exe 2500 xlfxlrr.exe 344 7hhtnb.exe 832 1dvdd.exe 1388 pdpjp.exe 1880 pddvv.exe 2496 rfrllll.exe -
resource yara_rule behavioral1/memory/2672-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2772 2672 19d0c65482ad77c6385914b10c736e40N.exe 31 PID 2672 wrote to memory of 2772 2672 19d0c65482ad77c6385914b10c736e40N.exe 31 PID 2672 wrote to memory of 2772 2672 19d0c65482ad77c6385914b10c736e40N.exe 31 PID 2672 wrote to memory of 2772 2672 19d0c65482ad77c6385914b10c736e40N.exe 31 PID 2772 wrote to memory of 2536 2772 9rffrlf.exe 32 PID 2772 wrote to memory of 2536 2772 9rffrlf.exe 32 PID 2772 wrote to memory of 2536 2772 9rffrlf.exe 32 PID 2772 wrote to memory of 2536 2772 9rffrlf.exe 32 PID 2536 wrote to memory of 2820 2536 1ffflrr.exe 33 PID 2536 wrote to memory of 2820 2536 1ffflrr.exe 33 PID 2536 wrote to memory of 2820 2536 1ffflrr.exe 33 PID 2536 wrote to memory of 2820 2536 1ffflrr.exe 33 PID 2820 wrote to memory of 2432 2820 5thhht.exe 34 PID 2820 wrote to memory of 2432 2820 5thhht.exe 34 PID 2820 wrote to memory of 2432 2820 5thhht.exe 34 PID 2820 wrote to memory of 2432 2820 5thhht.exe 34 PID 2432 wrote to memory of 2600 2432 pdpvj.exe 35 PID 2432 wrote to memory of 2600 2432 pdpvj.exe 35 PID 2432 wrote to memory of 2600 2432 pdpvj.exe 35 PID 2432 wrote to memory of 2600 2432 pdpvj.exe 35 PID 2600 wrote to memory of 2724 2600 flfxxlx.exe 36 PID 2600 wrote to memory of 2724 2600 flfxxlx.exe 36 PID 2600 wrote to memory of 2724 2600 flfxxlx.exe 36 PID 2600 wrote to memory of 2724 2600 flfxxlx.exe 36 PID 2724 wrote to memory of 1456 2724 lfrxfxl.exe 37 PID 2724 wrote to memory of 1456 2724 lfrxfxl.exe 37 PID 2724 wrote to memory of 1456 2724 lfrxfxl.exe 37 PID 2724 wrote to memory of 1456 2724 lfrxfxl.exe 37 PID 1456 wrote to memory of 2588 1456 btbhnb.exe 38 PID 1456 wrote to memory of 2588 1456 btbhnb.exe 38 PID 1456 wrote to memory of 2588 1456 btbhnb.exe 38 PID 1456 wrote to memory of 2588 1456 btbhnb.exe 38 PID 2588 wrote to memory of 2828 2588 7pvpv.exe 39 PID 2588 wrote to memory of 2828 2588 7pvpv.exe 39 PID 2588 wrote to memory of 2828 2588 7pvpv.exe 39 PID 2588 wrote to memory of 2828 2588 7pvpv.exe 39 PID 2828 wrote to memory of 1368 2828 ffxrxlx.exe 40 PID 2828 wrote to memory of 1368 2828 ffxrxlx.exe 40 PID 2828 wrote to memory of 1368 2828 ffxrxlx.exe 40 PID 2828 wrote to memory of 1368 2828 ffxrxlx.exe 40 PID 1368 wrote to memory of 1740 1368 7lxxllr.exe 41 PID 1368 wrote to memory of 1740 1368 7lxxllr.exe 41 PID 1368 wrote to memory of 1740 1368 7lxxllr.exe 41 PID 1368 wrote to memory of 1740 1368 7lxxllr.exe 41 PID 1740 wrote to memory of 1672 1740 nhnnbb.exe 42 PID 1740 wrote to memory of 1672 1740 nhnnbb.exe 42 PID 1740 wrote to memory of 1672 1740 nhnnbb.exe 42 PID 1740 wrote to memory of 1672 1740 nhnnbb.exe 42 PID 1672 wrote to memory of 1084 1672 pjvdj.exe 43 PID 1672 wrote to memory of 1084 1672 pjvdj.exe 43 PID 1672 wrote to memory of 1084 1672 pjvdj.exe 43 PID 1672 wrote to memory of 1084 1672 pjvdj.exe 43 PID 1084 wrote to memory of 984 1084 pjppv.exe 44 PID 1084 wrote to memory of 984 1084 pjppv.exe 44 PID 1084 wrote to memory of 984 1084 pjppv.exe 44 PID 1084 wrote to memory of 984 1084 pjppv.exe 44 PID 984 wrote to memory of 760 984 7xrlflr.exe 45 PID 984 wrote to memory of 760 984 7xrlflr.exe 45 PID 984 wrote to memory of 760 984 7xrlflr.exe 45 PID 984 wrote to memory of 760 984 7xrlflr.exe 45 PID 760 wrote to memory of 1688 760 hhbnbh.exe 46 PID 760 wrote to memory of 1688 760 hhbnbh.exe 46 PID 760 wrote to memory of 1688 760 hhbnbh.exe 46 PID 760 wrote to memory of 1688 760 hhbnbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d0c65482ad77c6385914b10c736e40N.exe"C:\Users\Admin\AppData\Local\Temp\19d0c65482ad77c6385914b10c736e40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9rffrlf.exec:\9rffrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1ffflrr.exec:\1ffflrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\5thhht.exec:\5thhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pdpvj.exec:\pdpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\flfxxlx.exec:\flfxxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lfrxfxl.exec:\lfrxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\btbhnb.exec:\btbhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\7pvpv.exec:\7pvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\ffxrxlx.exec:\ffxrxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7lxxllr.exec:\7lxxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\nhnnbb.exec:\nhnnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pjvdj.exec:\pjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\pjppv.exec:\pjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\7xrlflr.exec:\7xrlflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\hhbnbh.exec:\hhbnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\jddpv.exec:\jddpv.exe17⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pdpjv.exec:\pdpjv.exe18⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9lxfrxf.exec:\9lxfrxf.exe19⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lxrrrxr.exec:\lxrrrxr.exe20⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnhhnt.exec:\tnhhnt.exe21⤵
- Executes dropped EXE
PID:808 -
\??\c:\vppvd.exec:\vppvd.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1jpjp.exec:\1jpjp.exe23⤵
- Executes dropped EXE
PID:964 -
\??\c:\xfrxxxf.exec:\xfrxxxf.exe24⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe25⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nnhhbb.exec:\nnhhbb.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3hbtbb.exec:\3hbtbb.exe27⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjpdj.exec:\pjpdj.exe28⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vpddj.exec:\vpddj.exe29⤵
- Executes dropped EXE
PID:1188 -
\??\c:\fxlfxfl.exec:\fxlfxfl.exe30⤵
- Executes dropped EXE
PID:872 -
\??\c:\thbbtt.exec:\thbbtt.exe31⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bnbhhn.exec:\bnbhhn.exe32⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjdjv.exec:\pjdjv.exe33⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5xllrlr.exec:\5xllrlr.exe34⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fxfrxxf.exec:\fxfrxxf.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhntbb.exec:\nhntbb.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3ntntt.exec:\3ntntt.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pjjvj.exec:\pjjvj.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lfrlllr.exec:\lfrlllr.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\frrxflr.exec:\frrxflr.exe40⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bnnbbb.exec:\bnnbbb.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9bnntb.exec:\9bnntb.exe42⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pjpjp.exec:\pjpjp.exe43⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pjvpv.exec:\pjvpv.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrrfxlx.exec:\xrrfxlx.exe45⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rlrrxrf.exec:\rlrrxrf.exe46⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hbnntt.exec:\hbnntt.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\thtttt.exec:\thtttt.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dpvdd.exec:\dpvdd.exe49⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vpppd.exec:\vpppd.exe50⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rrllxxf.exec:\rrllxxf.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\5xlxfxf.exec:\5xlxfxf.exe52⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9nnbbb.exec:\9nnbbb.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tnbnhh.exec:\tnbnhh.exe54⤵
