Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 12:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe
-
Size
68KB
-
MD5
70b50aaa091962be8b86144dd7ba69a0
-
SHA1
feb16a4084fa1cddc2029b46384ab92cd29caa03
-
SHA256
757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67
-
SHA512
9fde1dc07628c28571ed9d04e78b4fb69f745791caaaf306be1cd33d28ae38fc3ed23a34c842c22c28e9e0c0d24bedba0f1cd880a087a58f25124ab20986a958
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcd:ymb3NkkiQ3mdBjFIsIVcd
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3064-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/436-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/472-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 fnjvtt.exe 2828 brpdxl.exe 2544 nlhdnx.exe 2684 nnjxd.exe 2552 ljxtnnb.exe 2184 bplld.exe 436 tbhfvt.exe 1544 dxfph.exe 2220 dhtljvx.exe 640 pvnbl.exe 1624 fpvllt.exe 1484 rdbvd.exe 1160 rpbtlbx.exe 472 xjhfbp.exe 692 jppnrp.exe 932 dnxltp.exe 3032 djxnfrv.exe 2820 vhtbfh.exe 1988 vfbbx.exe 1368 nvbfvb.exe 952 bxfbdl.exe 956 fbbbf.exe 1508 dhlrv.exe 1928 bldtdrb.exe 768 nrdjdfh.exe 2872 vvdlnrj.exe 2280 hlrdhb.exe 2052 vpdpft.exe 764 rftrhj.exe 2784 lbphd.exe 2732 prpjh.exe 2768 lpbff.exe 2620 flbnd.exe 2756 djftrx.exe 2628 rnntdl.exe 2532 rthvhp.exe 2624 lrpxjdn.exe 2576 jnnfr.exe 2900 nlrpd.exe 1728 ftxpv.exe 276 rbhlf.exe 1744 hfnxrn.exe 424 dbrjnx.exe 2836 fjnjnl.exe 1544 pvtvp.exe 1144 lhtttf.exe 640 ljxfhrv.exe 1340 vlnfvjh.exe 368 fxptnpb.exe 1688 bhnlrxx.exe 316 pdjxdlp.exe 2056 xlnfjlf.exe 592 rjvrfv.exe 2212 fhvdj.exe 1760 bbbfjb.exe 3024 hpnfjdj.exe 2868 frddpvb.exe 980 bnttppp.exe 2412 tffvbth.exe 1828 fpdrj.exe 1976 xlptn.exe 2368 rfpbvn.exe 544 fxlbddb.exe 1928 lrhtbr.exe -
resource yara_rule behavioral1/memory/3064-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/472-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-311-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhvnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnbhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlhxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txlblbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvbntvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnjfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbfntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvdnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpvbrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdfrxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjnvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjblxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhxnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvtbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlxjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffdhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhfvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrllhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brbnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjhjtdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2740 3064 757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe 30 PID 3064 wrote to memory of 2740 3064 757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe 30 PID 3064 wrote to memory of 2740 3064 757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe 30 PID 3064 wrote to memory of 2740 3064 757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe 30 PID 2740 wrote to memory of 2828 2740 fnjvtt.exe 31 