Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf75764bce315ed8e798e5b3cf8a52d0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
cf75764bce315ed8e798e5b3cf8a52d0N.exe
-
Size
78KB
-
MD5
cf75764bce315ed8e798e5b3cf8a52d0
-
SHA1
c0f6b4be1e78ac55fabcce66517d1b29adb0e524
-
SHA256
ca0fffab83aea709020303bb7747249a9ebf01ebbcb7ce846a3b46ee6d1d10c4
-
SHA512
4e45c8c8e6821ebffd92c84aa9f900db77187bd79ec5f3cb2a0aff11d9144ae2caedb13a85d1f874a757bd222a8b371df24a61a5a85e65b55dcd783a6d011caa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4ye5:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4U
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2632-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2632 llrxxxr.exe 2344 7nbhnb.exe 2992 5tttbb.exe 1076 fxlrflr.exe 2756 nbnnnt.exe 2872 jdvjj.exe 2588 llflxxl.exe 2600 bnbttn.exe 2616 pdvpd.exe 1772 ppdpv.exe 664 xrffllf.exe 2456 bbtnnt.exe 796 nnbhhn.exe 1804 ppjpp.exe 588 vvjpv.exe 2208 3lxrrxf.exe 1940 5hbhhh.exe 2284 3bthtb.exe 2076 ddvvj.exe 2204 ffrxflr.exe 2196 xfxxxrx.exe 2256 hbhhhn.exe 1144 vjpvd.exe 1604 pppdj.exe 1304 frxrrfr.exe 2012 nbnnhb.exe 1400 3hbbnt.exe 984 hhthtt.exe 2032 ppjvd.exe 2040 1rllllr.exe 2904 1nnttt.exe 2060 hhtbbb.exe 1152 5pvvd.exe 1656 7jdpp.exe 2976 rflfxfl.exe 3032 xlfrrxf.exe 2776 bbbbbh.exe 2708 tntbnn.exe 2668 pjdjj.exe 2872 djvpj.exe 2996 rlfrxff.exe 2796 lfrxllr.exe 2604 5fxffxl.exe 2956 nhbnbt.exe 1708 9bnhnb.exe 780 jjddp.exe 664 vpvpv.exe 1456 xlrxffl.exe 1108 1flrrrx.exe 2384 hhbnbb.exe 1036 9thttn.exe 1616 9vdjp.exe 1868 9jvpj.exe 2964 lrffflr.exe 2620 xrflrrr.exe 2428 rxflxlf.exe 2188 nnnnbh.exe 2748 tnhtbb.exe 1576 jdvjj.exe 2420 7vdjp.exe 1436 9jvvd.exe 2528 rfxrfff.exe 1604 3tbhhh.exe 272 5thhbh.exe -
resource yara_rule behavioral1/memory/2632-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2632 2108 cf75764bce315ed8e798e5b3cf8a52d0N.exe 30 PID 2108 wrote to memory of 2632 2108 cf75764bce315ed8e798e5b3cf8a52d0N.exe 30 PID 2108 wrote to memory of 2632 2108 cf75764bce315ed8e798e5b3cf8a52d0N.exe 30 PID 2108 wrote to memory of 2632 2108 cf75764bce315ed8e798e5b3cf8a52d0N.exe 30 PID 2632 wrote to memory of 2344 2632 llrxxxr.exe 31 PID 2632 wrote to memory of 2344 2632 llrxxxr.exe 31 PID 2632 wrote to memory of 2344 2632 llrxxxr.exe 31 PID 2632 wrote to memory of 2344 2632 llrxxxr.exe 31 PID 2344 wrote to memory of 2992 2344 7nbhnb.exe 32 PID 2344 wrote to memory of 2992 2344 7nbhnb.exe 32 PID 2344 wrote to memory of 2992 2344 7nbhnb.exe 32 PID 2344 wrote to memory of 2992 2344 7nbhnb.exe 32 PID 2992 wrote to memory of 1076 2992 5tttbb.exe 33 PID 2992 wrote to memory of 1076 2992 5tttbb.exe 33 PID 2992 wrote to memory of 1076 2992 5tttbb.exe 33 PID 2992 wrote to memory of 1076 2992 5tttbb.exe 33 PID 1076 wrote to memory of 2756 1076 fxlrflr.exe 34 PID 1076 wrote to memory of 2756 1076 fxlrflr.exe 34 PID 1076 wrote to memory of 2756 1076 fxlrflr.exe 34 PID 1076 wrote to memory of 2756 1076 fxlrflr.exe 34 PID 2756 wrote to memory of 2872 2756 nbnnnt.exe 35 PID 2756 wrote to memory of 2872 2756 nbnnnt.exe 35 PID 2756 wrote to memory of 2872 2756 nbnnnt.exe 35 PID 2756 wrote to memory of 2872 2756 nbnnnt.exe 35 PID 2872 wrote to memory