Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe
Resource
win7-20241010-en
General
-
Target
488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe
-
Size
82KB
-
MD5
6e5f9c524a8d99227405fe947825f511
-
SHA1
a93809a62e4b8e6edc263e8200ad121fcf513da9
-
SHA256
488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596
-
SHA512
734793892a57eb3a6932b69bbf3bc66bf07cd94b5a1483d2a9b2089553ae1806d1f7bb98315ab8d3702c9aa9466be99d45af1c6650b93e651dd7b5a3890d69f1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gtn:ymb3NkkiQ3mdBjFo73thgQ/wEkM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2060-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/516-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-87-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 dhnxt.exe 2584 rnhhbdn.exe 2756 bhdnrpj.exe 516 fftxfr.exe 2900 tbbnlph.exe 2684 tlxrrdh.exe 2700 rrlxtl.exe 2680 pvvnnxv.exe 2204 jpfdft.exe 2284 vflxdh.exe 2972 jxfpnd.exe 2340 jxnlht.exe 2780 dhvjnr.exe 1772 flvvt.exe 1924 nfhlr.exe 1984 txpntx.exe 2968 jxrftxp.exe 2280 tfpvn.exe 1908 lvxbvf.exe 676 fxrjfx.exe 1700 bhrth.exe 3032 lfxhfx.exe 744 lvfbd.exe 968 vxrnlvf.exe 2860 xrnrn.exe 908 pvxdnn.exe 2216 xnjpp.exe 2072 lvhxrdt.exe 820 ltndpf.exe 2432 pjhpvnl.exe 1720 dbfph.exe 2468 nxhxj.exe 2616 lddpp.exe 2092 btflxh.exe 2108 vfnxt.exe 2584 xvhhfp.exe 2532 bfrpr.exe 584 xxtdjtb.exe 2836 lltff.exe 3052 jvtvbn.exe 2684 rbfrhvn.exe 2856 vfdxjr.exe 2696 xntbx.exe 1532 bhvhrt.exe 2800 hljdpxh.exe 2496 htphvn.exe 2980 rplbnbh.exe 3016 dfrjdnr.exe 2744 xhltbjv.exe 1956 rhxdbvd.exe 2020 jrfth.exe 1484 jnjnvbh.exe 1764 btbrxl.exe 1988 lfnxvd.exe 2976 xhddfd.exe 1808 tjvpvdf.exe 1380 vjbbjp.exe 432 xnhjv.exe 1352 brdjt.exe 1512 vlpjj.exe 1552 phpfhln.exe 2652 dhppr.exe 968 vtvtpbl.exe 1932 rvxfrvv.exe -
resource yara_rule behavioral1/memory/2060-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/516-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dthvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npptrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvdpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtrfpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tllbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlhppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnpxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxhfth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpfvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppxpdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptfnlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpdjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdxbhdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlhnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvhfdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vphrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvbpbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2384 2060 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 30 PID 2060 wrote to memory of 2384 2060 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 30 PID 2060 wrote to memory of 2384 2060 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 30 PID 2060 wrote to memory of 2384 2060 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 30 PID 2384 wrote to memory of 2584 2384 dhnxt.exe 31 PID 2384 wrote to memory of 2584 2384 dhnxt.exe 31 PID 2384 wrote to memory of 2584 2384 dhnxt.exe 31 PID 2384 wrote to memory of 2584 2384 dhnxt.exe 31 PID 