Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe
-
Size
66KB
-
MD5
ce4826005bb4045528189c95d5e48320
-
SHA1
9560083ae24c56640a828487dd336c1b51a59f3e
-
SHA256
0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4
-
SHA512
4f5ee932bcbbcc3f91f254f886b9b03d8b221c56324fe56c057c25542ade64b1fbc74786a48c42211074175006a1dc72108ff614a606c2fed7e1e1910e351c59
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfo4n:ymb3NkkiQ3mdBjFI9cqfVn
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-10-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2272 npplfrt.exe 2364 fhprf.exe 2384 bbjvp.exe 2744 vjllftr.exe 2392 phxdb.exe 2796 xldxpxd.exe 2708 pxjfv.exe 2584 jfbnd.exe 3048 jnbjnjb.exe 2920 jxpjlpb.exe 2860 hlhvpl.exe 836 nfttp.exe 1788 lbdlnl.exe 2888 rffrt.exe 2896 dhpvh.exe 2724 pptph.exe 964 hvpnxhb.exe 2228 nbbpjpn.exe 2360 nfrxdld.exe 2188 frtxf.exe 2220 rnrvd.exe 108 nrxnx.exe 2000 pxhpld.exe 960 nfhdpt.exe 1216 hhvjt.exe 2608 rrbjf.exe 592 dxrlvd.exe 396 ttvdn.exe 2368 nxvxf.exe 2400 nfxntj.exe 2008 rlrvp.exe 2064 bhdtx.exe 2232 pxxdh.exe 1616 bfxvtxn.exe 2184 vlvflbf.exe 2680 htrtf.exe 2768 ppjxr.exe 2548 nprhv.exe 2960 pnxhp.exe 2900 ntpbrj.exe 2568 lftbv.exe 2676 njldftl.exe 2612 vvxrnf.exe 2180 nrftjrj.exe 2604 hjffjdx.exe 3048 nhxrlr.exe 696 rnrjhdb.exe 1428 xflvx.exe 2156 rlnvfh.exe 1264 tptvjtd.exe 1776 dnplv.exe 2928 rhxflh.exe 1736 btnldb.exe 852 vhfbpnt.exe 1420 tpjrtb.exe 2968 nnphtt.exe 2228 blxvdb.exe 2044 vddtfbd.exe 2240 bxdxdtv.exe 1316 fdrnv.exe 832 rpvpx.exe 1648 rjxnrv.exe 1164 bbffr.exe 1604 bxrvh.exe -
resource yara_rule behavioral1/memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/964-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpjbrhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxjdbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjfntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffhtbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbrdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdvfptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvxfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlldbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddhll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npplfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlhvpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvxbxxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlhvtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhxpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvhlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphxnhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphvbtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxfdfdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrtvb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2272 2468 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 29 PID 2468 wrote to memory of 2272 2468 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 29 PID 2468 wrote to memory of 2272 2468 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 29 PID 2468 wrote to memory of 2272 2468 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 29 PID 2272 wrote to memory of 2364 2272 npplfrt.exe 30 PID 2272 wrote to memory of 2364 2272 npplfrt.exe 30 PID 2272 wrote to memory of 2364 2272 npplfrt.exe 30 PID 2272 wrote to memory of 2364 2272 npplfrt.exe 30 PID 2364 wrote to memory of 2384 2364 fhprf.exe 31 PID 2364 wrote to memory of 2384 2364 