Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c47f433d92b00c56035a4896117c6c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7c47f433d92b00c56035a4896117c6c0N.exe
-
Size
79KB
-
MD5
7c47f433d92b00c56035a4896117c6c0
-
SHA1
8dc89daedfb8bee7cb00853107150edd94b0a1d9
-
SHA256
8101b34d5b2b8aa262eb4382bf6b2d161945053aa1aacba1fe21588bf09b301e
-
SHA512
42bd29d6dfeb94ec8b988e097cf952f28c3f099f4f2019da6c6ba0c70e8e21d60c08965faa1845be607285a04683a355fc7e8dcc614a1f7f9d13e30f166677ea
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjDbOXY8Rn:ymb3NkkiQ3mdBjFI4VAYA
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2904-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/404-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2388 pddpv.exe 2268 3vvdj.exe 2116 lxrrxll.exe 2096 hhhthn.exe 2764 hbhhtt.exe 2608 dvjpp.exe 2876 jdjpv.exe 2644 lfllllr.exe 2680 bthhhn.exe 2436 bnbnbh.exe 552 9bnbbh.exe 2928 5pjjp.exe 2504 9lrrrxl.exe 2920 3lrxxxx.exe 2036 lfrlxrr.exe 1816 5hbbtt.exe 2008 htbttn.exe 2500 3pvvd.exe 2640 vpvvd.exe 2360 frllllx.exe 2084 frflrxf.exe 404 7bntbn.exe 1956 htttnn.exe 2940 dpdvv.exe 1312 vjpvp.exe 3068 vjvpv.exe 2572 ffxrxlf.exe 1524 thnhhb.exe 1740 1bnbht.exe 2904 vjjdj.exe 1692 jdpvd.exe 2268 xrllrrx.exe 2080 frfllll.exe 1576 xrflflx.exe 1688 xrrxrxl.exe 2884 htbtbb.exe 2812 httnbt.exe 2628 hbhhhn.exe 2636 vpdjv.exe 2728 1vpvp.exe 2736 frlfrrx.exe 2860 rrxlxxl.exe 1484 9rxrflr.exe 3004 5lflxfl.exe 2928 tnbbnn.exe 2936 thhhtt.exe 1336 bhtnnh.exe 3000 7dpvj.exe 1708 dvdjp.exe 2092 3vppd.exe 2900 5rxxxrr.exe 1600 5xxllrx.exe 1800 fxfrfll.exe 2188 fxxfrrf.exe 2264 hbnbhh.exe 2024 ttnttt.exe 2320 7nhhbb.exe 1344 dvdvd.exe 1764 5dppj.exe 2128 dpdjp.exe 3056 xffrxxf.exe 524 xxxfrxf.exe 1560 rllfllr.exe 1432 thnttn.exe -
resource yara_rule behavioral1/memory/2904-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/404-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-38-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2388 2904 7c47f433d92b00c56035a4896117c6c0N.exe 30 PID 2904 wrote to memory of 2388 2904 7c47f433d92b00c56035a4896117c6c0N.exe 30 PID 2904 wrote to memory of 2388 2904 7c47f433d92b00c56035a4896117c6c0N.exe 30 PID 2904 wrote to memory of 2388 2904 7c47f433d92b00c56035a4896117c6c0N.exe 30 PID 2388 wrote to memory of 2268 2388 pddpv.exe 61 PID 2388 wrote to memory of 2268 2388 pddpv.exe 61 PID 2388 wrote to memory of 2268 2388 pddpv.exe 61 PID 2388 wrote to memory of 2268 2388 pddpv.exe 61 PID 2268 wrote to memory of 2116 2268 3vvdj.exe 32 PID 2268 wrote to memory of 2116 2268 3vvdj.exe 32 PID 2268 wrote to memory of 2116 2268 3vvdj.exe 32 PID 2268 wrote to memory of 2116 2268 3vvdj.exe 32 PID 2116 wrote to memory of 2096 2116 lxrrxll.exe 33 PID 2116 wrote to memory of 2096 2116 lxrrxll.exe 33 PID 2116 wrote to memory of 2096 2116 lxrrxll.exe 33 PID 2116 wrote to memory of 2096 2116 lxrrxll.exe 33 PID 2096 wrote to memory of 2764 2096 hhhthn.exe 34 PID 2096 wrote to memory of 2764 2096 hhhthn.exe 34 PID 2096 wrote to memory of 2764 2096 hhhthn.exe 34 PID 2096 wrote to memory of 2764 2096 hhhthn.exe 34 PID 2764 wrote to memory of 2608 2764 hbhhtt.exe 35 PID 2764 wrote to memory of 2608 2764 hbhhtt.exe 35 