Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 05:04
Static task
static1
Behavioral task
behavioral1
Sample
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
Resource
win7-20241010-en
General
-
Target
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
-
Size
82KB
-
MD5
e3a9a82f7c138c77e2b1716a5a6164b3
-
SHA1
c78a2245fb1d97d0cbfd5fdd415fe467e623a900
-
SHA256
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb
-
SHA512
0456800a2a89493e2db62f3d3c6f1f2e13a00af64190f2d12cf17e6cad0d7ff9daf44a507e3aea221cef0dab6fbac6e9d6b70beba9ce8407e6fd1d7a830a6fae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gt9:ymb3NkkiQ3mdBjFo73thgQ/wEkc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2540-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2344 nvrdl.exe 1628 rfdljd.exe 2932 vjftpf.exe 1576 dvxpnh.exe 2848 pfpxrd.exe 2468 jfbfdfl.exe 2100 rftnf.exe 2680 ddbbd.exe 2676 jvvflrx.exe 2952 dtxtbt.exe 1456 rlpjfl.exe 2620 ljllx.exe 2836 rdhnht.exe 948 jpplrdd.exe 1900 xvftr.exe 3000 nrrthfv.exe 1240 hnnfp.exe 2728 lnjpv.exe 1368 nlhldd.exe 1740 txjjhn.exe 1152 jjfrpr.exe 1620 vblvrph.exe 1476 jlnjdp.exe 1720 jdtfft.exe 1488 djndllx.exe 568 lxlxr.exe 3048 vlpjhx.exe 1532 rpnjh.exe 1712 nhdth.exe 1948 nrfdr.exe 2320 dnrxpfp.exe 1628 bxjtx.exe 2560 tbpnnpl.exe 2816 rhdprh.exe 2780 hbbptnt.exe 2880 tvjdld.exe 2864 fldrb.exe 2900 bjdjtn.exe 2468 vvrvr.exe 2656 bhxpxlx.exe 2804 lvhftf.exe 2644 dffhbbt.exe 2132 xvnnnj.exe 2960 tvbvftr.exe 752 pfblt.exe 1416 dhhxd.exe 2940 xfjlrp.exe 1728 jjbvbjj.exe 1652 jtbhbfj.exe 1168 bnxxrd.exe 2840 ddllbvb.exe 2212 htdvn.exe 1056 tltddb.exe 1240 frjftj.exe 1944 njtpj.exe 436 rbjpft.exe 2004 vhnfv.exe 1052 nxdxtp.exe 1152 lnhpvr.exe 1620 vnxpbl.exe 2608 fnthxn.exe 900 bpbrtj.exe 2600 xphbfbv.exe 1980 hlvhtrj.exe -
resource yara_rule behavioral1/memory/2540-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdjhvnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvbvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhrpllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtdlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htblp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtftxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvnnnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfdxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvjttr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djljr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlldr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlhldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtvvrvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nblbldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdrjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxrhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnvrhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tldrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpbjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthlpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlnpxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npxhpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2344 2540 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2540 wrote to memory of 2344 2540 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2540 wrote to memory of 2344 2540 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2540 wrote to memory of 2344 2540 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2344 wrote to memory of 1628 2344 nvrdl.exe 32 