Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d52e6a28da8050a2a9aaa7c1df6f5080N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
d52e6a28da8050a2a9aaa7c1df6f5080N.exe
-
Size
592KB
-
MD5
d52e6a28da8050a2a9aaa7c1df6f5080
-
SHA1
e2734c62abe5f27d6a9f57ba720a47f6cd1a9056
-
SHA256
90b504c2aed3515b5d57e6adc34a2b917f5a44fdb27763dee23ea2388609e7fb
-
SHA512
6c9f1b61d08df11ffda05d5931eb7664858b6f0c1479d7acde1d6fd0e3410ef4669530bccbb9919a18fecf9002ee18e3e5dcdbdb554a4f96bcde4edab1826f07
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayLn:n3C9Lebz+xt4vFeFmgayj
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2712-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1004-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 bdfrtdt.exe 2944 ddtlrn.exe 2888 pxxtll.exe 2636 phfvpd.exe 2660 rfddhpd.exe 3040 ttnljf.exe 2016 dnjltv.exe 1432 dtfnvnx.exe 1488 hhbfxd.exe 2920 prrrf.exe 1904 phrhb.exe 3044 jrtrpv.exe 1524 xplfd.exe 1616 nnlpfd.exe 2360 txvtl.exe 2988 pbdtd.exe 2164 fjjhv.exe 1132 flxlbl.exe 1520 jtfvrjb.exe 940 hfxjvb.exe 888 bvpnx.exe 1560 nfrdtb.exe 2028 blhjx.exe 2240 txtldx.exe 1060 vhlnjdn.exe 2336 fxtxx.exe 2004 ptnhf.exe 2892 hxvxtlb.exe 1004 vjfphpp.exe 1484 bthpnxp.exe 2236 xnvhpfl.exe 2740 hlxrjx.exe 2588 tlpppbp.exe 3020 frbtdv.exe 1964 phflnpx.exe 2624 dbfvvd.exe 2804 pddtvd.exe 740 bhjxdp.exe 2200 xhbtpbh.exe 388 ttfdt.exe 568 vlpdp.exe 2544 xhhprv.exe 1100 fhljpl.exe 2732 dtvntr.exe 2648 rjltxl.exe 1716 ldnfj.exe 1660 tpxvft.exe 3044 xvvptx.exe 368 xvlbdh.exe 2708 prdxddf.exe 1940 pbpxnl.exe 1972 ffjjphp.exe 2208 nnrdn.exe 2388 vnfvlhd.exe 3012 bbntv.exe 2124 fndpxpb.exe 2416 ljbpr.exe 1228 pvdvbh.exe 2476 pbxprx.exe 2408 pvlhr.exe 832 pppjhvb.exe 1640 jvbrvtx.exe 2056 xllnbx.exe 2392 hxhnn.exe -
resource yara_rule behavioral1/memory/2712-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-14-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbtlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptfrtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjrnlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brdnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdnxxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pprhdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhlvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllplh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbphdxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhnrhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdlbtbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprpndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnpphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxjjxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pldtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvjhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxvjffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btfnldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxvblnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltffvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldfjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtbhddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lppjdfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxprdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbndfjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnpxhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xntdbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbfhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfbppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndnftv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfrjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvltpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpfhf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2836 