Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb7b21c069f1e73466ee3df4194534d0N.exe
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
cb7b21c069f1e73466ee3df4194534d0N.exe
-
Size
193KB
-
MD5
cb7b21c069f1e73466ee3df4194534d0
-
SHA1
66e8a1cb8958d08fac28ad0e2c792636a9ff8742
-
SHA256
64585dd919b1b1dacf2888fb99c0c7648496485eee73705846e2268c8afa1989
-
SHA512
679dfc2f5bcd2813828ebf97b2ab2981e9c70c6696416c7638def19fe5849823133020ec2855542948ac3de5036fa79fcd10059ff2ced938a89cddef0d8f8a7d
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+3Eey:Ycm4FmowdHoSLEaTBftapTsyFeO3E5
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1988-7-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/3064-10-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2656-21-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2656-26-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2892-34-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2948-56-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2556-70-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2704-67-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2704-65-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2836-86-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2172-107-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2996-104-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2996-102-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1188-123-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2000-141-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2684-149-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/532-160-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2248-170-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2080-196-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2080-198-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1916-225-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1164-236-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1724-268-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2612-301-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2708-303-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2580-347-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2236-361-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2992-376-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/580-397-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2492-396-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/480-425-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1124-437-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1888-451-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2076-465-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1212-490-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1468-491-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2144-510-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1664-517-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2092-537-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2796-583-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2784-696-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1620-793-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2664-842-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2504-861-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2952-893-0x0000000000430000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2408-922-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/376-1001-0x00000000003A0000-0x00000000003D0000-memory.dmp family_blackmoon behavioral1/memory/1092-1045-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3064 3rxfrfr.exe 2656 rxfxlrf.exe 2892 hhtbnt.exe 2876 vdvjp.exe 2948 tbhbbn.exe 2704 1ppvd.exe 2556 5xrrxxf.exe 3008 ntnhbt.exe 2836 bbnbnb.exe 2996 jjjvp.exe 2172 3rfflrx.exe 1188 tnbnbn.exe 1600 xrllrrx.exe 2000 1nbhbh.exe 2684 jdjjd.exe 532 ddjdj.exe 