2584 wrote to memory of 2756 2584 rnhhbdn.exe 32 PID 2584 wrote to memory of 2756 2584 rnhhbdn.exe 32 PID 2584 wrote to memory of 2756 2584 rnhhbdn.exe 32 PID 2584 wrote to memory of 2756 2584 rnhhbdn.exe 32 PID 2756 wrote to memory of 516 2756 bhdnrpj.exe 33 PID 2756 wrote to memory of 516 2756 bhdnrpj.exe 33 PID 2756 wrote to memory of 516 2756 bhdnrpj.exe 33 PID 2756 wrote to memory of 516 2756 bhdnrpj.exe 33 PID 516 wrote to memory of 2900 516 fftxfr.exe 34 PID 516 wrote to memory of 2900 516 fftxfr.exe 34 PID 516 wrote to memory of 2900 516 fftxfr.exe 34 PID 516 wrote to memory of 2900 516 fftxfr.exe 34 PID 2900 wrote to memory of 2684 2900 tbbnlph.exe 35 PID 2900 wrote to memory of 2684 2900 tbbnlph.exe 35 PID 2900 wrote to memory of 2684 2900 tbbnlph.exe 35 PID 2900 wrote to memory of 2684 2900 tbbnlph.exe 35 PID 2684 wrote to memory of 2700 2684 tlxrrdh.exe 36 PID 2684 wrote to memory of 2700 2684 tlxrrdh.exe 36 PID 2684 wrote to memory of 2700 2684 tlxrrdh.exe 36 PID 2684 wrote to memory of 2700 2684 tlxrrdh.exe 36 PID 2700 wrote to memory of 2680 2700 rrlxtl.exe 37 PID 2700 wrote to memory of 2680 2700 rrlxtl.exe 37 PID 2700 wrote to memory of 2680 2700 rrlxtl.exe 37 PID 2700 wrote to memory of 2680 2700 rrlxtl.exe 37 PID 2680 wrote to memory of 2204 2680 pvvnnxv.exe 38 PID 2680 wrote to memory of 2204 2680 pvvnnxv.exe 38 PID 2680 wrote to memory of 2204 2680 pvvnnxv.exe 38 PID 2680 wrote to memory of 2204 2680 pvvnnxv.exe 38 PID 2204 wrote to memory of 2284 2204 jpfdft.exe 39 PID 2204 wrote to memory of 2284 2204 jpfdft.exe 39 PID 2204 wrote to memory of 2284 2204 jpfdft.exe 39 PID 2204 wrote to memory of 2284 2204 jpfdft.exe 39 PID 2284 wrote to memory of 2972 2284 vflxdh.exe 40 PID 2284 wrote to memory of 2972 2284 vflxdh.exe 40 PID 2284 wrote to memory of 2972 2284 vflxdh.exe 40 PID 2284 wrote to memory of 2972 2284 vflxdh.exe 40 PID 2972 wrote to memory of 2340 2972 jxfpnd.exe 41 PID 2972 wrote to memory of 2340 2972 jxfpnd.exe 41 PID 2972 wrote to memory of 2340 2972 jxfpnd.exe 41 PID 2972 wrote to memory of 2340 2972 jxfpnd.exe 41 PID 2340 wrote to memory of 2780 2340 jxnlht.exe 42 PID 2340 wrote to memory of 2780 2340 jxnlht.exe 42 PID 2340 wrote to memory of 2780 2340 jxnlht.exe 42 PID 2340 wrote to memory of 2780 2340 jxnlht.exe 42 PID 2780 wrote to memory of 1772 2780 dhvjnr.exe 43 PID 2780 wrote to memory of 1772 2780 dhvjnr.exe 43 PID 2780 wrote to memory of 1772 2780 dhvjnr.exe 43 PID 2780 wrote to memory of 1772 2780 dhvjnr.exe 43 PID 1772 wrote to memory of 1924 1772 flvvt.exe 44 PID 1772 wrote to memory of 1924 1772 flvvt.exe 44 PID 1772 wrote to memory of 1924 1772 flvvt.exe 44 PID 1772 wrote to memory of 1924 1772 flvvt.exe 44 PID 1924 wrote to memory of 1984 1924 nfhlr.exe 45 PID 1924 wrote to memory of 1984 1924 nfhlr.exe 45 PID 1924 wrote to memory of 1984 1924 nfhlr.exe 45 PID 1924 wrote to memory of 1984 1924 nfhlr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe"C:\Users\Admin\AppData\Local\Temp\488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\dhnxt.exec:\dhnxt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rnhhbdn.exec:\rnhhbdn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\bhdnrpj.exec:\bhdnrpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fftxfr.exec:\fftxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\tbbnlph.exec:\tbbnlph.