of 2588 2872 jdvjj.exe 36 PID 2872 wrote to memory of 2588 2872 jdvjj.exe 36 PID 2872 wrote to memory of 2588 2872 jdvjj.exe 36 PID 2872 wrote to memory of 2588 2872 jdvjj.exe 36 PID 2588 wrote to memory of 2600 2588 llflxxl.exe 37 PID 2588 wrote to memory of 2600 2588 llflxxl.exe 37 PID 2588 wrote to memory of 2600 2588 llflxxl.exe 37 PID 2588 wrote to memory of 2600 2588 llflxxl.exe 37 PID 2600 wrote to memory of 2616 2600 bnbttn.exe 38 PID 2600 wrote to memory of 2616 2600 bnbttn.exe 38 PID 2600 wrote to memory of 2616 2600 bnbttn.exe 38 PID 2600 wrote to memory of 2616 2600 bnbttn.exe 38 PID 2616 wrote to memory of 1772 2616 pdvpd.exe 39 PID 2616 wrote to memory of 1772 2616 pdvpd.exe 39 PID 2616 wrote to memory of 1772 2616 pdvpd.exe 39 PID 2616 wrote to memory of 1772 2616 pdvpd.exe 39 PID 1772 wrote to memory of 664 1772 ppdpv.exe 40 PID 1772 wrote to memory of 664 1772 ppdpv.exe 40 PID 1772 wrote to memory of 664 1772 ppdpv.exe 40 PID 1772 wrote to memory of 664 1772 ppdpv.exe 40 PID 664 wrote to memory of 2456 664 xrffllf.exe 41 PID 664 wrote to memory of 2456 664 xrffllf.exe 41 PID 664 wrote to memory of 2456 664 xrffllf.exe 41 PID 664 wrote to memory of 2456 664 xrffllf.exe 41 PID 2456 wrote to memory of 796 2456 bbtnnt.exe 42 PID 2456 wrote to memory of 796 2456 bbtnnt.exe 42 PID 2456 wrote to memory of 796 2456 bbtnnt.exe 42 PID 2456 wrote to memory of 796 2456 bbtnnt.exe 42 PID 796 wrote to memory of 1804 796 nnbhhn.exe 43 PID 796 wrote to memory of 1804 796 nnbhhn.exe 43 PID 796 wrote to memory of 1804 796 nnbhhn.exe 43 PID 796 wrote to memory of 1804 796 nnbhhn.exe 43 PID 1804 wrote to memory of 588 1804 ppjpp.exe 44 PID 1804 wrote to memory of 588 1804 ppjpp.exe 44 PID 1804 wrote to memory of 588 1804 ppjpp.exe 44 PID 1804 wrote to memory of 588 1804 ppjpp.exe 44 PID 588 wrote to memory of 2208 588 vvjpv.exe 45 PID 588 wrote to memory of 2208 588 vvjpv.exe 45 PID 588 wrote to memory of 2208 588 vvjpv.exe 45 PID 588 wrote to memory of 2208 588 vvjpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf75764bce315ed8e798e5b3cf8a52d0N.exe"C:\Users\Admin\AppData\Local\Temp\cf75764bce315ed8e798e5b3cf8a52d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\llrxxxr.exec:\llrxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7nbhnb.exec:\7nbhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\5tttbb.exec:\5tttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fxlrflr.exec:\fxlrflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\nbnnnt.exec:\nbnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jdvjj.exec:\jdvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\llflxxl.exec:\llflxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\bnbttn.exec:\bnbttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdvpd.exec:\pdvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ppdpv.exec:\ppdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\xrffllf.exec:\xrffllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\bbtnnt.exec:\bbtnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nnbhhn.exec:\nnbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\ppjpp.exec:\ppjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vvjpv.exec:\vvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\3lxrrxf.exec:\3lxrrxf.exe17⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5hbhhh.exec:\5hbhhh.exe18⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3bthtb.exec:\3bthtb.exe19⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ddvvj.exec:\ddvvj.