Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
120 seconds
General
-
Target
516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe
-
Size
58KB
-
MD5
dd01583e8701237968b242da40fa7e20
-
SHA1
9a1369384ab5b6a05fed66dcef30e5822a8edd1c
-
SHA256
516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4
-
SHA512
3f4fe6d53e61c7fc330c23b3d95db49e80323d72e049ed15f082433eee905269fd4475058aa2bace18303932280dd4782b23cc908add30bb7ba41bac2c5cc849
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI/RtoNt:ymb3NkkiQ3mdBjFI/kL
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2412-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 djfthf.exe 844 pldxb.exe 2800 prthf.exe 2952 hnpjpn.exe 2824 vbjnnj.exe 2936 fppbhl.exe 2804 rllfnbp.exe 2752 fjtlt.exe 2176 ltbpddh.exe 1032 rpfbfr.exe 1732 dnvnftj.exe 2740 jhnbtdd.exe 1208 rbjdn.exe 1272 fnlnb.exe 1816 nfldr.exe 1908 rbfdnv.exe 2208 tjjbdt.exe 2164 jhtftl.exe 2128 bnbrhp.exe 2788 vbpbbr.exe 2336 ldvptn.exe 2240 hprtnhd.exe 1948 bvnxx.exe 1536 dfvbjhb.exe 1096 dxvhbd.exe 2932 xhlntn.exe 2196 tpbvppf.exe 1512 fhxrr.exe 2460 ntxntf.exe 472 lnjvtp.exe 2344 ttnfjtn.exe 2116 xtvlnp.exe 1608 bxxpd.exe 2172 fhphjn.exe 2424 fftfbl.exe 2800 fhtvb.exe 2840 thxhvv.exe 2952 hrpxb.exe 3056 ddpbdlv.exe 2928 jvdxd.exe 2712 rxvlhf.exe 2768 vnhnnfv.exe 2024 hllhtv.exe 2672 jlvxl.exe 2056 bprvvp.exe 2588 hjjjdnt.exe 2604 xjhrnx.exe 2940 fxbxf.exe 2676 fhnrfhj.exe 3052 vxppp.exe 2308 hvjdxvx.exe 1640 fxhjr.exe 1988 jbpjr.exe 2448 bbhlt.exe 2540 drrtj.exe 2252 vjjblx.exe 592 vjdvvj.exe 2128 trprtlt.exe 2420 ffxfjv.exe 2212 btfxh.exe 2200 hhnbfhf.exe 1548 bxbvt.exe 1688 ptflnfh.exe 2616 fptpfnp.exe -
resource yara_rule behavioral1/memory/2412-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlbjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvvrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjvpjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlbvlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrpfvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtthffb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djlbjxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rltbrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtrlfbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvxdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hplfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvtbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjxjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pldhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddxhxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dflfvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2548 2412 516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe 29 PID 2412 wrote to memory of 2548 2412 516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe 29 PID 2412 wrote to memory of 2548 2412 516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe 29 PID 2412 wrote to memory of 2548 2412 516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe 29 PID 2548 wrote to memory of 844 2548 djfthf.exe 30 PID 2548 wrote to memory of 844 2548 djfthf.exe 30 PID 2548 wrote to memory of 844 2548 djfthf.exe 30 PID 2548 wrote to memory of 844 2548 djfthf.exe 30 PID 844 wrote to memory of 2800 844 pldxb.exe 31 PID 844 wrote to memory of 2800 844 pldxb.exe 31 PID 844 wrote to memory of 2800 844 pldxb.exe 31 PID 844 wrote to