Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe
Resource
win7-20240729-en
General
-
Target
62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe
-
Size
73KB
-
MD5
42ac32fb9f67792626fb1da62684fd90
-
SHA1
bd9a5eb0c5b1ddf53a4bbdcd77b919aef27d6b7d
-
SHA256
62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335
-
SHA512
a2a63d4d928103f37315aef7d4ceb005c9294d82d86617bb3bb1904352447ab3fe2c95942706569754d59091110f99d73f729c68cc3e9d4e212e5cecdc30ed11
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5RxfVK5DTXw:ymb3NkkiQ3mdBjF0yUmrfVcPw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1952-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 pjvdj.exe 2576 fxfllrf.exe 2196 htbntb.exe 2724 ppjvd.exe 2844 bhttht.exe 2736 5tntht.exe 2748 7dvvv.exe 2960 frxxlxx.exe 2632 7tnbnb.exe 808 bbhhnn.exe 2304 1jdpv.exe 1268 9xlrffx.exe 2964 btbhtn.exe 2128 nnbttn.exe 1396 ddvpv.exe 2952 9vddj.exe 1860 xrxfllr.exe 2160 hhhnbb.exe 2192 vvdjp.exe 2468 ddjjv.exe 2532 rxffllx.exe 288 xxflxxx.exe 448 5tnbth.exe 956 vvjdv.exe 936 ppvvd.exe 2348 rrfffxf.exe 544 nhhhhn.exe 2296 jjppv.exe 1700 ffffrxf.exe 2272 llxfllx.exe 792 thnbhn.exe 2416 jppdp.exe 2420 5jjpd.exe 2712 5xfxflr.exe 2900 nntthn.exe 2236 hhhnth.exe 2176 jjjvd.exe 2844 dvjjp.exe 3020 rxrrxfr.exe 2736 lllrrlr.exe 2792 9htnbh.exe 1880 5hntbn.exe 2648 pjvpd.exe 2708 jjjjp.exe 2220 rfxxlrx.exe 2304 1xlrxxf.exe 2928 9bbhth.exe 2372 7hnhnh.exe 2040 vdpjp.exe 1828 vvdjd.exe 2924 xrxrfrx.exe 1936 9xxrllr.exe 1576 tnbbtb.exe 1280 nbhhtt.exe 2056 1jdjd.exe 2300 vvdvv.exe 2584 xxfrxff.exe 1048 rrllrxr.exe 2532 hnhbbb.exe 1532 7nbbhh.exe 1744 ppdjp.exe 1808 ppjjp.exe 2064 3rxfflr.exe 2476 ffllxff.exe -
resource yara_rule behavioral1/memory/1952-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1952 2500 62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe 30 PID 2500 wrote to memory of 1952 2500 62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe 30 PID 2500 wrote to memory of 1952 2500 62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe 30 PID 2500 wrote to memory of 1952 2500 62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe 30 PID 1952 wrote to memory of 2576 1952 pjvdj.exe 31 PID 1952 wrote to memory of 2576 1952 pjvdj.exe 31 PID 1952 wrote to memory of 2576 1952 pjvdj.exe 31 PID 1952 wrote to memory of 2576 1952 pjvdj.exe 31 PID 2576 wrote to memory of 2196 2576 fxfllrf.exe 32 PID 2576 wrote to memory of 2196 2576 fxfllrf.exe 32 PID 2576 wrote to memory of 2196 2576 fxfllrf.exe 32 PID 2576 wrote to memory of 2196 2576 fxfllrf.exe 32 PID 2196 wrote to memory of 2724 2196 htbntb.exe 33 PID 2196 wrote to memory of 2724 2196 htbntb.exe 33 PID 2196 wrote to memory of 2724 2196 htbntb.exe 33 PID 2196 wrote to memory of 2724 2196 htbntb.exe 33 PID 2724 wrote to memory of 2844 2724 ppjvd.exe 34 PID 2724 wrote to memory of 2844 2724 ppjvd.exe 34 PID 2724 wrote to memory of 2844 2724 ppjvd.exe 34 PID 2724 wrote to memory of 2844 2724 ppjvd.exe 34 PID 2844 wrote to memory of 2736 2844 bhttht.exe 35 PID 2844 wrote to memory of 2736 2844 bhttht.exe 35 PID 2844 wrote to memory of 2736 2844 bhttht.exe 35 PID 2844 wrote to memory of 2736 2844 bhttht.exe 35 PID 