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ffrxflr.exec:\ffrxflr.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xfxxxrx.exec:\xfxxxrx.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbhhhn.exec:\hbhhhn.exe23⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vjpvd.exec:\vjpvd.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\pppdj.exec:\pppdj.exe25⤵
- Executes dropped EXE
PID:1604 -
\??\c:\frxrrfr.exec:\frxrrfr.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nbnnhb.exec:\nbnnhb.exe27⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3hbbnt.exec:\3hbbnt.exe28⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hhthtt.exec:\hhthtt.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\ppjvd.exec:\ppjvd.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1rllllr.exec:\1rllllr.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1nnttt.exec:\1nnttt.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hhtbbb.exec:\hhtbbb.exe33⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5pvvd.exec:\5pvvd.exe34⤵
- Executes dropped EXE
PID:1152 -
\??\c:\7jdpp.exec:\7jdpp.exe35⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rflfxfl.exec:\rflfxfl.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xlfrrxf.exec:\xlfrrxf.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bbbbbh.exec:\bbbbbh.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tntbnn.exec:\tntbnn.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjdjj.exec:\pjdjj.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\djvpj.exec:\djvpj.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlfrxff.exec:\rlfrxff.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lfrxllr.exec:\lfrxllr.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5fxffxl.exec:\5fxffxl.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nhbnbt.exec:\nhbnbt.exe45⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9bnhnb.exec:\9bnhnb.exe46⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jjddp.exec:\jjddp.exe47⤵
- Executes dropped EXE
PID:780 -
\??\c:\vpvpv.exec:\vpvpv.exe48⤵
- Executes dropped EXE
PID:664 -
\??\c:\xlrxffl.exec:\xlrxffl.exe49⤵
- Executes dropped EXE
PID:1456 -
\??\c:\1flrrrx.exec:\1flrrrx.exe50⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hhbnbb.exec:\hhbnbb.exe51⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9thttn.exec:\9thttn.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9vdjp.exec:\9vdjp.exe53⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9jvpj.exec:\9jvpj.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lrffflr.exec:\lrffflr.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrflrrr.exec:\xrflrrr.exe56⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rxflxlf.exec:\rxflxlf.exe57⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nnnnbh.exec:\nnnnbh.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tnhtbb.exec:\tnhtbb.exe59⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jdvjj.exec:\jdvjj.exe60⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7vdjp.exec:\7vdjp.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9jvvd.exec:\9jvvd.exe62⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rfxrfff.exec:\rfxrfff.exe63⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3tbhhh.exec:\3tbhhh.exe64⤵