memory of 2800 844 pldxb.exe 31 PID 2800 wrote to memory of 2952 2800 prthf.exe 32 PID 2800 wrote to memory of 2952 2800 prthf.exe 32 PID 2800 wrote to memory of 2952 2800 prthf.exe 32 PID 2800 wrote to memory of 2952 2800 prthf.exe 32 PID 2952 wrote to memory of 2824 2952 hnpjpn.exe 33 PID 2952 wrote to memory of 2824 2952 hnpjpn.exe 33 PID 2952 wrote to memory of 2824 2952 hnpjpn.exe 33 PID 2952 wrote to memory of 2824 2952 hnpjpn.exe 33 PID 2824 wrote to memory of 2936 2824 vbjnnj.exe 34 PID 2824 wrote to memory of 2936 2824 vbjnnj.exe 34 PID 2824 wrote to memory of 2936 2824 vbjnnj.exe 34 PID 2824 wrote to memory of 2936 2824 vbjnnj.exe 34 PID 2936 wrote to memory of 2804 2936 fppbhl.exe 35 PID 2936 wrote to memory of 2804 2936 fppbhl.exe 35 PID 2936 wrote to memory of 2804 2936 fppbhl.exe 35 PID 2936 wrote to memory of 2804 2936 fppbhl.exe 35 PID 2804 wrote to memory of 2752 2804 rllfnbp.exe 36 PID 2804 wrote to memory of 2752 2804 rllfnbp.exe 36 PID 2804 wrote to memory of 2752 2804 rllfnbp.exe 36 PID 2804 wrote to memory of 2752 2804 rllfnbp.exe 36 PID 2752 wrote to memory of 2176 2752 fjtlt.exe 37 PID 2752 wrote to memory of 2176 2752 fjtlt.exe 37 PID 2752 wrote to memory of 2176 2752 fjtlt.exe 37 PID 2752 wrote to memory of 2176 2752 fjtlt.exe 37 PID 2176 wrote to memory of 1032 2176 ltbpddh.exe 38 PID 2176 wrote to memory of 1032 2176 ltbpddh.exe 38 PID 2176 wrote to memory of 1032 2176 ltbpddh.exe 38 PID 2176 wrote to memory of 1032 2176 ltbpddh.exe 38 PID 1032 wrote to memory of 1732 1032 rpfbfr.exe 39 PID 1032 wrote to memory of 1732 1032 rpfbfr.exe 39 PID 1032 wrote to memory of 1732 1032 rpfbfr.exe 39 PID 1032 wrote to memory of 1732 1032 rpfbfr.exe 39 PID 1732 wrote to memory of 2740 1732 dnvnftj.exe 40 PID 1732 wrote to memory of 2740 1732 dnvnftj.exe 40 PID 1732 wrote to memory of 2740 1732 dnvnftj.exe 40 PID 1732 wrote to memory of 2740 1732 dnvnftj.exe 40 PID 2740 wrote to memory of 1208 2740 jhnbtdd.exe 41 PID 2740 wrote to memory of 1208 2740 jhnbtdd.exe 41 PID 2740 wrote to memory of 1208 2740 jhnbtdd.exe 41 PID 2740 wrote to memory of 1208 2740 jhnbtdd.exe 41 PID 1208 wrote to memory of 1272 1208 rbjdn.exe 42 PID 1208 wrote to memory of 1272 1208 rbjdn.exe 42 PID 1208 wrote to memory of 1272 1208 rbjdn.exe 42 PID 1208 wrote to memory of 1272 1208 rbjdn.exe 42 PID 1272 wrote to memory of 1816 1272 fnlnb.exe 43 PID 1272 wrote to memory of 1816 1272 fnlnb.exe 43 PID 1272 wrote to memory of 1816 1272 fnlnb.exe 43 PID 1272 wrote to memory of 1816 1272 fnlnb.exe 43 PID 1816 wrote to memory of 1908 1816 nfldr.exe 44 PID 1816 wrote to memory of 1908 1816 nfldr.exe 44 PID 1816 wrote to memory of 1908 1816 nfldr.exe 44 PID 1816 wrote to memory of 1908 1816 nfldr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe"C:\Users\Admin\AppData\Local\Temp\516def81d406f910cd2c2227cb04d529f6fc3de5442c0ecc70820f250e0c7db4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\djfthf.exec:\djfthf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\pldxb.exec:\pldxb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\prthf.exec:\prthf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hnpjpn.exec:\hnpjpn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\vbjnnj.exec:\vbjnnj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\fppbhl.exec:\fppbhl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\rllfnbp.exec:\rllfnbp