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tlxrrdh.exec:\tlxrrdh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rrlxtl.exec:\rrlxtl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pvvnnxv.exec:\pvvnnxv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jpfdft.exec:\jpfdft.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vflxdh.exec:\vflxdh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\jxfpnd.exec:\jxfpnd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jxnlht.exec:\jxnlht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\dhvjnr.exec:\dhvjnr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\flvvt.exec:\flvvt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nfhlr.exec:\nfhlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\txpntx.exec:\txpntx.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jxrftxp.exec:\jxrftxp.exe18⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tfpvn.exec:\tfpvn.exe19⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lvxbvf.exec:\lvxbvf.exe20⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxrjfx.exec:\fxrjfx.exe21⤵
- Executes dropped EXE
PID:676 -
\??\c:\bhrth.exec:\bhrth.exe22⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lfxhfx.exec:\lfxhfx.exe23⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lvfbd.exec:\lvfbd.exe24⤵
- Executes dropped EXE
PID:744 -
\??\c:\vxrnlvf.exec:\vxrnlvf.exe25⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrnrn.exec:\xrnrn.exe26⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pvxdnn.exec:\pvxdnn.exe27⤵
- Executes dropped EXE
PID:908 -
\??\c:\xnjpp.exec:\xnjpp.exe28⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lvhxrdt.exec:\lvhxrdt.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ltndpf.exec:\ltndpf.exe30⤵
- Executes dropped EXE
PID:820 -
\??\c:\pjhpvnl.exec:\pjhpvnl.exe31⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dbfph.exec:\dbfph.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nxhxj.exec:\nxhxj.exe33⤵
- Executes dropped EXE
PID:2468 -
\??\c:\frpln.exec:\frpln.exe34⤵PID:1592
-
\??\c:\lddpp.exec:\lddpp.exe35⤵
- Executes dropped EXE
PID:2616 -
\??\c:\btflxh.exec:\btflxh.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vfnxt.exec:\vfnxt.exe37⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xvhhfp.exec:\xvhhfp.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bfrpr.exec:\bfrpr.exe39⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxtdjtb.exec:\xxtdjtb.exe40⤵
- Executes dropped EXE
PID:584 -
\??\c:\lltff.exec:\lltff.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jvtvbn.exec:\jvtvbn.exe42⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rbfrhvn.exec:\rbfrhvn.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vfdxjr.exec:\vfdxjr.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xntbx.exec:\xntbx.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bhvhrt.exec:\bhvhrt.exe46⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hljdpxh.exec:\hljdpxh.exe47⤵
- Executes dropped EXE
PID:2800 -
\??\c:\htphvn.exec:\htphvn.exe48⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rplbnbh.exec:\rplbnbh.exe49⤵
- Executes dropped EXE
PID:2980 -
\??\c:\dfrjdnr.exec:\dfrjdnr.exe50⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xhltbjv.exec:\xhltbjv.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rhxdbvd.exec:\rhxdbvd.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jrfth.exec:\jrfth.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jnjnvbh.exec:\jnjnvbh.exe54⤵
- Executes dropped EXE
PID:1484 -
