Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe
-
Size
67KB
-
MD5
dc1da99ec8ddc07b09536060c824760c
-
SHA1
c279ac114ae52732f48f24ceaa04e385c4487c9b
-
SHA256
db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc
-
SHA512
21a9935477f132441a6438a471dc359266149539dff893512b76b024d1977cc6410eeec69a96765f2ca67294f73e952d213f2fd523ae8d1b78483507539c6427
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe7:ymb3NkkiQ3mdBjF0y7kbU7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/804-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 804 llfrflx.exe 2448 vpppv.exe 2260 ntnnht.exe 2788 7nbnhb.exe 2664 lrrlxfl.exe 2836 lfxflll.exe 2644 vvjdj.exe 2560 5xflrxl.exe 2176 9btbnt.exe 1924 nbbbhh.exe 2760 jpddd.exe 1564 5rxxlrl.exe 1232 bbbbht.exe 2772 hhthnb.exe 1856 9vjdd.exe 2212 xxxxlrf.exe 2184 nntbbh.exe 2152 ddddp.exe 2100 djjpj.exe 2952 3lrxlxf.exe 1080 hhthtb.exe 1600 jjdpp.exe 1908 lfrxllx.exe 604 rrrfrrl.exe 1776 hhhhht.exe 1664 hhthth.exe 2084 3xflxlf.exe 2396 bhtnhb.exe 1744 7hbhhn.exe 2332 ttttbn.exe 1588 jdvjp.exe 316 rrxllrl.exe 804 lrxrlxr.exe 2624 hthnhn.exe 2192 pdpjv.exe 2808 7jpdp.exe 2656 7xfrxrl.exe 2536 xllrffx.exe 2872 nnbtbn.exe 2840 ddppj.exe 2540 dpvpv.exe 2652 xxxlrfr.exe 2020 xfrlfrx.exe 2216 tbbhhn.exe 2764 tttnbn.exe 2304 ppjdv.exe 2276 ddpdv.exe 1068 xlfxxlx.exe 1232 nnhnnb.exe 1568 jjdpj.exe 1204 ppvjj.exe 2160 flrxlxl.exe 1756 lflxxrf.exe 1636 7hbbtb.exe 548 bhthbn.exe 376 5vjpj.exe 2748 djddp.exe 2952 rrrllrf.exe 1080 llrlrxx.exe 1084 tthnbn.exe 1748 9jvdp.exe 976 vpjvp.exe 624 lrxrrrr.exe 2436 3flxfrr.exe -
resource yara_rule behavioral1/memory/2328-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 804 2328 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 31 PID 2328 wrote to memory of 804 2328 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 31 PID 2328 wrote to memory of 804 2328 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 31 PID 2328 wrote to memory of 804 2328 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 31 PID 804 wrote to memory of 2448 804 llfrflx.exe 32 PID 804 wrote to memory of 2448 804 llfrflx.exe 32 PID 804 wrote to memory of 2448 804 llfrflx.exe 32 PID 804 wrote to memory of 2448 804 llfrflx.exe 32 PID 2448 wrote to memory of 2260 2448 vpppv.exe 33 PID 2448 wrote to memory of 2260 2448 vpppv.exe 33 PID 2448 wrote to memory of 2260 2448 vpppv.exe 33 PID 2448 wrote to memory of 2260 2448 vpppv.exe 33 PID 2260 wrote to memory of 2788 2260 ntnnht.exe 34 PID 2260 wrote to memory of 2788 2260 ntnnht.exe 34 PID 2260 wrote to memory of 2788 2260 ntnnht.exe 34 PID 2260 wrote to memory of 2788 2260 ntnnht.exe 34 PID 2788 wrote to memory of 2664 2788 7nbnhb.exe 35 PID 2788 wrote to memory of 2664 2788 7nbnhb.exe 35 PID 2788 wrote to memory of 2664 2788 7nbnhb.exe 35 PID 2788 wrote to memory of 2664 2788 7nbnhb.exe 35 PID 2664 wrote to memory of 2836 2664 lrrlxfl.exe 36 PID 2664 wrote to memory of 2836 2664 lrrlxfl.exe 36 PID 2664 wrote to memory of 2836 2664 lrrlxfl.exe 36 PID 2664 wrote to memory of 2836 2664 lrrlxfl.exe 36 PID 2836 wrote to memory of 2644 2836 lfxflll.exe 37 PID 2836 wrote to memory of 2644 