2736 wrote to memory of 2748 2736 5tntht.exe 36 PID 2736 wrote to memory of 2748 2736 5tntht.exe 36 PID 2736 wrote to memory of 2748 2736 5tntht.exe 36 PID 2736 wrote to memory of 2748 2736 5tntht.exe 36 PID 2748 wrote to memory of 2960 2748 7dvvv.exe 37 PID 2748 wrote to memory of 2960 2748 7dvvv.exe 37 PID 2748 wrote to memory of 2960 2748 7dvvv.exe 37 PID 2748 wrote to memory of 2960 2748 7dvvv.exe 37 PID 2960 wrote to memory of 2632 2960 frxxlxx.exe 38 PID 2960 wrote to memory of 2632 2960 frxxlxx.exe 38 PID 2960 wrote to memory of 2632 2960 frxxlxx.exe 38 PID 2960 wrote to memory of 2632 2960 frxxlxx.exe 38 PID 2632 wrote to memory of 808 2632 7tnbnb.exe 39 PID 2632 wrote to memory of 808 2632 7tnbnb.exe 39 PID 2632 wrote to memory of 808 2632 7tnbnb.exe 39 PID 2632 wrote to memory of 808 2632 7tnbnb.exe 39 PID 808 wrote to memory of 2304 808 bbhhnn.exe 40 PID 808 wrote to memory of 2304 808 bbhhnn.exe 40 PID 808 wrote to memory of 2304 808 bbhhnn.exe 40 PID 808 wrote to memory of 2304 808 bbhhnn.exe 40 PID 2304 wrote to memory of 1268 2304 1jdpv.exe 41 PID 2304 wrote to memory of 1268 2304 1jdpv.exe 41 PID 2304 wrote to memory of 1268 2304 1jdpv.exe 41 PID 2304 wrote to memory of 1268 2304 1jdpv.exe 41 PID 1268 wrote to memory of 2964 1268 9xlrffx.exe 42 PID 1268 wrote to memory of 2964 1268 9xlrffx.exe 42 PID 1268 wrote to memory of 2964 1268 9xlrffx.exe 42 PID 1268 wrote to memory of 2964 1268 9xlrffx.exe 42 PID 2964 wrote to memory of 2128 2964 btbhtn.exe 43 PID 2964 wrote to memory of 2128 2964 btbhtn.exe 43 PID 2964 wrote to memory of 2128 2964 btbhtn.exe 43 PID 2964 wrote to memory of 2128 2964 btbhtn.exe 43 PID 2128 wrote to memory of 1396 2128 nnbttn.exe 44 PID 2128 wrote to memory of 1396 2128 nnbttn.exe 44 PID 2128 wrote to memory of 1396 2128 nnbttn.exe 44 PID 2128 wrote to memory of 1396 2128 nnbttn.exe 44 PID 1396 wrote to memory of 2952 1396 ddvpv.exe 45 PID 1396 wrote to memory of 2952 1396 ddvpv.exe 45 PID 1396 wrote to memory of 2952 1396 ddvpv.exe 45 PID 1396 wrote to memory of 2952 1396 ddvpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe"C:\Users\Admin\AppData\Local\Temp\62c0ff504b5ccd3a6239bce43f8923f7d0f629d99629c769111eda83ceae6335.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\fxfllrf.exec:\fxfllrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\htbntb.exec:\htbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ppjvd.exec:\ppjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bhttht.exec:\bhttht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5tntht.exec:\5tntht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\7dvvv.exec:\7dvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\frxxlxx.exec:\frxxlxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\7tnbnb.exec:\7tnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\bbhhnn.exec:\bbhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\1jdpv.exec:\1jdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9xlrffx.exec:\9xlrffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\btbhtn.exec:\btbhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nnbttn.exec:\nnbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ddvpv.exec:\ddvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\9vddj.exec:\9vddj.exe17⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xrxfllr.exec:\xrxfllr.