Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 20:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe
-
Size
69KB
-
MD5
87025e85c45c850bbbf761ac364caba0
-
SHA1
e65f718a41d940ed1b6ff5558ab585b33c58e1ab
-
SHA256
191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6a
-
SHA512
93f1fb9aac909185c54eefc84bc3abf6a7feb9a8d61cf6a07b57380e3a8908571344e5edd4cdd58e8ff65417cbf0c0ed0771144ca8b5c2003fc5e3c9114a00f4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjQ:ymb3NkkiQ3mdBjFI4Vg
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2640 jdvdd.exe 2804 vvjjd.exe 2708 xrllxxl.exe 2756 bbhnbn.exe 2912 1ddvd.exe 2544 dpvpd.exe 2284 rlrxffx.exe 320 pjvvj.exe 1872 3vpvj.exe 1684 tnhhhh.exe 1608 btnbnn.exe 2796 jdjpp.exe 2932 7jvpv.exe 1096 rlflrxl.exe 3060 1flrxlr.exe 916 tntbnn.exe 1904 jdpvd.exe 1348 ffxxlrf.exe 2352 llxxlrf.exe 2212 hhhnbt.exe 2172 hthtbt.exe 2060 ddvdp.exe 840 fxrxxfr.exe 1940 bbhntn.exe 864 hhtthh.exe 1700 jdjjj.exe 1744 3lllllx.exe 1888 5flxrxf.exe 2064 hnhtnn.exe 1516 tnbbhb.exe 2824 vpjjv.exe 2680 fxlrxxx.exe 2988 rlxfxfl.exe 1584 hhtbhh.exe 1408 pjdpv.exe 2556 pjpjj.exe 2580 llrrxll.exe 2596 lfrrxxf.exe 2672 bbthbb.exe 1784 tnhhhn.exe 2068 ppjpd.exe 296 dpdvv.exe 1812 lfllxrl.exe 2876 nnbnnn.exe 2792 1hhbht.exe 2796 pjjjp.exe 2916 pdppj.exe 2232 rlxxffl.exe 2944 ttbhbb.exe 1332 nnbtbh.exe 1364 jdpvj.exe 1524 rfrrxrx.exe 1136 rrrffrr.exe 2152 1bhtnh.exe 3020 7jvpp.exe 2372 vpjpv.exe 1708 rflflrr.exe 696 1rffffr.exe 2644 hthntt.exe 840 btnthb.exe 1696 7vpjj.exe 2492 pdddd.exe 2444 ffxxllr.exe 1000 nhbhnn.exe -
resource yara_rule behavioral1/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2640 1508 191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe 31 PID 1508 wrote to memory of 2640 1508 191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe 31 PID 1508 wrote to memory of 2640 1508 191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe 31 PID 1508 wrote to memory of 2640 1508 191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe 31 PID 2640 wrote to memory of 2804 2640 jdvdd.exe 32 PID 2640 wrote to memory of 2804 2640 jdvdd.exe 32 PID 2640 wrote to memory of 2804 2640 jdvdd.exe 32 PID 2640 wrote to memory of 2804 2640 jdvdd.exe 32 PID 2804 wrote to memory of 2708 2804 vvjjd.exe 33 PID 2804 wrote to memory of 2708 2804 vvjjd.exe 33 PID 2804 wrote to memory of 2708 2804 vvjjd.exe 33 PID 2804 wrote to memory of 2708 2804 vvjjd.exe 33 PID 2708 wrote to memory of 2756 2708 xrllxxl.exe 34 PID 2708 wrote to memory of 2756 2708 xrllxxl.exe 34 PID 2708 wrote to memory of 2756 2708 xrllxxl.exe 34 PID 2708 wrote to memory of 2756 2708 xrllxxl.exe 34 PID 2756 wrote to memory of 2912 2756 bbhnbn.exe 35 PID 2756 wrote to memory of 2912 2756 bbhnbn.exe 35 PID 2756 wrote to memory of 2912 2756 bbhnbn.exe 35 PID 2756 wrote to memory of 2912 2756 bbhnbn.exe 35 PID 2912 wrote to memory of 2544 2912 1ddvd.exe 36 PID 2912 wrote to memory of 2544 2912 1ddvd.exe 36 PID 2912 wrote to memory of 2544 2912 1ddvd.exe 36 PID 2912 wrote to memory of 2544 2912 1ddvd.exe 36 PID 2544 wrote to memory of 2284 2544 dpvpd.exe 37 PID 2544 wrote to