Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-09-2024 12:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe
-
Size
70KB
-
MD5
583e8424ce92cc09d4f807e1c6dc8881
-
SHA1
7a3e72677111ee7720852771c150e27691b7fc46
-
SHA256
c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8
-
SHA512
a35586c393f0218192893b98ddad6de07e0d4b65a2cee16cee4ddbd670d2f9f85dab7936fbdbbb17898806ffb77d5a988babe32ff28aa250176de3651671e338
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj2:ymb3NkkiQ3mdBjFI4Vm
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2592-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/360-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 jrfbrdv.exe 2776 bnvlflv.exe 2976 ddjbf.exe 2164 xlvdpdn.exe 2836 ltlnn.exe 2748 bpdbtbn.exe 1572 tdtbrjf.exe 3056 fvxbjn.exe 2280 nttnlff.exe 2268 hfjfxnd.exe 1984 jxdlnl.exe 1148 dptrv.exe 2908 ldxnbjb.exe 896 ldxljv.exe 1992 brfrlh.exe 2184 rbdjrv.exe 2992 flfxf.exe 2452 tndvdd.exe 2228 lxrddf.exe 580 lffvfhr.exe 2536 rvfbdfn.exe 360 lrdbdd.exe 2080 hxxpx.exe 1456 dbnddnj.exe 2140 bdbnjx.exe 1676 rdbpdjb.exe 924 tjhpxtj.exe 1736 xbjrdbv.exe 3068 dhdvdbv.exe 1516 xnvrhvd.exe 3016 xvhvr.exe 2728 lxntx.exe 2848 htnhxn.exe 2788 jhlhj.exe 2576 vnfnrr.exe 2820 njlndv.exe 2164 bdvrp.exe 2660 rnvnlx.exe 2684 pdhpvf.exe 2640 lrbbt.exe 3044 rdrfrp.exe 2708 xxjntjp.exe 2832 xrftfjj.exe 2132 vtndhlv.exe 2060 tfllr.exe 2088 nptdf.exe 1092 jtdxtht.exe 2112 xbprt.exe 1148 vrvfhx.exe 968 btlbx.exe 2952 vvvfp.exe 1136 btfjd.exe 2996 rxrhbdh.exe 2184 fxffd.exe 3000 tjtxrlb.exe 2440 rdlbbx.exe 236 frlvd.exe 2228 bptll.exe 1620 jpjjj.exe 2168 tdfrftb.exe 1768 lllphvd.exe 2612 fpltbfb.exe 2080 tnjxj.exe 2604 xjtft.exe -
resource yara_rule behavioral1/memory/2592-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/360-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhpxtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjldpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfftvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrhfrrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnpvpnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbvbjtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnvttpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbpvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blnhxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdrfrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhrfbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdtjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrnrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfpfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvjxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tprbjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfdxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbpbrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljtbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbfbxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxhbfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2824 2592 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 29 PID 2592 wrote to memory of 2824 2592 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 29 PID 2592 wrote to memory of 2824 2592 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 29 PID 2592 wrote to memory of 2824 2592 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 29 PID 2824 wrote to memory of 2776 2824 jrfbrdv.exe 30 PID 2824 wrote to memory of 2776 2824 jrfbrdv.exe 30 