Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe
-
Size
71KB
-
MD5
1ade8b39c6e1d586768139bd2a9d3180
-
SHA1
eb9380d3cd3c7fbba5caee983b13d6ae3a5abe20
-
SHA256
1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76b
-
SHA512
1b1a15646308f97a086220038c80a2d0b358caf719c8e2a2cedab98b09f4f346ca8e63a1f6ba4a537bfbe0ed4150cd186fcf4ef15f7e16737ac75338b74bde1d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj9:ymb3NkkiQ3mdBjFI4Vt
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1968-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1680 pjvpv.exe 2924 pjvjd.exe 1548 lfxfllx.exe 2232 xxffrff.exe 2828 hbnnhb.exe 2912 jjdjp.exe 2744 frxxfxf.exe 2720 vpddd.exe 2616 jdpdp.exe 2044 rlxfllx.exe 1512 5rrfxlr.exe 2896 9hhbhn.exe 568 vpjdv.exe 2684 vpjdj.exe 2672 llrrrfl.exe 836 rlxfxfl.exe 1152 nnbthn.exe 2964 tnhntn.exe 2204 bnhnbt.exe 2100 pjvdp.exe 640 jjvvj.exe 2244 ffrrxxf.exe 1036 xlrxffx.exe 1328 xrxlxrf.exe 1696 bthbhn.exe 1392 hbhhnh.exe 1740 1pjvd.exe 2128 pjvvd.exe 604 rxrlrrx.exe 1924 5rlrfxl.exe 1920 ffrxlrf.exe 2528 nhbntb.exe 1520 jdjpv.exe 1704 dvpvj.exe 2232 jdpdp.exe 2928 rlrrrrf.exe 292 xxrlfrr.exe 2856 7xlfrrl.exe 2752 btnbhn.exe 2744 nhhhtb.exe 2636 vvjpp.exe 1984 jdjjv.exe 2580 jdpdv.exe 2572 xlxxllr.exe 616 rllfllx.exe 2968 xxrllxl.exe 2812 nnhnnt.exe 2684 5hbbbb.exe 2960 nhhhnh.exe 316 1vpvd.exe 836 jdpvv.exe 2972 7xlfrxl.exe 2988 xrxxffx.exe 2332 lxlrrrf.exe 1476 xrxflrx.exe 904 thttbt.exe 2564 hbhntt.exe 1044 hbhhhh.exe 1804 vjppv.exe 1140 vvjvd.exe 1084 dvdvd.exe 2196 rlrxxfx.exe 1996 rlfrxxf.exe 1072 rlxfllr.exe -
resource yara_rule behavioral1/memory/1968-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-163-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1680 1968 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 30 PID 1968 wrote to memory of 1680 1968 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 30 PID 1968 wrote to memory of 1680 1968 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 30 PID 1968 wrote to memory of 1680 1968 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 30 PID 1680 wrote to memory of 2924 1680 pjvpv.exe 31 PID 1680 wrote to memory of 2924 1680 pjvpv.exe 31 PID 1680 wrote to memory of 2924 1680 pjvpv.exe 31 PID 1680 wrote to memory of 2924 1680 pjvpv.exe 31 PID 2924 wrote to memory of 1548 2924 pjvjd.exe 32 PID 2924 wrote to memory of 1548 2924 pjvjd.exe 32 PID 2924 wrote to memory of 1548 2924 pjvjd.exe 32 PID 2924 wrote to memory of 1548 2924 pjvjd.exe 32 PID 1548 wrote to memory of 2232 1548 lfxfllx.exe 33 PID 1548 wrote to memory of 2232 1548 lfxfllx.exe 33 PID 1548 wrote to memory of 2232 1548 lfxfllx.exe 33 PID 1548 wrote to memory of 2232 1548 lfxfllx.exe 33 PID 2232 wrote to memory of 2828 2232 xxffrff.exe 34 PID 2232 wrote to memory of 2828 2232 xxffrff.exe 34 PID 2232 wrote to memory of 2828 2232 xxffrff.exe 34 PID 2232 wrote to memory of 2828 2232 xxffrff.exe 34 PID 2828 wrote to memory of 2912 2828 hbnnhb.exe 35 PID 2828 wrote to memory of 2912 2828 hbnnhb.exe 35 PID 2828 wrote to memory of 2912 2828 hbnnhb.exe 35 PID 2828 wrote to memory of 2912 2828 hbnnhb.exe 35 