- Executes dropped EXE
PID:1604 -
\??\c:\5thhbh.exec:\5thhbh.exe65⤵
- Executes dropped EXE
PID:272 -
\??\c:\pvvvd.exec:\pvvvd.exe66⤵PID:2168
-
\??\c:\jjpvd.exec:\jjpvd.exe67⤵PID:2064
-
\??\c:\3rrrrll.exec:\3rrrrll.exe68⤵PID:604
-
\??\c:\xrflrrr.exec:\xrflrrr.exe69⤵PID:756
-
\??\c:\btbhtb.exec:\btbhtb.exe70⤵PID:2636
-
\??\c:\nhnhnb.exec:\nhnhnb.exe71⤵PID:2120
-
\??\c:\pdvvj.exec:\pdvvj.exe72⤵PID:2324
-
\??\c:\dvdjd.exec:\dvdjd.exe73⤵PID:2368
-
\??\c:\9fxffxx.exec:\9fxffxx.exe74⤵PID:2060
-
\??\c:\5frrrxf.exec:\5frrrxf.exe75⤵PID:2988
-
\??\c:\thttbh.exec:\thttbh.exe76⤵PID:1656
-
\??\c:\tntbhh.exec:\tntbhh.exe77⤵PID:2976
-
\??\c:\pjvdj.exec:\pjvdj.exe78⤵PID:3032
-
\??\c:\vpddj.exec:\vpddj.exe79⤵PID:2560
-
\??\c:\llflxxf.exec:\llflxxf.exe80⤵PID:2708
-
\??\c:\7fxrffr.exec:\7fxrffr.exe81⤵PID:2668
-
\??\c:\bbnhtt.exec:\bbnhtt.exe82⤵PID:2872
-
\??\c:\9btbnn.exec:\9btbnn.exe83⤵PID:2996
-
\??\c:\vppvd.exec:\vppvd.exe84⤵PID:2796
-
\??\c:\vvdvp.exec:\vvdvp.exe85⤵PID:760
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe86⤵PID:2956
-
\??\c:\9rrxffl.exec:\9rrxffl.exe87⤵PID:928
-
\??\c:\hbthtt.exec:\hbthtt.exe88⤵PID:780
-
\??\c:\5nbhtb.exec:\5nbhtb.exe89⤵PID:320
-
\??\c:\jjvvp.exec:\jjvvp.exe90⤵PID:1456
-
\??\c:\5vddd.exec:\5vddd.exe91⤵PID:1892
-
\??\c:\fxrxfff.exec:\fxrxfff.exe92⤵PID:2384
-
\??\c:\fxlflrx.exec:\fxlflrx.exe93⤵PID:856
-
\??\c:\5bbnbt.exec:\5bbnbt.exe94⤵PID:2208
-
\??\c:\7tnttt.exec:\7tnttt.exe95⤵PID:1308
-
\??\c:\vpvpv.exec:\vpvpv.exe96⤵PID:2964
-
\??\c:\7vvvp.exec:\7vvvp.exe97⤵PID:2524
-
\??\c:\fxxrllf.exec:\fxxrllf.exe98⤵PID:2428
-
\??\c:\xllfxxl.exec:\xllfxxl.exe99⤵PID:1608
-
\??\c:\hbtbhb.exec:\hbtbhb.exe100⤵PID:1252
-
\??\c:\bnttbn.exec:\bnttbn.exe101⤵PID:2440
-
\??\c:\jdppv.exec:\jdppv.exe102⤵PID:1172
-
\??\c:\7dpjd.exec:\7dpjd.exe103⤵PID:2960
-
\??\c:\frxrlrx.exec:\frxrlrx.exe104⤵PID:3060
-
\??\c:\fxrfflx.exec:\fxrfflx.exe105⤵PID:3044
-
\??\c:\btnnnn.exec:\btnnnn.exe106⤵PID:2044
-
\??\c:\bntthh.exec:\bntthh.exe107⤵PID:2132
-
\??\c:\dvjjp.exec:\dvjjp.exe108⤵
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\vpvpv.exec:\vpvpv.exe109⤵PID:3052
-
\??\c:\1xllrxf.exec:\1xllrxf.exe110⤵PID:1596
-
\??\c:\lxfrrrx.exec:\lxfrrrx.exe111⤵PID:2052
-
\??\c:\thnnbt.exec:\thnnbt.exe112⤵PID:2472
-
\??\c:\hbhhnn.exec:\hbhhnn.exe113⤵PID:2984
-
\??\c:\pvvpp.exec:\pvvpp.exe114⤵PID:1452
-
\??\c:\fxxrfff.exec:\fxxrfff.exe115⤵PID:2860
-
\??\c:\frxxlll.exec:\frxxlll.exe116⤵PID:2988
-
\??\c:\nhbnnn.exec:\nhbnnn.exe117⤵PID:2744
-
\??\c:\ppvvv.exec:\ppvvv.exe118⤵PID:2976
-
\??\c:\pdpjd.exec:\pdpjd.exe119⤵PID:2764
-
\??\c:\xrffflx.exec:\xrffflx.exe120⤵PID:2412
-
\??\c:\xrllrrx.exec:\xrllrrx.exe121⤵PID:2580
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe122⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-