PID 2764 wrote to memory of 2608 2764 hbhhtt.exe 35 PID 2764 wrote to memory of 2608 2764 hbhhtt.exe 35 PID 2608 wrote to memory of 2876 2608 dvjpp.exe 36 PID 2608 wrote to memory of 2876 2608 dvjpp.exe 36 PID 2608 wrote to memory of 2876 2608 dvjpp.exe 36 PID 2608 wrote to memory of 2876 2608 dvjpp.exe 36 PID 2876 wrote to memory of 2644 2876 jdjpv.exe 37 PID 2876 wrote to memory of 2644 2876 jdjpv.exe 37 PID 2876 wrote to memory of 2644 2876 jdjpv.exe 37 PID 2876 wrote to memory of 2644 2876 jdjpv.exe 37 PID 2644 wrote to memory of 2680 2644 lfllllr.exe 38 PID 2644 wrote to memory of 2680 2644 lfllllr.exe 38 PID 2644 wrote to memory of 2680 2644 lfllllr.exe 38 PID 2644 wrote to memory of 2680 2644 lfllllr.exe 38 PID 2680 wrote to memory of 2436 2680 bthhhn.exe 39 PID 2680 wrote to memory of 2436 2680 bthhhn.exe 39 PID 2680 wrote to memory of 2436 2680 bthhhn.exe 39 PID 2680 wrote to memory of 2436 2680 bthhhn.exe 39 PID 2436 wrote to memory of 552 2436 bnbnbh.exe 40 PID 2436 wrote to memory of 552 2436 bnbnbh.exe 40 PID 2436 wrote to memory of 552 2436 bnbnbh.exe 40 PID 2436 wrote to memory of 552 2436 bnbnbh.exe 40 PID 552 wrote to memory of 2928 552 9bnbbh.exe 41 PID 552 wrote to memory of 2928 552 9bnbbh.exe 41 PID 552 wrote to memory of 2928 552 9bnbbh.exe 41 PID 552 wrote to memory of 2928 552 9bnbbh.exe 41 PID 2928 wrote to memory of 2504 2928 5pjjp.exe 42 PID 2928 wrote to memory of 2504 2928 5pjjp.exe 42 PID 2928 wrote to memory of 2504 2928 5pjjp.exe 42 PID 2928 wrote to memory of 2504 2928 5pjjp.exe 42 PID 2504 wrote to memory of 2920 2504 9lrrrxl.exe 43 PID 2504 wrote to memory of 2920 2504 9lrrrxl.exe 43 PID 2504 wrote to memory of 2920 2504 9lrrrxl.exe 43 PID 2504 wrote to memory of 2920 2504 9lrrrxl.exe 43 PID 2920 wrote to memory of 2036 2920 3lrxxxx.exe 44 PID 2920 wrote to memory of 2036 2920 3lrxxxx.exe 44 PID 2920 wrote to memory of 2036 2920 3lrxxxx.exe 44 PID 2920 wrote to memory of 2036 2920 3lrxxxx.exe 44 PID 2036 wrote to memory of 1816 2036 lfrlxrr.exe 45 PID 2036 wrote to memory of 1816 2036 lfrlxrr.exe 45 PID 2036 wrote to memory of 1816 2036 lfrlxrr.exe 45 PID 2036 wrote to memory of 1816 2036 lfrlxrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c47f433d92b00c56035a4896117c6c0N.exe"C:\Users\Admin\AppData\Local\Temp\7c47f433d92b00c56035a4896117c6c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pddpv.exec:\pddpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\3vvdj.exec:\3vvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lxrrxll.exec:\lxrrxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hhhthn.exec:\hhhthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\hbhhtt.exec:\hbhhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dvjpp.exec:\dvjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jdjpv.exec:\jdjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lfllllr.exec:\lfllllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bthhhn.exec:\bthhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bnbnbh.exec:\bnbnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9bnbbh.exec:\9bnbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\5pjjp.exec:\5pjjp.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\9lrrrxl.exec:\9lrrrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\3lrxxxx.exec:\3lrxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lfrlxrr.exec:\lfrlxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\5hbbtt.exec:\5hbbtt.exe17⤵