PID 2912 wrote to memory of 2744 2912 jjdjp.exe 36 PID 2912 wrote to memory of 2744 2912 jjdjp.exe 36 PID 2912 wrote to memory of 2744 2912 jjdjp.exe 36 PID 2912 wrote to memory of 2744 2912 jjdjp.exe 36 PID 2744 wrote to memory of 2720 2744 frxxfxf.exe 37 PID 2744 wrote to memory of 2720 2744 frxxfxf.exe 37 PID 2744 wrote to memory of 2720 2744 frxxfxf.exe 37 PID 2744 wrote to memory of 2720 2744 frxxfxf.exe 37 PID 2720 wrote to memory of 2616 2720 vpddd.exe 38 PID 2720 wrote to memory of 2616 2720 vpddd.exe 38 PID 2720 wrote to memory of 2616 2720 vpddd.exe 38 PID 2720 wrote to memory of 2616 2720 vpddd.exe 38 PID 2616 wrote to memory of 2044 2616 jdpdp.exe 39 PID 2616 wrote to memory of 2044 2616 jdpdp.exe 39 PID 2616 wrote to memory of 2044 2616 jdpdp.exe 39 PID 2616 wrote to memory of 2044 2616 jdpdp.exe 39 PID 2044 wrote to memory of 1512 2044 rlxfllx.exe 40 PID 2044 wrote to memory of 1512 2044 rlxfllx.exe 40 PID 2044 wrote to memory of 1512 2044 rlxfllx.exe 40 PID 2044 wrote to memory of 1512 2044 rlxfllx.exe 40 PID 1512 wrote to memory of 2896 1512 5rrfxlr.exe 41 PID 1512 wrote to memory of 2896 1512 5rrfxlr.exe 41 PID 1512 wrote to memory of 2896 1512 5rrfxlr.exe 41 PID 1512 wrote to memory of 2896 1512 5rrfxlr.exe 41 PID 2896 wrote to memory of 568 2896 9hhbhn.exe 42 PID 2896 wrote to memory of 568 2896 9hhbhn.exe 42 PID 2896 wrote to memory of 568 2896 9hhbhn.exe 42 PID 2896 wrote to memory of 568 2896 9hhbhn.exe 42 PID 568 wrote to memory of 2684 568 vpjdv.exe 43 PID 568 wrote to memory of 2684 568 vpjdv.exe 43 PID 568 wrote to memory of 2684 568 vpjdv.exe 43 PID 568 wrote to memory of 2684 568 vpjdv.exe 43 PID 2684 wrote to memory of 2672 2684 vpjdj.exe 44 PID 2684 wrote to memory of 2672 2684 vpjdj.exe 44 PID 2684 wrote to memory of 2672 2684 vpjdj.exe 44 PID 2684 wrote to memory of 2672 2684 vpjdj.exe 44 PID 2672 wrote to memory of 836 2672 llrrrfl.exe 81 PID 2672 wrote to memory of 836 2672 llrrrfl.exe 81 PID 2672 wrote to memory of 836 2672 llrrrfl.exe 81 PID 2672 wrote to memory of 836 2672 llrrrfl.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe"C:\Users\Admin\AppData\Local\Temp\1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pjvpv.exec:\pjvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\pjvjd.exec:\pjvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lfxfllx.exec:\lfxfllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\xxffrff.exec:\xxffrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hbnnhb.exec:\hbnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jjdjp.exec:\jjdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\frxxfxf.exec:\frxxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vpddd.exec:\vpddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdpdp.exec:\jdpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rlxfllx.exec:\rlxfllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\5rrfxlr.exec:\5rrfxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\9hhbhn.exec:\9hhbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vpjdv.exec:\vpjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\vpjdj.exec:\vpjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\llrrrfl.exec:\llrrrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe17⤵
