Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe
-
Size
58KB
-
MD5
67848d081fcd57a681130b7fc7895c40
-
SHA1
078724efa39319e70427adad39056f59b61396de
-
SHA256
420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809
-
SHA512
a8a285015904318a13a70298509cab798f79abe9d3d3649e2c9e2ca10cf5416615b2d37201bf018f7052931f2c175cfb8bc2f9bcbdfff9bc204ba89d86ab8ff7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv781:ymb3NkkiQ3mdBjFIfvY1
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2972-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-94-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2668 xllxxrr.exe 484 nhbhtt.exe 2920 pjppv.exe 2728 dppdp.exe 2880 rlrxlrf.exe 2772 lfrxlfl.exe 2928 nbhhnt.exe 2696 5tbbbb.exe 2656 jpvpp.exe 3048 1rrrrrr.exe 800 3ntntt.exe 1596 bbhbbb.exe 2556 ppddv.exe 1428 ppddj.exe 580 xflllfr.exe 1496 xllfrll.exe 1756 nbnttb.exe 2684 7nbhnt.exe 264 pjjjd.exe 1816 vpdvj.exe 2828 xrxxlll.exe 2016 fxxxllr.exe 840 nbhbnn.exe 940 jdvvj.exe 2820 jdppv.exe 2248 frxflrx.exe 1268 hbhtbn.exe 316 btnthb.exe 340 jdvvd.exe 3016 dpvvj.exe 2972 fxxrfrx.exe 1684 ffrxllf.exe 1712 9nbbnt.exe 2240 vpjjp.exe 2172 9pddj.exe 2852 jjdvj.exe 2712 xlxfxxf.exe 2912 lffflrx.exe 2964 nbnntn.exe 2696 hbhtnt.exe 2596 vdddd.exe 2604 9dvvd.exe 2904 rfflrlf.exe 2656 lfrrrrx.exe 1644 lxxllxx.exe 1920 htbhtt.exe 1956 thbbhb.exe 1984 vvppv.exe 2556 dpvpv.exe 1428 llfrffl.exe 2032 lfrrlrr.exe 1380 hntttn.exe 2780 hbhtbt.exe 1756 1vpjj.exe 916 xlxxxfl.exe 2624 bnbnbb.exe 828 httnnh.exe 640 bbnthn.exe 1848 pddvd.exe 960 jvddp.exe 2276 9lrlxxx.exe 940 1rlrflx.exe 2012 hnhbhb.exe 3028 thtnhh.exe -
resource yara_rule behavioral1/memory/2972-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2668 2972 420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe 30 PID 2972 wrote to memory of 2668 2972 420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe 30 PID 2972 wrote to memory of 2668 2972 420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe 30 PID 2972 wrote to memory of 2668 2972 420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe 30 PID 2668 wrote to memory of 484 2668 xllxxrr.exe 31 PID 2668 wrote to memory of 484 2668 xllxxrr.exe 31 PID 2668 wrote to memory of 484 2668 xllxxrr.exe 31 PID 2668 wrote to memory of 484 2668 xllxxrr.exe 31 PID 484 wrote to memory of 2920 484 nhbhtt.exe 32 PID 484 wrote to memory of 2920 484 nhbhtt.exe 32 PID 484 wrote to memory of 2920 484 nhbhtt.exe 32 PID 484 wrote to memory of 2920 484 nhbhtt.exe 32 PID 2920 wrote to memory of 2728 2920 pjppv.exe 33 PID 2920 wrote to memory of 2728 2920 pjppv.exe 33 PID 2920 wrote to memory of 2728 2920 pjppv.exe 33 PID 2920 wrote to memory of 2728 2920 pjppv.exe 33 PID 2728 wrote to memory of 2880 2728 dppdp.exe 34 PID 2728 wrote to memory of 2880 2728 dppdp.exe 34 PID 2728 wrote to memory of 2880 2728 dppdp.exe 34 PID 2728 wrote to memory of 2880 2728 dppdp.exe 34 PID 2880 wrote to memory of 2772 2880 rlrxlrf.exe 35 PID 2880 wrote to memory of 2772 2880 rlrxlrf.exe 35 PID 2880 wrote to memory of 2772 2880 rlrxlrf.exe 35 PID 2880 wrote to memory of 2772 2880 