- Executes dropped EXE
PID:1816 -
\??\c:\htbttn.exec:\htbttn.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3pvvd.exec:\3pvvd.exe19⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vpvvd.exec:\vpvvd.exe20⤵
- Executes dropped EXE
PID:2640 -
\??\c:\frllllx.exec:\frllllx.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frflrxf.exec:\frflrxf.exe22⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7bntbn.exec:\7bntbn.exe23⤵
- Executes dropped EXE
PID:404 -
\??\c:\htttnn.exec:\htttnn.exe24⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dpdvv.exec:\dpdvv.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vjpvp.exec:\vjpvp.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vjvpv.exec:\vjvpv.exe27⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ffxrxlf.exec:\ffxrxlf.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\thnhhb.exec:\thnhhb.exe29⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1bnbht.exec:\1bnbht.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vjjdj.exec:\vjjdj.exe31⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jdpvd.exec:\jdpvd.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrllrrx.exec:\xrllrrx.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\frfllll.exec:\frfllll.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrflflx.exec:\xrflflx.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe36⤵
- Executes dropped EXE
PID:1688 -
\??\c:\htbtbb.exec:\htbtbb.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\httnbt.exec:\httnbt.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\hbhhhn.exec:\hbhhhn.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vpdjv.exec:\vpdjv.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1vpvp.exec:\1vpvp.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\frlfrrx.exec:\frlfrrx.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rrxlxxl.exec:\rrxlxxl.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9rxrflr.exec:\9rxrflr.exe44⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5lflxfl.exec:\5lflxfl.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tnbbnn.exec:\tnbbnn.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thhhtt.exec:\thhhtt.exe47⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bhtnnh.exec:\bhtnnh.exe48⤵
- Executes dropped EXE
PID:1336 -
\??\c:\7dpvj.exec:\7dpvj.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dvdjp.exec:\dvdjp.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3vppd.exec:\3vppd.exe51⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5rxxxrr.exec:\5rxxxrr.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5xxllrx.exec:\5xxllrx.exe53⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fxfrfll.exec:\fxfrfll.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbnbhh.exec:\hbnbhh.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ttnttt.exec:\ttnttt.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7nhhbb.exec:\7nhhbb.exe58⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvdvd.exec:\dvdvd.exe59⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5dppj.exec:\5dppj.exe60⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dpdjp.exec:\dpdjp.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xffrxxf.exec:\xffrxxf.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xxxfrxf.exec:\xxxfrxf.exe63⤵
