Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe
Resource
win7-20241010-en
General
-
Target
7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe
-
Size
73KB
-
MD5
eac0a43da39bac5b07ea98d3c514ae80
-
SHA1
a3b85566483e8ca0453f6377ce88cc89301ec996
-
SHA256
7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83a
-
SHA512
ec08c0bececa132bb86897758b3d1ffa2b28402e3c4329b4c7792bd96fb9f97630a6b8bdd4b17dcbe15dbd75c2ed5d24498d4d67363cc24423864c6468906a03
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5RxfVK5DTXA:ymb3NkkiQ3mdBjF0yUmrfVcPA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1064-12-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-45-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/432-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/432-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/388-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2444 jpvldtx.exe 2816 xvjlftr.exe 2180 hnphdt.exe 2848 tjhhvrd.exe 2764 nfjxfn.exe 2604 bxltx.exe 3060 dpllhlf.exe 432 pbddjrv.exe 1116 bdfrlxh.exe 2904 pvvhnpb.exe 1992 fphlhjt.exe 1252 vlvhl.exe 3036 dlttlpt.exe 2304 bdfhrr.exe 548 xhfdx.exe 2432 pvbrbx.exe 1384 lnprnfj.exe 2292 jlpdf.exe 2092 dpdxhr.exe 388 fddvxt.exe 1600 fhpxr.exe 1852 hnxhj.exe 1700 tlvlx.exe 1920 pdljn.exe 1508 nrnfp.exe 1372 fbddxlb.exe 2064 pddxb.exe 2872 jrdrxf.exe 2060 jnlfpf.exe 2500 xhjpdlt.exe 1900 hpnxfp.exe 2448 rrvrht.exe 2748 hddlt.exe 2804 jrvxfvn.exe 2816 vjfbx.exe 2708 npltpx.exe 2616 jxdfxl.exe 1756 bhppfvd.exe 2636 lflhld.exe 2588 llhlxf.exe 2664 hddnll.exe 2412 nnhltjl.exe 2572 hxxlb.exe 2924 pppjdhx.exe 1028 hrbrpfh.exe 2900 nflpff.exe 1728 jtrnpnf.exe 1156 tlxdp.exe 648 bvhfjnh.exe 2320 pfdldhx.exe 320 tfnfr.exe 472 jxhpnbp.exe 2336 nhhvxj.exe 548 tntpl.exe 2472 dhptptt.exe 1412 tptjtx.exe 2328 fnnldd.exe 2424 vpprh.exe 2016 pddvtfp.exe 388 jhpvxtn.exe 2028 rbdlhb.exe 780 phjfvv.exe 2076 pxvtbbn.exe 1716 rnfhbft.exe -
resource yara_rule behavioral1/memory/1064-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/432-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/432-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/432-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/432-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/388-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvtfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptfbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxpjvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtxxhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjhdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drdtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxvtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpbbttd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvhnpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpbnrnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvtpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtxxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdljn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtjfljr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvxjftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhhjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxhbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvvxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnxrnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhjxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2444 1064 7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe 30 PID 1064 wrote to memory of 2444 1064 7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe 30 PID 1064 