PID 2740 wrote to memory of 2828 2740 fnjvtt.exe 31 PID 2740 wrote to memory of 2828 2740 fnjvtt.exe 31 PID 2740 wrote to memory of 2828 2740 fnjvtt.exe 31 PID 2828 wrote to memory of 2544 2828 brpdxl.exe 32 PID 2828 wrote to memory of 2544 2828 brpdxl.exe 32 PID 2828 wrote to memory of 2544 2828 brpdxl.exe 32 PID 2828 wrote to memory of 2544 2828 brpdxl.exe 32 PID 2544 wrote to memory of 2684 2544 nlhdnx.exe 33 PID 2544 wrote to memory of 2684 2544 nlhdnx.exe 33 PID 2544 wrote to memory of 2684 2544 nlhdnx.exe 33 PID 2544 wrote to memory of 2684 2544 nlhdnx.exe 33 PID 2684 wrote to memory of 2552 2684 nnjxd.exe 34 PID 2684 wrote to memory of 2552 2684 nnjxd.exe 34 PID 2684 wrote to memory of 2552 2684 nnjxd.exe 34 PID 2684 wrote to memory of 2552 2684 nnjxd.exe 34 PID 2552 wrote to memory of 2184 2552 ljxtnnb.exe 35 PID 2552 wrote to memory of 2184 2552 ljxtnnb.exe 35 PID 2552 wrote to memory of 2184 2552 ljxtnnb.exe 35 PID 2552 wrote to memory of 2184 2552 ljxtnnb.exe 35 PID 2184 wrote to memory of 436 2184 bplld.exe 36 PID 2184 wrote to memory of 436 2184 bplld.exe 36 PID 2184 wrote to memory of 436 2184 bplld.exe 36 PID 2184 wrote to memory of 436 2184 bplld.exe 36 PID 436 wrote to memory of 1544 436 tbhfvt.exe 37 PID 436 wrote to memory of 1544 436 tbhfvt.exe 37 PID 436 wrote to memory of 1544 436 tbhfvt.exe 37 PID 436 wrote to memory of 1544 436 tbhfvt.exe 37 PID 1544 wrote to memory of 2220 1544 dxfph.exe 38 PID 1544 wrote to memory of 2220 1544 dxfph.exe 38 PID 1544 wrote to memory of 2220 1544 dxfph.exe 38 PID 1544 wrote to memory of 2220 1544 dxfph.exe 38 PID 2220 wrote to memory of 640 2220 dhtljvx.exe 39 PID 2220 wrote to memory of 640 2220 dhtljvx.exe 39 PID 2220 wrote to memory of 640 2220 dhtljvx.exe 39 PID 2220 wrote to memory of 640 2220 dhtljvx.exe 39 PID 640 wrote to memory of 1624 640 pvnbl.exe 40 PID 640 wrote to memory of 1624 640 pvnbl.exe 40 PID 640 wrote to memory of 1624 640 pvnbl.exe 40 PID 640 wrote to memory of 1624 640 pvnbl.exe 40 PID 1624 wrote to memory of 1484 1624 fpvllt.exe 41 PID 1624 wrote to memory of 1484 1624 fpvllt.exe 41 PID 1624 wrote to memory of 1484 1624 fpvllt.exe 41 PID 1624 wrote to memory of 1484 1624 fpvllt.exe 41 PID 1484 wrote to memory of 1160 1484 rdbvd.exe 42 PID 1484 wrote to memory of 1160 1484 rdbvd.exe 42 PID 1484 wrote to memory of 1160 1484 rdbvd.exe 42 PID 1484 wrote to memory of 1160 1484 rdbvd.exe 42 PID 1160 wrote to memory of 472 1160 rpbtlbx.exe 43 PID 1160 wrote to memory of 472 1160 rpbtlbx.exe 43 PID 1160 wrote to memory of 472 1160 rpbtlbx.exe 43 PID 1160 wrote to memory of 472 1160 rpbtlbx.exe 43 PID 472 wrote to memory of 692 472 xjhfbp.exe 44 PID 472 wrote to memory of 692 472 xjhfbp.exe 44 PID 472 wrote to memory of 692 472 xjhfbp.exe 44 PID 472 wrote to memory of 692 472 xjhfbp.exe 44 PID 692 wrote to memory of 932 692 jppnrp.exe 45 PID 692 wrote to memory of 932 692 jppnrp.exe 45 PID 692 wrote to memory of 932 692 jppnrp.exe 45 PID 692 wrote to memory of 932 692 jppnrp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe"C:\Users\Admin\AppData\Local\Temp\757c1b4c47bb226afd7f5e172e650b4e13c49e93a816c9e944f134cf76502b67N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\fnjvtt.exec:\fnjvtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\brpdxl.exec:\brpdxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nlhdnx.exec:\nlhdnx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\nnjxd.exec:\nnjxd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ljxtnnb.exec:\ljxtnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bplld.exec:\bplld.