2836 lfxflll.exe 37 PID 2836 wrote to memory of 2644 2836 lfxflll.exe 37 PID 2836 wrote to memory of 2644 2836 lfxflll.exe 37 PID 2644 wrote to memory of 2560 2644 vvjdj.exe 38 PID 2644 wrote to memory of 2560 2644 vvjdj.exe 38 PID 2644 wrote to memory of 2560 2644 vvjdj.exe 38 PID 2644 wrote to memory of 2560 2644 vvjdj.exe 38 PID 2560 wrote to memory of 2176 2560 5xflrxl.exe 39 PID 2560 wrote to memory of 2176 2560 5xflrxl.exe 39 PID 2560 wrote to memory of 2176 2560 5xflrxl.exe 39 PID 2560 wrote to memory of 2176 2560 5xflrxl.exe 39 PID 2176 wrote to memory of 1924 2176 9btbnt.exe 40 PID 2176 wrote to memory of 1924 2176 9btbnt.exe 40 PID 2176 wrote to memory of 1924 2176 9btbnt.exe 40 PID 2176 wrote to memory of 1924 2176 9btbnt.exe 40 PID 1924 wrote to memory of 2760 1924 nbbbhh.exe 41 PID 1924 wrote to memory of 2760 1924 nbbbhh.exe 41 PID 1924 wrote to memory of 2760 1924 nbbbhh.exe 41 PID 1924 wrote to memory of 2760 1924 nbbbhh.exe 41 PID 2760 wrote to memory of 1564 2760 jpddd.exe 42 PID 2760 wrote to memory of 1564 2760 jpddd.exe 42 PID 2760 wrote to memory of 1564 2760 jpddd.exe 42 PID 2760 wrote to memory of 1564 2760 jpddd.exe 42 PID 1564 wrote to memory of 1232 1564 5rxxlrl.exe 43 PID 1564 wrote to memory of 1232 1564 5rxxlrl.exe 43 PID 1564 wrote to memory of 1232 1564 5rxxlrl.exe 43 PID 1564 wrote to memory of 1232 1564 5rxxlrl.exe 43 PID 1232 wrote to memory of 2772 1232 bbbbht.exe 44 PID 1232 wrote to memory of 2772 1232 bbbbht.exe 44 PID 1232 wrote to memory of 2772 1232 bbbbht.exe 44 PID 1232 wrote to memory of 2772 1232 bbbbht.exe 44 PID 2772 wrote to memory of 1856 2772 hhthnb.exe 45 PID 2772 wrote to memory of 1856 2772 hhthnb.exe 45 PID 2772 wrote to memory of 1856 2772 hhthnb.exe 45 PID 2772 wrote to memory of 1856 2772 hhthnb.exe 45 PID 1856 wrote to memory of 2212 1856 9vjdd.exe 46 PID 1856 wrote to memory of 2212 1856 9vjdd.exe 46 PID 1856 wrote to memory of 2212 1856 9vjdd.exe 46 PID 1856 wrote to memory of 2212 1856 9vjdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe"C:\Users\Admin\AppData\Local\Temp\db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\llfrflx.exec:\llfrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\vpppv.exec:\vpppv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ntnnht.exec:\ntnnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\7nbnhb.exec:\7nbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lrrlxfl.exec:\lrrlxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lfxflll.exec:\lfxflll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vvjdj.exec:\vvjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\5xflrxl.exec:\5xflrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\9btbnt.exec:\9btbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\nbbbhh.exec:\nbbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jpddd.exec:\jpddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\5rxxlrl.exec:\5rxxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\bbbbht.exec:\bbbbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\hhthnb.exec:\hhthnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9vjdd.exec:\9vjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nntbbh.exec:\nntbbh.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\ddddp.exec:\ddddp.exe19⤵