- Executes dropped EXE
PID:2508 -
\??\c:\thhbtn.exec:\thhbtn.exe55⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vpjpp.exec:\vpjpp.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5vdjj.exec:\5vdjj.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dpjdj.exec:\dpjdj.exe58⤵
- Executes dropped EXE
PID:336 -
\??\c:\5fxrllr.exec:\5fxrllr.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xlfxlrr.exec:\xlfxlrr.exe60⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7hhtnb.exec:\7hhtnb.exe61⤵
- Executes dropped EXE
PID:344 -
\??\c:\1dvdd.exec:\1dvdd.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\pdpjp.exec:\pdpjp.exe63⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pddvv.exec:\pddvv.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880 -
\??\c:\rfrllll.exec:\rfrllll.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3xfrxrf.exec:\3xfrxrf.exe66⤵PID:556
-
\??\c:\nbttnt.exec:\nbttnt.exe67⤵PID:2392
-
\??\c:\thtthh.exec:\thtthh.exe68⤵PID:2904
-
\??\c:\nhnnbt.exec:\nhnnbt.exe69⤵PID:2788
-
\??\c:\pvvvd.exec:\pvvvd.exe70⤵PID:2884
-
\??\c:\vpvvd.exec:\vpvvd.exe71⤵PID:2652
-
\??\c:\rlflxfx.exec:\rlflxfx.exe72⤵PID:2728
-
\??\c:\9rlrflr.exec:\9rlrflr.exe73⤵PID:2732
-
\??\c:\thhntb.exec:\thhntb.exe74⤵PID:2716
-
\??\c:\bntntn.exec:\bntntn.exe75⤵PID:2748
-
\??\c:\htnhnn.exec:\htnhnn.exe76⤵PID:2524
-
\??\c:\dvjjp.exec:\dvjjp.exe77⤵PID:2252
-
\??\c:\pddvd.exec:\pddvd.exe78⤵PID:1592
-
\??\c:\9pvpp.exec:\9pvpp.exe79⤵PID:568
-
\??\c:\xrlrrlf.exec:\xrlrrlf.exe80⤵PID:484
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe81⤵PID:2824
-
\??\c:\hthnhn.exec:\hthnhn.exe82⤵PID:2044
-
\??\c:\9htnnn.exec:\9htnnn.exe83⤵PID:2828
-
\??\c:\nhbhnn.exec:\nhbhnn.exe84⤵PID:2032
-
\??\c:\1vjjj.exec:\1vjjj.exe85⤵PID:2288
-
\??\c:\xxflrxf.exec:\xxflrxf.exe86⤵PID:632
-
\??\c:\xrfrlrr.exec:\xrfrlrr.exe87⤵PID:496
-
\??\c:\5hbnhh.exec:\5hbnhh.exe88⤵PID:1460
-
\??\c:\nhhnbh.exec:\nhhnbh.exe89⤵PID:572
-
\??\c:\7btthh.exec:\7btthh.exe90⤵PID:1976
-
\??\c:\vpddp.exec:\vpddp.exe91⤵PID:2512
-
\??\c:\lxrllrx.exec:\lxrllrx.exe92⤵PID:3068
-
\??\c:\lxffxrr.exec:\lxffxrr.exe93⤵PID:2072
-
\??\c:\7bnbbh.exec:\7bnbbh.exe94⤵PID:2076
-
\??\c:\3thnbn.exec:\3thnbn.exe95⤵PID:2340
-
\??\c:\3ddjp.exec:\3ddjp.exe96⤵PID:1344
-
\??\c:\dpjdv.exec:\dpjdv.exe97⤵PID:612
-
\??\c:\fxflxxf.exec:\fxflxxf.exe98⤵PID:1624
-
\??\c:\llfllrf.exec:\llfllrf.exe99⤵PID:1996
-
\??\c:\tbnnnh.exec:\tbnnnh.exe100⤵PID:1540
-
\??\c:\7thttt.exec:\7thttt.exe101⤵PID:2244
-
\??\c:\dvjjd.exec:\dvjjd.exe102⤵
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\frlllxl.exec:\frlllxl.exe103⤵PID:2980
-
\??\c:\rlxxffr.exec:\rlxxffr.exe104⤵PID:2216
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe105⤵PID:1928
-
\??\c:\tthhtb.exec:\tthhtb.exe106⤵PID:1188
-
\??\c:\7btnbh.exec:\7btnbh.exe107⤵PID:2632
-
\??\c:\vpvvd.exec:\vpvvd.exe108⤵PID:2796
-
\??\c:\pjpvv.exec:\pjpvv.exe109⤵PID:2940
-
\??\c:\5rlrxxf.exec:\5rlrxxf.exe110⤵PID:2752
-
\??\c:\lflrxrl.exec:\lflrxrl.exe111⤵PID:2628
-
\??\c:\dvdpd.exec:\dvdpd.exe112⤵PID:2728
-
\??\c:\1dddd.exec:\1dddd.exe113⤵PID:2640
-
\??\c:\lfxflfl.exec:\lfxflfl.exe114⤵PID:2804
-
\??\c:\5lxxxrr.exec:\5lxxxrr.exe115⤵PID:2560
-
\??\c:\7ffxxrf.exec:\7ffxxrf.exe116⤵PID:2548
-
\??\c:\tnbbnn.exec:\tnbbnn.exe117⤵PID:1956
-
\??\c:\tnbbtb.exec:\tnbbtb.exe118⤵PID:1592
-
\??\c:\dvjjv.exec:\dvjjv.exe119⤵PID:2736
-
\??\c:\ddjdj.exec:\ddjdj.exe120⤵PID:484
-
\??\c:\9rlrxfl.exec:\9rlrxfl.exe121⤵PID:2956
-
\??\c:\5fxfllx.exec:\5fxfllx.exe122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-