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\fjtlt.exec:\fjtlt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ltbpddh.exec:\ltbpddh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\rpfbfr.exec:\rpfbfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\dnvnftj.exec:\dnvnftj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jhnbtdd.exec:\jhnbtdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rbjdn.exec:\rbjdn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\fnlnb.exec:\fnlnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\nfldr.exec:\nfldr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\rbfdnv.exec:\rbfdnv.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\tjjbdt.exec:\tjjbdt.exe18⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jhtftl.exec:\jhtftl.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bnbrhp.exec:\bnbrhp.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vbpbbr.exec:\vbpbbr.exe21⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ldvptn.exec:\ldvptn.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hprtnhd.exec:\hprtnhd.exe23⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bvnxx.exec:\bvnxx.exe24⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dfvbjhb.exec:\dfvbjhb.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dxvhbd.exec:\dxvhbd.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xhlntn.exec:\xhlntn.exe27⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tpbvppf.exec:\tpbvppf.exe28⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fhxrr.exec:\fhxrr.exe29⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ntxntf.exec:\ntxntf.exe30⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lnjvtp.exec:\lnjvtp.exe31⤵
- Executes dropped EXE
PID:472 -
\??\c:\ttnfjtn.exec:\ttnfjtn.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xtvlnp.exec:\xtvlnp.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bxxpd.exec:\bxxpd.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fhphjn.exec:\fhphjn.exe35⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fftfbl.exec:\fftfbl.exe36⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fhtvb.exec:\fhtvb.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\thxhvv.exec:\thxhvv.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hrpxb.exec:\hrpxb.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ddpbdlv.exec:\ddpbdlv.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvdxd.exec:\jvdxd.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rxvlhf.exec:\rxvlhf.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vnhnnfv.exec:\vnhnnfv.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hllhtv.exec:\hllhtv.exe44⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jlvxl.exec:\jlvxl.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bprvvp.exec:\bprvvp.exe46⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hjjjdnt.exec:\hjjjdnt.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xjhrnx.exec:\xjhrnx.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\fxbxf.exec:\fxbxf.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fhnrfhj.exec:\fhnrfhj.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vxppp.exec:\vxppp.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hvjdxvx.exec:\hvjdxvx.exe52⤵
- Executes dropped EXE
PID:2308 -
\??\c:\fxhjr.exec:\fxhjr.exe53⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jbpjr.exec:\jbpjr.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbhlt.exec:\bbhlt.exe55⤵