\??\c:\btbrxl.exec:\btbrxl.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lfnxvd.exec:\lfnxvd.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xhddfd.exec:\xhddfd.exe57⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tjvpvdf.exec:\tjvpvdf.exe58⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vjbbjp.exec:\vjbbjp.exe59⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xnhjv.exec:\xnhjv.exe60⤵
- Executes dropped EXE
PID:432 -
\??\c:\brdjt.exec:\brdjt.exe61⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vlpjj.exec:\vlpjj.exe62⤵
- Executes dropped EXE
PID:1512 -
\??\c:\phpfhln.exec:\phpfhln.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dhppr.exec:\dhppr.exe64⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vtvtpbl.exec:\vtvtpbl.exe65⤵
- Executes dropped EXE
PID:968 -
\??\c:\rvxfrvv.exec:\rvxfrvv.exe66⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dthvr.exec:\dthvr.exe67⤵
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\tblth.exec:\tblth.exe68⤵PID:1584
-
\??\c:\brlllp.exec:\brlllp.exe69⤵PID:2540
-
\??\c:\nxxttvr.exec:\nxxttvr.exe70⤵PID:2556
-
\??\c:\fnblflf.exec:\fnblflf.exe71⤵PID:820
-
\??\c:\txjlhjh.exec:\txjlhjh.exe72⤵PID:1892
-
\??\c:\jvvfdt.exec:\jvvfdt.exe73⤵PID:2472
-
\??\c:\xbtrp.exec:\xbtrp.exe74⤵PID:1560
-
\??\c:\ffjxh.exec:\ffjxh.exe75⤵PID:1592
-
\??\c:\vrtvr.exec:\vrtvr.exe76⤵PID:1756
-
\??\c:\ppdph.exec:\ppdph.exe77⤵
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\pbbbdpn.exec:\pbbbdpn.exe78⤵PID:2372
-
\??\c:\xbxrrvv.exec:\xbxrrvv.exe79⤵PID:2196
-
\??\c:\lrlrtn.exec:\lrlrtn.exe80⤵PID:2228
-
\??\c:\nftbfhr.exec:\nftbfhr.exe81⤵PID:2876
-
\??\c:\fpjrp.exec:\fpjrp.exe82⤵PID:2512
-
\??\c:\nhrlh.exec:\nhrlh.exe83⤵PID:2232
-
\??\c:\vptxxb.exec:\vptxxb.exe84⤵PID:2688
-
\??\c:\prxxp.exec:\prxxp.exe85⤵PID:1264
-
\??\c:\bltdtbp.exec:\bltdtbp.exe86⤵PID:2680
-
\??\c:\lxfpb.exec:\lxfpb.exe87⤵PID:2660
-
\??\c:\lbpvxx.exec:\lbpvxx.exe88⤵PID:1200
-
\??\c:\hhrhr.exec:\hhrhr.exe89⤵PID:2736
-
\??\c:\lnnvpx.exec:\lnnvpx.exe90⤵PID:1948
-
\??\c:\xpjhvfh.exec:\xpjhvfh.exe91⤵PID:1152
-
\??\c:\nlpdbp.exec:\nlpdbp.exe92⤵PID:2780
-
\??\c:\jrlfp.exec:\jrlfp.exe93⤵PID:1956
-
\??\c:\plrlh.exec:\plrlh.exe94⤵PID:1488
-
\??\c:\ltvdvrb.exec:\ltvdvrb.exe95⤵PID:1976
-
\??\c:\hjnnxr.exec:\hjnnxr.exe96⤵PID:2940
-
\??\c:\pvpfr.exec:\pvpfr.exe97⤵PID:1312
-
\??\c:\hllrd.exec:\hllrd.exe98⤵PID:2348
-
\??\c:\nlrnlh.exec:\nlrnlh.exe99⤵PID:1876
-
\??\c:\hfntp.exec:\hfntp.exe100⤵PID:880
-
\??\c:\jnltf.exec:\jnltf.exe101⤵PID:1796
-
\??\c:\fdvhhvv.exec:\fdvhhvv.exe102⤵PID:1160
-
\??\c:\rhxdt.exec:\rhxdt.exe103⤵PID:656
-
\??\c:\prltlhl.exec:\prltlhl.exe104⤵PID:1552
-
\??\c:\frnblf.exec:\frnblf.exe105⤵PID:1728
-
\??\c:\dhhrv.exec:\dhhrv.exe106⤵PID:1732
-
\??\c:\pdvdpbt.exec:\pdvdpbt.exe107⤵PID:272
-
\??\c:\btppptn.exec:\btppptn.exe108⤵PID:908
-
\??\c:\rfdbdt.exec:\rfdbdt.exe109⤵PID:1100
-
\??\c:\llhdp.exec:\llhdp.exe110⤵PID:2540
-
\??\c:\jbrjd.exec:\jbrjd.exe111⤵PID:2460
-
\??\c:\xxbhrrr.exec:\xxbhrrr.exe112⤵PID:2480
-
\??\c:\fppbvxr.exec:\fppbvxr.exe113⤵PID:804
-
\??\c:\dvjtfjx.exec:\dvjtfjx.exe114⤵PID:2620
-
\??\c:\rxfpfh.exec:\rxfpfh.exe115⤵PID:2324
-
\??\c:\htttbj.exec:\htttbj.exe116⤵
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\hvdnnbh.exec:\hvdnnbh.exe117⤵PID:1756
-
\??\c:\xxfhb.exec:\xxfhb.exe118⤵PID:2760
-
\??\c:\fjnvdl.exec:\fjnvdl.exe119⤵PID:1384
-
\??\c:\pthlj.exec:\pthlj.exe120⤵PID:2584
-
\??\c:\fhppvj.exec:\fhppvj.exe121⤵PID:584
-
\??\c:\xxnrx.exec:\xxnrx.exe122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-