Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe
-
Size
229KB
-
MD5
b240f0f6af18f3761944e747427a0a4d
-
SHA1
c2a19c8eb6fc2b6693a39f7857df3dabb0c7bf2c
-
SHA256
33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe
-
SHA512
a7d8f82f1bc519bf4cce946ce24835f2b617f48728ab95b4fc76bb13e22ad2ff738e06546cdfabd9d9586ba0560a85ec0ca5a1b9bdc174ddf6279761ad73d43c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeGdE:n3C9BRo7MlrWKo+lxK4
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2008-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 9bttbb.exe 2388 3hntbb.exe 2764 lxrxfxf.exe 2920 thbbhb.exe 2288 jvpvd.exe 2828 rlrxllf.exe 2992 bbntbb.exe 2696 ntnntn.exe 1936 jjdjv.exe 1284 5lxxfxl.exe 3008 bnhhnt.exe 2932 pjvvp.exe 844 lrxxrxf.exe 3052 rllfrlf.exe 1528 htbthh.exe 1752 dvjjv.exe 264 fxllxxr.exe 1928 rfllrrx.exe 1428 vpppv.exe 464 9dppv.exe 996 rlxfrrx.exe 1684 tnbbhb.exe 1184 dvjpv.exe 1760 ffffrfx.exe 3020 bhtbtt.exe 336 bthnbb.exe 2272 vjppj.exe 2400 9xlllll.exe 1632 hhbhbb.exe 1596 ntnhnn.exe 2988 jvvvj.exe 2464 xrrrffl.exe 2888 hhbhhh.exe 2892 hthhhh.exe 2628 pjddp.exe 2880 jvjjj.exe 1860 fxfflfl.exe 2792 3xlrxfr.exe 2640 1ttbnt.exe 2340 thtthh.exe 1272 5dvdd.exe 2836 pjvdv.exe 3028 rlrfrrx.exe 2852 xlxxffr.exe 2948 bbnbht.exe 1660 bthntt.exe 2824 7vjjp.exe 2844 vjpjv.exe 1824 rlxxffl.exe 1924 nbhntn.exe 3064 thttbb.exe 2136 1jvpv.exe 2116 pjddd.exe 836 rfxrffl.exe 268 hbtbnb.exe 1984 7nnntt.exe 1812 7pvpv.exe 1252 dvdvv.exe 1248 frxxffr.exe 2508 frxfffl.exe 1760 nhbbnt.exe 2708 nbnhnt.exe 2260 1pddv.exe 1952 rfrrrrr.exe -
resource yara_rule behavioral1/memory/2364-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2008 2364 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 31 PID 2364 wrote to memory of 2008 2364 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 31 PID 2364 wrote to memory of 2008 2364 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 31 PID 2364 wrote to memory of 2008 2364 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 31 PID 2008 wrote to memory of 2388 2008 9bttbb.exe 32 PID 2008 wrote to memory of 2388 2008 9bttbb.exe 32 PID 2008 wrote to memory of 2388 2008 9bttbb.exe 32 PID 2008 wrote to memory of 2388 2008 9bttbb.exe 32 PID 2388 wrote to memory of 2764 2388 3hntbb.exe 33 PID 2388 wrote to memory of 2764 2388 3hntbb.exe 33 PID 2388 wrote to memory of 2764 2388 3hntbb.exe 33 PID 2388 wrote to memory of 2764 2388 3hntbb.exe 33 PID 2764 wrote to memory of 2920 2764 lxrxfxf.exe 34 PID 2764 wrote to memory of 2920 2764 lxrxfxf.exe 34 PID 2764 wrote to memory of 2920 2764 lxrxfxf.exe 34 PID 2764 wrote to memory of 2920 2764 lxrxfxf.exe 34 PID 2920 wrote to memory of 2288 2920 thbbhb.exe 35 PID 2920 wrote to memory of 2288 2920 thbbhb.exe 35 PID 2920 wrote to memory of 2288 2920 thbbhb.exe 35 PID 2920 wrote to memory of 2288 2920 thbbhb.exe 35 PID 2288 wrote to memory of 2828 2288 jvpvd.exe 36 PID 2288 wrote to memory of 2828 2288 jvpvd.exe 36 PID 2288 wrote to memory of 2828 2288 jvpvd.exe 36 PID 2288 wrote to memory of 2828 2288 jvpvd.exe 36 PID 2828 wrote to memory of 2992 2828 rlrxllf.exe 37 PID 2828 wrote to memory of 2992 2828 rlrxllf.exe 37 