Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
Resource
win7-20241010-en
6 signatures
150 seconds
General
-
Target
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
-
Size
49KB
-
MD5
64ab0cd8df9d6d027937e65c52b2e498
-
SHA1
52f075d3aed88341b4f4d941eb7e1becdef42f7f
-
SHA256
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da
-
SHA512
093123d714d2987b28d79cee810c810988c5e2291182707e18cfae48ed69503d75b17b340b900c1be431c307746d4e1871cb7dcba8c301dbac054d2a40046a74
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlU:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2240-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/516-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-175-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2248-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-206-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1616-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-246-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/772-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-308-0x0000000077580000-0x000000007769F000-memory.dmp family_blackmoon behavioral1/memory/2308-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-330-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1600-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-418-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1664-413-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1764-450-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-471-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2396-484-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/940-505-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-567-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-617-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2928-668-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-681-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-730-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-742-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1096-745-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2304-875-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2076-880-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-893-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-896-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/584-918-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/584-920-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2812-928-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2692-947-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2660-956-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1460-967-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2332-986-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2988-1013-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/396-1048-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/396-1067-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1884-1088-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/2436-1095-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/900-1126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 dfnnltj.exe 1104 vvnnx.exe 2648 fpjlhp.exe 1920 fjthb.exe 516 vbbdt.exe 2920 txlxfr.exe 3056 rjxrpd.exe 2816 nnlnpj.exe 2868 jlpdj.exe 2800 pxvnd.exe 1832 hjltr.exe 2664 rhfxl.exe 2028 dhlhvfd.exe 1504 rphlx.exe 1208 lvljtj.exe 2024 bpfdnp.exe 2000 jxvrjrv.exe 2288 dvdhj.exe 1312 bjblj.exe 2248 lvhxnnn.exe 112 xxdrfln.exe 1492 rjjrf.exe 776 bntrxp.exe 656 jjtjfv.exe 1616 ndtdrv.exe 964 xpjrft.exe 1148 tjpvb.exe 1556 pfhldfj.exe 772 fhdhp.exe 2320 jdbndpn.exe 2544 rflxdlx.exe 288 nhffn.exe 2492 tdldx.exe 2468 jdlxn.exe 2388 hnrdjr.exe 2104 pbhbpvt.exe 1600 ddrfn.exe 2648 thtldbj.exe 584 nhhrbdh.exe 2888 xlnvv.exe 2220 bljbjhh.exe 2924 xxxtr.exe 1528 pllhd.exe 2908 vjdnlxn.exe 2816 xnldv.exe 2676 vvtrrtf.exe 1688 fnbthn.exe 3016 dbfrnhx.exe 1664 dvrbj.exe 1328 llfbtt.exe 1888 rhlxf.exe 1096 frpdhnr.exe 2064 hpjbv.exe 2056 tddfx.exe 1764 bdbjfj.exe 3028 prjppbv.exe 2416 jnfxr.exe 2428 tvtrxdh.exe 2396 fbldnx.exe 560 hvhtn.exe 432 rvnnn.exe 1064 fnppfxb.exe 940 rlljbl.exe 656 tfhxvj.