2248 5tnbnn.exe 1900 vpjpp.exe 3056 xxrrffl.exe 2080 nnbhbt.exe 112 pjddj.exe 2276 xfrflfl.exe 1916 vvpjp.exe 2404 dvvdd.exe 1164 hbhtbn.exe 1744 1bhnbb.exe 2020 9pvjd.exe 1724 rlrxflr.exe 2864 nhhtbn.exe 552 vvjvj.exe 1596 lrxfffx.exe 2612 tnhttn.exe 2708 jjjpj.exe 2712 ddvjp.exe 2668 3hhttn.exe 2800 bnhbhn.exe 2764 djpdp.exe 2500 rfxfllr.exe 2580 lrrrffx.exe 2572 nbhthn.exe 2236 5vjdp.exe 2836 llrxllx.exe 2992 5lxfxff.exe 2980 hhbhtt.exe 1492 9btthn.exe 2492 rrfrrlx.exe 580 ffrrlrf.exe 976 nhhbht.exe 2608 btthnt.exe 2820 vpddv.exe 480 9fxlrrx.exe 1124 xxllxfl.exe 1768 3bbhnb.exe 1888 ppjjp.exe 2268 dvjvj.exe 2076 flrxrfr.exe 392 tthhnt.exe 440 3bhbhh.exe 1480 vpddv.exe 1212 5pdjd.exe 1468 fflfxrf.exe 688 btbnth.exe 2144 3btntn.exe 1664 pjpdp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 3064 1988 cb7b21c069f1e73466ee3df4194534d0N.exe 30 PID 1988 wrote to memory of 3064 1988 cb7b21c069f1e73466ee3df4194534d0N.exe 30 PID 1988 wrote to memory of 3064 1988 cb7b21c069f1e73466ee3df4194534d0N.exe 30 PID 1988 wrote to memory of 3064 1988 cb7b21c069f1e73466ee3df4194534d0N.exe 30 PID 3064 wrote to memory of 2656 3064 3rxfrfr.exe 31 PID 3064 wrote to memory of 2656 3064 3rxfrfr.exe 31 PID 3064 wrote to memory of 2656 3064 3rxfrfr.exe 31 PID 3064 wrote to memory of 2656 3064 3rxfrfr.exe 31 PID 2656 wrote to memory of 2892 2656 rxfxlrf.exe 32 PID 2656 wrote to memory of 2892 2656 rxfxlrf.exe 32 PID 2656 wrote to memory of 2892 2656 rxfxlrf.exe 32 PID 2656 wrote to memory of 2892 2656 rxfxlrf.exe 32 PID 2892 wrote to memory of 2876 2892 hhtbnt.exe 33 PID 2892 wrote to memory of 2876 2892 hhtbnt.exe 33 PID 2892 wrote to memory of 2876 2892 hhtbnt.exe 33 PID 2892 wrote to memory of 2876 2892 hhtbnt.exe 33 PID 2876 wrote to memory of 2948 2876 vdvjp.exe 34 PID 2876 wrote to memory of 2948 2876 vdvjp.exe 34 PID 2876 wrote to memory of 2948 2876 vdvjp.exe 34 PID 2876 wrote to memory of 2948 2876 vdvjp.exe 34 PID 2948 wrote to memory of 2704 2948 tbhbbn.exe 35 PID 2948 wrote to memory of 2704 2948 tbhbbn.exe 35 PID 2948 wrote to memory of 2704 2948 tbhbbn.exe 35 PID 2948 wrote to memory of 2704 2948 tbhbbn.exe 35 PID 2704 wrote to memory of 2556 2704 1ppvd.exe 36 PID 2704 wrote to memory of 2556 2704 1ppvd.exe 36 PID 2704 wrote to memory of 2556 2704 1ppvd.exe 36 PID 2704 wrote to memory of 2556 2704 1ppvd.exe 36 PID 2556 wrote to memory of 3008 2556 5xrrxxf.exe 37 PID 2556 wrote to memory of 3008 2556 5xrrxxf.exe 37 PID 2556 wrote to memory of 3008 2556 5xrrxxf.exe 37 PID 2556 wrote to memory of 3008 2556 5xrrxxf.exe 37 PID 3008 wrote to memory of 2836 3008 ntnhbt.exe 38 PID 3008 wrote to memory of 2836 3008 ntnhbt.exe 38 PID 3008 wrote to memory of 2836 3008 ntnhbt.exe 38 PID 3008 wrote to memory of 2836 3008 ntnhbt.exe 38 PID 2836 wrote to memory of 2996 2836 bbnbnb.exe 39 PID 2836 wrote to memory of 2996 2836 bbnbnb.exe 39 PID 2836 wrote to memory of 2996 2836 bbnbnb.exe 39 PID 2836 wrote to memory of 2996 2836 bbnbnb.exe 39 PID 2996 wrote to memory of 2172 2996 jjjvp.exe 40 PID 2996 wrote to memory of 2172 2996 jjjvp.exe 40 PID 2996 wrote to memory of 2172 2996 jjjvp.exe 40 PID 2996 wrote to memory of 2172 2996 jjjvp.exe 40 PID 2172 wrote to memory of 1188 2172 3rfflrx.exe 41 PID 2172 wrote to memory of 1188 2172 3rfflrx.exe 41 PID 2172 wrote to memory of 1188 2172 3rfflrx.exe 41 PID 2172 wrote to memory of 1188 2172 3rfflrx.exe 41 PID 1188 wrote to memory of 1600 1188 tnbnbn.exe 42 PID 1188 wrote to memory of 1600 1188 tnbnbn.exe 42 PID 1188 wrote to memory of 1600 1188 tnbnbn.exe 42 PID 1188 wrote to memory of 1600 1188 tnbnbn.exe 42 PID 1600 wrote to memory of 2000 1600 xrllrrx.exe 43 PID 1600 wrote to memory of 2000 1600 xrllrrx.exe 43 PID 1600 wrote to memory of 2000 1600 xrllrrx.exe 43 PID 1600 wrote to memory of 2000 1600 xrllrrx.exe 43 PID 2000 wrote to memory of 2684 2000 1nbhbh.exe 44 PID 2000 wrote to memory of 2684 2000 1nbhbh.exe 44 