Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe
-
Size
71KB
-
MD5
f6f566f622dda5972b3864d8606fe126
-
SHA1
3163e2f4edf8459faa50494c6804ba3062cf147f
-
SHA256
68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8
-
SHA512
56ba0e453b16a78da75b6321717d2969a3be79b28aa69099e65d15ce6a011415da3d3f3d91e1a989d216f3117861dcafd6a49b4eed7f4ddfcad63b15bc1c2c57
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3A8N:ymb3NkkiQ3mdBjFI46TQ8N
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2100-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1644 vpjjv.exe 2392 pjvdv.exe 2340 hhthtb.exe 2744 hhhttn.exe 2756 ffxrxxl.exe 2864 bbtbnn.exe 2848 vppdj.exe 2596 ffllxxl.exe 2332 tnbhnb.exe 836 htbnhb.exe 1576 pjdvd.exe 2788 xxrflrf.exe 2688 nntthb.exe 1792 7bbnbh.exe 2020 jjdvp.exe 1720 pjvdp.exe 1148 llrflxx.exe 2552 bhbnnn.exe 264 ppjpd.exe 572 jdvjv.exe 2136 lllrflf.exe 920 nnnbhn.exe 3028 1nbbht.exe 1344 ddpvj.exe 2424 ffflxrf.exe 2212 llflxlr.exe 2156 nhbbnn.exe 1756 dvjpv.exe 1760 rrrxrrf.exe 2176 xxlfrrx.exe 2420 bbnthn.exe 2372 3vvjj.exe 1972 5pjvv.exe 1028 xlffrrx.exe 2748 7fxfffl.exe 2808 hbnhbh.exe 2704 pdpdj.exe 2316 5jjjv.exe 2716 3xfrflr.exe 2324 fxrxffr.exe 2148 nhhhnh.exe 2848 bbbntb.exe 2204 pdvjp.exe 1968 xfrlrxx.exe 2916 xxfxrxl.exe 900 7thnhn.exe 1576 nnbnth.exe 2776 jjvjp.exe 2992 5fxfrlf.exe 2004 xlxfxxf.exe 1792 tnbhnt.exe 2496 tntthb.exe 1392 7vjdj.exe 2272 llflrfr.exe 532 7lfrflx.exe 2512 3bbhbt.exe 600 btnntn.exe 272 1vvpv.exe 1540 dvppv.exe 2256 lrxffff.exe 2304 3nnbnh.exe 3028 nhttbb.exe 1348 ddppj.exe 3048 vvvdj.exe -
resource yara_rule behavioral1/memory/2100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1644 2100 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 30 PID 2100 wrote to memory of 1644 2100 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 30 PID 2100 wrote to memory of 1644 2100 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 30 PID 2100 wrote to memory of 1644 2100 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 30 PID 1644 wrote to memory of 2392 1644 vpjjv.exe 31 PID 1644 wrote to memory of 2392 1644 vpjjv.exe 31 PID 1644 wrote to memory of 2392 1644 vpjjv.exe 31 PID 1644 wrote to memory of 2392 1644 vpjjv.exe 31 PID 2392 wrote to memory of 2340 2392 pjvdv.exe 32 PID 2392 wrote to memory of 2340 2392 pjvdv.exe 32 PID 2392 wrote to memory of 2340 2392 pjvdv.exe 32 PID 2392 wrote to memory of 2340 2392 pjvdv.exe 32 PID 2340 wrote to memory of 2744 2340 hhthtb.exe 33 PID 2340 wrote to memory of 2744 2340 hhthtb.exe 33 PID 2340 wrote to memory of 2744 2340 hhthtb.exe 33 PID 2340 wrote to memory of 2744 2340 hhthtb.exe 33 PID 2744 wrote to memory of 2756 2744 hhhttn.exe 34 PID 2744 wrote to memory of 2756 2744 hhhttn.exe 34 PID 2744 wrote to memory of 2756 2744 hhhttn.exe 34 PID 2744 wrote to memory of 2756 2744 hhhttn.exe 34 PID 2756 wrote to memory of 2864 2756 ffxrxxl.exe 35 PID 2756 wrote to memory of 2864 2756 ffxrxxl.exe 35 PID 2756 wrote to memory of 2864 2756 ffxrxxl.exe 35 PID 2756 wrote to memory of 2864 2756 ffxrxxl.exe 35 PID 2864 wrote to memory of 2848 2864 bbtbnn.exe 36 PID 2864 wrote