- Executes dropped EXE
PID:2152 -
\??\c:\djjpj.exec:\djjpj.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3lrxlxf.exec:\3lrxlxf.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhthtb.exec:\hhthtb.exe22⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jjdpp.exec:\jjdpp.exe23⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lfrxllx.exec:\lfrxllx.exe24⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rrrfrrl.exec:\rrrfrrl.exe25⤵
- Executes dropped EXE
PID:604 -
\??\c:\hhhhht.exec:\hhhhht.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hhthth.exec:\hhthth.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3xflxlf.exec:\3xflxlf.exe28⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bhtnhb.exec:\bhtnhb.exe29⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7hbhhn.exec:\7hbhhn.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ttttbn.exec:\ttttbn.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdvjp.exec:\jdvjp.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rrxllrl.exec:\rrxllrl.exe33⤵
- Executes dropped EXE
PID:316 -
\??\c:\lrxrlxr.exec:\lrxrlxr.exe34⤵
- Executes dropped EXE
PID:804 -
\??\c:\hthnhn.exec:\hthnhn.exe35⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pdpjv.exec:\pdpjv.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7jpdp.exec:\7jpdp.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7xfrxrl.exec:\7xfrxrl.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xllrffx.exec:\xllrffx.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nnbtbn.exec:\nnbtbn.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddppj.exec:\ddppj.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpvpv.exec:\dpvpv.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxxlrfr.exec:\xxxlrfr.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xfrlfrx.exec:\xfrlfrx.exe44⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tbbhhn.exec:\tbbhhn.exe45⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tttnbn.exec:\tttnbn.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ppjdv.exec:\ppjdv.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddpdv.exec:\ddpdv.exe48⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xlfxxlx.exec:\xlfxxlx.exe49⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nnhnnb.exec:\nnhnnb.exe50⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jjdpj.exec:\jjdpj.exe51⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ppvjj.exec:\ppvjj.exe52⤵
- Executes dropped EXE
PID:1204 -
\??\c:\flrxlxl.exec:\flrxlxl.exe53⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lflxxrf.exec:\lflxxrf.exe54⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7hbbtb.exec:\7hbbtb.exe55⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhthbn.exec:\bhthbn.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\5vjpj.exec:\5vjpj.exe57⤵
- Executes dropped EXE
PID:376 -
\??\c:\djddp.exec:\djddp.exe58⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rrrllrf.exec:\rrrllrf.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\llrlrxx.exec:\llrlrxx.exe60⤵