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phbxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbnpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjrhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdjttd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltdtdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdnhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjfhfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvptvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdlrdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btvxvtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blxfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhjrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pltnjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhbvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdhj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2308 2240 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2240 wrote to memory of 2308 2240 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2240 wrote to memory of 2308 2240 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2240 wrote to memory of 2308 2240 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2308 wrote to memory of 1104 2308 dfnnltj.exe 31 PID 2308 wrote to memory of 1104 2308 dfnnltj.exe 31 PID 2308 wrote to memory of 1104 2308 dfnnltj.exe 31 PID 2308 wrote to memory of 1104 2308 dfnnltj.exe 31 PID 1104 wrote to memory of 2648 1104 vvnnx.exe 32 PID 1104 wrote to memory of 2648 1104 vvnnx.exe 32 PID 1104 wrote to memory of 2648 1104 vvnnx.exe 32 PID 1104 wrote to memory of 2648 1104 vvnnx.exe 32 PID 2648 wrote to memory of 1920 2648 fpjlhp.exe 33 PID 2648 wrote to memory of 1920 2648 fpjlhp.exe 33 PID 2648 wrote to memory of 1920 2648 fpjlhp.exe 33 PID 2648 wrote to memory of 1920 2648 fpjlhp.exe 33 PID 1920 wrote to memory of 516 1920 fjthb.exe 34 PID 1920 wrote to memory of 516 1920 fjthb.exe 34 PID 1920 wrote to memory of 516 1920 fjthb.exe 34 PID 1920 wrote to memory of 516 1920 fjthb.exe 34 PID 516 wrote to memory of 2920 516 vbbdt.exe 35 PID 516 wrote to memory of 2920 516 vbbdt.exe 35 PID 516 wrote to memory of 2920 516 vbbdt.exe 35 PID 516 wrote to memory of 2920 516 vbbdt.exe 35 PID 2920 wrote to memory of 3056 2920 txlxfr.exe 36 PID 2920 wrote to memory of 3056 2920 txlxfr.exe 36 PID 2920 wrote to memory of 3056 2920 txlxfr.exe 36 PID 2920 wrote to memory of 3056 2920 txlxfr.exe 36 PID 3056 wrote to memory of 2816 3056 rjxrpd.exe 37 PID 3056 wrote to memory of 2816 3056 rjxrpd.exe 37 PID 3056 wrote to memory of 2816 3056 rjxrpd.exe 37 PID 3056 wrote to memory of 2816 3056 rjxrpd.exe 37 PID 2816 wrote to memory of 2868 2816 nnlnpj.exe 38 PID 2816 wrote to memory of 2868 2816 nnlnpj.exe 38 PID 2816 wrote to memory of 2868 2816 nnlnpj.exe 38 PID 2816 wrote to memory of 2868 2816 nnlnpj.exe 38 PID 2868 wrote to memory of 2800 2868 jlpdj.exe 39 PID 2868 wrote to memory of 2800 2868 jlpdj.exe 39 PID 2868 wrote to memory of 2800 2868 jlpdj.exe 39 PID 2868 wrote to memory of 2800 2868 jlpdj.exe 39 PID 2800 wrote to memory of 1832 2800 pxvnd.exe 40 PID 2800 wrote to memory of 1832 2800 pxvnd.exe 40 PID 2800 wrote to memory of 1832 2800 pxvnd.exe 40 PID 2800 wrote to memory of 1832 2800 pxvnd.exe 40 PID 1832 wrote to memory of 2664 1832 hjltr.exe 41 PID 1832 wrote to memory of 2664 1832 hjltr.exe 41 PID 1832 wrote to memory of 2664 1832 hjltr.exe 41 PID 1832 wrote to memory of 2664 1832 hjltr.exe 41 PID 2664 wrote to memory of 2028 2664 rhfxl.exe 42 PID 2664 wrote to memory of 2028 2664 rhfxl.exe 42 PID 2664 wrote to memory of 2028 2664 rhfxl.exe 42 PID 2664 wrote to memory of 2028 2664 rhfxl.exe 42 PID 2028 wrote to memory of 1504 2028 