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hhhnbb.exec:\hhhnbb.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vvdjp.exec:\vvdjp.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ddjjv.exec:\ddjjv.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rxffllx.exec:\rxffllx.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxflxxx.exec:\xxflxxx.exe23⤵
- Executes dropped EXE
PID:288 -
\??\c:\5tnbth.exec:\5tnbth.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\vvjdv.exec:\vvjdv.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\ppvvd.exec:\ppvvd.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936 -
\??\c:\rrfffxf.exec:\rrfffxf.exe27⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhhhhn.exec:\nhhhhn.exe28⤵
- Executes dropped EXE
PID:544 -
\??\c:\jjppv.exec:\jjppv.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ffffrxf.exec:\ffffrxf.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\llxfllx.exec:\llxfllx.exe31⤵
- Executes dropped EXE
PID:2272 -
\??\c:\thnbhn.exec:\thnbhn.exe32⤵
- Executes dropped EXE
PID:792 -
\??\c:\jppdp.exec:\jppdp.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5jjpd.exec:\5jjpd.exe34⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5xfxflr.exec:\5xfxflr.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nntthn.exec:\nntthn.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhhnth.exec:\hhhnth.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jjjvd.exec:\jjjvd.exe38⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjjp.exec:\dvjjp.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rxrrxfr.exec:\rxrrxfr.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lllrrlr.exec:\lllrrlr.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9htnbh.exec:\9htnbh.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5hntbn.exec:\5hntbn.exe43⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pjvpd.exec:\pjvpd.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jjjjp.exec:\jjjjp.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rfxxlrx.exec:\rfxxlrx.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1xlrxxf.exec:\1xlrxxf.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9bbhth.exec:\9bbhth.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hnhnh.exec:\7hnhnh.exe49⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vdpjp.exec:\vdpjp.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvdjd.exec:\vvdjd.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xrxrfrx.exec:\xrxrfrx.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9xxrllr.exec:\9xxrllr.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tnbbtb.exec:\tnbbtb.exe54⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nbhhtt.exec:\nbhhtt.exe55⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1jdjd.exec:\1jdjd.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vvdvv.exec:\vvdvv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\xxfrxff.exec:\xxfrxff.exe58⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrllrxr.exec:\rrllrxr.exe59⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hnhbbb.exec:\hnhbbb.exe60⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7nbbhh.exec:\7nbbhh.