Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 21:23
Static task
static1
Behavioral task
behavioral1
Sample
fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe
Resource
win7-20240903-en
General
-
Target
fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe
-
Size
83KB
-
MD5
d392214af365ed354a5b48ed78e9c8f0
-
SHA1
b1dd06f4caaf33c648328e65803a6ac9d283d290
-
SHA256
fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cf
-
SHA512
6d8eebf09fea206c6d4778a9f89f7f4aef85cf46869ad6eeb7a16196e438e12cd723131785e253fbc0469f361b3de76f14921f76ca992f9b2f1fbf40117a6888
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qt:ymb3NkkiQ3mdBjFIIp9L9QrrA8I
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1732-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/428-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1432 vvdjd.exe 3064 fxxflrx.exe 2528 rrlxflf.exe 2484 9hbhtb.exe 2880 jppjd.exe 2312 jjvvp.exe 2912 3vvjj.exe 2668 rxrllfx.exe 2688 nhthth.exe 2396 7ttthn.exe 664 1dvjp.exe 2788 5fffllr.exe 1188 7llrflx.exe 2824 bbhhht.exe 532 bhbhht.exe 2016 ppjjj.exe 348 lxrflrf.exe 2196 nnttbh.exe 1720 hbbbbn.exe 2376 ppjdv.exe 1316 jjjvd.exe 904 xrxfrxl.exe 428 xrflrxf.exe 1836 nnhnhn.exe 644 3nhhtb.exe 2496 dddjv.exe 2840 3rflrxl.exe 2292 nntbhn.exe 1228 nnnnbn.exe 1868 1jdpv.exe 3048 1pvdp.exe 1536 rxxlxff.exe 2536 9bhtbn.exe 3044 hhbbbh.exe 2352 jjjdv.exe 2888 1ppdj.exe 2096 rrllxlx.exe 1612 3flxfrl.exe 2932 nhtttb.exe 2960 5nhtnt.exe 2660 vvvdv.exe 2608 dvjjp.exe 2432 vvvpd.exe 2456 5xrfllf.exe 2396 rllrrrl.exe 1484 bthbnn.exe 2712 dvjdj.exe 780 jjppd.exe 2844 pjvvd.exe 480 xxrrlrx.exe 2940 nnhthn.exe 1080 nnntnt.exe 2040 thtthh.exe 1988 jvdjj.exe 2368 fxlfrrf.exe 2116 1frxllx.exe 2228 tbnbht.exe 556 tnhnbb.exe 1316 9vjdv.exe 1076 jdppj.exe 1976 vpjjd.exe 1624 lfrlxfx.exe 616 5nnntn.exe 2104 7vppv.exe -
resource yara_rule behavioral1/memory/1732-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/428-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1432 1732 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 30 PID 1732 wrote to memory of 1432 1732 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 30 PID 1732 wrote to memory of 1432 1732 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 30 PID 1732 wrote to memory of 1432 1732 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 30 PID 1432 wrote to memory of 3064 1432 vvdjd.exe 31 PID 1432 wrote to memory of 3064 1432 vvdjd.exe 31 PID 1432 wrote to memory of 3064 1432 vvdjd.exe 31 PID 1432 wrote to memory of 3064 1432 vvdjd.exe 31 PID 3064 wrote to memory of 2528 3064 fxxflrx.exe 32 PID 3064 wrote to memory of 2528 3064 fxxflrx.exe 32 PID 3064 wrote to memory of 2528 3064 fxxflrx.exe 32 PID 3064 wrote to memory of 2528 3064 fxxflrx.exe 32 PID 2528 wrote to memory of 2484 2528 rrlxflf.exe 33 PID 2528 wrote to memory of 2484 2528 rrlxflf.exe 33 PID 2528 wrote to memory of 2484 2528 rrlxflf.exe 33 PID 2528 wrote to memory of 2484 2528 rrlxflf.exe 33 PID 2484 wrote to memory of 2880 2484 9hbhtb.exe 34 PID 2484 wrote to memory of 2880 2484 9hbhtb.exe 34 PID 2484 wrote to memory of 2880 2484 9hbhtb.exe 34 PID 2484 wrote to memory of 2880 2484 9hbhtb.exe 34 PID 2880 wrote to memory of 2312 