dhlhvfd.exe 43 PID 2028 wrote to memory of 1504 2028 dhlhvfd.exe 43 PID 2028 wrote to memory of 1504 2028 dhlhvfd.exe 43 PID 2028 wrote to memory of 1504 2028 dhlhvfd.exe 43 PID 1504 wrote to memory of 1208 1504 rphlx.exe 44 PID 1504 wrote to memory of 1208 1504 rphlx.exe 44 PID 1504 wrote to memory of 1208 1504 rphlx.exe 44 PID 1504 wrote to memory of 1208 1504 rphlx.exe 44 PID 1208 wrote to memory of 2024 1208 lvljtj.exe 45 PID 1208 wrote to memory of 2024 1208 lvljtj.exe 45 PID 1208 wrote to memory of 2024 1208 lvljtj.exe 45 PID 1208 wrote to memory of 2024 1208 lvljtj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dfnnltj.exec:\dfnnltj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\vvnnx.exec:\vvnnx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\fpjlhp.exec:\fpjlhp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\fjthb.exec:\fjthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vbbdt.exec:\vbbdt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\txlxfr.exec:\txlxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rjxrpd.exec:\rjxrpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nnlnpj.exec:\nnlnpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jlpdj.exec:\jlpdj.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pxvnd.exec:\pxvnd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hjltr.exec:\hjltr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\rhfxl.exec:\rhfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dhlhvfd.exec:\dhlhvfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rphlx.exec:\rphlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\lvljtj.exec:\lvljtj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bpfdnp.exec:\bpfdnp.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jxvrjrv.exec:\jxvrjrv.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dvdhj.exec:\dvdhj.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\bjblj.exec:\bjblj.exe20⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lvhxnnn.exec:\lvhxnnn.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxdrfln.exec:\xxdrfln.exe22⤵
- Executes dropped EXE
PID:112 -
\??\c:\rjjrf.exec:\rjjrf.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bntrxp.exec:\bntrxp.exe24⤵
- Executes dropped EXE
PID:776 -
\??\c:\jjtjfv.exec:\jjtjfv.exe25⤵
- Executes dropped EXE
PID:656 -
\??\c:\ndtdrv.exec:\ndtdrv.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xpjrft.exec:\xpjrft.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\tjpvb.exec:\tjpvb.exe28⤵
- Executes dropped EXE
PID:1148 -
\??\c:\pfhldfj.exec:\pfhldfj.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fhdhp.exec:\fhdhp.exe30⤵
- Executes dropped EXE
PID:772 -
\??\c:\jdbndpn.exec:\jdbndpn.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rflxdlx.exec:\rflxdlx.exe32⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhffn.exec:\nhffn.exe33⤵
- Executes dropped EXE
PID:288 -
\??\c:\tdldx.exec:\tdldx.exe34⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdlxn.exec:\jdlxn.exe35⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hlrddr.exec:\hlrddr.exe36⤵PID:2308
-
\??\c:\hnrdjr.exec:\hnrdjr.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pbhbpvt.exec:\pbhbpvt.exe38⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ddrfn.exec:\ddrfn.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\thtldbj.exec:\thtldbj.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nhhrbdh.exec:\nhhrbdh.exe41⤵
- Executes dropped EXE
PID:584 -