memory of 2284 2544 dpvpd.exe 37 PID 2544 wrote to memory of 2284 2544 dpvpd.exe 37 PID 2544 wrote to memory of 2284 2544 dpvpd.exe 37 PID 2284 wrote to memory of 320 2284 rlrxffx.exe 38 PID 2284 wrote to memory of 320 2284 rlrxffx.exe 38 PID 2284 wrote to memory of 320 2284 rlrxffx.exe 38 PID 2284 wrote to memory of 320 2284 rlrxffx.exe 38 PID 320 wrote to memory of 1872 320 pjvvj.exe 39 PID 320 wrote to memory of 1872 320 pjvvj.exe 39 PID 320 wrote to memory of 1872 320 pjvvj.exe 39 PID 320 wrote to memory of 1872 320 pjvvj.exe 39 PID 1872 wrote to memory of 1684 1872 3vpvj.exe 40 PID 1872 wrote to memory of 1684 1872 3vpvj.exe 40 PID 1872 wrote to memory of 1684 1872 3vpvj.exe 40 PID 1872 wrote to memory of 1684 1872 3vpvj.exe 40 PID 1684 wrote to memory of 1608 1684 tnhhhh.exe 41 PID 1684 wrote to memory of 1608 1684 tnhhhh.exe 41 PID 1684 wrote to memory of 1608 1684 tnhhhh.exe 41 PID 1684 wrote to memory of 1608 1684 tnhhhh.exe 41 PID 1608 wrote to memory of 2796 1608 btnbnn.exe 42 PID 1608 wrote to memory of 2796 1608 btnbnn.exe 42 PID 1608 wrote to memory of 2796 1608 btnbnn.exe 42 PID 1608 wrote to memory of 2796 1608 btnbnn.exe 42 PID 2796 wrote to memory of 2932 2796 jdjpp.exe 43 PID 2796 wrote to memory of 2932 2796 jdjpp.exe 43 PID 2796 wrote to memory of 2932 2796 jdjpp.exe 43 PID 2796 wrote to memory of 2932 2796 jdjpp.exe 43 PID 2932 wrote to memory of 1096 2932 7jvpv.exe 44 PID 2932 wrote to memory of 1096 2932 7jvpv.exe 44 PID 2932 wrote to memory of 1096 2932 7jvpv.exe 44 PID 2932 wrote to memory of 1096 2932 7jvpv.exe 44 PID 1096 wrote to memory of 3060 1096 rlflrxl.exe 45 PID 1096 wrote to memory of 3060 1096 rlflrxl.exe 45 PID 1096 wrote to memory of 3060 1096 rlflrxl.exe 45 PID 1096 wrote to memory of 3060 1096 rlflrxl.exe 45 PID 3060 wrote to memory of 916 3060 1flrxlr.exe 46 PID 3060 wrote to memory of 916 3060 1flrxlr.exe 46 PID 3060 wrote to memory of 916 3060 1flrxlr.exe 46 PID 3060 wrote to memory of 916 3060 1flrxlr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe"C:\Users\Admin\AppData\Local\Temp\191043c630d6f1590132eccc62519489c51c65c9a3d452d73a8cae84f761fa6aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\jdvdd.exec:\jdvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vvjjd.exec:\vvjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xrllxxl.exec:\xrllxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bbhnbn.exec:\bbhnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1ddvd.exec:\1ddvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dpvpd.exec:\dpvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rlrxffx.exec:\rlrxffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pjvvj.exec:\pjvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\3vpvj.exec:\3vpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\tnhhhh.exec:\tnhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\btnbnn.exec:\btnbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\jdjpp.exec:\jdjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7jvpv.exec:\7jvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rlflrxl.exec:\rlflrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\1flrxlr.exec:\1flrxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tntbnn.exec:\tntbnn.exe17⤵