- Executes dropped EXE
PID:836 -
\??\c:\nnbthn.exec:\nnbthn.exe18⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tnhntn.exec:\tnhntn.exe19⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bnhnbt.exec:\bnhnbt.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pjvdp.exec:\pjvdp.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jjvvj.exec:\jjvvj.exe22⤵
- Executes dropped EXE
PID:640 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xlrxffx.exec:\xlrxffx.exe24⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xrxlxrf.exec:\xrxlxrf.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bthbhn.exec:\bthbhn.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hbhhnh.exec:\hbhhnh.exe27⤵
- Executes dropped EXE
PID:1392 -
\??\c:\1pjvd.exec:\1pjvd.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pjvvd.exec:\pjvvd.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rxrlrrx.exec:\rxrlrrx.exe30⤵
- Executes dropped EXE
PID:604 -
\??\c:\5rlrfxl.exec:\5rlrfxl.exe31⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe32⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tthhhn.exec:\tthhhn.exe33⤵PID:2344
-
\??\c:\nhbntb.exec:\nhbntb.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jdjpv.exec:\jdjpv.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dvpvj.exec:\dvpvj.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jdpdp.exec:\jdpdp.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xxrlfrr.exec:\xxrlfrr.exe39⤵
- Executes dropped EXE
PID:292 -
\??\c:\7xlfrrl.exec:\7xlfrrl.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btnbhn.exec:\btnbhn.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\nhhhtb.exec:\nhhhtb.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvjpp.exec:\vvjpp.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdjjv.exec:\jdjjv.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jdpdv.exec:\jdpdv.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xlxxllr.exec:\xlxxllr.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rllfllx.exec:\rllfllx.exe47⤵
- Executes dropped EXE
PID:616 -
\??\c:\xxrllxl.exec:\xxrllxl.exe48⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nnhnnt.exec:\nnhnnt.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5hbbbb.exec:\5hbbbb.exe50⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhhhnh.exec:\nhhhnh.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1vpvd.exec:\1vpvd.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\jdpvv.exec:\jdpvv.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\7xlfrxl.exec:\7xlfrxl.exe54⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xrxxffx.exec:\xrxxffx.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xrxflrx.exec:\xrxflrx.exe57⤵
- Executes dropped EXE
PID:1476 -
\??\c:\thttbt.exec:\thttbt.exe58⤵
- Executes dropped EXE
PID:904 -