fhprf.exe 31 PID 2364 wrote to memory of 2384 2364 fhprf.exe 31 PID 2364 wrote to memory of 2384 2364 fhprf.exe 31 PID 2384 wrote to memory of 2744 2384 bbjvp.exe 32 PID 2384 wrote to memory of 2744 2384 bbjvp.exe 32 PID 2384 wrote to memory of 2744 2384 bbjvp.exe 32 PID 2384 wrote to memory of 2744 2384 bbjvp.exe 32 PID 2744 wrote to memory of 2392 2744 vjllftr.exe 33 PID 2744 wrote to memory of 2392 2744 vjllftr.exe 33 PID 2744 wrote to memory of 2392 2744 vjllftr.exe 33 PID 2744 wrote to memory of 2392 2744 vjllftr.exe 33 PID 2392 wrote to memory of 2796 2392 phxdb.exe 34 PID 2392 wrote to memory of 2796 2392 phxdb.exe 34 PID 2392 wrote to memory of 2796 2392 phxdb.exe 34 PID 2392 wrote to memory of 2796 2392 phxdb.exe 34 PID 2796 wrote to memory of 2708 2796 xldxpxd.exe 35 PID 2796 wrote to memory of 2708 2796 xldxpxd.exe 35 PID 2796 wrote to memory of 2708 2796 xldxpxd.exe 35 PID 2796 wrote to memory of 2708 2796 xldxpxd.exe 35 PID 2708 wrote to memory of 2584 2708 pxjfv.exe 36 PID 2708 wrote to memory of 2584 2708 pxjfv.exe 36 PID 2708 wrote to memory of 2584 2708 pxjfv.exe 36 PID 2708 wrote to memory of 2584 2708 pxjfv.exe 36 PID 2584 wrote to memory of 3048 2584 jfbnd.exe 37 PID 2584 wrote to memory of 3048 2584 jfbnd.exe 37 PID 2584 wrote to memory of 3048 2584 jfbnd.exe 37 PID 2584 wrote to memory of 3048 2584 jfbnd.exe 37 PID 3048 wrote to memory of 2920 3048 jnbjnjb.exe 38 PID 3048 wrote to memory of 2920 3048 jnbjnjb.exe 38 PID 3048 wrote to memory of 2920 3048 jnbjnjb.exe 38 PID 3048 wrote to memory of 2920 3048 jnbjnjb.exe 38 PID 2920 wrote to memory of 2860 2920 jxpjlpb.exe 39 PID 2920 wrote to memory of 2860 2920 jxpjlpb.exe 39 PID 2920 wrote to memory of 2860 2920 jxpjlpb.exe 39 PID 2920 wrote to memory of 2860 2920 jxpjlpb.exe 39 PID 2860 wrote to memory of 836 2860 hlhvpl.exe 40 PID 2860 wrote to memory of 836 2860 hlhvpl.exe 40 PID 2860 wrote to memory of 836 2860 hlhvpl.exe 40 PID 2860 wrote to memory of 836 2860 hlhvpl.exe 40 PID 836 wrote to memory of 1788 836 nfttp.exe 41 PID 836 wrote to memory of 1788 836 nfttp.exe 41 PID 836 wrote to memory of 1788 836 nfttp.exe 41 PID 836 wrote to memory of 1788 836 nfttp.exe 41 PID 1788 wrote to memory of 2888 1788 lbdlnl.exe 42 PID 1788 wrote to memory of 2888 1788 lbdlnl.exe 42 PID 1788 wrote to memory of 2888 1788 lbdlnl.exe 42 PID 1788 wrote to memory of 2888 1788 lbdlnl.exe 42 PID 2888 wrote to memory of 2896 2888 rffrt.exe 43 PID 2888 wrote to memory of 2896 2888 rffrt.exe 43 PID 2888 wrote to memory of 2896 2888 rffrt.exe 43 PID 2888 wrote to memory of 2896 2888 rffrt.exe 43 PID 2896 wrote to memory of 2724 2896 dhpvh.exe 44 PID 2896 wrote to memory of 2724 2896 dhpvh.exe 44 PID 2896 wrote to memory of 2724 2896 dhpvh.exe 44 PID 2896 wrote to memory of 2724 2896 dhpvh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe"C:\Users\Admin\AppData\Local\Temp\0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\npplfrt.exec:\npplfrt.