PID 2828 wrote to memory of 2992 2828 rlrxllf.exe 37 PID 2828 wrote to memory of 2992 2828 rlrxllf.exe 37 PID 2992 wrote to memory of 2696 2992 bbntbb.exe 38 PID 2992 wrote to memory of 2696 2992 bbntbb.exe 38 PID 2992 wrote to memory of 2696 2992 bbntbb.exe 38 PID 2992 wrote to memory of 2696 2992 bbntbb.exe 38 PID 2696 wrote to memory of 1936 2696 ntnntn.exe 39 PID 2696 wrote to memory of 1936 2696 ntnntn.exe 39 PID 2696 wrote to memory of 1936 2696 ntnntn.exe 39 PID 2696 wrote to memory of 1936 2696 ntnntn.exe 39 PID 1936 wrote to memory of 1284 1936 jjdjv.exe 40 PID 1936 wrote to memory of 1284 1936 jjdjv.exe 40 PID 1936 wrote to memory of 1284 1936 jjdjv.exe 40 PID 1936 wrote to memory of 1284 1936 jjdjv.exe 40 PID 1284 wrote to memory of 3008 1284 5lxxfxl.exe 41 PID 1284 wrote to memory of 3008 1284 5lxxfxl.exe 41 PID 1284 wrote to memory of 3008 1284 5lxxfxl.exe 41 PID 1284 wrote to memory of 3008 1284 5lxxfxl.exe 41 PID 3008 wrote to memory of 2932 3008 bnhhnt.exe 42 PID 3008 wrote to memory of 2932 3008 bnhhnt.exe 42 PID 3008 wrote to memory of 2932 3008 bnhhnt.exe 42 PID 3008 wrote to memory of 2932 3008 bnhhnt.exe 42 PID 2932 wrote to memory of 844 2932 pjvvp.exe 43 PID 2932 wrote to memory of 844 2932 pjvvp.exe 43 PID 2932 wrote to memory of 844 2932 pjvvp.exe 43 PID 2932 wrote to memory of 844 2932 pjvvp.exe 43 PID 844 wrote to memory of 3052 844 lrxxrxf.exe 44 PID 844 wrote to memory of 3052 844 lrxxrxf.exe 44 PID 844 wrote to memory of 3052 844 lrxxrxf.exe 44 PID 844 wrote to memory of 3052 844 lrxxrxf.exe 44 PID 3052 wrote to memory of 1528 3052 rllfrlf.exe 45 PID 3052 wrote to memory of 1528 3052 rllfrlf.exe 45 PID 3052 wrote to memory of 1528 3052 rllfrlf.exe 45 PID 3052 wrote to memory of 1528 3052 rllfrlf.exe 45 PID 1528 wrote to memory of 1752 1528 htbthh.exe 46 PID 1528 wrote to memory of 1752 1528 htbthh.exe 46 PID 1528 wrote to memory of 1752 1528 htbthh.exe 46 PID 1528 wrote to memory of 1752 1528 htbthh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe"C:\Users\Admin\AppData\Local\Temp\33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9bttbb.exec:\9bttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\3hntbb.exec:\3hntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\thbbhb.exec:\thbbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jvpvd.exec:\jvpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rlrxllf.exec:\rlrxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bbntbb.exec:\bbntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ntnntn.exec:\ntnntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jjdjv.exec:\jjdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\5lxxfxl.exec:\5lxxfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\bnhhnt.exec:\bnhhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pjvvp.exec:\pjvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lrxxrxf.exec:\lrxxrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rllfrlf.exec:\rllfrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\htbthh.exec:\htbthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\dvjjv.exec:\dvjjv.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fxllxxr.exec:\fxllxxr.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\rfllrrx.exec:\rfllrrx.exe19⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpppv.exec:\vpppv.exe20⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9dppv.exec:\9dppv.exe21⤵