PID 2824 wrote to memory of 2776 2824 jrfbrdv.exe 30 PID 2824 wrote to memory of 2776 2824 jrfbrdv.exe 30 PID 2776 wrote to memory of 2976 2776 bnvlflv.exe 31 PID 2776 wrote to memory of 2976 2776 bnvlflv.exe 31 PID 2776 wrote to memory of 2976 2776 bnvlflv.exe 31 PID 2776 wrote to memory of 2976 2776 bnvlflv.exe 31 PID 2976 wrote to memory of 2164 2976 ddjbf.exe 32 PID 2976 wrote to memory of 2164 2976 ddjbf.exe 32 PID 2976 wrote to memory of 2164 2976 ddjbf.exe 32 PID 2976 wrote to memory of 2164 2976 ddjbf.exe 32 PID 2164 wrote to memory of 2836 2164 xlvdpdn.exe 33 PID 2164 wrote to memory of 2836 2164 xlvdpdn.exe 33 PID 2164 wrote to memory of 2836 2164 xlvdpdn.exe 33 PID 2164 wrote to memory of 2836 2164 xlvdpdn.exe 33 PID 2836 wrote to memory of 2748 2836 ltlnn.exe 34 PID 2836 wrote to memory of 2748 2836 ltlnn.exe 34 PID 2836 wrote to memory of 2748 2836 ltlnn.exe 34 PID 2836 wrote to memory of 2748 2836 ltlnn.exe 34 PID 2748 wrote to memory of 1572 2748 bpdbtbn.exe 35 PID 2748 wrote to memory of 1572 2748 bpdbtbn.exe 35 PID 2748 wrote to memory of 1572 2748 bpdbtbn.exe 35 PID 2748 wrote to memory of 1572 2748 bpdbtbn.exe 35 PID 1572 wrote to memory of 3056 1572 tdtbrjf.exe 36 PID 1572 wrote to memory of 3056 1572 tdtbrjf.exe 36 PID 1572 wrote to memory of 3056 1572 tdtbrjf.exe 36 PID 1572 wrote to memory of 3056 1572 tdtbrjf.exe 36 PID 3056 wrote to memory of 2280 3056 fvxbjn.exe 37 PID 3056 wrote to memory of 2280 3056 fvxbjn.exe 37 PID 3056 wrote to memory of 2280 3056 fvxbjn.exe 37 PID 3056 wrote to memory of 2280 3056 fvxbjn.exe 37 PID 2280 wrote to memory of 2268 2280 nttnlff.exe 38 PID 2280 wrote to memory of 2268 2280 nttnlff.exe 38 PID 2280 wrote to memory of 2268 2280 nttnlff.exe 38 PID 2280 wrote to memory of 2268 2280 nttnlff.exe 38 PID 2268 wrote to memory of 1984 2268 hfjfxnd.exe 39 PID 2268 wrote to memory of 1984 2268 hfjfxnd.exe 39 PID 2268 wrote to memory of 1984 2268 hfjfxnd.exe 39 PID 2268 wrote to memory of 1984 2268 hfjfxnd.exe 39 PID 1984 wrote to memory of 1148 1984 jxdlnl.exe 40 PID 1984 wrote to memory of 1148 1984 jxdlnl.exe 40 PID 1984 wrote to memory of 1148 1984 jxdlnl.exe 40 PID 1984 wrote to memory of 1148 1984 jxdlnl.exe 40 PID 1148 wrote to memory of 2908 1148 dptrv.exe 41 PID 1148 wrote to memory of 2908 1148 dptrv.exe 41 PID 1148 wrote to memory of 2908 1148 dptrv.exe 41 PID 1148 wrote to memory of 2908 1148 dptrv.exe 41 PID 2908 wrote to memory of 896 2908 ldxnbjb.exe 42 PID 2908 wrote to memory of 896 2908 ldxnbjb.exe 42 PID 2908 wrote to memory of 896 2908 ldxnbjb.exe 42 PID 2908 wrote to memory of 896 2908 ldxnbjb.exe 42 PID 896 wrote to memory of 1992 896 ldxljv.exe 43 PID 896 wrote to memory of 1992 896 ldxljv.exe 43 PID 896 wrote to memory of 1992 896 ldxljv.exe 43 PID 896 wrote to memory of 1992 896 ldxljv.exe 43 PID 1992 wrote to memory of 2184 1992 brfrlh.exe 44 PID 1992 wrote to memory of 2184 1992 brfrlh.exe 44 PID 1992 wrote to memory of 2184 1992 brfrlh.exe 44 PID 1992 wrote to memory of 2184 1992 