to memory of 2848 2864 bbtbnn.exe 36 PID 2864 wrote to memory of 2848 2864 bbtbnn.exe 36 PID 2864 wrote to memory of 2848 2864 bbtbnn.exe 36 PID 2848 wrote to memory of 2596 2848 vppdj.exe 37 PID 2848 wrote to memory of 2596 2848 vppdj.exe 37 PID 2848 wrote to memory of 2596 2848 vppdj.exe 37 PID 2848 wrote to memory of 2596 2848 vppdj.exe 37 PID 2596 wrote to memory of 2332 2596 ffllxxl.exe 38 PID 2596 wrote to memory of 2332 2596 ffllxxl.exe 38 PID 2596 wrote to memory of 2332 2596 ffllxxl.exe 38 PID 2596 wrote to memory of 2332 2596 ffllxxl.exe 38 PID 2332 wrote to memory of 836 2332 tnbhnb.exe 39 PID 2332 wrote to memory of 836 2332 tnbhnb.exe 39 PID 2332 wrote to memory of 836 2332 tnbhnb.exe 39 PID 2332 wrote to memory of 836 2332 tnbhnb.exe 39 PID 836 wrote to memory of 1576 836 htbnhb.exe 40 PID 836 wrote to memory of 1576 836 htbnhb.exe 40 PID 836 wrote to memory of 1576 836 htbnhb.exe 40 PID 836 wrote to memory of 1576 836 htbnhb.exe 40 PID 1576 wrote to memory of 2788 1576 pjdvd.exe 41 PID 1576 wrote to memory of 2788 1576 pjdvd.exe 41 PID 1576 wrote to memory of 2788 1576 pjdvd.exe 41 PID 1576 wrote to memory of 2788 1576 pjdvd.exe 41 PID 2788 wrote to memory of 2688 2788 xxrflrf.exe 42 PID 2788 wrote to memory of 2688 2788 xxrflrf.exe 42 PID 2788 wrote to memory of 2688 2788 xxrflrf.exe 42 PID 2788 wrote to memory of 2688 2788 xxrflrf.exe 42 PID 2688 wrote to memory of 1792 2688 nntthb.exe 43 PID 2688 wrote to memory of 1792 2688 nntthb.exe 43 PID 2688 wrote to memory of 1792 2688 nntthb.exe 43 PID 2688 wrote to memory of 1792 2688 nntthb.exe 43 PID 1792 wrote to memory of 2020 1792 7bbnbh.exe 44 PID 1792 wrote to memory of 2020 1792 7bbnbh.exe 44 PID 1792 wrote to memory of 2020 1792 7bbnbh.exe 44 PID 1792 wrote to memory of 2020 1792 7bbnbh.exe 44 PID 2020 wrote to memory of 1720 2020 jjdvp.exe 45 PID 2020 wrote to memory of 1720 2020 jjdvp.exe 45 PID 2020 wrote to memory of 1720 2020 jjdvp.exe 45 PID 2020 wrote to memory of 1720 2020 jjdvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe"C:\Users\Admin\AppData\Local\Temp\68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vpjjv.exec:\vpjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\pjvdv.exec:\pjvdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\hhthtb.exec:\hhthtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\hhhttn.exec:\hhhttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bbtbnn.exec:\bbtbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vppdj.exec:\vppdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ffllxxl.exec:\ffllxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\tnbhnb.exec:\tnbhnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\htbnhb.exec:\htbnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\pjdvd.exec:\pjdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xxrflrf.exec:\xxrflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nntthb.exec:\nntthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7bbnbh.exec:\7bbnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\jjdvp.exec:\jjdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\pjvdp.exec:\pjvdp.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\llrflxx.exec:\llrflxx.exe18⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bhbnnn.exec:\bhbnnn.exe19⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ppjpd.exec:\ppjpd.exe20⤵