rlrxlrf.exe 35 PID 2772 wrote to memory of 2928 2772 lfrxlfl.exe 36 PID 2772 wrote to memory of 2928 2772 lfrxlfl.exe 36 PID 2772 wrote to memory of 2928 2772 lfrxlfl.exe 36 PID 2772 wrote to memory of 2928 2772 lfrxlfl.exe 36 PID 2928 wrote to memory of 2696 2928 nbhhnt.exe 37 PID 2928 wrote to memory of 2696 2928 nbhhnt.exe 37 PID 2928 wrote to memory of 2696 2928 nbhhnt.exe 37 PID 2928 wrote to memory of 2696 2928 nbhhnt.exe 37 PID 2696 wrote to memory of 2656 2696 5tbbbb.exe 38 PID 2696 wrote to memory of 2656 2696 5tbbbb.exe 38 PID 2696 wrote to memory of 2656 2696 5tbbbb.exe 38 PID 2696 wrote to memory of 2656 2696 5tbbbb.exe 38 PID 2656 wrote to memory of 3048 2656 jpvpp.exe 39 PID 2656 wrote to memory of 3048 2656 jpvpp.exe 39 PID 2656 wrote to memory of 3048 2656 jpvpp.exe 39 PID 2656 wrote to memory of 3048 2656 jpvpp.exe 39 PID 3048 wrote to memory of 800 3048 1rrrrrr.exe 40 PID 3048 wrote to memory of 800 3048 1rrrrrr.exe 40 PID 3048 wrote to memory of 800 3048 1rrrrrr.exe 40 PID 3048 wrote to memory of 800 3048 1rrrrrr.exe 40 PID 800 wrote to memory of 1596 800 3ntntt.exe 41 PID 800 wrote to memory of 1596 800 3ntntt.exe 41 PID 800 wrote to memory of 1596 800 3ntntt.exe 41 PID 800 wrote to memory of 1596 800 3ntntt.exe 41 PID 1596 wrote to memory of 2556 1596 bbhbbb.exe 42 PID 1596 wrote to memory of 2556 1596 bbhbbb.exe 42 PID 1596 wrote to memory of 2556 1596 bbhbbb.exe 42 PID 1596 wrote to memory of 2556 1596 bbhbbb.exe 42 PID 2556 wrote to memory of 1428 2556 ppddv.exe 43 PID 2556 wrote to memory of 1428 2556 ppddv.exe 43 PID 2556 wrote to memory of 1428 2556 ppddv.exe 43 PID 2556 wrote to memory of 1428 2556 ppddv.exe 43 PID 1428 wrote to memory of 580 1428 ppddj.exe 44 PID 1428 wrote to memory of 580 1428 ppddj.exe 44 PID 1428 wrote to memory of 580 1428 ppddj.exe 44 PID 1428 wrote to memory of 580 1428 ppddj.exe 44 PID 580 wrote to memory of 1496 580 xflllfr.exe 45 PID 580 wrote to memory of 1496 580 xflllfr.exe 45 PID 580 wrote to memory of 1496 580 xflllfr.exe 45 PID 580 wrote to memory of 1496 580 xflllfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe"C:\Users\Admin\AppData\Local\Temp\420ee04e303d000e1ea91aa9790aac6bef2e96ec7c6375d212f34cc7b4e57809N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xllxxrr.exec:\xllxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhbhtt.exec:\nhbhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\pjppv.exec:\pjppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\dppdp.exec:\dppdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbhhnt.exec:\nbhhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\5tbbbb.exec:\5tbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jpvpp.exec:\jpvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\1rrrrrr.exec:\1rrrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\3ntntt.exec:\3ntntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\bbhbbb.exec:\bbhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\ppddv.exec:\ppddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ppddj.exec:\ppddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\xflllfr.exec:\xflllfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\xllfrll.exec:\xllfrll.exe17⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nbnttb.exec:\nbnttb.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7nbhnt.exec:\7nbhnt.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684 -