brfrlh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe"C:\Users\Admin\AppData\Local\Temp\c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jrfbrdv.exec:\jrfbrdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bnvlflv.exec:\bnvlflv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ddjbf.exec:\ddjbf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xlvdpdn.exec:\xlvdpdn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ltlnn.exec:\ltlnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bpdbtbn.exec:\bpdbtbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tdtbrjf.exec:\tdtbrjf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\fvxbjn.exec:\fvxbjn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nttnlff.exec:\nttnlff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hfjfxnd.exec:\hfjfxnd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\jxdlnl.exec:\jxdlnl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\dptrv.exec:\dptrv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\ldxnbjb.exec:\ldxnbjb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ldxljv.exec:\ldxljv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\brfrlh.exec:\brfrlh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\rbdjrv.exec:\rbdjrv.exe17⤵
- Executes dropped EXE
PID:2184 -
\??\c:\flfxf.exec:\flfxf.exe18⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tndvdd.exec:\tndvdd.exe19⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lxrddf.exec:\lxrddf.exe20⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lffvfhr.exec:\lffvfhr.exe21⤵
- Executes dropped EXE
PID:580 -
\??\c:\rvfbdfn.exec:\rvfbdfn.exe22⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lrdbdd.exec:\lrdbdd.exe23⤵
- Executes dropped EXE
PID:360 -
\??\c:\hxxpx.exec:\hxxpx.exe24⤵
- Executes dropped EXE
PID:2080 -
\??\c:\dbnddnj.exec:\dbnddnj.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\bdbnjx.exec:\bdbnjx.exe26⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rdbpdjb.exec:\rdbpdjb.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tjhpxtj.exec:\tjhpxtj.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924 -
\??\c:\xbjrdbv.exec:\xbjrdbv.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dhdvdbv.exec:\dhdvdbv.exe30⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xnvrhvd.exec:\xnvrhvd.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xvhvr.exec:\xvhvr.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lxntx.exec:\lxntx.exe33⤵
- Executes dropped EXE
PID:2728 -
\??\c:\htnhxn.exec:\htnhxn.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jhlhj.exec:\jhlhj.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vnfnrr.exec:\vnfnrr.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\njlndv.exec:\njlndv.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bdvrp.exec:\bdvrp.exe38⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rnvnlx.exec:\rnvnlx.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pdhpvf.exec:\pdhpvf.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lrbbt.exec:\lrbbt.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rdrfrp.exec:\rdrfrp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\xxjntjp.exec:\xxjntjp.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xrftfjj.exec:\xrftfjj.exe44⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vtndhlv.exec:\vtndhlv.exe45⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tfllr.exec:\tfllr.exe46⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nptdf.exec:\nptdf.exe47⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jtdxtht.exec:\jtdxtht.exe48⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xbprt.exec:\xbprt.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vrvfhx.exec:\vrvfhx.exe50⤵
- Executes dropped EXE
PID:1148 -
\??\c:\btlbx.exec:\btlbx.exe51⤵
- Executes dropped EXE
PID:968 -
\??\c:\vvvfp.exec:\vvvfp.exe52⤵
- Executes dropped EXE
PID:2952 -