- Executes dropped EXE
PID:524 -
\??\c:\rllfllr.exec:\rllfllr.exe64⤵
- Executes dropped EXE
PID:1560 -
\??\c:\thnttn.exec:\thnttn.exe65⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hthhnh.exec:\hthhnh.exe66⤵PID:1000
-
\??\c:\7hntnt.exec:\7hntnt.exe67⤵PID:2404
-
\??\c:\7jvpp.exec:\7jvpp.exe68⤵PID:1144
-
\??\c:\5jvdj.exec:\5jvdj.exe69⤵PID:2464
-
\??\c:\vjjpd.exec:\vjjpd.exe70⤵PID:1692
-
\??\c:\1flxlrx.exec:\1flxlrx.exe71⤵PID:2452
-
\??\c:\lffllrx.exec:\lffllrx.exe72⤵PID:1580
-
\??\c:\fxrflll.exec:\fxrflll.exe73⤵PID:2756
-
\??\c:\tbhnbn.exec:\tbhnbn.exe74⤵PID:2376
-
\??\c:\nbbbhb.exec:\nbbbhb.exe75⤵PID:2276
-
\??\c:\1hnttn.exec:\1hnttn.exe76⤵PID:272
-
\??\c:\3btttb.exec:\3btttb.exe77⤵PID:2256
-
\??\c:\dvjjj.exec:\dvjjj.exe78⤵PID:2628
-
\??\c:\pjdjv.exec:\pjdjv.exe79⤵PID:2636
-
\??\c:\frxrfff.exec:\frxrfff.exe80⤵PID:1796
-
\??\c:\5flrffx.exec:\5flrffx.exe81⤵PID:2148
-
\??\c:\nbhhnn.exec:\nbhhnn.exe82⤵PID:892
-
\??\c:\lfrrflr.exec:\lfrrflr.exe83⤵PID:2952
-
\??\c:\tnhhhb.exec:\tnhhhb.exe84⤵PID:1112
-
\??\c:\5bhnbh.exec:\5bhnbh.exe85⤵PID:2772
-
\??\c:\pjpjj.exec:\pjpjj.exe86⤵PID:2712
-
\??\c:\lfrfxlx.exec:\lfrfxlx.exe87⤵PID:2768
-
\??\c:\nbntbb.exec:\nbntbb.exe88⤵PID:1984
-
\??\c:\9thhnn.exec:\9thhnn.exe89⤵PID:1976
-
\??\c:\7jvvp.exec:\7jvvp.exe90⤵PID:1164
-
\??\c:\pdjpv.exec:\pdjpv.exe91⤵PID:3036
-
\??\c:\xlrxfxl.exec:\xlrxfxl.exe92⤵PID:2120
-
\??\c:\5nttbb.exec:\5nttbb.exe93⤵PID:2872
-
\??\c:\7pjvd.exec:\7pjvd.exe94⤵PID:2640
-
\??\c:\1xflxrx.exec:\1xflxrx.exe95⤵PID:2864
-
\??\c:\thtttb.exec:\thtttb.exe96⤵PID:2136
-
\??\c:\hhbbbt.exec:\hhbbbt.exe97⤵PID:2076
-
\??\c:\9pvdd.exec:\9pvdd.exe98⤵PID:616
-
\??\c:\htbhnb.exec:\htbhnb.exe99⤵PID:1244
-
\??\c:\vjddj.exec:\vjddj.exe100⤵PID:2984
-
\??\c:\vdjvp.exec:\vdjvp.exe101⤵PID:2296
-
\??\c:\rlxlflf.exec:\rlxlflf.exe102⤵PID:3028
-
\??\c:\rrfxlrx.exec:\rrfxlrx.exe103⤵PID:3068
-
\??\c:\3bhbnn.exec:\3bhbnn.exe104⤵PID:316
-
\??\c:\5dvdp.exec:\5dvdp.exe105⤵PID:372
-
\??\c:\rrxfxlr.exec:\rrxfxlr.exe106⤵PID:2292
-
\??\c:\lffflrr.exec:\lffflrr.exe107⤵PID:2528
-
\??\c:\bnbntb.exec:\bnbntb.exe108⤵PID:1636
-
\??\c:\nbthhn.exec:\nbthhn.exe109⤵PID:1332
-
\??\c:\1jvdv.exec:\1jvdv.exe110⤵PID:2204
-
\??\c:\1xlxfxf.exec:\1xlxfxf.exe111⤵
- System Location Discovery: System Language Discovery
PID:1240 -
\??\c:\rlrfrfr.exec:\rlrfrfr.exe112⤵PID:1684
-
\??\c:\htbhbh.exec:\htbhbh.exe113⤵PID:2788
-
\??\c:\pdpvd.exec:\pdpvd.exe114⤵PID:2820
-
\??\c:\pdjjd.exec:\pdjjd.exe115⤵PID:2608
-
\??\c:\lffflfl.exec:\lffflfl.exe116⤵PID:2812
-
\??\c:\nbnntn.exec:\nbnntn.exe117⤵PID:1752
-
\??\c:\3dddv.exec:\3dddv.exe118⤵PID:2140
-
\??\c:\frxfflr.exec:\frxfflr.exe119⤵PID:2332
-
\??\c:\rfllrxf.exec:\rfllrxf.exe120⤵PID:2532
-
\??\c:\tnbnhn.exec:\tnbnhn.exe121⤵PID:2072
-
\??\c:\httthn.exec:\httthn.exe122⤵PID:680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-