PID 2344 wrote to memory of 1628 2344 nvrdl.exe 32 PID 2344 wrote to memory of 1628 2344 nvrdl.exe 32 PID 2344 wrote to memory of 1628 2344 nvrdl.exe 32 PID 1628 wrote to memory of 2932 1628 rfdljd.exe 33 PID 1628 wrote to memory of 2932 1628 rfdljd.exe 33 PID 1628 wrote to memory of 2932 1628 rfdljd.exe 33 PID 1628 wrote to memory of 2932 1628 rfdljd.exe 33 PID 2932 wrote to memory of 1576 2932 vjftpf.exe 34 PID 2932 wrote to memory of 1576 2932 vjftpf.exe 34 PID 2932 wrote to memory of 1576 2932 vjftpf.exe 34 PID 2932 wrote to memory of 1576 2932 vjftpf.exe 34 PID 1576 wrote to memory of 2848 1576 dvxpnh.exe 35 PID 1576 wrote to memory of 2848 1576 dvxpnh.exe 35 PID 1576 wrote to memory of 2848 1576 dvxpnh.exe 35 PID 1576 wrote to memory of 2848 1576 dvxpnh.exe 35 PID 2848 wrote to memory of 2468 2848 pfpxrd.exe 36 PID 2848 wrote to memory of 2468 2848 pfpxrd.exe 36 PID 2848 wrote to memory of 2468 2848 pfpxrd.exe 36 PID 2848 wrote to memory of 2468 2848 pfpxrd.exe 36 PID 2468 wrote to memory of 2100 2468 jfbfdfl.exe 37 PID 2468 wrote to memory of 2100 2468 jfbfdfl.exe 37 PID 2468 wrote to memory of 2100 2468 jfbfdfl.exe 37 PID 2468 wrote to memory of 2100 2468 jfbfdfl.exe 37 PID 2100 wrote to memory of 2680 2100 rftnf.exe 38 PID 2100 wrote to memory of 2680 2100 rftnf.exe 38 PID 2100 wrote to memory of 2680 2100 rftnf.exe 38 PID 2100 wrote to memory of 2680 2100 rftnf.exe 38 PID 2680 wrote to memory of 2676 2680 ddbbd.exe 39 PID 2680 wrote to memory of 2676 2680 ddbbd.exe 39 PID 2680 wrote to memory of 2676 2680 ddbbd.exe 39 PID 2680 wrote to memory of 2676 2680 ddbbd.exe 39 PID 2676 wrote to memory of 2952 2676 jvvflrx.exe 40 PID 2676 wrote to memory of 2952 2676 jvvflrx.exe 40 PID 2676 wrote to memory of 2952 2676 jvvflrx.exe 40 PID 2676 wrote to memory of 2952 2676 jvvflrx.exe 40 PID 2952 wrote to memory of 1456 2952 dtxtbt.exe 41 PID 2952 wrote to memory of 1456 2952 dtxtbt.exe 41 PID 2952 wrote to memory of 1456 2952 dtxtbt.exe 41 PID 2952 wrote to memory of 1456 2952 dtxtbt.exe 41 PID 1456 wrote to memory of 2620 1456 rlpjfl.exe 42 PID 1456 wrote to memory of 2620 1456 rlpjfl.exe 42 PID 1456 wrote to memory of 2620 1456 rlpjfl.exe 42 PID 1456 wrote to memory of 2620 1456 rlpjfl.exe 42 PID 2620 wrote to memory of 2836 2620 ljllx.exe 43 PID 2620 wrote to memory of 2836 2620 ljllx.exe 43 PID 2620 wrote to memory of 2836 2620 ljllx.exe 43 PID 2620 wrote to memory of 2836 2620 ljllx.exe 43 PID 2836 wrote to memory of 948 2836 rdhnht.exe 44 PID 2836 wrote to memory of 948 2836 rdhnht.exe 44 PID 2836 wrote to memory of 948 2836 rdhnht.exe 44 PID 2836 wrote to memory of 948 2836 rdhnht.exe 44 PID 948 wrote to memory of 1900 948 jpplrdd.exe 45 PID 948 wrote to memory of 1900 948 jpplrdd.exe 45 PID 948 wrote to memory of 1900 948 jpplrdd.exe 45 PID 948 wrote to memory of 1900 948 jpplrdd.exe 45 PID 1900 wrote to memory of 3000 1900 xvftr.exe 46 PID 1900 wrote to memory of 3000 1900 xvftr.exe 46 PID 1900 wrote to memory of 3000 1900 xvftr.exe 46 PID 1900 wrote to memory of 3000 1900 xvftr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nvrdl.exec:\nvrdl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\rfdljd.exec:\rfdljd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vjftpf.exec:\vjftpf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dvxpnh.exec:\dvxpnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\pfpxrd.exec:\pfpxrd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jfbfdfl.exec:\jfbfdfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rftnf.exec:\rftnf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ddbbd.exec:\ddbbd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jvvflrx.exec:\jvvflrx.