PID 2000 wrote to memory of 2684 2000 1nbhbh.exe 44 PID 2000 wrote to memory of 2684 2000 1nbhbh.exe 44 PID 2684 wrote to memory of 532 2684 jdjjd.exe 45 PID 2684 wrote to memory of 532 2684 jdjjd.exe 45 PID 2684 wrote to memory of 532 2684 jdjjd.exe 45 PID 2684 wrote to memory of 532 2684 jdjjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7b21c069f1e73466ee3df4194534d0N.exe"C:\Users\Admin\AppData\Local\Temp\cb7b21c069f1e73466ee3df4194534d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\3rxfrfr.exec:\3rxfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rxfxlrf.exec:\rxfxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\hhtbnt.exec:\hhtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vdvjp.exec:\vdvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tbhbbn.exec:\tbhbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\1ppvd.exec:\1ppvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5xrrxxf.exec:\5xrrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ntnhbt.exec:\ntnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bbnbnb.exec:\bbnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jjjvp.exec:\jjjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\3rfflrx.exec:\3rfflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\tnbnbn.exec:\tnbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xrllrrx.exec:\xrllrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\1nbhbh.exec:\1nbhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\jdjjd.exec:\jdjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ddjdj.exec:\ddjdj.exe17⤵
- Executes dropped EXE
PID:532 -
\??\c:\5tnbnn.exec:\5tnbnn.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpjpp.exec:\vpjpp.exe19⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xxrrffl.exec:\xxrrffl.exe20⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nnbhbt.exec:\nnbhbt.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjddj.exec:\pjddj.exe22⤵
- Executes dropped EXE
PID:112 -
\??\c:\xfrflfl.exec:\xfrflfl.exe23⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvpjp.exec:\vvpjp.exe24⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dvvdd.exec:\dvvdd.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hbhtbn.exec:\hbhtbn.exe26⤵
- Executes dropped EXE
PID:1164 -
\??\c:\1bhnbb.exec:\1bhnbb.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9pvjd.exec:\9pvjd.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rlrxflr.exec:\rlrxflr.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nhhtbn.exec:\nhhtbn.exe30⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vvjvj.exec:\vvjvj.exe31⤵
- Executes dropped EXE
PID:552 -
\??\c:\lrxfffx.exec:\lrxfffx.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tnhttn.exec:\tnhttn.exe33⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jjjpj.exec:\jjjpj.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ddvjp.exec:\ddvjp.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3hhttn.exec:\3hhttn.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bnhbhn.exec:\bnhbhn.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\djpdp.exec:\djpdp.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rfxfllr.exec:\rfxfllr.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lrrrffx.exec:\lrrrffx.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nbhthn.exec:\nbhthn.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5vjdp.exec:\5vjdp.exe42⤵
- Executes dropped EXE
PID:2236 -
\??\c:\llrxllx.exec:\llrxllx.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5lxfxff.exec:\5lxfxff.exe44⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hhbhtt.exec:\hhbhtt.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9btthn.exec:\9btthn.exe46⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rrfrrlx.exec:\rrfrrlx.exe47⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ffrrlrf.exec:\ffrrlrf.exe48⤵
- Executes dropped EXE
PID:580 -