\??\c:\pjjjd.exec:\pjjjd.exe20⤵
- Executes dropped EXE
PID:264 -
\??\c:\vpdvj.exec:\vpdvj.exe21⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrxxlll.exec:\xrxxlll.exe22⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fxxxllr.exec:\fxxxllr.exe23⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbhbnn.exec:\nbhbnn.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\jdvvj.exec:\jdvvj.exe25⤵
- Executes dropped EXE
PID:940 -
\??\c:\jdppv.exec:\jdppv.exe26⤵
- Executes dropped EXE
PID:2820 -
\??\c:\frxflrx.exec:\frxflrx.exe27⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbhtbn.exec:\hbhtbn.exe28⤵
- Executes dropped EXE
PID:1268 -
\??\c:\btnthb.exec:\btnthb.exe29⤵
- Executes dropped EXE
PID:316 -
\??\c:\jdvvd.exec:\jdvvd.exe30⤵
- Executes dropped EXE
PID:340 -
\??\c:\dpvvj.exec:\dpvvj.exe31⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fxxrfrx.exec:\fxxrfrx.exe32⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ffrxllf.exec:\ffrxllf.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9nbbnt.exec:\9nbbnt.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vpjjp.exec:\vpjjp.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9pddj.exec:\9pddj.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jjdvj.exec:\jjdvj.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xlxfxxf.exec:\xlxfxxf.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lffflrx.exec:\lffflrx.exe39⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nbnntn.exec:\nbnntn.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbhtnt.exec:\hbhtnt.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vdddd.exec:\vdddd.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9dvvd.exec:\9dvvd.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rfflrlf.exec:\rfflrlf.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lxxllxx.exec:\lxxllxx.exe46⤵
- Executes dropped EXE
PID:1644 -
\??\c:\htbhtt.exec:\htbhtt.exe47⤵
- Executes dropped EXE
PID:1920 -
\??\c:\thbbhb.exec:\thbbhb.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvppv.exec:\vvppv.exe49⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dpvpv.exec:\dpvpv.exe50⤵
- Executes dropped EXE
PID:2556 -
\??\c:\llfrffl.exec:\llfrffl.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lfrrlrr.exec:\lfrrlrr.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hntttn.exec:\hntttn.exe53⤵
- Executes dropped EXE
PID:1380 -
\??\c:\hbhtbt.exec:\hbhtbt.exe54⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1vpjj.exec:\1vpjj.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe56⤵
- Executes dropped EXE
PID:916 -
\??\c:\bnbnbb.exec:\bnbnbb.exe57⤵
- Executes dropped EXE
PID:2624 -
\??\c:\httnnh.exec:\httnnh.exe58⤵
- Executes dropped EXE
PID:828 -
\??\c:\bbnthn.exec:\bbnthn.exe59⤵
- Executes dropped EXE