2880 jppjd.exe 35 PID 2880 wrote to memory of 2312 2880 jppjd.exe 35 PID 2880 wrote to memory of 2312 2880 jppjd.exe 35 PID 2880 wrote to memory of 2312 2880 jppjd.exe 35 PID 2312 wrote to memory of 2912 2312 jjvvp.exe 36 PID 2312 wrote to memory of 2912 2312 jjvvp.exe 36 PID 2312 wrote to memory of 2912 2312 jjvvp.exe 36 PID 2312 wrote to memory of 2912 2312 jjvvp.exe 36 PID 2912 wrote to memory of 2668 2912 3vvjj.exe 37 PID 2912 wrote to memory of 2668 2912 3vvjj.exe 37 PID 2912 wrote to memory of 2668 2912 3vvjj.exe 37 PID 2912 wrote to memory of 2668 2912 3vvjj.exe 37 PID 2668 wrote to memory of 2688 2668 rxrllfx.exe 38 PID 2668 wrote to memory of 2688 2668 rxrllfx.exe 38 PID 2668 wrote to memory of 2688 2668 rxrllfx.exe 38 PID 2668 wrote to memory of 2688 2668 rxrllfx.exe 38 PID 2688 wrote to memory of 2396 2688 nhthth.exe 39 PID 2688 wrote to memory of 2396 2688 nhthth.exe 39 PID 2688 wrote to memory of 2396 2688 nhthth.exe 39 PID 2688 wrote to memory of 2396 2688 nhthth.exe 39 PID 2396 wrote to memory of 664 2396 7ttthn.exe 40 PID 2396 wrote to memory of 664 2396 7ttthn.exe 40 PID 2396 wrote to memory of 664 2396 7ttthn.exe 40 PID 2396 wrote to memory of 664 2396 7ttthn.exe 40 PID 664 wrote to memory of 2788 664 1dvjp.exe 41 PID 664 wrote to memory of 2788 664 1dvjp.exe 41 PID 664 wrote to memory of 2788 664 1dvjp.exe 41 PID 664 wrote to memory of 2788 664 1dvjp.exe 41 PID 2788 wrote to memory of 1188 2788 5fffllr.exe 42 PID 2788 wrote to memory of 1188 2788 5fffllr.exe 42 PID 2788 wrote to memory of 1188 2788 5fffllr.exe 42 PID 2788 wrote to memory of 1188 2788 5fffllr.exe 42 PID 1188 wrote to memory of 2824 1188 7llrflx.exe 43 PID 1188 wrote to memory of 2824 1188 7llrflx.exe 43 PID 1188 wrote to memory of 2824 1188 7llrflx.exe 43 PID 1188 wrote to memory of 2824 1188 7llrflx.exe 43 PID 2824 wrote to memory of 532 2824 bbhhht.exe 44 PID 2824 wrote to memory of 532 2824 bbhhht.exe 44 PID 2824 wrote to memory of 532 2824 bbhhht.exe 44 PID 2824 wrote to memory of 532 2824 bbhhht.exe 44 PID 532 wrote to memory of 2016 532 bhbhht.exe 45 PID 532 wrote to memory of 2016 532 bhbhht.exe 45 PID 532 wrote to memory of 2016 532 bhbhht.exe 45 PID 532 wrote to memory of 2016 532 bhbhht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe"C:\Users\Admin\AppData\Local\Temp\fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vvdjd.exec:\vvdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\fxxflrx.exec:\fxxflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rrlxflf.exec:\rrlxflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\9hbhtb.exec:\9hbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jppjd.exec:\jppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jjvvp.exec:\jjvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3vvjj.exec:\3vvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rxrllfx.exec:\rxrllfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhthth.exec:\nhthth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7ttthn.exec:\7ttthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\1dvjp.exec:\1dvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\5fffllr.exec:\5fffllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7llrflx.exec:\7llrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\bbhhht.exec:\bbhhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bhbhht.exec:\bhbhht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\ppjjj.exec:\ppjjj.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lxrflrf.exec:\lxrflrf.exe18⤵
