Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 21:20
Static task
static1
Behavioral task
behavioral1
Sample
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe
Resource
win7-20241010-en
General
-
Target
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe
-
Size
105KB
-
MD5
d8b1eb5847774742429d5578ed0e8b57
-
SHA1
8dd1723c339a881b22899a3c9a6f0e7ea743e2f4
-
SHA256
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7
-
SHA512
2b0eab56c7677175e38e424baa4c23356e52b170dd47ee18d225aa44d078a930b83c6e0df4146d4118a4e8a85e56cc9f8212b762265074e566d98baba506179c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PCK:n3C9BRo7tvnJ99T/KZE89K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
npnnlr.exejnfxxlr.exelfbfvrt.exettdxth.exextrxxxl.exeppnldl.exerbhpt.exevvpbfj.exevnxbllv.exernhnlx.exephnpn.exevtlbjj.exehhdjn.exextrrxrp.exelpjjdrf.exexlnpvl.exeddpnd.exellhjnnv.exeltfbrx.exejdhnb.exexjnlnb.exeltbfrl.exexxbhr.exehxtxdnb.exevtxfpv.exejplnpv.exernbtnjd.exevrfbt.exenbhbt.exevfpfl.exeflrdfbl.exejjvntx.exelvphht.exeddvrv.exendbhhx.exerbjbr.exetvvppr.exedjrlld.exertfxvn.exexthbnb.exerdppdbh.exevldldx.exexrrxltb.exevrfvvt.exejfjpbx.exejnrrdx.exefltdl.exepjvddvf.exepxltlb.exexvprp.exevdpdfv.exelprpl.exetptjvrv.exevlxbvd.exejntpdrv.exejdttxhx.exeftrdnfl.exehlxdbd.exevjrpnh.exebbtvb.exehbbpxf.exebljbpnx.exeflplxdl.exehbvlrnv.exepid Process 2824 npnnlr.exe 2996 jnfxxlr.exe 2072 lfbfvrt.exe 2744 ttdxth.exe 3000 xtrxxxl.exe 2788 ppnldl.exe 2268 rbhpt.exe 3048 vvpbfj.exe 2812 vnxbllv.exe 2312 rnhnlx.exe 3068 phnpn.exe 2300 vtlbjj.exe 892 hhdjn.exe 2944 xtrrxrp.exe 1240 lpjjdrf.exe 2472 xlnpvl.exe 2128 ddpnd.exe 2060 llhjnnv.exe 2200 ltfbrx.exe 1392 jdhnb.exe 1620 xjnlnb.exe 2512 ltbfrl.exe 932 xxbhr.exe 2468 hxtxdnb.exe 764 vtxfpv.exe 748 jplnpv.exe 1304 rnbtnjd.exe 1936 vrfbt.exe 1504 nbhbt.exe 2592 vfpfl.exe 864 flrdfbl.exe 2424 jjvntx.exe 2968 lvphht.exe 1572 ddvrv.exe 2976 ndbhhx.exe 2724 rbjbr.exe 2072 tvvppr.exe 2876 djrlld.exe 2772 rtfxvn.exe 2732 xthbnb.exe 2760 rdppdbh.exe 2792 vldldx.exe 2928 xrrxltb.exe 2080 vrfvvt.exe 568 jfjpbx.exe 2812 jnrrdx.exe 2312 fltdl.exe 856 pjvddvf.exe 1692 pxltlb.exe 2396 xvprp.exe 892 vdpdfv.exe 2132 lprpl.exe 2480 tptjvrv.exe 2356 vlxbvd.exe 2440 jntpdrv.exe 2332 jdttxhx.exe 2408 ftrdnfl.exe 560 hlxdbd.exe 1688 vjrpnh.exe 2692 bbtvb.exe 1148 hbbpxf.exe 2168 bljbpnx.exe 2548 flplxdl.exe 1516 hbvlrnv.exe -
Processes:
resource yara_rule behavioral1/memory/2172-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fvdplj.exelvphht.exeftfbpt.exenntljd.exepdrrpl.exeprprh.exefvfhr.exejvxrd.exebfdvr.exeffvprvh.exevrllv.exexxxxdr.exehnhtv.exenfpbdlp.exelfpxh.exellxtt.exelhtjpd.exehvnpf.exelpfvln.exefvvbd.exevvrnr.exetvldnp.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvphht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftfbpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrrpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvfhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfdvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvprvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpbdlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpfvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvvbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvrnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvldnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exenpnnlr.exejnfxxlr.exelfbfvrt.exettdxth.exextrxxxl.exeppnldl.exerbhpt.exevvpbfj.exevnxbllv.exernhnlx.exephnpn.exevtlbjj.exehhdjn.exextrrxrp.exelpjjdrf.exedescription pid Process procid_target PID 2172 wrote to memory of 2824 2172 