- Executes dropped EXE
PID:916 -
\??\c:\jdpvd.exec:\jdpvd.exe18⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe19⤵
- Executes dropped EXE
PID:1348 -
\??\c:\llxxlrf.exec:\llxxlrf.exe20⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhhnbt.exec:\hhhnbt.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hthtbt.exec:\hthtbt.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ddvdp.exec:\ddvdp.exe23⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxrxxfr.exec:\fxrxxfr.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\bbhntn.exec:\bbhntn.exe25⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hhtthh.exec:\hhtthh.exe26⤵
- Executes dropped EXE
PID:864 -
\??\c:\jdjjj.exec:\jdjjj.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3lllllx.exec:\3lllllx.exe28⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5flxrxf.exec:\5flxrxf.exe29⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hnhtnn.exec:\hnhtnn.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tnbbhb.exec:\tnbbhb.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vpjjv.exec:\vpjjv.exe32⤵
- Executes dropped EXE
PID:2824 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe33⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hhtbhh.exec:\hhtbhh.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjdpv.exec:\pjdpv.exe36⤵
- Executes dropped EXE
PID:1408 -
\??\c:\pjpjj.exec:\pjpjj.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\llrrxll.exec:\llrrxll.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bbthbb.exec:\bbthbb.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnhhhn.exec:\tnhhhn.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ppjpd.exec:\ppjpd.exe42⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dpdvv.exec:\dpdvv.exe43⤵
- Executes dropped EXE
PID:296 -
\??\c:\lfllxrl.exec:\lfllxrl.exe44⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nnbnnn.exec:\nnbnnn.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1hhbht.exec:\1hhbht.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjjjp.exec:\pjjjp.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pdppj.exec:\pdppj.exe48⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlxxffl.exec:\rlxxffl.exe49⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ttbhbb.exec:\ttbhbb.exe50⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nnbtbh.exec:\nnbtbh.exe51⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jdpvj.exec:\jdpvj.exe52⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe53⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rrrffrr.exec:\rrrffrr.exe54⤵
- Executes dropped EXE
PID:1136 -
\??\c:\1bhtnh.exec:\1bhtnh.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7jvpp.exec:\7jvpp.exe56⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpjpv.exec:\vpjpv.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rflflrr.exec:\rflflrr.exe58⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1rffffr.exec:\1rffffr.exe59⤵
- Executes dropped EXE