wrote to memory of 2444 1064 7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe 30 PID 1064 wrote to memory of 2444 1064 7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe 30 PID 2444 wrote to memory of 2816 2444 jpvldtx.exe 31 PID 2444 wrote to memory of 2816 2444 jpvldtx.exe 31 PID 2444 wrote to memory of 2816 2444 jpvldtx.exe 31 PID 2444 wrote to memory of 2816 2444 jpvldtx.exe 31 PID 2816 wrote to memory of 2180 2816 xvjlftr.exe 32 PID 2816 wrote to memory of 2180 2816 xvjlftr.exe 32 PID 2816 wrote to memory of 2180 2816 xvjlftr.exe 32 PID 2816 wrote to memory of 2180 2816 xvjlftr.exe 32 PID 2180 wrote to memory of 2848 2180 hnphdt.exe 33 PID 2180 wrote to memory of 2848 2180 hnphdt.exe 33 PID 2180 wrote to memory of 2848 2180 hnphdt.exe 33 PID 2180 wrote to memory of 2848 2180 hnphdt.exe 33 PID 2848 wrote to memory of 2764 2848 tjhhvrd.exe 34 PID 2848 wrote to memory of 2764 2848 tjhhvrd.exe 34 PID 2848 wrote to memory of 2764 2848 tjhhvrd.exe 34 PID 2848 wrote to memory of 2764 2848 tjhhvrd.exe 34 PID 2764 wrote to memory of 2604 2764 nfjxfn.exe 35 PID 2764 wrote to memory of 2604 2764 nfjxfn.exe 35 PID 2764 wrote to memory of 2604 2764 nfjxfn.exe 35 PID 2764 wrote to memory of 2604 2764 nfjxfn.exe 35 PID 2604 wrote to memory of 3060 2604 bxltx.exe 36 PID 2604 wrote to memory of 3060 2604 bxltx.exe 36 PID 2604 wrote to memory of 3060 2604 bxltx.exe 36 PID 2604 wrote to memory of 3060 2604 bxltx.exe 36 PID 3060 wrote to memory of 432 3060 dpllhlf.exe 37 PID 3060 wrote to memory of 432 3060 dpllhlf.exe 37 PID 3060 wrote to memory of 432 3060 dpllhlf.exe 37 PID 3060 wrote to memory of 432 3060 dpllhlf.exe 37 PID 432 wrote to memory of 1116 432 pbddjrv.exe 38 PID 432 wrote to memory of 1116 432 pbddjrv.exe 38 PID 432 wrote to memory of 1116 432 pbddjrv.exe 38 PID 432 wrote to memory of 1116 432 pbddjrv.exe 38 PID 1116 wrote to memory of 2904 1116 bdfrlxh.exe 39 PID 1116 wrote to memory of 2904 1116 bdfrlxh.exe 39 PID 1116 wrote to memory of 2904 1116 bdfrlxh.exe 39 PID 1116 wrote to memory of 2904 1116 bdfrlxh.exe 39 PID 2904 wrote to memory of 1992 2904 pvvhnpb.exe 40 PID 2904 wrote to memory of 1992 2904 pvvhnpb.exe 40 PID 2904 wrote to memory of 1992 2904 pvvhnpb.exe 40 PID 2904 wrote to memory of 1992 2904 pvvhnpb.exe 40 PID 1992 wrote to memory of 1252 1992 fphlhjt.exe 41 PID 1992 wrote to memory of 1252 1992 fphlhjt.exe 41 PID 1992 wrote to memory of 1252 1992 fphlhjt.exe 41 PID 1992 wrote to memory of 1252 1992 fphlhjt.exe 41 PID 1252 wrote to memory of 3036 1252 vlvhl.exe 42 PID 1252 wrote to memory of 3036 1252 vlvhl.exe 42 PID 1252 wrote to memory of 3036 1252 vlvhl.exe 42 PID 1252 wrote to memory of 3036 1252 vlvhl.exe 42 PID 3036 wrote to memory of 2304 3036 dlttlpt.exe 43 PID 3036 wrote to memory of 2304 3036 dlttlpt.exe 43 PID 3036 wrote to memory of 2304 3036 dlttlpt.exe 43 PID 3036 wrote to memory of 2304 3036 dlttlpt.exe 43 PID 2304 wrote to memory of 548 2304 bdfhrr.exe 44 PID 2304 wrote to memory of 548 2304 bdfhrr.exe 44 PID 2304 wrote to memory of 548 2304 bdfhrr.exe 44 PID 2304 wrote to memory of 548 2304 bdfhrr.exe 44 PID 548 wrote to memory of 2432 548 xhfdx.exe 45 PID 548 wrote to memory of 2432 548 xhfdx.exe 45 PID 548 wrote to memory of 2432 548 xhfdx.exe 45 PID 548 wrote to memory of 2432 548 