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tbhfvt.exec:\tbhfvt.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\dxfph.exec:\dxfph.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\dhtljvx.exec:\dhtljvx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\pvnbl.exec:\pvnbl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\fpvllt.exec:\fpvllt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rdbvd.exec:\rdbvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\rpbtlbx.exec:\rpbtlbx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\xjhfbp.exec:\xjhfbp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\jppnrp.exec:\jppnrp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\dnxltp.exec:\dnxltp.exe17⤵
- Executes dropped EXE
PID:932 -
\??\c:\djxnfrv.exec:\djxnfrv.exe18⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vhtbfh.exec:\vhtbfh.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vfbbx.exec:\vfbbx.exe20⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nvbfvb.exec:\nvbfvb.exe21⤵
- Executes dropped EXE
PID:1368 -
\??\c:\bxfbdl.exec:\bxfbdl.exe22⤵
- Executes dropped EXE
PID:952 -
\??\c:\fbbbf.exec:\fbbbf.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\dhlrv.exec:\dhlrv.exe24⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bldtdrb.exec:\bldtdrb.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nrdjdfh.exec:\nrdjdfh.exe26⤵
- Executes dropped EXE
PID:768 -
\??\c:\vvdlnrj.exec:\vvdlnrj.exe27⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hlrdhb.exec:\hlrdhb.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpdpft.exec:\vpdpft.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rftrhj.exec:\rftrhj.exe30⤵
- Executes dropped EXE
PID:764 -
\??\c:\lbphd.exec:\lbphd.exe31⤵
- Executes dropped EXE
PID:2784 -
\??\c:\prpjh.exec:\prpjh.exe32⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lpbff.exec:\lpbff.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\flbnd.exec:\flbnd.exe34⤵
- Executes dropped EXE
PID:2620 -
\??\c:\djftrx.exec:\djftrx.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rnntdl.exec:\rnntdl.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rthvhp.exec:\rthvhp.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lrpxjdn.exec:\lrpxjdn.exe38⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jnnfr.exec:\jnnfr.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nlrpd.exec:\nlrpd.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ftxpv.exec:\ftxpv.exe41⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rbhlf.exec:\rbhlf.exe42⤵
- Executes dropped EXE
PID:276 -
\??\c:\hfnxrn.exec:\hfnxrn.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dbrjnx.exec:\dbrjnx.exe44⤵
- Executes dropped EXE
PID:424 -
\??\c:\fjnjnl.exec:\fjnjnl.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pvtvp.exec:\pvtvp.exe46⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lhtttf.exec:\lhtttf.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ljxfhrv.exec:\ljxfhrv.exe48⤵
- Executes dropped EXE
PID:640 -
\??\c:\vlnfvjh.exec:\vlnfvjh.exe49⤵
- Executes dropped EXE
PID:1340 -
\??\c:\fxptnpb.exec:\fxptnpb.exe50⤵
- Executes dropped EXE
PID:368 -
\??\c:\bhnlrxx.exec:\bhnlrxx.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pdjxdlp.exec:\pdjxdlp.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\xlnfjlf.exec:\xlnfjlf.exe53⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rjvrfv.exec:\rjvrfv.exe54⤵