PID:696 -
\??\c:\hthntt.exec:\hthntt.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\btnthb.exec:\btnthb.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\7vpjj.exec:\7vpjj.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pdddd.exec:\pdddd.exe63⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ffxxllr.exec:\ffxxllr.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nhbhnn.exec:\nhbhnn.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tnbhhh.exec:\tnbhhh.exe66⤵PID:892
-
\??\c:\jdvvd.exec:\jdvvd.exe67⤵PID:2452
-
\??\c:\jvpvd.exec:\jvpvd.exe68⤵PID:1800
-
\??\c:\9fxlflr.exec:\9fxlflr.exe69⤵PID:2820
-
\??\c:\9ttbhh.exec:\9ttbhh.exe70⤵PID:1820
-
\??\c:\5btbhh.exec:\5btbhh.exe71⤵PID:2680
-
\??\c:\9pjvp.exec:\9pjvp.exe72⤵PID:2712
-
\??\c:\jdvdd.exec:\jdvdd.exe73⤵PID:3004
-
\??\c:\lfrfllr.exec:\lfrfllr.exe74⤵PID:2720
-
\??\c:\llxfrxx.exec:\llxfrxx.exe75⤵PID:2664
-
\??\c:\hhbnbh.exec:\hhbnbh.exe76⤵PID:2608
-
\??\c:\nhbbbb.exec:\nhbbbb.exe77⤵
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\pjvpv.exec:\pjvpv.exe78⤵PID:1932
-
\??\c:\jdvdd.exec:\jdvdd.exe79⤵PID:2284
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe80⤵PID:2228
-
\??\c:\lrxxffl.exec:\lrxxffl.exe81⤵PID:1460
-
\??\c:\nhbnnn.exec:\nhbnnn.exe82⤵PID:2236
-
\??\c:\hbnbbn.exec:\hbnbbn.exe83⤵PID:1684
-
\??\c:\jdjvp.exec:\jdjvp.exe84⤵PID:2908
-
\??\c:\1xfrrrf.exec:\1xfrrrf.exe85⤵PID:2776
-
\??\c:\7fxfxfr.exec:\7fxfxfr.exe86⤵PID:2900
-
\??\c:\bbbbnn.exec:\bbbbnn.exe87⤵PID:1096
-
\??\c:\bbtbtb.exec:\bbtbtb.exe88⤵PID:2968
-
\??\c:\jdjvv.exec:\jdjvv.exe89⤵PID:584
-
\??\c:\dvddd.exec:\dvddd.exe90⤵PID:1052
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe91⤵PID:1864
-
\??\c:\9btbnn.exec:\9btbnn.exe92⤵PID:1260
-
\??\c:\7tnbnt.exec:\7tnbnt.exe93⤵PID:2752
-
\??\c:\9jvpv.exec:\9jvpv.exe94⤵PID:2076
-
\??\c:\rlrxffr.exec:\rlrxffr.exe95⤵PID:912
-
\??\c:\lfrrffr.exec:\lfrrffr.exe96⤵PID:2080
-
\??\c:\btntbb.exec:\btntbb.exe97⤵PID:1860
-
\??\c:\nnbhtb.exec:\nnbhtb.exe98⤵PID:2520
-
\??\c:\jjjjv.exec:\jjjjv.exe99⤵PID:740
-
\??\c:\jdppj.exec:\jdppj.exe100⤵PID:848
-
\??\c:\rxlxllx.exec:\rxlxllx.exe101⤵PID:904
-
\??\c:\3nhhbh.exec:\3nhhbh.exe102⤵PID:2156
-
\??\c:\tbtbtb.exec:\tbtbtb.exe103⤵PID:1596
-
\??\c:\jvvdv.exec:\jvvdv.exe104⤵PID:1428
-
\??\c:\fxrrxff.exec:\fxrrxff.exe105⤵PID:1756
-
\??\c:\rrffflx.exec:\rrffflx.exe106⤵PID:2660
-
\??\c:\tnbhtt.exec:\tnbhtt.exe107⤵PID:2436
-
\??\c:\tnhtbb.exec:\tnhtbb.exe108⤵PID:2812
-
\??\c:\vpjpj.exec:\vpjpj.exe109⤵PID:2676
-
\??\c:\1ppdj.exec:\1ppdj.exe110⤵PID:2704
-
\??\c:\rlxrffl.exec:\rlxrffl.exe111⤵PID:1588
-
\??\c:\5fllrfr.exec:\5fllrfr.exe112⤵PID:2120
-
\??\c:\tntbnn.exec:\tntbnn.exe113⤵PID:2540
-
\??\c:\btttbb.exec:\btttbb.exe114⤵PID:2544
-
\??\c:\pjvdj.exec:\pjvdj.exe115⤵PID:1796
-
\??\c:\7rlflrx.exec:\7rlflrx.exe116⤵PID:2844
-
\??\c:\xrlxflr.exec:\xrlxflr.exe117⤵PID:2148
-
\??\c:\fxlxrrx.exec:\fxlxrrx.exe118⤵PID:1740
-
\??\c:\hbtbhh.exec:\hbtbhh.exe119⤵PID:2140
-
\??\c:\vjvvv.exec:\vjvvv.exe120⤵PID:328
-
\??\c:\dvjpv.exec:\dvjpv.exe121⤵PID:1816
-
\??\c:\1lfflrx.exec:\1lfflrx.exe122⤵PID:1156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-