- Executes dropped EXE
PID:464 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe22⤵
- Executes dropped EXE
PID:996 -
\??\c:\tnbbhb.exec:\tnbbhb.exe23⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dvjpv.exec:\dvjpv.exe24⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ffffrfx.exec:\ffffrfx.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bhtbtt.exec:\bhtbtt.exe26⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bthnbb.exec:\bthnbb.exe27⤵
- Executes dropped EXE
PID:336 -
\??\c:\vjppj.exec:\vjppj.exe28⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9xlllll.exec:\9xlllll.exe29⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhbhbb.exec:\hhbhbb.exe30⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ntnhnn.exec:\ntnhnn.exe31⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jvvvj.exec:\jvvvj.exe32⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrrrffl.exec:\xrrrffl.exe33⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hhbhhh.exec:\hhbhhh.exe34⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hthhhh.exec:\hthhhh.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjddp.exec:\pjddp.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jvjjj.exec:\jvjjj.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fxfflfl.exec:\fxfflfl.exe38⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3xlrxfr.exec:\3xlrxfr.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1ttbnt.exec:\1ttbnt.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\thtthh.exec:\thtthh.exe41⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5dvdd.exec:\5dvdd.exe42⤵
- Executes dropped EXE
PID:1272 -
\??\c:\pjvdv.exec:\pjvdv.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rlrfrrx.exec:\rlrfrrx.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xlxxffr.exec:\xlxxffr.exe45⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbnbht.exec:\bbnbht.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bthntt.exec:\bthntt.exe47⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7vjjp.exec:\7vjjp.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vjpjv.exec:\vjpjv.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlxxffl.exec:\rlxxffl.exe50⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nbhntn.exec:\nbhntn.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\thttbb.exec:\thttbb.exe52⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1jvpv.exec:\1jvpv.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjddd.exec:\pjddd.exe54⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rfxrffl.exec:\rfxrffl.exe55⤵
- Executes dropped EXE
PID:836 -
\??\c:\hbtbnb.exec:\hbtbnb.exe56⤵
- Executes dropped EXE
PID:268 -
\??\c:\7nnntt.exec:\7nnntt.exe57⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7pvpv.exec:\7pvpv.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812 -
\??\c:\dvdvv.exec:\dvdvv.exe59⤵
- Executes dropped EXE