- Executes dropped EXE
PID:264 -
\??\c:\jdvjv.exec:\jdvjv.exe21⤵
- Executes dropped EXE
PID:572 -
\??\c:\lllrflf.exec:\lllrflf.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nnnbhn.exec:\nnnbhn.exe23⤵
- Executes dropped EXE
PID:920 -
\??\c:\1nbbht.exec:\1nbbht.exe24⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ddpvj.exec:\ddpvj.exe25⤵
- Executes dropped EXE
PID:1344 -
\??\c:\ffflxrf.exec:\ffflxrf.exe26⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llflxlr.exec:\llflxlr.exe27⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhbbnn.exec:\nhbbnn.exe28⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rrrxrrf.exec:\rrrxrrf.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xxlfrrx.exec:\xxlfrrx.exe31⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbnthn.exec:\bbnthn.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3vvjj.exec:\3vvjj.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5pjvv.exec:\5pjvv.exe34⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xlffrrx.exec:\xlffrrx.exe35⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7fxfffl.exec:\7fxfffl.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbnhbh.exec:\hbnhbh.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pdpdj.exec:\pdpdj.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5jjjv.exec:\5jjjv.exe39⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3xfrflr.exec:\3xfrflr.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxrxffr.exec:\fxrxffr.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhhhnh.exec:\nhhhnh.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bbbntb.exec:\bbbntb.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pdvjp.exec:\pdvjp.exe44⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xfrlrxx.exec:\xfrlrxx.exe45⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xxfxrxl.exec:\xxfxrxl.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7thnhn.exec:\7thnhn.exe47⤵
- Executes dropped EXE
PID:900 -
\??\c:\nnbnth.exec:\nnbnth.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jjvjp.exec:\jjvjp.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5fxfrlf.exec:\5fxfrlf.exe50⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xlxfxxf.exec:\xlxfxxf.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnbhnt.exec:\tnbhnt.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tntthb.exec:\tntthb.exe53⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7vjdj.exec:\7vjdj.exe54⤵
- Executes dropped EXE
PID:1392 -
\??\c:\llflrfr.exec:\llflrfr.exe55⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7lfrflx.exec:\7lfrflx.exe56⤵
- Executes dropped EXE
PID:532 -
\??\c:\3bbhbt.exec:\3bbhbt.exe57⤵
- Executes dropped EXE
PID:2512 -
\??\c:\btnntn.exec:\btnntn.exe58⤵
- Executes dropped EXE
PID:600 -
\??\c:\1vvpv.exec:\1vvpv.exe59⤵
- Executes dropped EXE
PID:272 -