\??\c:\btfjd.exec:\btfjd.exe53⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rxrhbdh.exec:\rxrhbdh.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxffd.exec:\fxffd.exe55⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tjtxrlb.exec:\tjtxrlb.exe56⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rdlbbx.exec:\rdlbbx.exe57⤵
- Executes dropped EXE
PID:2440 -
\??\c:\frlvd.exec:\frlvd.exe58⤵
- Executes dropped EXE
PID:236 -
\??\c:\bptll.exec:\bptll.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jpjjj.exec:\jpjjj.exe60⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tdfrftb.exec:\tdfrftb.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lllphvd.exec:\lllphvd.exe62⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fpltbfb.exec:\fpltbfb.exe63⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnjxj.exec:\tnjxj.exe64⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xjtft.exec:\xjtft.exe65⤵
- Executes dropped EXE
PID:2604 -
\??\c:\phvpn.exec:\phvpn.exe66⤵PID:1616
-
\??\c:\dbtbhd.exec:\dbtbhd.exe67⤵PID:1732
-
\??\c:\vttrx.exec:\vttrx.exe68⤵PID:920
-
\??\c:\vnfhh.exec:\vnfhh.exe69⤵PID:2392
-
\??\c:\hfdhrf.exec:\hfdhrf.exe70⤵PID:472
-
\??\c:\bxjth.exec:\bxjth.exe71⤵PID:2340
-
\??\c:\tlfxdlp.exec:\tlfxdlp.exe72⤵PID:1244
-
\??\c:\dpfdvvp.exec:\dpfdvvp.exe73⤵PID:3024
-
\??\c:\vhthnnj.exec:\vhthnnj.exe74⤵PID:2956
-
\??\c:\tndbljv.exec:\tndbljv.exe75⤵PID:2888
-
\??\c:\ndrpb.exec:\ndrpb.exe76⤵PID:1584
-
\??\c:\rjdlnh.exec:\rjdlnh.exe77⤵PID:2876
-
\??\c:\fbplrb.exec:\fbplrb.exe78⤵PID:2920
-
\??\c:\bdtbbxd.exec:\bdtbbxd.exe79⤵PID:2840
-
\??\c:\ttjrbj.exec:\ttjrbj.exe80⤵PID:2172
-
\??\c:\bfjprv.exec:\bfjprv.exe81⤵PID:2808
-
\??\c:\jppdpn.exec:\jppdpn.exe82⤵PID:2656
-
\??\c:\vtbxtvd.exec:\vtbxtvd.exe83⤵PID:2668
-
\??\c:\nrtfndh.exec:\nrtfndh.exe84⤵PID:1120
-
\??\c:\bdxnn.exec:\bdxnn.exe85⤵PID:1608
-
\??\c:\ffvrh.exec:\ffvrh.exe86⤵PID:1756
-
\??\c:\llfpj.exec:\llfpj.exe87⤵
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\bfvhr.exec:\bfvhr.exe88⤵PID:928
-
\??\c:\dxvvvhj.exec:\dxvvvhj.exe89⤵PID:2932
-
\??\c:\xpvddhh.exec:\xpvddhh.exe90⤵PID:1980
-
\??\c:\npdhxpd.exec:\npdhxpd.exe91⤵PID:2336
-
\??\c:\bbxtfnn.exec:\bbxtfnn.exe92⤵PID:2420
-
\??\c:\dnlxjnv.exec:\dnlxjnv.exe93⤵PID:896
-
\??\c:\xnfvtbb.exec:\xnfvtbb.exe94⤵PID:1632
-
\??\c:\jhbpdn.exec:\jhbpdn.exe95⤵PID:2260
-
\??\c:\ptrnf.exec:\ptrnf.exe96⤵PID:936
-
\??\c:\lvnlrf.exec:\lvnlrf.exe97⤵PID:2300
-
\??\c:\jtbhxlr.exec:\jtbhxlr.exe98⤵PID:2452
-
\??\c:\bprlfhx.exec:\bprlfhx.exe99⤵PID:2308
-
\??\c:\lprpl.exec:\lprpl.exe100⤵PID:864
-
\??\c:\pbbxd.exec:\pbbxd.exe101⤵PID:2488
-
\??\c:\txvhn.exec:\txvhn.exe102⤵PID:1000
-
\??\c:\rlvrn.exec:\rlvrn.exe103⤵PID:684
-
\??\c:\vlptp.exec:\vlptp.exe104⤵PID:2024
-
\??\c:\tbnxj.exec:\tbnxj.exe105⤵PID:1804
-
\??\c:\lvxlpbf.exec:\lvxlpbf.exe106⤵PID:1500
-
\??\c:\pltpln.exec:\pltpln.exe107⤵PID:548
-
\??\c:\rtvhx.exec:\rtvhx.exe108⤵PID:2216
-
\??\c:\nhrthr.exec:\nhrthr.exe109⤵PID:2484
-
\??\c:\xfdpld.exec:\xfdpld.exe110⤵PID:2492
-
\??\c:\jdvtdvv.exec:\jdvtdvv.exe111⤵PID:1692
-
\??\c:\btbbdvv.exec:\btbbdvv.exe112⤵PID:1772
-
\??\c:\bdxndh.exec:\bdxndh.exe113⤵PID:2964
-
\??\c:\lljntf.exec:\lljntf.exe114⤵PID:2416
-
\??\c:\drvlvb.exec:\drvlvb.exe115⤵PID:1964
-
\??\c:\hxxvhlt.exec:\hxxvhlt.exe116⤵PID:2956
-
\??\c:\rbnfxl.exec:\rbnfxl.exe117⤵PID:2888
-
\??\c:\jnrjb.exec:\jnrjb.exe118⤵PID:1584
-
\??\c:\nxffbd.exec:\nxffbd.exe119⤵PID:2876
-
\??\c:\dlhbfv.exec:\dlhbfv.exe120⤵PID:2920
-
\??\c:\lnjdjnn.exec:\lnjdjnn.exe121⤵PID:2840
-
\??\c:\fdbdrph.exec:\fdbdrph.exe122⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-