2712 d52e6a28da8050a2a9aaa7c1df6f5080N.exe 30 PID 2712 wrote to memory of 2836 2712 d52e6a28da8050a2a9aaa7c1df6f5080N.exe 30 PID 2712 wrote to memory of 2836 2712 d52e6a28da8050a2a9aaa7c1df6f5080N.exe 30 PID 2712 wrote to memory of 2836 2712 d52e6a28da8050a2a9aaa7c1df6f5080N.exe 30 PID 2836 wrote to memory of 2944 2836 bdfrtdt.exe 31 PID 2836 wrote to memory of 2944 2836 bdfrtdt.exe 31 PID 2836 wrote to memory of 2944 2836 bdfrtdt.exe 31 PID 2836 wrote to memory of 2944 2836 bdfrtdt.exe 31 PID 2944 wrote to memory of 2888 2944 ddtlrn.exe 32 PID 2944 wrote to memory of 2888 2944 ddtlrn.exe 32 PID 2944 wrote to memory of 2888 2944 ddtlrn.exe 32 PID 2944 wrote to memory of 2888 2944 ddtlrn.exe 32 PID 2888 wrote to memory of 2636 2888 pxxtll.exe 33 PID 2888 wrote to memory of 2636 2888 pxxtll.exe 33 PID 2888 wrote to memory of 2636 2888 pxxtll.exe 33 PID 2888 wrote to memory of 2636 2888 pxxtll.exe 33 PID 2636 wrote to memory of 2660 2636 phfvpd.exe 34 PID 2636 wrote to memory of 2660 2636 phfvpd.exe 34 PID 2636 wrote to memory of 2660 2636 phfvpd.exe 34 PID 2636 wrote to memory of 2660 2636 phfvpd.exe 34 PID 2660 wrote to memory of 3040 2660 rfddhpd.exe 35 PID 2660 wrote to memory of 3040 2660 rfddhpd.exe 35 PID 2660 wrote to memory of 3040 2660 rfddhpd.exe 35 PID 2660 wrote to memory of 3040 2660 rfddhpd.exe 35 PID 3040 wrote to memory of 2016 3040 ttnljf.exe 36 PID 3040 wrote to memory of 2016 3040 ttnljf.exe 36 PID 3040 wrote to memory of 2016 3040 ttnljf.exe 36 PID 3040 wrote to memory of 2016 3040 ttnljf.exe 36 PID 2016 wrote to memory of 1432 2016 dnjltv.exe 37 PID 2016 wrote to memory of 1432 2016 dnjltv.exe 37 PID 2016 wrote to memory of 1432 2016 dnjltv.exe 37 PID 2016 wrote to memory of 1432 2016 dnjltv.exe 37 PID 1432 wrote to memory of 1488 1432 dtfnvnx.exe 38 PID 1432 wrote to memory of 1488 1432 dtfnvnx.exe 38 PID 1432 wrote to memory of 1488 1432 dtfnvnx.exe 38 PID 1432 wrote to memory of 1488 1432 dtfnvnx.exe 38 PID 1488 wrote to memory of 2920 1488 hhbfxd.exe 39 PID 1488 wrote to memory of 2920 1488 hhbfxd.exe 39 PID 1488 wrote to memory of 2920 1488 hhbfxd.exe 39 PID 1488 wrote to memory of 2920 1488 hhbfxd.exe 39 PID 2920 wrote to memory of 1904 2920 prrrf.exe 40 PID 2920 wrote to memory of 1904 2920 prrrf.exe 40 PID 2920 wrote to memory of 1904 2920 prrrf.exe 40 PID 2920 wrote to memory of 1904 2920 prrrf.exe 40 PID 1904 wrote to memory of 3044 1904 phrhb.exe 77 PID 1904 wrote to memory of 3044 1904 phrhb.exe 77 PID 1904 wrote to memory of 3044 1904 phrhb.exe 77 PID 1904 wrote to memory of 3044 1904 phrhb.exe 77 PID 3044 wrote to memory of 1524 3044 jrtrpv.exe 42 PID 3044 wrote to memory of 1524 3044 jrtrpv.exe 42 PID 3044 wrote to memory of 1524 3044 jrtrpv.exe 42 PID 3044 wrote to memory of 1524 3044 jrtrpv.exe 42 PID 1524 wrote to memory of 1616 1524 xplfd.exe 43 PID 1524 wrote to memory of 1616 1524 xplfd.exe 43 PID 1524 wrote to memory of 1616 1524 xplfd.exe 43 PID 1524 wrote to memory of 1616 1524 xplfd.exe 43 PID 1616 wrote to memory of 2360 1616 nnlpfd.exe 44 PID 1616 wrote to memory of 2360 1616 nnlpfd.exe 44 PID 1616 wrote to memory of 2360 1616 nnlpfd.exe 44 PID 1616 wrote to memory of 2360 1616 nnlpfd.exe 44 PID 2360 wrote to memory of 2988 2360 txvtl.exe 45 PID 2360 wrote to memory of 2988 2360 txvtl.exe 45 PID 2360 wrote to memory of 2988 2360 txvtl.exe 45 PID 2360 wrote to memory of 2988 2360 