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\fhprf.exec:\fhprf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bbjvp.exec:\bbjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vjllftr.exec:\vjllftr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\phxdb.exec:\phxdb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\xldxpxd.exec:\xldxpxd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\pxjfv.exec:\pxjfv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jfbnd.exec:\jfbnd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jnbjnjb.exec:\jnbjnjb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jxpjlpb.exec:\jxpjlpb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hlhvpl.exec:\hlhvpl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nfttp.exec:\nfttp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\lbdlnl.exec:\lbdlnl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\rffrt.exec:\rffrt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\dhpvh.exec:\dhpvh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pptph.exec:\pptph.exe17⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hvpnxhb.exec:\hvpnxhb.exe18⤵
- Executes dropped EXE
PID:964 -
\??\c:\nbbpjpn.exec:\nbbpjpn.exe19⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nfrxdld.exec:\nfrxdld.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frtxf.exec:\frtxf.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rnrvd.exec:\rnrvd.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nrxnx.exec:\nrxnx.exe23⤵
- Executes dropped EXE
PID:108 -
\??\c:\pxhpld.exec:\pxhpld.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\nfhdpt.exec:\nfhdpt.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\hhvjt.exec:\hhvjt.exe26⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rrbjf.exec:\rrbjf.exe27⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dxrlvd.exec:\dxrlvd.exe28⤵
- Executes dropped EXE
PID:592 -
\??\c:\ttvdn.exec:\ttvdn.exe29⤵
- Executes dropped EXE
PID:396 -
\??\c:\nxvxf.exec:\nxvxf.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nfxntj.exec:\nfxntj.exe31⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rlrvp.exec:\rlrvp.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bhdtx.exec:\bhdtx.exe33⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pxxdh.exec:\pxxdh.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bfxvtxn.exec:\bfxvtxn.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vlvflbf.exec:\vlvflbf.exe36⤵
- Executes dropped EXE
PID:2184 -
\??\c:\htrtf.exec:\htrtf.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ppjxr.exec:\ppjxr.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nprhv.exec:\nprhv.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pnxhp.exec:\pnxhp.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ntpbrj.exec:\ntpbrj.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lftbv.exec:\lftbv.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\njldftl.exec:\njldftl.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vvxrnf.exec:\vvxrnf.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nrftjrj.exec:\nrftjrj.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hjffjdx.exec:\hjffjdx.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nhxrlr.exec:\nhxrlr.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rnrjhdb.exec:\rnrjhdb.exe48⤵
- Executes dropped EXE
PID:696 -
\??\c:\xflvx.exec:\xflvx.exe49⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rlnvfh.exec:\rlnvfh.exe50⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tptvjtd.exec:\tptvjtd.exe51⤵
- Executes dropped EXE
PID:1264 -
\??\c:\dnplv.exec:\dnplv.exe52⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rhxflh.exec:\rhxflh.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\btnldb.exec:\btnldb.exe54⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vhfbpnt.exec:\vhfbpnt.exe55⤵
- Executes dropped EXE
PID:852 -