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 29 PID 2172 wrote to memory of 2824 2172 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 29 PID 2172 wrote to memory of 2824 2172 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 29 PID 2172 wrote to memory of 2824 2172 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 29 PID 2824 wrote to memory of 2996 2824 npnnlr.exe 30 PID 2824 wrote to memory of 2996 2824 npnnlr.exe 30 PID 2824 wrote to memory of 2996 2824 npnnlr.exe 30 PID 2824 wrote to memory of 2996 2824 npnnlr.exe 30 PID 2996 wrote to memory of 2072 2996 jnfxxlr.exe 31 PID 2996 wrote to memory of 2072 2996 jnfxxlr.exe 31 PID 2996 wrote to memory of 2072 2996 jnfxxlr.exe 31 PID 2996 wrote to memory of 2072 2996 jnfxxlr.exe 31 PID 2072 wrote to memory of 2744 2072 lfbfvrt.exe 32 PID 2072 wrote to memory of 2744 2072 lfbfvrt.exe 32 PID 2072 wrote to memory of 2744 2072 lfbfvrt.exe 32 PID 2072 wrote to memory of 2744 2072 lfbfvrt.exe 32 PID 2744 wrote to memory of 3000 2744 ttdxth.exe 33 PID 2744 wrote to memory of 3000 2744 ttdxth.exe 33 PID 2744 wrote to memory of 3000 2744 ttdxth.exe 33 PID 2744 wrote to memory of 3000 2744 ttdxth.exe 33 PID 3000 wrote to memory of 2788 3000 xtrxxxl.exe 34 PID 3000 wrote to memory of 2788 3000 xtrxxxl.exe 34 PID 3000 wrote to memory of 2788 3000 xtrxxxl.exe 34 PID 3000 wrote to memory of 2788 3000 xtrxxxl.exe 34 PID 2788 wrote to memory of 2268 2788 ppnldl.exe 35 PID 2788 wrote to memory of 2268 2788 ppnldl.exe 35 PID 2788 wrote to memory of 2268 2788 ppnldl.exe 35 PID 2788 wrote to memory of 2268 2788 ppnldl.exe 35 PID 2268 wrote to memory of 3048 2268 rbhpt.exe 36 PID 2268 wrote to memory of 3048 2268 rbhpt.exe 36 PID 2268 wrote to memory of 3048 2268 rbhpt.exe 36 PID 2268 wrote to memory of 3048 2268 rbhpt.exe 36 PID 3048 wrote to memory of 2812 3048 vvpbfj.exe 37 PID 3048 wrote to memory of 2812 3048 vvpbfj.exe 37 PID 3048 wrote to memory of 2812 3048 vvpbfj.exe 37 PID 3048 wrote to memory of 2812 3048 vvpbfj.exe 37 PID 2812 wrote to memory of 2312 2812 vnxbllv.exe 38 PID 2812 wrote to memory of 2312 2812 vnxbllv.exe 38 PID 2812 wrote to memory of 2312 2812 vnxbllv.exe 38 PID 2812 wrote to memory of 2312 2812 vnxbllv.exe 38 PID 2312 wrote to memory of 3068 2312 rnhnlx.exe 39 PID 2312 wrote to memory of 3068 2312 rnhnlx.exe 39 PID 2312 wrote to memory of 3068 2312 rnhnlx.exe 39 PID 2312 wrote to memory of 3068 2312 rnhnlx.exe 39 PID 3068 wrote to memory of 2300 3068 phnpn.exe 40 PID 3068 wrote to memory of 2300 3068 phnpn.exe 40 PID 3068 wrote to memory of 2300 3068 phnpn.exe 40 PID 3068 wrote to memory of 2300 3068 phnpn.exe 40 PID 2300 wrote to memory of 892 2300 vtlbjj.exe 41 PID 2300 wrote to memory of 892 2300 vtlbjj.exe 41 PID 2300 wrote to memory of 892 2300 vtlbjj.exe 41 PID 2300 wrote to memory of 892 2300 vtlbjj.exe 41 PID 892 wrote to memory of 2944 892 hhdjn.exe 42 PID 892 wrote to memory of 2944 892 hhdjn.exe 42 PID 892 wrote to memory of 2944 892 hhdjn.exe 42 PID 892 wrote to memory of 2944 892 hhdjn.exe 42 PID 2944 wrote to memory of 1240 2944 xtrrxrp.exe 43 PID 2944 wrote to memory of 1240 2944 xtrrxrp.exe 43 PID 2944 wrote to memory of 1240 2944 xtrrxrp.exe 43 PID 2944 wrote to memory of 1240 2944 xtrrxrp.exe 43 PID 1240 wrote to memory of 2472 1240 lpjjdrf.exe 44 PID 1240 wrote to memory of 2472 1240 lpjjdrf.exe 44 PID 1240 wrote to memory of 2472 1240 lpjjdrf.exe 44 PID 1240 wrote to memory of 2472 1240 lpjjdrf.