\??\c:\hbhntt.exec:\hbhntt.exe59⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hbhhhh.exec:\hbhhhh.exe60⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vjppv.exec:\vjppv.exe61⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vvjvd.exec:\vvjvd.exe62⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dvdvd.exec:\dvdvd.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rlrxxfx.exec:\rlrxxfx.exe64⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe65⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rlxfllr.exec:\rlxfllr.exe66⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hbhnnb.exec:\hbhnnb.exe67⤵PID:2248
-
\??\c:\bhntth.exec:\bhntth.exe68⤵PID:2284
-
\??\c:\tntbht.exec:\tntbht.exe69⤵PID:3020
-
\??\c:\jjvjj.exec:\jjvjj.exe70⤵PID:2344
-
\??\c:\3jddp.exec:\3jddp.exe71⤵PID:2676
-
\??\c:\jdjpd.exec:\jdjpd.exe72⤵PID:2056
-
\??\c:\5lffflx.exec:\5lffflx.exe73⤵PID:1300
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe74⤵PID:1704
-
\??\c:\xrxxfrx.exec:\xrxxfrx.exe75⤵PID:2832
-
\??\c:\3nhtbb.exec:\3nhtbb.exe76⤵PID:2932
-
\??\c:\3nbhnn.exec:\3nbhnn.exe77⤵PID:2592
-
\??\c:\nnttbb.exec:\nnttbb.exe78⤵PID:3060
-
\??\c:\vpdjp.exec:\vpdjp.exe79⤵PID:2016
-
\??\c:\dvpdj.exec:\dvpdj.exe80⤵PID:2640
-
\??\c:\3vjdj.exec:\3vjdj.exe81⤵PID:2744
-
\??\c:\fxrrfrr.exec:\fxrrfrr.exe82⤵PID:2408
-
\??\c:\xxllrrf.exec:\xxllrrf.exe83⤵PID:1872
-
\??\c:\xlrxllr.exec:\xlrxllr.exe84⤵PID:1980
-
\??\c:\hhnthh.exec:\hhnthh.exe85⤵PID:2328
-
\??\c:\btntbh.exec:\btntbh.exe86⤵PID:2136
-
\??\c:\ttnbbn.exec:\ttnbbn.exe87⤵PID:1080
-
\??\c:\djjpj.exec:\djjpj.exe88⤵PID:2784
-
\??\c:\1dpvd.exec:\1dpvd.exe89⤵PID:1988
-
\??\c:\jdppj.exec:\jdppj.exe90⤵PID:2792
-
\??\c:\xxfxlrl.exec:\xxfxlrl.exe91⤵PID:2960
-
\??\c:\lflllrf.exec:\lflllrf.exe92⤵PID:316
-
\??\c:\xxflllf.exec:\xxflllf.exe93⤵PID:836
-
\??\c:\5vpjv.exec:\5vpjv.exe94⤵PID:1656
-
\??\c:\jdjpd.exec:\jdjpd.exe95⤵PID:2484
-
\??\c:\tthhhb.exec:\tthhhb.exe96⤵PID:2320
-
\??\c:\3dvjv.exec:\3dvjv.exe97⤵PID:640
-
\??\c:\jjddv.exec:\jjddv.exe98⤵PID:1212
-
\??\c:\hhhbtn.exec:\hhhbtn.exe99⤵PID:3036
-
\??\c:\hbhntt.exec:\hbhntt.exe100⤵PID:1888
-
\??\c:\pjjpd.exec:\pjjpd.exe101⤵PID:692
-
\??\c:\jdppp.exec:\jdppp.exe102⤵PID:2132
-
\??\c:\dvjjp.exec:\dvjjp.exe103⤵
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\fxllrrf.exec:\fxllrrf.exe104⤵PID:2300
-
\??\c:\9lfrfxf.exec:\9lfrfxf.exe105⤵PID:1564
-
\??\c:\3nhntb.exec:\3nhntb.exe106⤵PID:604
-
\??\c:\5thbbb.exec:\5thbbb.exe107⤵
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\pdpjj.exec:\pdpjj.exe108⤵PID:2548
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe109⤵PID:3040
-
\??\c:\1lxlrfl.exec:\1lxlrfl.exe110⤵PID:2668
-
\??\c:\htbbtb.exec:\htbbtb.exe111⤵PID:2676
-
\??\c:\9bbhbh.exec:\9bbhbh.exe112⤵PID:2728
-
\??\c:\nhhbbb.exec:\nhhbbb.exe113⤵PID:1300
-
\??\c:\dvddj.exec:\dvddj.exe114⤵PID:2424
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe115⤵PID:2076
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe116⤵PID:1484
-
\??\c:\hbnnbn.exec:\hbnnbn.exe117⤵PID:2912
-
\??\c:\vpdjp.exec:\vpdjp.exe118⤵PID:3060
-
\??\c:\7rfxxll.exec:\7rfxxll.exe119⤵PID:1928
-
\??\c:\xxxllxr.exec:\xxxllxr.exe120⤵PID:2720
-
\??\c:\hbnnnt.exec:\hbnnnt.exe121⤵PID:2744
-
\??\c:\3httnn.exec:\3httnn.exe122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-