\??\c:\tpjrtb.exec:\tpjrtb.exe56⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nnphtt.exec:\nnphtt.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\blxvdb.exec:\blxvdb.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vddtfbd.exec:\vddtfbd.exe59⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bxdxdtv.exec:\bxdxdtv.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fdrnv.exec:\fdrnv.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rpvpx.exec:\rpvpx.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\rjxnrv.exec:\rjxnrv.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bbffr.exec:\bbffr.exe64⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bxrvh.exec:\bxrvh.exe65⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xfpblf.exec:\xfpblf.exe66⤵PID:828
-
\??\c:\lhrbvt.exec:\lhrbvt.exe67⤵PID:1972
-
\??\c:\rbfnxd.exec:\rbfnxd.exe68⤵PID:1176
-
\??\c:\jxfflx.exec:\jxfflx.exe69⤵PID:2068
-
\??\c:\ntxbrf.exec:\ntxbrf.exe70⤵PID:1856
-
\??\c:\xrbpp.exec:\xrbpp.exe71⤵PID:2420
-
\??\c:\npdxrr.exec:\npdxrr.exe72⤵PID:2472
-
\??\c:\nhhxrv.exec:\nhhxrv.exe73⤵PID:1104
-
\??\c:\rjjthnp.exec:\rjjthnp.exe74⤵PID:2016
-
\??\c:\ppxvx.exec:\ppxvx.exe75⤵PID:1608
-
\??\c:\xlxvv.exec:\xlxvv.exe76⤵
- System Location Discovery: System Language Discovery
PID:1240 -
\??\c:\ppdnt.exec:\ppdnt.exe77⤵
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\frlrxp.exec:\frlrxp.exe78⤵PID:2752
-
\??\c:\ppljxbj.exec:\ppljxbj.exe79⤵PID:2732
-
\??\c:\pjflp.exec:\pjflp.exe80⤵PID:2956
-
\??\c:\rjdbxbv.exec:\rjdbxbv.exe81⤵PID:2808
-
\??\c:\rjvlrpp.exec:\rjvlrpp.exe82⤵PID:2564
-
\??\c:\pbtfj.exec:\pbtfj.exe83⤵PID:2588
-
\??\c:\xdpln.exec:\xdpln.exe84⤵PID:2540
-
\??\c:\nxfdfdv.exec:\nxfdfdv.exe85⤵
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\prlxl.exec:\prlxl.exe86⤵PID:2028
-
\??\c:\vplbjv.exec:\vplbjv.exe87⤵PID:860
-
\??\c:\hfpftx.exec:\hfpftx.exe88⤵PID:3028
-
\??\c:\fhlpj.exec:\fhlpj.exe89⤵PID:2324
-
\??\c:\ftnpbnp.exec:\ftnpbnp.exe90⤵PID:2004
-
\??\c:\jpplt.exec:\jpplt.exe91⤵PID:544
-
\??\c:\dxxnbd.exec:\dxxnbd.exe92⤵PID:836
-
\??\c:\lxvnl.exec:\lxvnl.exe93⤵PID:1384
-
\??\c:\jdrfrft.exec:\jdrfrft.exe94⤵PID:2328
-
\??\c:\nhxfb.exec:\nhxfb.exe95⤵PID:2840
-
\??\c:\bptdll.exec:\bptdll.exe96⤵PID:2824
-
\??\c:\hdhtv.exec:\hdhtv.exe97⤵PID:1628
-
\??\c:\xrpbhtv.exec:\xrpbhtv.exe98⤵PID:2984
-
\??\c:\xxpdht.exec:\xxpdht.exe99⤵PID:1012
-
\??\c:\plhrvdv.exec:\plhrvdv.exe100⤵PID:1200
-
\??\c:\tnffj.exec:\tnffj.exe101⤵PID:1360
-
\??\c:\vxhnlt.exec:\vxhnlt.exe102⤵PID:2220
-
\??\c:\tfxxt.exec:\tfxxt.exe103⤵PID:1060
-
\??\c:\fnlhjj.exec:\fnlhjj.exe104⤵PID:980
-
\??\c:\tddhn.exec:\tddhn.exe105⤵PID:1400
-
\??\c:\hpnjdxh.exec:\hpnjdxh.exe106⤵PID:2148
-
\??\c:\hplfhb.exec:\hplfhb.exe107⤵PID:1988
-
\??\c:\vdrftvb.exec:\vdrftvb.exe108⤵PID:856
-
\??\c:\rjbblt.exec:\rjbblt.exe109⤵PID:676
-
\??\c:\pvjfjh.exec:\pvjfjh.exe110⤵PID:1732
-
\??\c:\jjrxfnr.exec:\jjrxfnr.exe111⤵PID:1692
-
\??\c:\nvxvdp.exec:\nvxvdp.exe112⤵PID:1536
-
\??\c:\rjxjdbf.exec:\rjxjdbf.exe113⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\fbrjlx.exec:\fbrjlx.exe114⤵PID:984
-
\??\c:\pfbxlxt.exec:\pfbxlxt.exe115⤵PID:2272
-
\??\c:\vtvxtl.exec:\vtvxtl.exe116⤵PID:2016
-
\??\c:\rblfhvj.exec:\rblfhvj.exe117⤵PID:1028
-
\??\c:\nxrhntf.exec:\nxrhntf.exe118⤵PID:2684
-
\??\c:\fbldjpx.exec:\fbldjpx.exe119⤵PID:2076
-
\??\c:\tttbpb.exec:\tttbpb.exe120⤵PID:2772
-
\??\c:\dlhhh.exec:\dlhhh.exe121⤵PID:2672
-
\??\c:\flpffhd.exec:\flpffhd.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-