\??\c:\xlnvv.exec:\xlnvv.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bljbjhh.exec:\bljbjhh.exe43⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xxxtr.exec:\xxxtr.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pllhd.exec:\pllhd.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vjdnlxn.exec:\vjdnlxn.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xnldv.exec:\xnldv.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vvtrrtf.exec:\vvtrrtf.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\fnbthn.exec:\fnbthn.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dbfrnhx.exec:\dbfrnhx.exe50⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvrbj.exec:\dvrbj.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llfbtt.exec:\llfbtt.exe52⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rhlxf.exec:\rhlxf.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\frpdhnr.exec:\frpdhnr.exe54⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hpjbv.exec:\hpjbv.exe55⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tddfx.exec:\tddfx.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bdbjfj.exec:\bdbjfj.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\prjppbv.exec:\prjppbv.exe58⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jnfxr.exec:\jnfxr.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tvtrxdh.exec:\tvtrxdh.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fbldnx.exec:\fbldnx.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hvhtn.exec:\hvhtn.exe62⤵
- Executes dropped EXE
PID:560 -
\??\c:\rvnnn.exec:\rvnnn.exe63⤵
- Executes dropped EXE
PID:432 -
\??\c:\fnppfxb.exec:\fnppfxb.exe64⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rlljbl.exec:\rlljbl.exe65⤵
- Executes dropped EXE
PID:940 -
\??\c:\tfhxvj.exec:\tfhxvj.exe66⤵
- Executes dropped EXE
PID:656 -
\??\c:\bjvrb.exec:\bjvrb.exe67⤵PID:1728
-
\??\c:\dbptv.exec:\dbptv.exe68⤵PID:1184
-
\??\c:\xdbxrdf.exec:\xdbxrdf.exe69⤵PID:272
-
\??\c:\xbffdtn.exec:\xbffdtn.exe70⤵PID:2640
-
\??\c:\njbtjt.exec:\njbtjt.exe71⤵PID:1100
-
\??\c:\fdvdjf.exec:\fdvdjf.exe72⤵PID:2400
-
\??\c:\drhff.exec:\drhff.exe73⤵PID:2160
-
\??\c:\ffnvl.exec:\ffnvl.exe74⤵PID:2520
-
\??\c:\pvrddnj.exec:\pvrddnj.exe75⤵PID:2336
-
\??\c:\xbnbrrv.exec:\xbnbrrv.exe76⤵PID:1724
-
\??\c:\ptxhlt.exec:\ptxhlt.exe77⤵PID:2612
-
\??\c:\vllfh.exec:\vllfh.exe78⤵PID:2492
-
\??\c:\vpprvf.exec:\vpprvf.exe79⤵PID:2620
-
\??\c:\xljrdf.exec:\xljrdf.exe80⤵PID:2092
-
\??\c:\tnxlb.exec:\tnxlb.exe81⤵PID:1604
-
\??\c:\ntdhxp.exec:\ntdhxp.exe82⤵PID:2196
-
\??\c:\nlhdh.exec:\nlhdh.exe83⤵PID:2864
-
\??\c:\hvbfv.exec:\hvbfv.exe84⤵PID:2956
-
\??\c:\hnxljld.exec:\hnxljld.exe85⤵PID:584
-
\??\c:\lrvvhf.exec:\lrvvhf.exe86⤵PID:3068
-
\??\c:\ltjfrd.exec:\ltjfrd.exe87⤵PID:2220
-
\??\c:\vtffvlf.exec:\vtffvlf.exe88⤵PID:2716
-
\??\c:\lnhltdh.exec:\lnhltdh.exe89⤵PID:2728
-
\??\c:\rvjlxf.exec:\rvjlxf.exe90⤵PID:2928
-
\??\c:\jvrpb.exec:\jvrpb.exe91⤵PID:2696
-
\??\c:\hdrrhpb.exec:\hdrrhpb.exe92⤵PID:2868
-
\??\c:\dhdjbb.exec:\dhdjbb.exe93⤵PID:2736
-
\??\c:\fxttpdn.exec:\fxttpdn.exe94⤵PID:2340
-
\??\c:\hffvb.exec:\hffvb.exe95⤵PID:1664
-
\??\c:\tndbp.exec:\tndbp.exe96⤵PID:2944
-
\??\c:\hfdbp.exec:\hfdbp.exe97⤵PID:1772
-
\??\c:\pdjjdtd.exec:\pdjjdtd.exe98⤵PID:2576
-
\??\c:\brjxh.exec:\brjxh.exe99⤵PID:1096
-
\??\c:\lhffb.exec:\lhffb.exe100⤵PID:2984
-
\??\c:\vfldvf.exec:\vfldvf.exe101⤵PID:2968
-
\??\c:\fpfvj.exec:\fpfvj.exe102⤵PID:2976
-
\??\c:\hbpvx.exec:\hbpvx.exe103⤵PID:2276
-
\??\c:\pfdjtrt.exec:\pfdjtrt.exe104⤵PID:2100
-
\??\c:\nffnp.exec:\nffnp.exe105⤵PID:880
-
\??\c:\tbbhfl.exec:\tbbhfl.exe106⤵PID:1876
-
\??\c:\fvrnbrn.exec:\fvrnbrn.exe107⤵PID:1352
-
\??\c:\vjvph.exec:\vjvph.exe108⤵PID:432
-
\??\c:\bjhvvbr.exec:\bjhvvbr.exe109⤵PID:1064
-
\??\c:\hfvpxh.exec:\hfvpxh.exe110⤵PID:744
-
\??\c:\hppxvxv.exec:\hppxvxv.exe111⤵PID:1284
-
\??\c:\hbvnv.exec:\hbvnv.exe112⤵PID:1968
-
\??\c:\jrfjlvf.exec:\jrfjlvf.exe113⤵PID:1184
-
\??\c:\rtrrbvl.exec:\rtrrbvl.exe114⤵PID:272
-
\??\c:\pbbnl.exec:\pbbnl.exe115⤵
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\vnfbjnv.exec:\vnfbjnv.exe116⤵PID:1892
-
\??\c:\xtjpxpt.exec:\xtjpxpt.exe117⤵PID:264
-
\??\c:\flbxbl.exec:\flbxbl.exe118⤵PID:1768
-
\??\c:\pxnlp.exec:\pxnlp.exe119⤵PID:2520
-
\??\c:\pnhxd.exec:\pnhxd.exe120⤵PID:2336
-
\??\c:\pjjpxt.exec:\pjjpxt.exe121⤵PID:896
-
\??\c:\prfhhdp.exec:\prfhhdp.exe122⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-