- Executes dropped EXE
PID:1080 -
\??\c:\tthnbn.exec:\tthnbn.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\9jvdp.exec:\9jvdp.exe62⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vpjvp.exec:\vpjvp.exe63⤵
- Executes dropped EXE
PID:976 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\3flxfrr.exec:\3flxfrr.exe65⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ttnnhn.exec:\ttnnhn.exe66⤵PID:1248
-
\??\c:\tnnbnb.exec:\tnnbnb.exe67⤵PID:1884
-
\??\c:\3pvvd.exec:\3pvvd.exe68⤵PID:1992
-
\??\c:\vvpdj.exec:\vvpdj.exe69⤵PID:1968
-
\??\c:\frffxxr.exec:\frffxxr.exe70⤵PID:2960
-
\??\c:\tththt.exec:\tththt.exe71⤵PID:1576
-
\??\c:\bbbttb.exec:\bbbttb.exe72⤵PID:2012
-
\??\c:\dddpd.exec:\dddpd.exe73⤵PID:108
-
\??\c:\vpddp.exec:\vpddp.exe74⤵PID:2908
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe75⤵PID:2336
-
\??\c:\nhhnbh.exec:\nhhnbh.exe76⤵PID:2672
-
\??\c:\bnbnth.exec:\bnbnth.exe77⤵PID:2828
-
\??\c:\pvpjd.exec:\pvpjd.exe78⤵PID:2852
-
\??\c:\jvvpj.exec:\jvvpj.exe79⤵PID:2844
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe80⤵
- System Location Discovery: System Language Discovery
PID:988 -
\??\c:\1rlxrfr.exec:\1rlxrfr.exe81⤵PID:2884
-
\??\c:\nnhntt.exec:\nnhntt.exe82⤵PID:2548
-
\??\c:\bhbtbn.exec:\bhbtbn.exe83⤵PID:2044
-
\??\c:\3jddj.exec:\3jddj.exe84⤵PID:1796
-
\??\c:\9fflxfr.exec:\9fflxfr.exe85⤵PID:328
-
\??\c:\xrfffrx.exec:\xrfffrx.exe86⤵PID:2216
-
\??\c:\1nnbnt.exec:\1nnbnt.exe87⤵PID:1620
-
\??\c:\ttbnbh.exec:\ttbnbh.exe88⤵PID:2760
-
\??\c:\1vvjd.exec:\1vvjd.exe89⤵PID:1564
-
\??\c:\5ddjj.exec:\5ddjj.exe90⤵PID:1068
-
\??\c:\3xxlfrx.exec:\3xxlfrx.exe91⤵PID:1816
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe92⤵PID:1156
-
\??\c:\7nhbnb.exec:\7nhbnb.exe93⤵PID:1528
-
\??\c:\ntnbtt.exec:\ntnbtt.exe94⤵PID:664
-
\??\c:\jvjjd.exec:\jvjjd.exe95⤵PID:2212
-
\??\c:\vdvvd.exec:\vdvvd.exe96⤵PID:2356
-
\??\c:\xxxffrf.exec:\xxxffrf.exe97⤵PID:2948
-
\??\c:\fffxrrf.exec:\fffxrrf.exe98⤵PID:2768
-
\??\c:\tbnhtn.exec:\tbnhtn.exe99⤵PID:1288
-
\??\c:\nhhnbn.exec:\nhhnbn.exe100⤵PID:1996
-
\??\c:\ddddj.exec:\ddddj.exe101⤵PID:1172
-
\??\c:\rlfxllf.exec:\rlfxllf.exe102⤵PID:1908
-
\??\c:\rfllrxf.exec:\rfllrxf.exe103⤵PID:2400
-
\??\c:\bhtnhb.exec:\bhtnhb.exe104⤵PID:2516
-
\??\c:\9tbhht.exec:\9tbhht.exe105⤵PID:1776
-
\??\c:\vpvvp.exec:\vpvvp.exe106⤵PID:2436
-
\??\c:\dvjvp.exec:\dvjvp.exe107⤵PID:3064
-
\??\c:\7xxlllx.exec:\7xxlllx.exe108⤵PID:1900
-
\??\c:\fxflfrf.exec:\fxflfrf.exe109⤵PID:872
-
\??\c:\ttnhnb.exec:\ttnhnb.exe110⤵PID:2912
-
\??\c:\httbnn.exec:\httbnn.exe111⤵PID:2332
-
\??\c:\jdvjp.exec:\jdvjp.exe112⤵PID:1088
-
\??\c:\pdpdd.exec:\pdpdd.exe113⤵PID:2324
-
\??\c:\lrxrfxx.exec:\lrxrfxx.exe114⤵PID:2096
-
\??\c:\frlrxlr.exec:\frlrxlr.exe115⤵PID:2104
-
\??\c:\bthnbt.exec:\bthnbt.exe116⤵PID:2676
-
\??\c:\bhthbn.exec:\bhthbn.exe117⤵PID:2680
-
\??\c:\ddjpp.exec:\ddjpp.exe118⤵PID:2920
-
\??\c:\jjdjj.exec:\jjdjj.exe119⤵PID:2556
-
\??\c:\3flxlxl.exec:\3flxlxl.exe120⤵PID:1628
-
\??\c:\fxrxlxl.exec:\fxrxlxl.exe121⤵PID:2704
-
\??\c:\3nhthh.exec:\3nhthh.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-