\??\c:\dvppv.exec:\dvppv.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lrxffff.exec:\lrxffff.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\3nnbnh.exec:\3nnbnh.exe62⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhttbb.exec:\nhttbb.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ddppj.exec:\ddppj.exe64⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vvvdj.exec:\vvvdj.exe65⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7lfflxf.exec:\7lfflxf.exe66⤵PID:2044
-
\??\c:\5bhhbn.exec:\5bhhbn.exe67⤵PID:2448
-
\??\c:\tthtbb.exec:\tthtbb.exe68⤵PID:800
-
\??\c:\ppddj.exec:\ppddj.exe69⤵PID:1756
-
\??\c:\dvvdj.exec:\dvvdj.exe70⤵PID:892
-
\??\c:\xxrfxfl.exec:\xxrfxfl.exe71⤵PID:1708
-
\??\c:\lxxflrr.exec:\lxxflrr.exe72⤵PID:1556
-
\??\c:\3nbhhn.exec:\3nbhhn.exe73⤵PID:2092
-
\??\c:\thhhtn.exec:\thhhtn.exe74⤵PID:2372
-
\??\c:\vdjjp.exec:\vdjjp.exe75⤵PID:2240
-
\??\c:\7ppjj.exec:\7ppjj.exe76⤵PID:2488
-
\??\c:\1fxlrxr.exec:\1fxlrxr.exe77⤵PID:2856
-
\??\c:\xxxrfxx.exec:\xxxrfxx.exe78⤵PID:2708
-
\??\c:\tnbbhh.exec:\tnbbhh.exe79⤵PID:2840
-
\??\c:\3pjvj.exec:\3pjvj.exe80⤵PID:2628
-
\??\c:\ppddv.exec:\ppddv.exe81⤵PID:2644
-
\??\c:\5rxflrl.exec:\5rxflrl.exe82⤵PID:2616
-
\??\c:\llflxlx.exec:\llflxlx.exe83⤵PID:2672
-
\??\c:\ntnhnb.exec:\ntnhnb.exe84⤵PID:2596
-
\??\c:\bttbhn.exec:\bttbhn.exe85⤵PID:2900
-
\??\c:\ddpvv.exec:\ddpvv.exe86⤵PID:1488
-
\??\c:\7djpv.exec:\7djpv.exe87⤵PID:2300
-
\??\c:\ffxflxf.exec:\ffxflxf.exe88⤵PID:2012
-
\??\c:\7lrfrrf.exec:\7lrfrrf.exe89⤵PID:2968
-
\??\c:\hbntht.exec:\hbntht.exe90⤵PID:2000
-
\??\c:\nhtbht.exec:\nhtbht.exe91⤵PID:2588
-
\??\c:\1vdvd.exec:\1vdvd.exe92⤵PID:2948
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe93⤵PID:2956
-
\??\c:\rrflrfr.exec:\rrflrfr.exe94⤵PID:2308
-
\??\c:\nnhbtb.exec:\nnhbtb.exe95⤵PID:2456
-
\??\c:\hhbhbb.exec:\hhbhbb.exe96⤵PID:2272
-
\??\c:\jdpvj.exec:\jdpvj.exe97⤵PID:1104
-
\??\c:\3vpjv.exec:\3vpjv.exe98⤵PID:2512
-
\??\c:\rlfllrl.exec:\rlfllrl.exe99⤵PID:1620
-
\??\c:\7thntb.exec:\7thntb.exe100⤵PID:1140
-
\??\c:\btbbnt.exec:\btbbnt.exe101⤵PID:920
-
\??\c:\1jdpd.exec:\1jdpd.exe102⤵PID:968
-
\??\c:\vvpvv.exec:\vvpvv.exe103⤵PID:1764
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe104⤵PID:2464
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe105⤵PID:2640
-
\??\c:\hththt.exec:\hththt.exe106⤵PID:2292
-
\??\c:\ffrlxlr.exec:\ffrlxlr.exe107⤵PID:2252
-
\??\c:\ttntbh.exec:\ttntbh.exe108⤵
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\nhnntt.exec:\nhnntt.exe109⤵PID:2276
-
\??\c:\1ddjv.exec:\1ddjv.exe110⤵PID:2108
-
\??\c:\rrllxfl.exec:\rrllxfl.exe111⤵PID:1760
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe112⤵PID:1700
-
\??\c:\ntbbbt.exec:\ntbbbt.exe113⤵PID:2024
-
\??\c:\tnbnnt.exec:\tnbnnt.exe114⤵PID:1972
-
\??\c:\9dddp.exec:\9dddp.exe115⤵PID:2192
-
\??\c:\jjjdj.exec:\jjjdj.exe116⤵PID:2800
-
\??\c:\rrlflxf.exec:\rrlflxf.exe117⤵PID:2748
-
\??\c:\rrxfxxl.exec:\rrxfxxl.exe118⤵PID:2856
-
\??\c:\7tnnbb.exec:\7tnnbb.exe119⤵PID:2636
-
\??\c:\nnnbbb.exec:\nnnbbb.exe120⤵PID:2908
-
\??\c:\1btbbn.exec:\1btbbn.exe121⤵PID:2764
-
\??\c:\vvdjv.exec:\vvdjv.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-