- Executes dropped EXE
PID:348 -
\??\c:\nnttbh.exec:\nnttbh.exe19⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbbbbn.exec:\hbbbbn.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ppjdv.exec:\ppjdv.exe21⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jjjvd.exec:\jjjvd.exe22⤵
- Executes dropped EXE
PID:1316 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe23⤵
- Executes dropped EXE
PID:904 -
\??\c:\xrflrxf.exec:\xrflrxf.exe24⤵
- Executes dropped EXE
PID:428 -
\??\c:\nnhnhn.exec:\nnhnhn.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3nhhtb.exec:\3nhhtb.exe26⤵
- Executes dropped EXE
PID:644 -
\??\c:\dddjv.exec:\dddjv.exe27⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3rflrxl.exec:\3rflrxl.exe28⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nntbhn.exec:\nntbhn.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnnnbn.exec:\nnnnbn.exe30⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1jdpv.exec:\1jdpv.exe31⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1pvdp.exec:\1pvdp.exe32⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rxxlxff.exec:\rxxlxff.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\9bhtbn.exec:\9bhtbn.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hhbbbh.exec:\hhbbbh.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jjjdv.exec:\jjjdv.exe36⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1ppdj.exec:\1ppdj.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrllxlx.exec:\rrllxlx.exe38⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3flxfrl.exec:\3flxfrl.exe39⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nhtttb.exec:\nhtttb.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5nhtnt.exec:\5nhtnt.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvvdv.exec:\vvvdv.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dvjjp.exec:\dvjjp.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vvvpd.exec:\vvvpd.exe44⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5xrfllf.exec:\5xrfllf.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rllrrrl.exec:\rllrrrl.exe46⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bthbnn.exec:\bthbnn.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dvjdj.exec:\dvjdj.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jjppd.exec:\jjppd.exe49⤵
- Executes dropped EXE
PID:780 -
\??\c:\pjvvd.exec:\pjvvd.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xxrrlrx.exec:\xxrrlrx.exe51⤵
- Executes dropped EXE
PID:480 -
\??\c:\nnhthn.exec:\nnhthn.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nnntnt.exec:\nnntnt.exe53⤵
- Executes dropped EXE
PID:1080 -