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\ppdjp.exec:\ppdjp.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ppjjp.exec:\ppjjp.exe63⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3rxfflr.exec:\3rxfflr.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ffllxff.exec:\ffllxff.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hnttbb.exec:\hnttbb.exe66⤵PID:2348
-
\??\c:\bhtnbb.exec:\bhtnbb.exe67⤵PID:2232
-
\??\c:\pjjpd.exec:\pjjpd.exe68⤵PID:744
-
\??\c:\ppddj.exec:\ppddj.exe69⤵PID:2344
-
\??\c:\llrllff.exec:\llrllff.exe70⤵PID:2240
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe71⤵PID:2272
-
\??\c:\nhntbh.exec:\nhntbh.exe72⤵PID:792
-
\??\c:\tttthh.exec:\tttthh.exe73⤵PID:2428
-
\??\c:\pjvvj.exec:\pjvvj.exe74⤵PID:2212
-
\??\c:\dddjj.exec:\dddjj.exe75⤵PID:2820
-
\??\c:\ffrxflr.exec:\ffrxflr.exe76⤵PID:264
-
\??\c:\7xrxlfl.exec:\7xrxlfl.exe77⤵PID:2780
-
\??\c:\bhtbnb.exec:\bhtbnb.exe78⤵PID:2848
-
\??\c:\5hnntn.exec:\5hnntn.exe79⤵PID:2640
-
\??\c:\pjjjv.exec:\pjjjv.exe80⤵PID:1716
-
\??\c:\5jddj.exec:\5jddj.exe81⤵PID:888
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe82⤵PID:2732
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe83⤵PID:2960
-
\??\c:\nhhhnn.exec:\nhhhnn.exe84⤵PID:2636
-
\??\c:\1tbhtb.exec:\1tbhtb.exe85⤵PID:2492
-
\??\c:\dvdpv.exec:\dvdpv.exe86⤵PID:1128
-
\??\c:\vvpvv.exec:\vvpvv.exe87⤵PID:1412
-
\??\c:\lflfxxf.exec:\lflfxxf.exe88⤵PID:1268
-
\??\c:\xxffxxf.exec:\xxffxxf.exe89⤵PID:2360
-
\??\c:\5bttbb.exec:\5bttbb.exe90⤵PID:536
-
\??\c:\hhnhhh.exec:\hhnhhh.exe91⤵PID:2916
-
\??\c:\ppvdp.exec:\ppvdp.exe92⤵PID:1064
-
\??\c:\djpvj.exec:\djpvj.exe93⤵PID:2996
-
\??\c:\xxflrxf.exec:\xxflrxf.exe94⤵PID:1860
-
\??\c:\flllrrr.exec:\flllrrr.exe95⤵PID:1596
-
\??\c:\bbhbhh.exec:\bbhbhh.exe96⤵PID:2076
-
\??\c:\5nttnt.exec:\5nttnt.exe97⤵PID:2308
-
\??\c:\3pjpd.exec:\3pjpd.exe98⤵PID:1476
-
\??\c:\jjjjp.exec:\jjjjp.exe99⤵PID:2616
-
\??\c:\rxxrxxx.exec:\rxxrxxx.exe100⤵PID:1044
-
\??\c:\llrrflr.exec:\llrrflr.exe101⤵PID:1264
-
\??\c:\hnttbt.exec:\hnttbt.exe102⤵PID:1728
-
\??\c:\nbbnhh.exec:\nbbnhh.exe103⤵PID:2600
-
\??\c:\vvddd.exec:\vvddd.exe104⤵PID:2440
-
\??\c:\9pvdd.exec:\9pvdd.exe105⤵PID:1416
-
\??\c:\frxxlfr.exec:\frxxlfr.exe106⤵PID:2536
-
\??\c:\lfllrrf.exec:\lfllrrf.exe107⤵PID:1080
-
\??\c:\nnhntb.exec:\nnhntb.exe108⤵PID:876
-
\??\c:\bbthnt.exec:\bbthnt.exe109⤵PID:1700
-
\??\c:\jjppd.exec:\jjppd.exe110⤵PID:1684
-
\??\c:\3ppjj.exec:\3ppjj.exe111⤵PID:1952
-
\??\c:\lflrxfl.exec:\lflrxfl.exe112⤵PID:1676
-
\??\c:\5rlrflr.exec:\5rlrflr.exe113⤵PID:1908
-
\??\c:\ttttbh.exec:\ttttbh.exe114⤵PID:2576
-
\??\c:\3ntnnh.exec:\3ntnnh.exe115⤵PID:2404
-
\??\c:\7pvvv.exec:\7pvvv.exe116⤵PID:2772
-
\??\c:\ddjvj.exec:\ddjvj.exe117⤵PID:2876
-
\??\c:\lllrrff.exec:\lllrrff.exe118⤵PID:2764
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe119⤵PID:3008
-
\??\c:\nnbhhh.exec:\nnbhhh.exe120⤵PID:2972
-
\??\c:\tbhnbb.exec:\tbhnbb.exe121⤵PID:2776
-
\??\c:\5pjpv.exec:\5pjpv.exe122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-