PID:640 -
\??\c:\pddvd.exec:\pddvd.exe60⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jvddp.exec:\jvddp.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\9lrlxxx.exec:\9lrlxxx.exe62⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1rlrflx.exec:\1rlrflx.exe63⤵
- Executes dropped EXE
PID:940 -
\??\c:\hnhbhb.exec:\hnhbhb.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\thtnhh.exec:\thtnhh.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7vjpp.exec:\7vjpp.exe66⤵PID:2404
-
\??\c:\vjdjp.exec:\vjdjp.exe67⤵PID:2124
-
\??\c:\xfxfrlr.exec:\xfxfrlr.exe68⤵PID:1748
-
\??\c:\9rfxfxl.exec:\9rfxfxl.exe69⤵PID:544
-
\??\c:\hhhhnh.exec:\hhhhnh.exe70⤵PID:2188
-
\??\c:\dvddd.exec:\dvddd.exe71⤵PID:2320
-
\??\c:\7jjdj.exec:\7jjdj.exe72⤵PID:2972
-
\??\c:\lxrxflr.exec:\lxrxflr.exe73⤵PID:2052
-
\??\c:\xllrrrx.exec:\xllrrrx.exe74⤵PID:2184
-
\??\c:\rlxflrf.exec:\rlxflrf.exe75⤵PID:2676
-
\??\c:\5thnnt.exec:\5thnnt.exe76⤵PID:2732
-
\??\c:\bhtnnn.exec:\bhtnnn.exe77⤵PID:2848
-
\??\c:\7dvdd.exec:\7dvdd.exe78⤵PID:2716
-
\??\c:\dvjjv.exec:\dvjjv.exe79⤵PID:2872
-
\??\c:\1xllffl.exec:\1xllffl.exe80⤵PID:2888
-
\??\c:\7rfxffl.exec:\7rfxffl.exe81⤵PID:2856
-
\??\c:\7bnntb.exec:\7bnntb.exe82⤵PID:2640
-
\??\c:\hbhnbb.exec:\hbhnbb.exe83⤵
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\djjjd.exec:\djjjd.exe84⤵PID:2660
-
\??\c:\5pdvv.exec:\5pdvv.exe85⤵PID:776
-
\??\c:\5jppj.exec:\5jppj.exe86⤵PID:1732
-
\??\c:\xrlfllr.exec:\xrlfllr.exe87⤵PID:1676
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe88⤵PID:1996
-
\??\c:\nhntbb.exec:\nhntbb.exe89⤵PID:768
-
\??\c:\hbhhnb.exec:\hbhhnb.exe90⤵PID:1280
-
\??\c:\dpvvv.exec:\dpvvv.exe91⤵PID:1148
-
\??\c:\djpjp.exec:\djpjp.exe92⤵PID:2024
-
\??\c:\lxxxfxl.exec:\lxxxfxl.exe93⤵PID:2776
-
\??\c:\rflffxx.exec:\rflffxx.exe94⤵PID:2672
-
\??\c:\xlxlrxf.exec:\xlxlrxf.exe95⤵PID:2684
-
\??\c:\9hbhtb.exec:\9hbhtb.exe96⤵PID:2948
-
\??\c:\nhhhhn.exec:\nhhhhn.exe97⤵PID:2944
-
\??\c:\thnntt.exec:\thnntt.exe98⤵PID:408
-
\??\c:\dvjdv.exec:\dvjdv.exe99⤵PID:2988
-
\??\c:\7pjjv.exec:\7pjjv.exe100⤵PID:1976
-
\??\c:\rfrxffl.exec:\rfrxffl.exe101⤵PID:1852
-
\??\c:\xrxflrx.exec:\xrxflrx.exe102⤵PID:1000
-
\??\c:\tnbnnt.exec:\tnbnnt.exe103⤵PID:2196
-
\??\c:\tntbbb.exec:\tntbbb.exe104⤵PID:3060
-
\??\c:\5vpjv.exec:\5vpjv.exe105⤵PID:592
-
\??\c:\pjjjv.exec:\pjjjv.exe106⤵PID:1476
-
\??\c:\rxlrlfx.exec:\rxlrlfx.exe107⤵PID:904
-
\??\c:\rfflrxx.exec:\rfflrxx.exe108⤵PID:812
-
\??\c:\nttnnn.exec:\nttnnn.exe109⤵PID:2100
-
\??\c:\htbbtb.exec:\htbbtb.exe110⤵PID:2508
-
\??\c:\nnnntt.exec:\nnnntt.exe111⤵PID:2260
-
\??\c:\3dppp.exec:\3dppp.exe112⤵PID:3056
-
\??\c:\7jdvd.exec:\7jdvd.exe113⤵PID:2148
-
\??\c:\lxffxxl.exec:\lxffxxl.exe114⤵PID:2692
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe115⤵PID:2844
-
\??\c:\5ttnbh.exec:\5ttnbh.exe116⤵PID:2736
-
\??\c:\nbhhhh.exec:\nbhhhh.exe117⤵PID:2864
-
\??\c:\dvvvd.exec:\dvvvd.exe118⤵PID:2620
-
\??\c:\djvjv.exec:\djvjv.exe119⤵PID:1272
-
\??\c:\9dvvd.exec:\9dvvd.exe120⤵PID:2580
-
\??\c:\lflllll.exec:\lflllll.exe121⤵PID:1700
-
\??\c:\rfffrlx.exec:\rfffrlx.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-