\??\c:\thtthh.exec:\thtthh.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvdjj.exec:\jvdjj.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1frxllx.exec:\1frxllx.exe57⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tbnbht.exec:\tbnbht.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tnhnbb.exec:\tnhnbb.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\9vjdv.exec:\9vjdv.exe60⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jdppj.exec:\jdppj.exe61⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vpjjd.exec:\vpjjd.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lfrlxfx.exec:\lfrlxfx.exe63⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5nnntn.exec:\5nnntn.exe64⤵
- Executes dropped EXE
PID:616 -
\??\c:\7vppv.exec:\7vppv.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpjjp.exec:\vpjjp.exe66⤵PID:2236
-
\??\c:\9xxlfrf.exec:\9xxlfrf.exe67⤵PID:2208
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe68⤵PID:2276
-
\??\c:\3tbbnt.exec:\3tbbnt.exe69⤵PID:1512
-
\??\c:\ttbntb.exec:\ttbntb.exe70⤵PID:2216
-
\??\c:\pjpdp.exec:\pjpdp.exe71⤵PID:1692
-
\??\c:\ppjvj.exec:\ppjvj.exe72⤵PID:2092
-
\??\c:\9xrfrrf.exec:\9xrfrrf.exe73⤵PID:2064
-
\??\c:\xxflrxl.exec:\xxflrxl.exe74⤵PID:2704
-
\??\c:\hbtbnt.exec:\hbtbnt.exe75⤵PID:2328
-
\??\c:\hhthth.exec:\hhthth.exe76⤵PID:2752
-
\??\c:\dvpvj.exec:\dvpvj.exe77⤵PID:2880
-
\??\c:\djdjd.exec:\djdjd.exe78⤵PID:1616
-
\??\c:\vpppd.exec:\vpppd.exe79⤵PID:3000
-
\??\c:\frllxfl.exec:\frllxfl.exe80⤵PID:2648
-
\??\c:\7xlxrrl.exec:\7xlxrrl.exe81⤵PID:2960
-
\??\c:\tnbbhn.exec:\tnbbhn.exe82⤵PID:2964
-
\??\c:\9bbthh.exec:\9bbthh.exe83⤵PID:2684
-
\??\c:\1pjjp.exec:\1pjjp.exe84⤵
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\pdjjv.exec:\pdjjv.exe85⤵PID:2188
-
\??\c:\3jdjd.exec:\3jdjd.exe86⤵PID:1972
-
\??\c:\fxxxrlx.exec:\fxxxrlx.exe87⤵PID:2808
-
\??\c:\xrlflrf.exec:\xrlflrf.exe88⤵PID:268
-
\??\c:\nbnbnb.exec:\nbnbnb.exe89⤵PID:1064
-
\??\c:\3thnbb.exec:\3thnbb.exe90⤵PID:2012
-
\??\c:\dvdjv.exec:\dvdjv.exe91⤵PID:1160
-
\??\c:\7dvvv.exec:\7dvvv.exe92⤵PID:1200
-
\??\c:\lfxrffr.exec:\lfxrffr.exe93⤵PID:1220
-
\??\c:\lfxrxlx.exec:\lfxrxlx.exe94⤵PID:2476
-
\??\c:\rrfrxfl.exec:\rrfrxfl.exe95⤵PID:2980
-
\??\c:\tnbhnb.exec:\tnbhnb.exe96⤵PID:2196
-
\??\c:\hbnthn.exec:\hbnthn.exe97⤵PID:2176
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:1980
-
\??\c:\dvvdd.exec:\dvvdd.exe99⤵PID:2584
-
\??\c:\fxlrrfx.exec:\fxlrrfx.exe100⤵PID:2596
-
\??\c:\9lxfxlx.exec:\9lxfxlx.exe101⤵PID:1076
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe102⤵PID:940
-
\??\c:\5hbtnn.exec:\5hbtnn.exe103⤵PID:2832
-
\??\c:\9thhnb.exec:\9thhnb.exe104⤵PID:1372
-
\??\c:\jddpp.exec:\jddpp.exe105⤵PID:2560
-
\??\c:\9dddj.exec:\9dddj.exe106⤵PID:1232
-
\??\c:\rlrrlxf.exec:\rlrrlxf.exe107⤵PID:2840
-
\??\c:\rxrrrfr.exec:\rxrrrfr.exe108⤵PID:2524
-
\??\c:\3bbtnb.exec:\3bbtnb.exe109⤵PID:1588
-
\??\c:\hhbnbn.exec:\hhbnbn.exe110⤵PID:1308
-
\??\c:\pppjp.exec:\pppjp.exe111⤵PID:2212
-
\??\c:\ppvdp.exec:\ppvdp.exe112⤵PID:2384
-
\??\c:\dpddp.exec:\dpddp.exe113⤵PID:1536
-
\??\c:\fxflrfx.exec:\fxflrfx.exe114⤵PID:2412
-
\??\c:\llxffrx.exec:\llxffrx.exe115⤵PID:3044
-
\??\c:\hbhnhn.exec:\hbhnhn.exe116⤵PID:2484
-
\??\c:\1nnhtt.exec:\1nnhtt.exe117⤵PID:2764
-
\??\c:\3jjjp.exec:\3jjjp.exe118⤵PID:2336
-
\??\c:\pdjjv.exec:\pdjjv.exe119⤵PID:2740
-
\??\c:\9dvdj.exec:\9dvdj.exe120⤵PID:2924
-
\??\c:\rllrlrl.exec:\rllrlrl.exe121⤵PID:2920
-
\??\c:\xxfrflf.exec:\xxfrflf.exe122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-