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dtxtbt.exec:\dtxtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rlpjfl.exec:\rlpjfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\ljllx.exec:\ljllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rdhnht.exec:\rdhnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jpplrdd.exec:\jpplrdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\xvftr.exec:\xvftr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nrrthfv.exec:\nrrthfv.exe17⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hnnfp.exec:\hnnfp.exe18⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lnjpv.exec:\lnjpv.exe19⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nlhldd.exec:\nlhldd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\txjjhn.exec:\txjjhn.exe21⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jjfrpr.exec:\jjfrpr.exe22⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vblvrph.exec:\vblvrph.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jlnjdp.exec:\jlnjdp.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jdtfft.exec:\jdtfft.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\djndllx.exec:\djndllx.exe26⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lxlxr.exec:\lxlxr.exe27⤵
- Executes dropped EXE
PID:568 -
\??\c:\vlpjhx.exec:\vlpjhx.exe28⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rpnjh.exec:\rpnjh.exe29⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nhdth.exec:\nhdth.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nrfdr.exec:\nrfdr.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dnrxpfp.exec:\dnrxpfp.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bxjtx.exec:\bxjtx.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tbpnnpl.exec:\tbpnnpl.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rhdprh.exec:\rhdprh.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbbptnt.exec:\hbbptnt.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tvjdld.exec:\tvjdld.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fldrb.exec:\fldrb.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bjdjtn.exec:\bjdjtn.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2900 -
\??\c:\vvrvr.exec:\vvrvr.exe40⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bhxpxlx.exec:\bhxpxlx.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lvhftf.exec:\lvhftf.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dffhbbt.exec:\dffhbbt.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xvnnnj.exec:\xvnnnj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132 -
\??\c:\tvbvftr.exec:\tvbvftr.exe45⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pfblt.exec:\pfblt.exe46⤵
- Executes dropped EXE
PID:752 -
\??\c:\dhhxd.exec:\dhhxd.exe47⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xfjlrp.exec:\xfjlrp.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jjbvbjj.exec:\jjbvbjj.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jtbhbfj.exec:\jtbhbfj.exe50⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bnxxrd.exec:\bnxxrd.exe51⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ddllbvb.exec:\ddllbvb.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\htdvn.exec:\htdvn.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tltddb.exec:\tltddb.exe54⤵
- Executes dropped EXE