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe"C:\Users\Admin\AppData\Local\Temp\34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\npnnlr.exec:\npnnlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jnfxxlr.exec:\jnfxxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lfbfvrt.exec:\lfbfvrt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ttdxth.exec:\ttdxth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xtrxxxl.exec:\xtrxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ppnldl.exec:\ppnldl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rbhpt.exec:\rbhpt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\vvpbfj.exec:\vvpbfj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vnxbllv.exec:\vnxbllv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rnhnlx.exec:\rnhnlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\phnpn.exec:\phnpn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\vtlbjj.exec:\vtlbjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\hhdjn.exec:\hhdjn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\xtrrxrp.exec:\xtrrxrp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\lpjjdrf.exec:\lpjjdrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\xlnpvl.exec:\xlnpvl.exe17⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ddpnd.exec:\ddpnd.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\llhjnnv.exec:\llhjnnv.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ltfbrx.exec:\ltfbrx.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdhnb.exec:\jdhnb.exe21⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xjnlnb.exec:\xjnlnb.exe22⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ltbfrl.exec:\ltbfrl.exe23⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xxbhr.exec:\xxbhr.exe24⤵
- Executes dropped EXE
PID:932 -
\??\c:\hxtxdnb.exec:\hxtxdnb.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vtxfpv.exec:\vtxfpv.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\jplnpv.exec:\jplnpv.exe27⤵
- Executes dropped EXE
PID:748 -
\??\c:\rnbtnjd.exec:\rnbtnjd.exe28⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vrfbt.exec:\vrfbt.exe29⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nbhbt.exec:\nbhbt.exe30⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vfpfl.exec:\vfpfl.exe31⤵
- Executes dropped EXE
PID:2592 -
\??\c:\flrdfbl.exec:\flrdfbl.exe32⤵
- Executes dropped EXE
PID:864 -
\??\c:\jjvntx.exec:\jjvntx.exe33⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lvphht.exec:\lvphht.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\ddvrv.exec:\ddvrv.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ndbhhx.exec:\ndbhhx.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rbjbr.exec:\rbjbr.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tvvppr.exec:\tvvppr.exe38⤵
- Executes dropped EXE
PID:2072 -
\??\c:\djrlld.exec:\djrlld.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rtfxvn.exec:\rtfxvn.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xthbnb.exec:\xthbnb.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rdppdbh.exec:\rdppdbh.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vldldx.exec:\vldldx.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xrrxltb.exec:\xrrxltb.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vrfvvt.exec:\vrfvvt.exe45⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jfjpbx.exec:\jfjpbx.exe46⤵
- Executes dropped EXE
PID:568 -
\??\c:\jnrrdx.exec:\jnrrdx.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fltdl.exec:\fltdl.exe48⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjvddvf.exec:\pjvddvf.exe49⤵
- Executes dropped EXE
PID:856 -
\??\c:\pxltlb.exec:\pxltlb.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xvprp.exec:\xvprp.exe51⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vdpdfv.exec:\vdpdfv.exe52⤵