- Executes dropped EXE
PID:2448 -
\??\c:\drrtj.exec:\drrtj.exe56⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjjblx.exec:\vjjblx.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vjdvvj.exec:\vjdvvj.exe58⤵
- Executes dropped EXE
PID:592 -
\??\c:\trprtlt.exec:\trprtlt.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ffxfjv.exec:\ffxfjv.exe60⤵
- Executes dropped EXE
PID:2420 -
\??\c:\btfxh.exec:\btfxh.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hhnbfhf.exec:\hhnbfhf.exe62⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bxbvt.exec:\bxbvt.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\ptflnfh.exec:\ptflnfh.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fptpfnp.exec:\fptpfnp.exe65⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vjvvtrl.exec:\vjvvtrl.exe66⤵PID:2044
-
\??\c:\hrvvdrl.exec:\hrvvdrl.exe67⤵PID:2644
-
\??\c:\tbjtb.exec:\tbjtb.exe68⤵PID:576
-
\??\c:\ptllb.exec:\ptllb.exe69⤵PID:2384
-
\??\c:\nvffdb.exec:\nvffdb.exe70⤵PID:1420
-
\??\c:\fddvxpj.exec:\fddvxpj.exe71⤵PID:2612
-
\??\c:\xrxjn.exec:\xrxjn.exe72⤵PID:1280
-
\??\c:\vrpbrf.exec:\vrpbrf.exe73⤵PID:2008
-
\??\c:\hltbtx.exec:\hltbtx.exe74⤵PID:2548
-
\??\c:\fdvhtd.exec:\fdvhtd.exe75⤵PID:1604
-
\??\c:\djddr.exec:\djddr.exe76⤵PID:2980
-
\??\c:\bvftt.exec:\bvftt.exe77⤵PID:2512
-
\??\c:\rhljtdd.exec:\rhljtdd.exe78⤵PID:2900
-
\??\c:\jbtxxl.exec:\jbtxxl.exe79⤵PID:2228
-
\??\c:\jflxv.exec:\jflxv.exe80⤵PID:2876
-
\??\c:\fxhlfx.exec:\fxhlfx.exe81⤵PID:2224
-
\??\c:\tfvrflx.exec:\tfvrflx.exe82⤵PID:2864
-
\??\c:\xjnbdxp.exec:\xjnbdxp.exe83⤵PID:2684
-
\??\c:\dllfln.exec:\dllfln.exe84⤵PID:2920
-
\??\c:\nthlrvv.exec:\nthlrvv.exe85⤵PID:1656
-
\??\c:\jhlbfx.exec:\jhlbfx.exe86⤵PID:2744
-
\??\c:\bjxbh.exec:\bjxbh.exe87⤵PID:2176
-
\??\c:\jlvhfpp.exec:\jlvhfpp.exe88⤵PID:1032
-
\??\c:\prhbfj.exec:\prhbfj.exe89⤵PID:2552
-
\??\c:\vdbxnr.exec:\vdbxnr.exe90⤵PID:980
-
\??\c:\bbbjxv.exec:\bbbjxv.exe91⤵PID:2984
-
\??\c:\fhxvpd.exec:\fhxvpd.exe92⤵PID:1628
-
\??\c:\lvtbrd.exec:\lvtbrd.exe93⤵PID:1612
-
\??\c:\dvxvrhn.exec:\dvxvrhn.exe94⤵PID:544
-
\??\c:\htlvxnt.exec:\htlvxnt.exe95⤵PID:584
-
\??\c:\nbxfbxx.exec:\nbxfbxx.exe96⤵PID:2248
-
\??\c:\hnldj.exec:\hnldj.exe97⤵PID:2276
-
\??\c:\bvfhbb.exec:\bvfhbb.exe98⤵PID:2136
-
\??\c:\bvhhxf.exec:\bvhhxf.exe99⤵PID:2060
-
\??\c:\tdlfdj.exec:\tdlfdj.exe100⤵PID:840
-
\??\c:\hlhrl.exec:\hlhrl.exe101⤵PID:1128
-
\??\c:\bjjdjx.exec:\bjjdjx.exe102⤵PID:2272
-
\??\c:\vtdtvn.exec:\vtdtvn.exe103⤵PID:964
-
\??\c:\fdrdj.exec:\fdrdj.exe104⤵PID:1968
-
\??\c:\vtxpp.exec:\vtxpp.exe105⤵PID:308
-
\??\c:\hfdrfvl.exec:\hfdrfvl.exe106⤵PID:1416
-
\??\c:\phnntp.exec:\phnntp.exe107⤵PID:2476
-
\??\c:\xnlvnhp.exec:\xnlvnhp.exe108⤵PID:1528
-
\??\c:\hjnvf.exec:\hjnvf.exe109⤵PID:2196
-
\??\c:\hjfxxbd.exec:\hjfxxbd.exe110⤵PID:1484
-
\??\c:\bxtvt.exec:\bxtvt.exe111⤵PID:1960
-
\??\c:\pljldd.exec:\pljldd.exe112⤵PID:2352
-
\??\c:\rdnnnx.exec:\rdnnnx.exe113⤵PID:1176
-
\??\c:\jfttf.exec:\jfttf.exe114⤵PID:2656
-
\??\c:\rffthjx.exec:\rffthjx.exe115⤵PID:1568
-
\??\c:\fntjxtv.exec:\fntjxtv.exe116⤵PID:2528
-
\??\c:\hjftp.exec:\hjftp.exe117⤵PID:844
-
\??\c:\trdtpl.exec:\trdtpl.exe118⤵PID:2904
-
\??\c:\nvfntrb.exec:\nvfntrb.exe119⤵PID:2148
-
\??\c:\fptjn.exec:\fptjn.exe120⤵PID:2968
-
\??\c:\lbbtdd.exec:\lbbtdd.exe121⤵PID:2956
-
\??\c:\xntlr.exec:\xntlr.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-