\??\c:\nhhbht.exec:\nhhbht.exe49⤵
- Executes dropped EXE
PID:976 -
\??\c:\btthnt.exec:\btthnt.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpddv.exec:\vpddv.exe51⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9fxlrrx.exec:\9fxlrrx.exe52⤵
- Executes dropped EXE
PID:480 -
\??\c:\xxllxfl.exec:\xxllxfl.exe53⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3bbhnb.exec:\3bbhnb.exe54⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ppjjp.exec:\ppjjp.exe55⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dvjvj.exec:\dvjvj.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\flrxrfr.exec:\flrxrfr.exe57⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tthhnt.exec:\tthhnt.exe58⤵
- Executes dropped EXE
PID:392 -
\??\c:\3bhbhh.exec:\3bhbhh.exe59⤵
- Executes dropped EXE
PID:440 -
\??\c:\vpddv.exec:\vpddv.exe60⤵
- Executes dropped EXE
PID:1480 -
\??\c:\5pdjd.exec:\5pdjd.exe61⤵
- Executes dropped EXE
PID:1212 -
\??\c:\fflfxrf.exec:\fflfxrf.exe62⤵
- Executes dropped EXE
PID:1468 -
\??\c:\btbnth.exec:\btbnth.exe63⤵
- Executes dropped EXE
PID:688 -
\??\c:\3btntn.exec:\3btntn.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pjpdp.exec:\pjpdp.exe65⤵
- Executes dropped EXE
PID:1664 -
\??\c:\frrfflr.exec:\frrfflr.exe66⤵PID:2912
-
\??\c:\rlfxlfl.exec:\rlfxlfl.exe67⤵PID:2020
-
\??\c:\bttbtb.exec:\bttbtb.exe68⤵PID:2092
-
\??\c:\tnthbb.exec:\tnthbb.exe69⤵PID:1760
-
\??\c:\1vjpp.exec:\1vjpp.exe70⤵PID:2808
-
\??\c:\xlffrxl.exec:\xlffrxl.exe71⤵PID:2428
-
\??\c:\bbthtt.exec:\bbthtt.exe72⤵
- System Location Discovery: System Language Discovery
PID:1596 -
\??\c:\ntbhbt.exec:\ntbhbt.exe73⤵PID:3060
-
\??\c:\ddvvd.exec:\ddvvd.exe74⤵PID:2648
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe75⤵PID:2796
-
\??\c:\ffrflxf.exec:\ffrflxf.exe76⤵
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\nhtbhn.exec:\nhtbhn.exe77⤵PID:2768
-
\??\c:\ppjvj.exec:\ppjvj.exe78⤵PID:2948
-
\??\c:\vpvvd.exec:\vpvvd.exe79⤵PID:2480
-
\??\c:\5rlxlrf.exec:\5rlxlrf.exe80⤵PID:2256
-
\??\c:\xlflrrx.exec:\xlflrrx.exe81⤵PID:3012
-
\??\c:\ntntbb.exec:\ntntbb.exe82⤵PID:1224
-
\??\c:\7pvvv.exec:\7pvvv.exe83⤵PID:2964
-
\??\c:\dvvjd.exec:\dvvjd.exe84⤵PID:1932
-
\??\c:\rrxfxlx.exec:\rrxfxlx.exe85⤵PID:2040
-
\??\c:\tnttnn.exec:\tnttnn.exe86⤵PID:2980
-
\??\c:\btbbnn.exec:\btbbnn.exe87⤵PID:1884
-
\??\c:\pjddd.exec:\pjddd.exe88⤵PID:300
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe89⤵PID:1188
-
\??\c:\rlfrflr.exec:\rlfrflr.exe90⤵PID:1328
-
\??\c:\bnbhtt.exec:\bnbhtt.exe91⤵PID:1004
-
\??\c:\tntntb.exec:\tntntb.exe92⤵PID:2812
-
\??\c:\jjvvj.exec:\jjvvj.exe93⤵PID:2784
-
\??\c:\1rrxfff.exec:\1rrxfff.exe94⤵PID:988
-
\??\c:\3lffrrr.exec:\3lffrrr.exe95⤵PID:2176
-
\??\c:\9hbbnn.exec:\9hbbnn.exe96⤵PID:2188
-
\??\c:\dvddj.exec:\dvddj.exe97⤵PID:2336
-
\??\c:\jjvjp.exec:\jjvjp.exe98⤵PID:1740
-
\??\c:\rlflrxf.exec:\rlflrxf.exe99⤵PID:2328
-
\??\c:\frfflfr.exec:\frfflfr.exe100⤵PID:392
-
\??\c:\thnbbt.exec:\thnbbt.exe101⤵PID:2288
-
\??\c:\hbtbnh.exec:\hbtbnh.exe102⤵PID:1684
-
\??\c:\jjpvd.exec:\jjpvd.exe103⤵PID:1820
-
\??\c:\lrrflrl.exec:\lrrflrl.exe104⤵PID:1648
-
\??\c:\xxrxflx.exec:\xxrxflx.exe105⤵PID:828
-
\??\c:\tnhtbb.exec:\tnhtbb.exe106⤵PID:1620
-
\??\c:\vjvdj.exec:\vjvdj.exe107⤵PID:1672
-
\??\c:\3djvj.exec:\3djvj.exe108⤵PID:568
-
\??\c:\xrflfrl.exec:\xrflfrl.exe109⤵PID:2940
-
\??\c:\7nhthn.exec:\7nhthn.exe110⤵PID:648
-
\??\c:\1dvjd.exec:\1dvjd.exe111⤵PID:2864
-
\??\c:\vjppv.exec:\vjppv.exe112⤵PID:1592
-
\??\c:\lxlrrff.exec:\lxlrrff.exe113⤵PID:1984
-
\??\c:\lffxflf.exec:\lffxflf.exe114⤵PID:2740
-
\??\c:\hhbhnt.exec:\hhbhnt.exe115⤵PID:2192
-
\??\c:\hhbnhh.exec:\hhbnhh.exe116⤵PID:2716
-
\??\c:\vvdjj.exec:\vvdjj.exe117⤵PID:2664
-
\??\c:\rfrfffr.exec:\rfrfffr.exe118⤵PID:2512
-
\??\c:\ffrrfrf.exec:\ffrrfrf.exe119⤵PID:2264
-
\??\c:\9hnbhn.exec:\9hnbhn.exe120⤵PID:2504
-
\??\c:\ttnhbb.exec:\ttnhbb.exe121⤵PID:2552
-
\??\c:\jdvdj.exec:\jdvdj.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-