PID:1056 -
\??\c:\frjftj.exec:\frjftj.exe55⤵
- Executes dropped EXE
PID:1240 -
\??\c:\njtpj.exec:\njtpj.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rbjpft.exec:\rbjpft.exe57⤵
- Executes dropped EXE
PID:436 -
\??\c:\vhnfv.exec:\vhnfv.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nxdxtp.exec:\nxdxtp.exe59⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lnhpvr.exec:\lnhpvr.exe60⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vnxpbl.exec:\vnxpbl.exe61⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fnthxn.exec:\fnthxn.exe62⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bpbrtj.exec:\bpbrtj.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\xphbfbv.exec:\xphbfbv.exe64⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hlvhtrj.exec:\hlvhtrj.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frvrndl.exec:\frvrndl.exe66⤵PID:264
-
\??\c:\dnndn.exec:\dnndn.exe67⤵PID:3048
-
\??\c:\jxbpnb.exec:\jxbpnb.exe68⤵PID:1532
-
\??\c:\tdrfl.exec:\tdrfl.exe69⤵PID:1936
-
\??\c:\jjbrnhp.exec:\jjbrnhp.exe70⤵PID:2216
-
\??\c:\flptlf.exec:\flptlf.exe71⤵PID:2052
-
\??\c:\brdrjht.exec:\brdrjht.exe72⤵PID:1636
-
\??\c:\jdxrn.exec:\jdxrn.exe73⤵PID:1604
-
\??\c:\pvtbhn.exec:\pvtbhn.exe74⤵PID:2036
-
\??\c:\trbtjrd.exec:\trbtjrd.exe75⤵PID:2932
-
\??\c:\ppnpr.exec:\ppnpr.exe76⤵PID:2860
-
\??\c:\vdplv.exec:\vdplv.exe77⤵PID:2736
-
\??\c:\rdxjhbt.exec:\rdxjhbt.exe78⤵PID:2228
-
\??\c:\rtvrrt.exec:\rtvrrt.exe79⤵PID:2848
-
\??\c:\tvjttn.exec:\tvjttn.exe80⤵PID:2828
-
\??\c:\rntlnj.exec:\rntlnj.exe81⤵PID:2720
-
\??\c:\rltdhpn.exec:\rltdhpn.exe82⤵PID:2800
-
\??\c:\jhtdv.exec:\jhtdv.exe83⤵PID:2704
-
\??\c:\trxtnb.exec:\trxtnb.exe84⤵PID:2652
-
\??\c:\hjjdx.exec:\hjjdx.exe85⤵PID:1196
-
\??\c:\xvbrrf.exec:\xvbrrf.exe86⤵PID:2956
-
\??\c:\nhfbbb.exec:\nhfbbb.exe87⤵PID:1456
-
\??\c:\fdfhbb.exec:\fdfhbb.exe88⤵PID:2096
-
\??\c:\vlhdxbl.exec:\vlhdxbl.exe89⤵PID:2988
-
\??\c:\phfxtb.exec:\phfxtb.exe90⤵PID:1880
-
\??\c:\lfttdrl.exec:\lfttdrl.exe91⤵PID:2428
-
\??\c:\hldjlv.exec:\hldjlv.exe92⤵PID:2916
-
\??\c:\xlldft.exec:\xlldft.exe93⤵PID:3000
-
\??\c:\nvnjhrl.exec:\nvnjhrl.exe94⤵PID:2160
-
\??\c:\rdjhvnv.exec:\rdjhvnv.exe95⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\hjvjd.exec:\hjvjd.exe96⤵PID:2408
-
\??\c:\nvbpvnh.exec:\nvbpvnh.exe97⤵PID:1736
-
\??\c:\dtntb.exec:\dtntb.exe98⤵PID:916
-
\??\c:\vhhttp.exec:\vhhttp.exe99⤵PID:972
-
\??\c:\nbpbh.exec:\nbpbh.exe100⤵PID:2460
-
\??\c:\rvfhp.exec:\rvfhp.exe101⤵PID:1460
-
\??\c:\xlrbph.exec:\xlrbph.exe102⤵PID:2404
-
\??\c:\tvdptv.exec:\tvdptv.exe103⤵PID:1536
-
\??\c:\rndjtrl.exec:\rndjtrl.exe104⤵PID:3068
-
\??\c:\ptpdlf.exec:\ptpdlf.exe105⤵PID:1648
-
\??\c:\fhnhhbd.exec:\fhnhhbd.exe106⤵PID:1372
-
\??\c:\xxllnt.exec:\xxllnt.exe107⤵PID:376
-
\??\c:\fbpnjj.exec:\fbpnjj.exe108⤵PID:2364
-
\??\c:\lvrlb.exec:\lvrlb.exe109⤵PID:2284
-
\??\c:\vhfdr.exec:\vhfdr.exe110⤵PID:2352
-
\??\c:\brlrnrv.exec:\brlrnrv.exe111⤵PID:2548
-
\??\c:\rxtptvl.exec:\rxtptvl.exe112⤵PID:1976
-
\??\c:\dlxvpp.exec:\dlxvpp.exe113⤵PID:1080
-
\??\c:\hvxvxb.exec:\hvxvxb.exe114⤵
- System Location Discovery: System Language Discovery
PID:1724 -
\??\c:\xjhndtp.exec:\xjhndtp.exe115⤵PID:2932
-
\??\c:\lprdrd.exec:\lprdrd.exe116⤵PID:2724
-
\??\c:\ttvjb.exec:\ttvjb.exe117⤵PID:2736
-
\??\c:\bldnxnn.exec:\bldnxnn.exe118⤵PID:2908
-
\??\c:\vjvnfp.exec:\vjvnfp.exe119⤵PID:2892
-
\??\c:\jttbbb.exec:\jttbbb.exe120⤵PID:2232
-
\??\c:\fhvxv.exec:\fhvxv.exe121⤵PID:2812
-
\??\c:\txttt.exec:\txttt.exe122⤵PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-