PID:1252 -
\??\c:\frxxffr.exec:\frxxffr.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\frxfffl.exec:\frxfffl.exe61⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nhbbnt.exec:\nhbbnt.exe62⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nbnhnt.exec:\nbnhnt.exe63⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1pddv.exec:\1pddv.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3xxflrx.exec:\3xxflrx.exe66⤵PID:1956
-
\??\c:\xlrrrlr.exec:\xlrrrlr.exe67⤵PID:1972
-
\??\c:\nbnnnt.exec:\nbnnnt.exe68⤵PID:1600
-
\??\c:\bnbbbb.exec:\bnbbbb.exe69⤵PID:2984
-
\??\c:\pdjdd.exec:\pdjdd.exe70⤵PID:2008
-
\??\c:\vpdvd.exec:\vpdvd.exe71⤵PID:2056
-
\??\c:\rxfxllr.exec:\rxfxllr.exe72⤵PID:2188
-
\??\c:\3bhhnt.exec:\3bhhnt.exe73⤵PID:2888
-
\??\c:\bntnnn.exec:\bntnnn.exe74⤵PID:2052
-
\??\c:\dpvvj.exec:\dpvvj.exe75⤵PID:2628
-
\??\c:\jvjdd.exec:\jvjdd.exe76⤵PID:2784
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe77⤵PID:1740
-
\??\c:\xxflrxl.exec:\xxflrxl.exe78⤵PID:2744
-
\??\c:\1btbbh.exec:\1btbbh.exe79⤵PID:2640
-
\??\c:\tnttbb.exec:\tnttbb.exe80⤵PID:2340
-
\??\c:\vvddp.exec:\vvddp.exe81⤵PID:2436
-
\??\c:\pdpjp.exec:\pdpjp.exe82⤵PID:2960
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe83⤵PID:3028
-
\??\c:\7ffrxfr.exec:\7ffrxfr.exe84⤵PID:1820
-
\??\c:\hbhntt.exec:\hbhntt.exe85⤵PID:2608
-
\??\c:\thnttt.exec:\thnttt.exe86⤵PID:1560
-
\??\c:\jdjdp.exec:\jdjdp.exe87⤵PID:2824
-
\??\c:\9pjpv.exec:\9pjpv.exe88⤵PID:1644
-
\??\c:\fxffllx.exec:\fxffllx.exe89⤵PID:2336
-
\??\c:\lfflrrf.exec:\lfflrrf.exe90⤵PID:1748
-
\??\c:\thbtnt.exec:\thbtnt.exe91⤵PID:3064
-
\??\c:\9tbbbh.exec:\9tbbbh.exe92⤵PID:2372
-
\??\c:\7jddd.exec:\7jddd.exe93⤵PID:2116
-
\??\c:\jvpvd.exec:\jvpvd.exe94⤵PID:2420
-
\??\c:\fxllrrf.exec:\fxllrrf.exe95⤵PID:992
-
\??\c:\7tnthh.exec:\7tnthh.exe96⤵PID:404
-
\??\c:\nhttbb.exec:\nhttbb.exe97⤵PID:1812
-
\??\c:\bbhntb.exec:\bbhntb.exe98⤵PID:2320
-
\??\c:\vpdjp.exec:\vpdjp.exe99⤵PID:1248
-
\??\c:\dpjdp.exec:\dpjdp.exe100⤵PID:2404
-
\??\c:\rfllfxf.exec:\rfllfxf.exe101⤵PID:1760
-
\??\c:\1hnbhh.exec:\1hnbhh.exe102⤵PID:1816
-
\??\c:\bthhbh.exec:\bthhbh.exe103⤵PID:2260
-
\??\c:\vjpdj.exec:\vjpdj.exe104⤵
- System Location Discovery: System Language Discovery
PID:1156 -
\??\c:\5vjvd.exec:\5vjvd.exe105⤵PID:1956
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe106⤵PID:840
-
\??\c:\frffllr.exec:\frffllr.exe107⤵PID:1600
-
\??\c:\xrflrlx.exec:\xrflrlx.exe108⤵PID:2012
-
\??\c:\thttbh.exec:\thttbh.exe109⤵PID:2008
-
\??\c:\7htbhn.exec:\7htbhn.exe110⤵PID:2256
-
\??\c:\pdppv.exec:\pdppv.exe111⤵PID:2764
-
\??\c:\9rrrrll.exec:\9rrrrll.exe112⤵PID:2740
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe113⤵PID:2656
-
\??\c:\bnbhtb.exec:\bnbhtb.exe114⤵PID:2812
-
\??\c:\1hhhnn.exec:\1hhhnn.exe115⤵PID:2880
-
\??\c:\jvdjj.exec:\jvdjj.exe116⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\7pdjd.exec:\7pdjd.exe117⤵PID:2744
-
\??\c:\rlxfllr.exec:\rlxfllr.exe118⤵PID:1868
-
\??\c:\9xlrxxl.exec:\9xlrxxl.exe119⤵PID:2340
-
\??\c:\nnhnnh.exec:\nnhnnh.exe120⤵PID:1272
-
\??\c:\tntthb.exec:\tntthb.exe121⤵PID:2960
-
\??\c:\jvjpv.exec:\jvjpv.exe122⤵PID:1284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-