txvtl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d52e6a28da8050a2a9aaa7c1df6f5080N.exe"C:\Users\Admin\AppData\Local\Temp\d52e6a28da8050a2a9aaa7c1df6f5080N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bdfrtdt.exec:\bdfrtdt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ddtlrn.exec:\ddtlrn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pxxtll.exec:\pxxtll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\phfvpd.exec:\phfvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rfddhpd.exec:\rfddhpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ttnljf.exec:\ttnljf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\dnjltv.exec:\dnjltv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dtfnvnx.exec:\dtfnvnx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\hhbfxd.exec:\hhbfxd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\prrrf.exec:\prrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\phrhb.exec:\phrhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\jrtrpv.exec:\jrtrpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\xplfd.exec:\xplfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nnlpfd.exec:\nnlpfd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\txvtl.exec:\txvtl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pbdtd.exec:\pbdtd.exe17⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fjjhv.exec:\fjjhv.exe18⤵
- Executes dropped EXE
PID:2164 -
\??\c:\flxlbl.exec:\flxlbl.exe19⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jtfvrjb.exec:\jtfvrjb.exe20⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hfxjvb.exec:\hfxjvb.exe21⤵
- Executes dropped EXE
PID:940 -
\??\c:\bvpnx.exec:\bvpnx.exe22⤵
- Executes dropped EXE
PID:888 -
\??\c:\nfrdtb.exec:\nfrdtb.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\blhjx.exec:\blhjx.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\txtldx.exec:\txtldx.exe25⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vhlnjdn.exec:\vhlnjdn.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fxtxx.exec:\fxtxx.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ptnhf.exec:\ptnhf.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hxvxtlb.exec:\hxvxtlb.exe29⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjfphpp.exec:\vjfphpp.exe30⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bthpnxp.exec:\bthpnxp.exe31⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xnvhpfl.exec:\xnvhpfl.exe32⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hlxrjx.exec:\hlxrjx.exe33⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tlpppbp.exec:\tlpppbp.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\frbtdv.exec:\frbtdv.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\phflnpx.exec:\phflnpx.exe36⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dbfvvd.exec:\dbfvvd.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pddtvd.exec:\pddtvd.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bhjxdp.exec:\bhjxdp.exe39⤵
- Executes dropped EXE
PID:740 -
\??\c:\xhbtpbh.exec:\xhbtpbh.exe40⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ttfdt.exec:\ttfdt.exe41⤵
- Executes dropped EXE
PID:388 -
\??\c:\vlpdp.exec:\vlpdp.exe42⤵
- Executes dropped EXE
PID:568 -
\??\c:\xhhprv.exec:\xhhprv.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fhljpl.exec:\fhljpl.exe44⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dtvntr.exec:\dtvntr.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rjltxl.exec:\rjltxl.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ldnfj.exec:\ldnfj.exe47⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tpxvft.exec:\tpxvft.exe48⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xvvptx.exec:\xvvptx.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xvlbdh.exec:\xvlbdh.exe50⤵
- Executes dropped EXE
PID:368 -