xhfdx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe"C:\Users\Admin\AppData\Local\Temp\7d7cb1c627c80ab356083e9d22120b49d89ddf06f270d3110eee9c224b27e83aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\jpvldtx.exec:\jpvldtx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xvjlftr.exec:\xvjlftr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hnphdt.exec:\hnphdt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\tjhhvrd.exec:\tjhhvrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nfjxfn.exec:\nfjxfn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bxltx.exec:\bxltx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dpllhlf.exec:\dpllhlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pbddjrv.exec:\pbddjrv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\bdfrlxh.exec:\bdfrlxh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\pvvhnpb.exec:\pvvhnpb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fphlhjt.exec:\fphlhjt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\vlvhl.exec:\vlvhl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\dlttlpt.exec:\dlttlpt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bdfhrr.exec:\bdfhrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xhfdx.exec:\xhfdx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\pvbrbx.exec:\pvbrbx.exe17⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lnprnfj.exec:\lnprnfj.exe18⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jlpdf.exec:\jlpdf.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dpdxhr.exec:\dpdxhr.exe20⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fddvxt.exec:\fddvxt.exe21⤵
- Executes dropped EXE
PID:388 -
\??\c:\fhpxr.exec:\fhpxr.exe22⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hnxhj.exec:\hnxhj.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tlvlx.exec:\tlvlx.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pdljn.exec:\pdljn.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\nrnfp.exec:\nrnfp.exe26⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fbddxlb.exec:\fbddxlb.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pddxb.exec:\pddxb.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jrdrxf.exec:\jrdrxf.exe29⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jnlfpf.exec:\jnlfpf.exe30⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xhjpdlt.exec:\xhjpdlt.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hpnxfp.exec:\hpnxfp.exe32⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rrvrht.exec:\rrvrht.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hddlt.exec:\hddlt.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jrvxfvn.exec:\jrvxfvn.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vjfbx.exec:\vjfbx.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\npltpx.exec:\npltpx.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jxdfxl.exec:\jxdfxl.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bhppfvd.exec:\bhppfvd.exe39⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lflhld.exec:\lflhld.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\llhlxf.exec:\llhlxf.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hddnll.exec:\hddnll.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nnhltjl.exec:\nnhltjl.exe43⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hxxlb.exec:\hxxlb.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pppjdhx.exec:\pppjdhx.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hrbrpfh.exec:\hrbrpfh.exe46⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nflpff.exec:\nflpff.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jtrnpnf.exec:\jtrnpnf.exe48⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tlxdp.exec:\tlxdp.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bvhfjnh.exec:\bvhfjnh.exe50⤵
- Executes dropped EXE
PID:648 -
\??\c:\pfdldhx.exec:\pfdldhx.exe51⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tfnfr.exec:\tfnfr.exe52⤵