- Executes dropped EXE
PID:592 -
\??\c:\fhvdj.exec:\fhvdj.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbbfjb.exec:\bbbfjb.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hpnfjdj.exec:\hpnfjdj.exe57⤵
- Executes dropped EXE
PID:3024 -
\??\c:\frddpvb.exec:\frddpvb.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bnttppp.exec:\bnttppp.exe59⤵
- Executes dropped EXE
PID:980 -
\??\c:\tffvbth.exec:\tffvbth.exe60⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fpdrj.exec:\fpdrj.exe61⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xlptn.exec:\xlptn.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rfpbvn.exec:\rfpbvn.exe63⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxlbddb.exec:\fxlbddb.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\lrhtbr.exec:\lrhtbr.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dnvjphb.exec:\dnvjphb.exe66⤵PID:2456
-
\??\c:\njxvvx.exec:\njxvvx.exe67⤵PID:1276
-
\??\c:\lrdrfd.exec:\lrdrfd.exe68⤵PID:2788
-
\??\c:\hfdhp.exec:\hfdhp.exe69⤵PID:1016
-
\??\c:\xnbhpn.exec:\xnbhpn.exe70⤵
- System Location Discovery: System Language Discovery
PID:664 -
\??\c:\dtdtrv.exec:\dtdtrv.exe71⤵PID:2968
-
\??\c:\bjhxpf.exec:\bjhxpf.exe72⤵PID:2892
-
\??\c:\dftxhl.exec:\dftxhl.exe73⤵PID:2936
-
\??\c:\flpbbjx.exec:\flpbbjx.exe74⤵PID:2652
-
\??\c:\rvbdnhp.exec:\rvbdnhp.exe75⤵PID:2988
-
\??\c:\dfvhjdr.exec:\dfvhjdr.exe76⤵PID:2712
-
\??\c:\nnxxlh.exec:\nnxxlh.exe77⤵PID:2708
-
\??\c:\tfrblh.exec:\tfrblh.exe78⤵PID:2348
-
\??\c:\nbthfdh.exec:\nbthfdh.exe79⤵PID:2804
-
\??\c:\nnprhxn.exec:\nnprhxn.exe80⤵PID:2548
-
\??\c:\fjtjxfn.exec:\fjtjxfn.exe81⤵PID:2632
-
\??\c:\vnblxhv.exec:\vnblxhv.exe82⤵PID:2908
-
\??\c:\plvpxdh.exec:\plvpxdh.exe83⤵PID:2180
-
\??\c:\xjlpnd.exec:\xjlpnd.exe84⤵PID:2480
-
\??\c:\pxvhrj.exec:\pxvhrj.exe85⤵PID:2080
-
\??\c:\bdtpnlr.exec:\bdtpnlr.exe86⤵PID:424
-
\??\c:\vhjtvrr.exec:\vhjtvrr.exe87⤵PID:2124
-
\??\c:\vpdphb.exec:\vpdphb.exe88⤵PID:3068
-
\??\c:\rhhvt.exec:\rhhvt.exe89⤵PID:672
-
\??\c:\bhxrl.exec:\bhxrl.exe90⤵PID:1820
-
\??\c:\bntdldr.exec:\bntdldr.exe91⤵PID:1548
-
\??\c:\nprhh.exec:\nprhh.exe92⤵PID:2332
-
\??\c:\vjnbxrn.exec:\vjnbxrn.exe93⤵PID:1336
-
\??\c:\lndbxv.exec:\lndbxv.exe94⤵PID:316
-
\??\c:\jlvnt.exec:\jlvnt.exe95⤵PID:2992
-
\??\c:\ddfbfxv.exec:\ddfbfxv.exe96⤵PID:692
-
\??\c:\pvrbj.exec:\pvrbj.exe97⤵PID:2200
-
\??\c:\jvhlvtf.exec:\jvhlvtf.exe98⤵PID:1796
-
\??\c:\dfjbdnp.exec:\dfjbdnp.exe99⤵PID:3024
-
\??\c:\fpnnh.exec:\fpnnh.exe100⤵PID:708
-
\??\c:\trvxrv.exec:\trvxrv.exe101⤵PID:980
-
\??\c:\xtfflhh.exec:\xtfflhh.exe102⤵PID:2412
-
\??\c:\jllpt.exec:\jllpt.exe103⤵PID:1828
-
\??\c:\jvbhjv.exec:\jvbhjv.exe104⤵PID:1976
-
\??\c:\vrvdpd.exec:\vrvdpd.exe105⤵PID:2368
-
\??\c:\rxtnbbl.exec:\rxtnbbl.exe106⤵PID:1216
-
\??\c:\dnxpjx.exec:\dnxpjx.exe107⤵PID:2032
-
\??\c:\pxrbr.exec:\pxrbr.exe108⤵PID:2456
-
\??\c:\hpvnv.exec:\hpvnv.exe109⤵PID:1276
-
\??\c:\lhpldth.exec:\lhpldth.exe110⤵PID:2788
-
\??\c:\xvvhtj.exec:\xvvhtj.exe111⤵PID:1016
-
\??\c:\ttfflx.exec:\ttfflx.exe112⤵PID:664
-
\??\c:\bfldhfv.exec:\bfldhfv.exe113⤵PID:1732
-
\??\c:\btrvr.exec:\btrvr.exe114⤵PID:2772
-
\??\c:\pddfhf.exec:\pddfhf.exe115⤵PID:1704
-
\??\c:\fhdvxp.exec:\fhdvxp.exe116⤵PID:2768
-
\??\c:\ppjtxp.exec:\ppjtxp.exe117⤵PID:2688
-
\??\c:\hlpdf.exec:\hlpdf.exe118⤵PID:2644
-
\??\c:\fvvnvlr.exec:\fvvnvlr.exe119⤵PID:1412
-
\??\c:\vvvpbb.exec:\vvvpbb.exe120⤵PID:2504
-
\??\c:\dbpjfd.exec:\dbpjfd.exe121⤵PID:2520
-
\??\c:\hbtbl.exec:\hbtbl.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-