- Executes dropped EXE
PID:892 -
\??\c:\lprpl.exec:\lprpl.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tptjvrv.exec:\tptjvrv.exe54⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vlxbvd.exec:\vlxbvd.exe55⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jntpdrv.exec:\jntpdrv.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdttxhx.exec:\jdttxhx.exe57⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ftrdnfl.exec:\ftrdnfl.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hlxdbd.exec:\hlxdbd.exe59⤵
- Executes dropped EXE
PID:560 -
\??\c:\vjrpnh.exec:\vjrpnh.exe60⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bbtvb.exec:\bbtvb.exe61⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbbpxf.exec:\hbbpxf.exe62⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bljbpnx.exec:\bljbpnx.exe63⤵
- Executes dropped EXE
PID:2168 -
\??\c:\flplxdl.exec:\flplxdl.exe64⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hbvlrnv.exec:\hbvlrnv.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jjfnfbb.exec:\jjfnfbb.exe66⤵PID:796
-
\??\c:\pxtblp.exec:\pxtblp.exe67⤵PID:1652
-
\??\c:\xjrpp.exec:\xjrpp.exe68⤵PID:748
-
\??\c:\dnblj.exec:\dnblj.exe69⤵PID:1288
-
\??\c:\xllvn.exec:\xllvn.exe70⤵PID:1760
-
\??\c:\drnrvhj.exec:\drnrvhj.exe71⤵PID:1696
-
\??\c:\llpxtd.exec:\llpxtd.exe72⤵PID:520
-
\??\c:\dnhvdvr.exec:\dnhvdvr.exe73⤵PID:2368
-
\??\c:\vnvdn.exec:\vnvdn.exe74⤵PID:864
-
\??\c:\jxjhlfn.exec:\jxjhlfn.exe75⤵PID:2980
-
\??\c:\tbhxnbv.exec:\tbhxnbv.exe76⤵PID:2984
-
\??\c:\lrprfj.exec:\lrprfj.exe77⤵PID:2116
-
\??\c:\vlvhnvr.exec:\vlvhnvr.exe78⤵PID:2996
-
\??\c:\hrxfnhx.exec:\hrxfnhx.exe79⤵PID:2752
-
\??\c:\dvlvhl.exec:\dvlvhl.exe80⤵PID:2756
-
\??\c:\lnbhhnd.exec:\lnbhhnd.exe81⤵PID:2804
-
\??\c:\rfrfr.exec:\rfrfr.exe82⤵PID:2736
-
\??\c:\hrrjp.exec:\hrrjp.exe83⤵PID:2748
-
\??\c:\xvrbt.exec:\xvrbt.exe84⤵PID:1128
-
\??\c:\ttlpxh.exec:\ttlpxh.exe85⤵PID:872
-
\??\c:\xtrrj.exec:\xtrrj.exe86⤵PID:700
-
\??\c:\btpnn.exec:\btpnn.exe87⤵PID:2808
-
\??\c:\vrrjp.exec:\vrrjp.exe88⤵PID:2180
-
\??\c:\hljlp.exec:\hljlp.exe89⤵PID:2948
-
\??\c:\prtjpt.exec:\prtjpt.exe90⤵PID:3052
-
\??\c:\hrdrtfl.exec:\hrdrtfl.exe91⤵PID:2228
-
\??\c:\ddppp.exec:\ddppp.exe92⤵PID:2892
-
\??\c:\lfntt.exec:\lfntt.exe93⤵PID:2628
-
\??\c:\jntjb.exec:\jntjb.exe94⤵PID:1636
-
\??\c:\jbbfp.exec:\jbbfp.exe95⤵PID:836
-
\??\c:\bnjfl.exec:\bnjfl.exe96⤵PID:1980
-
\??\c:\jttrr.exec:\jttrr.exe97⤵PID:2412
-
\??\c:\lrdbphb.exec:\lrdbphb.exe98⤵PID:2104
-
\??\c:\dxhjvr.exec:\dxhjvr.exe99⤵PID:2332
-
\??\c:\tbblf.exec:\tbblf.exe100⤵PID:2244
-
\??\c:\prtnl.exec:\prtnl.exe101⤵PID:528
-
\??\c:\dnldvr.exec:\dnldvr.exe102⤵PID:808
-
\??\c:\dnxjn.exec:\dnxjn.exe103⤵PID:2692
-
\??\c:\npvdr.exec:\npvdr.exe104⤵PID:1600
-
\??\c:\lnxrl.exec:\lnxrl.exe105⤵PID:2512
-
\??\c:\btbvhbh.exec:\btbvhbh.exe106⤵PID:2548
-
\??\c:\vdxdht.exec:\vdxdht.exe107⤵PID:1516
-
\??\c:\pvlprdp.exec:\pvlprdp.exe108⤵PID:796
-
\??\c:\vvrnr.exec:\vvrnr.exe109⤵
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\dvnpd.exec:\dvnpd.exe110⤵PID:748
-
\??\c:\pvfnnh.exec:\pvfnnh.exe111⤵PID:1288
-
\??\c:\bnbhv.exec:\bnbhv.exe112⤵PID:2392
-
\??\c:\vlfpxt.exec:\vlfpxt.exe113⤵PID:1696
-
\??\c:\jpdjvr.exec:\jpdjvr.exe114⤵PID:520
-
\??\c:\bjtvfhb.exec:\bjtvfhb.exe115⤵PID:2368
-
\??\c:\rtjdv.exec:\rtjdv.exe116⤵PID:1564
-
\??\c:\vvrbjp.exec:\vvrbjp.exe117⤵PID:2868
-
\??\c:\nvpnt.exec:\nvpnt.exe118⤵PID:2984
-
\??\c:\ndljpn.exec:\ndljpn.exe119⤵PID:2116
-
\??\c:\rbhvn.exec:\rbhvn.exe120⤵PID:2996
-
\??\c:\jrvlrd.exec:\jrvlrd.exe121⤵PID:3008
-
\??\c:\bvxfdj.exec:\bvxfdj.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-