- Executes dropped EXE
PID:320 -
\??\c:\jxhpnbp.exec:\jxhpnbp.exe53⤵
- Executes dropped EXE
PID:472 -
\??\c:\nhhvxj.exec:\nhhvxj.exe54⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tntpl.exec:\tntpl.exe55⤵
- Executes dropped EXE
PID:548 -
\??\c:\dhptptt.exec:\dhptptt.exe56⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tptjtx.exec:\tptjtx.exe57⤵
- Executes dropped EXE
PID:1412 -
\??\c:\fnnldd.exec:\fnnldd.exe58⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vpprh.exec:\vpprh.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pddvtfp.exec:\pddvtfp.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\jhpvxtn.exec:\jhpvxtn.exe61⤵
- Executes dropped EXE
PID:388 -
\??\c:\rbdlhb.exec:\rbdlhb.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\phjfvv.exec:\phjfvv.exe63⤵
- Executes dropped EXE
PID:780 -
\??\c:\pxvtbbn.exec:\pxvtbbn.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\rnfhbft.exec:\rnfhbft.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jxhnhdr.exec:\jxhnhdr.exe66⤵PID:536
-
\??\c:\nxfnp.exec:\nxfnp.exe67⤵PID:1964
-
\??\c:\rbhpth.exec:\rbhpth.exe68⤵PID:2080
-
\??\c:\nvfjdfl.exec:\nvfjdfl.exe69⤵PID:2984
-
\??\c:\lxftb.exec:\lxftb.exe70⤵PID:1676
-
\??\c:\hnbnx.exec:\hnbnx.exe71⤵PID:1188
-
\??\c:\pttlhx.exec:\pttlhx.exe72⤵PID:1696
-
\??\c:\vrvjbbl.exec:\vrvjbbl.exe73⤵PID:892
-
\??\c:\bljvtdv.exec:\bljvtdv.exe74⤵PID:2248
-
\??\c:\ndfxbtv.exec:\ndfxbtv.exe75⤵PID:2700
-
\??\c:\jfxxdv.exec:\jfxxdv.exe76⤵PID:2740
-
\??\c:\nbjhxrr.exec:\nbjhxrr.exe77⤵PID:2744
-
\??\c:\tpvbrp.exec:\tpvbrp.exe78⤵PID:2724
-
\??\c:\tlpdbxf.exec:\tlpdbxf.exe79⤵PID:2628
-
\??\c:\fpdffh.exec:\fpdffh.exe80⤵PID:2792
-
\??\c:\xhhnjpl.exec:\xhhnjpl.exe81⤵PID:2692
-
\??\c:\ftjlnb.exec:\ftjlnb.exe82⤵PID:2704
-
\??\c:\vjnrbb.exec:\vjnrbb.exe83⤵PID:2764
-
\??\c:\fhdbfl.exec:\fhdbfl.exe84⤵PID:1104
-
\??\c:\jtjbbnl.exec:\jtjbbnl.exe85⤵PID:2576
-
\??\c:\bjdljn.exec:\bjdljn.exe86⤵PID:580
-
\??\c:\dxxhv.exec:\dxxhv.exe87⤵
- System Location Discovery: System Language Discovery
PID:1296 -
\??\c:\nfdtt.exec:\nfdtt.exe88⤵PID:2652
-
\??\c:\bfbpjl.exec:\bfbpjl.exe89⤵PID:552
-
\??\c:\rnfjfd.exec:\rnfjfd.exe90⤵PID:2904
-
\??\c:\vbrbf.exec:\vbrbf.exe91⤵PID:2680
-
\??\c:\blhtl.exec:\blhtl.exe92⤵PID:1768
-
\??\c:\dfndl.exec:\dfndl.exe93⤵PID:1252
-
\??\c:\hfjtfjf.exec:\hfjtfjf.exe94⤵PID:800
-
\??\c:\fdfvr.exec:\fdfvr.exe95⤵PID:2304
-
\??\c:\nbtlxvp.exec:\nbtlxvp.exe96⤵PID:2088
-
\??\c:\hjfvfn.exec:\hjfvfn.exe97⤵PID:2116
-
\??\c:\fnvrndv.exec:\fnvrndv.exe98⤵PID:2152
-
\??\c:\jnrptlx.exec:\jnrptlx.exe99⤵PID:2356
-
\??\c:\nrxjd.exec:\nrxjd.exe100⤵PID:1808
-
\??\c:\lrldbhl.exec:\lrldbhl.exe101⤵PID:3020
-
\??\c:\lxpxdh.exec:\lxpxdh.exe102⤵PID:980
-
\??\c:\bhpfjl.exec:\bhpfjl.exe103⤵PID:1136
-
\??\c:\fbvnp.exec:\fbvnp.exe104⤵PID:2156
-
\??\c:\rdfldl.exec:\rdfldl.exe105⤵PID:1828
-
\??\c:\nldfp.exec:\nldfp.exe106⤵PID:1700
-
\??\c:\vfptv.exec:\vfptv.exe107⤵PID:1528
-
\??\c:\tdlbth.exec:\tdlbth.exe108⤵PID:1848
-
\??\c:\frjrnjp.exec:\frjrnjp.exe109⤵PID:1404
-
\??\c:\flfdtbf.exec:\flfdtbf.exe110⤵PID:2364
-
\??\c:\vrhxpdr.exec:\vrhxpdr.exe111⤵PID:848
-
\??\c:\lbhdxr.exec:\lbhdxr.exe112⤵PID:2672
-
\??\c:\lnrddt.exec:\lnrddt.exe113⤵PID:2060
-
\??\c:\lxxndll.exec:\lxxndll.exe114⤵PID:1160
-
\??\c:\vlhjjn.exec:\vlhjjn.exe115⤵PID:2376
-
\??\c:\dvlxtb.exec:\dvlxtb.exe116⤵PID:844
-
\??\c:\xjdjdd.exec:\xjdjdd.exe117⤵PID:1236
-
\??\c:\djfvr.exec:\djfvr.exe118⤵PID:2200
-
\??\c:\xfrnvrn.exec:\xfrnvrn.exe119⤵PID:2732
-
\??\c:\bxpprhv.exec:\bxpprhv.exe120⤵PID:2716
-
\??\c:\ltxhhp.exec:\ltxhhp.exe121⤵PID:2708
-
\??\c:\vhbft.exec:\vhbft.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-