\??\c:\prdxddf.exec:\prdxddf.exe51⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pbpxnl.exec:\pbpxnl.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ffjjphp.exec:\ffjjphp.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nnrdn.exec:\nnrdn.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vnfvlhd.exec:\vnfvlhd.exe55⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bbntv.exec:\bbntv.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fndpxpb.exec:\fndpxpb.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ljbpr.exec:\ljbpr.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pvdvbh.exec:\pvdvbh.exe59⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pbxprx.exec:\pbxprx.exe60⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pvlhr.exec:\pvlhr.exe61⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pppjhvb.exec:\pppjhvb.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\jvbrvtx.exec:\jvbrvtx.exe63⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xllnbx.exec:\xllnbx.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hxhnn.exec:\hxhnn.exe65⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vjtpjlr.exec:\vjtpjlr.exe66⤵PID:2316
-
\??\c:\bjjdfh.exec:\bjjdfh.exe67⤵PID:2500
-
\??\c:\ljhhr.exec:\ljhhr.exe68⤵PID:2400
-
\??\c:\hvtlp.exec:\hvtlp.exe69⤵PID:2216
-
\??\c:\pftrxf.exec:\pftrxf.exe70⤵PID:1480
-
\??\c:\rlhbpdt.exec:\rlhbpdt.exe71⤵PID:1596
-
\??\c:\xxttl.exec:\xxttl.exe72⤵PID:2340
-
\??\c:\blvtpvt.exec:\blvtpvt.exe73⤵PID:1384
-
\??\c:\lbtnhf.exec:\lbtnhf.exe74⤵PID:1592
-
\??\c:\pfvpb.exec:\pfvpb.exe75⤵PID:2788
-
\??\c:\fbtdr.exec:\fbtdr.exe76⤵PID:2944
-
\??\c:\xjxpn.exec:\xjxpn.exe77⤵PID:2592
-
\??\c:\plvlx.exec:\plvlx.exe78⤵PID:2752
-
\??\c:\bldnlx.exec:\bldnlx.exe79⤵PID:2816
-
\??\c:\hxfdbfr.exec:\hxfdbfr.exe80⤵PID:2660
-
\??\c:\tjhtxvn.exec:\tjhtxvn.exe81⤵PID:2148
-
\??\c:\xvpltt.exec:\xvpltt.exe82⤵PID:2376
-
\??\c:\frndx.exec:\frndx.exe83⤵PID:2868
-
\??\c:\xlxpv.exec:\xlxpv.exe84⤵PID:1508
-
\??\c:\xhfvhr.exec:\xhfvhr.exe85⤵PID:2544
-
\??\c:\jnttx.exec:\jnttx.exe86⤵PID:1100
-
\??\c:\vnfrf.exec:\vnfrf.exe87⤵PID:2732
-
\??\c:\bjvdjx.exec:\bjvdjx.exe88⤵PID:2648
-
\??\c:\trlhp.exec:\trlhp.exe89⤵PID:1656
-
\??\c:\bbfbx.exec:\bbfbx.exe90⤵PID:1904
-
\??\c:\lrrbjrh.exec:\lrrbjrh.exe91⤵PID:3044
-
\??\c:\hnvbnd.exec:\hnvbnd.exe92⤵PID:368
-
\??\c:\vnxtlv.exec:\vnxtlv.exe93⤵PID:1544
-
\??\c:\fdhbpr.exec:\fdhbpr.exe94⤵PID:1128
-
\??\c:\njvbnbj.exec:\njvbnbj.exe95⤵PID:3064
-
\??\c:\nvfrn.exec:\nvfrn.exe96⤵PID:2060
-
\??\c:\hvtjpf.exec:\hvtjpf.exe97⤵PID:2388
-
\??\c:\jpnpxhx.exec:\jpnpxhx.exe98⤵
- System Location Discovery: System Language Discovery
PID:1268 -
\??\c:\tbrvhl.exec:\tbrvhl.exe99⤵PID:1948
-
\??\c:\dplrb.exec:\dplrb.exe100⤵PID:732
-
\??\c:\tbfvrbf.exec:\tbfvrbf.exe101⤵PID:900
-
\??\c:\npbhp.exec:\npbhp.exe102⤵PID:2264
-
\??\c:\dbbbxv.exec:\dbbbxv.exe103⤵PID:1560
-
\??\c:\fdnxpdl.exec:\fdnxpdl.exe104⤵PID:2672
-
\??\c:\bpfhf.exec:\bpfhf.exe105⤵
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\bdrfh.exec:\bdrfh.exe106⤵PID:1792
-
\??\c:\thvxfv.exec:\thvxfv.exe107⤵PID:1180
-
\??\c:\lpddfv.exec:\lpddfv.exe108⤵PID:1944
-
\??\c:\dlxbdp.exec:\dlxbdp.exe109⤵PID:1292
-
\??\c:\fxhvr.exec:\fxhvr.exe110⤵PID:2400
-
\??\c:\rpjht.exec:\rpjht.exe111⤵PID:860
-
\??\c:\ttxbd.exec:\ttxbd.exe112⤵PID:1480
-
\??\c:\xflbbh.exec:\xflbbh.exe113⤵PID:1484
-
\??\c:\tnplt.exec:\tnplt.exe114⤵PID:2780
-
\??\c:\tldtfh.exec:\tldtfh.exe115⤵PID:1556
-
\??\c:\ntvjprn.exec:\ntvjprn.exe116⤵PID:2020
-
\??\c:\lttlh.exec:\lttlh.exe117⤵PID:2756
-
\??\c:\vxpdxxt.exec:\vxpdxxt.exe118⤵PID:2696
-
\??\c:\phlpdfv.exec:\phlpdfv.exe119⤵PID:2820
-
\??\c:\lpvbtj.exec:\lpvbtj.exe120⤵PID:1960
-
\??\c:\dbfntt.exec:\dbfntt.exe121⤵PID:2076
-
\??\c:\tnldlvd.exec:\tnldlvd.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-