Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 17:24
Static task
static1
Behavioral task
behavioral1
Sample
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe
Resource
win7-20241010-en
General
-
Target
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe
-
Size
89KB
-
MD5
f891b4e0104d419684830cfb7653df6e
-
SHA1
0558b2f23024e30754c82a8ea2450a9a923f5ba8
-
SHA256
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995
-
SHA512
8499aef9637c0e483905a2d61e7e66f9a10d56a400d2292159bfd921b786fb16bc7bd8618eb20e809612ae303b4fbbf09781ae576a6fe827d6f712b14288ae50
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vhdW/:ymb3NkkiQ3mdBjFo6Pfgy3dbc/hdW/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnfpr.exejbhjvr.exejlxfrhh.exebbdrnhl.exerxbxxx.exelbbrhb.exedpxttr.exenfrbjpf.exexllvh.exejphblnl.exejbrntr.exedjjvj.exebhldr.exerdxjx.exedldft.exetnjnvjx.exefvnlnj.exevtrxhd.exepxlxd.exervjpx.exebnrjjh.exevxxtlpp.exejtxtv.exehrxlrn.exertlffj.exexvntj.exelrdjd.exexvrjrjn.exedxprhrt.exehtrpd.exepttxbr.exehxlnt.exevbbthpx.exelbbjr.exetbljlp.exehvvdn.exetpfvvp.exenxfrf.exefvdbnf.exetthlvhv.exexvxrfx.exefvbdtnd.exebfttptn.exedvpfrpr.exexnttx.exejfnhhhj.exefxtpxx.exexphtdf.exejtfnlj.exenprrxvv.exepvtfttv.exevxrtdt.exehhfbb.exebpbln.exedjbvj.exejlnll.exerpjpfjp.exehdxbft.exelbdbnvl.exedrdhjlr.exevxdbxv.exexlrdvvh.exelfhxv.exenbbxhjh.exepid Process 2536 bnfpr.exe 1684 jbhjvr.exe 2528 jlxfrhh.exe 1976 bbdrnhl.exe 2188 rxbxxx.exe 2248 lbbrhb.exe 2932 dpxttr.exe 2168 nfrbjpf.exe 2708 xllvh.exe 2684 jphblnl.exe 1032 jbrntr.exe 2892 djjvj.exe 564 bhldr.exe 1600 rdxjx.exe 1264 dldft.exe 2752 tnjnvjx.exe 3004 fvnlnj.exe 3032 vtrxhd.exe 2860 pxlxd.exe 3028 rvjpx.exe 2256 bnrjjh.exe 3016 vxxtlpp.exe 2548 jtxtv.exe 1872 hrxlrn.exe 1888 rtlffj.exe 1528 xvntj.exe 864 lrdjd.exe 1248 xvrjrjn.exe 1760 dxprhrt.exe 2304 htrpd.exe 2264 pttxbr.exe 2348 hxlnt.exe 2536 vbbthpx.exe 2620 lbbjr.exe 2744 tbljlp.exe 1564 hvvdn.exe 2092 tpfvvp.exe 2900 nxfrf.exe 2788 fvdbnf.exe 2920 tthlvhv.exe 1276 xvxrfx.exe 2972 fvbdtnd.exe 2928 bfttptn.exe 2168 dvpfrpr.exe 2716 xnttx.exe 2412 jfnhhhj.exe 1648 fxtpxx.exe 1152 xphtdf.exe 796 jtfnlj.exe 2720 nprrxvv.exe 1600 pvtfttv.exe 1964 vxrtdt.exe 1952 hhfbb.exe 2964 bpbln.exe 3044 djbvj.exe 1860 jlnll.exe 2556 rpjpfjp.exe 1696 hdxbft.exe 2180 lbdbnvl.exe 2256 drdhjlr.exe 800 vxdbxv.exe 960 xlrdvvh.exe 2484 lfhxv.exe 1048 nbbxhjh.exe -
Processes:
resource yara_rule behavioral1/memory/1832-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-255-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fdbvr.exehnflbb.exejtrvvnr.exerlprtr.exetdjphvt.exejnprvr.exefttjpv.exerxvjlt.exeddxxn.exexjfntfb.exentfvnxf.exedtfjd.exejbjbjj.exedhrhf.exexbjdhj.exelpjjttv.exepdhtrv.exenjxtnn.exexpjvf.exejfptj.exehdxbpj.exedpxtfhd.exeplvvx.exerffrrfr.exejdpfp.exevltffb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdbvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnflbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrvvnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlprtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdjphvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnprvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvjlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjfntfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntfvnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbjbjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhrhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjdhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjjttv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhtrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfptj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpxtfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vltffb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exebnfpr.exejbhjvr.exejlxfrhh.exebbdrnhl.exerxbxxx.exelbbrhb.exedpxttr.exenfrbjpf.exexllvh.exejphblnl.exejbrntr.exedjjvj.exebhldr.exerdxjx.exedldft.exedescription pid Process procid_target PID 1832 wrote to memory of 2536 1832 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 30 PID 1832 wrote to memory of 2536 1832 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 30 PID 1832 wrote to memory of 2536 1832 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 30 PID 1832 wrote to memory of 2536 1832 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 30 PID 2536 wrote to memory of 1684 2536 bnfpr.exe 31 PID 2536 wrote to memory of 1684 2536 bnfpr.exe 31 PID 2536 wrote to memory of 1684 2536 bnfpr.exe 31 PID 2536 wrote to memory of 1684 2536 bnfpr.exe 31 PID 1684 wrote to memory of 2528 1684 jbhjvr.exe 32 PID 1684 wrote to memory of 2528 1684 jbhjvr.exe 32 PID 1684 wrote to memory of 2528 1684 jbhjvr.exe 32 PID 1684 wrote to memory of 2528 1684 jbhjvr.exe 32 PID 2528 wrote to memory of 1976 2528 jlxfrhh.exe 33 PID 2528 wrote to memory of 1976 2528 jlxfrhh.exe 33 PID 2528 wrote to memory of 1976 2528 jlxfrhh.exe 33 PID 2528 wrote to memory of 1976 2528 jlxfrhh.exe 33 PID 1976 wrote to memory of 2188 1976 bbdrnhl.exe 34 PID 1976 wrote to memory of 2188 1976 bbdrnhl.exe 34 PID 1976 wrote to memory of 2188 1976 bbdrnhl.exe 34 PID 1976 wrote to memory of 2188 1976 bbdrnhl.exe 34 PID 2188 wrote to memory of 2248 2188 rxbxxx.exe 35 PID 2188 wrote to memory of 2248 2188 rxbxxx.exe 35 PID 2188 wrote to memory of 2248 2188 rxbxxx.exe 35 PID 2188 wrote to memory of 2248 2188 rxbxxx.exe 35 PID 2248 wrote to memory of 2932 2248 lbbrhb.exe 36 PID 2248 wrote to memory of 2932 2248 lbbrhb.exe 36 PID 2248 wrote to memory of 2932 2248 lbbrhb.exe 36 PID 2248 wrote to memory of 2932 2248 lbbrhb.exe 36 PID 2932 wrote to memory of 2168 2932 dpxttr.exe 37 PID 2932 wrote to memory of 2168 2932 dpxttr.exe 37 PID 2932 wrote to memory of 2168 2932 dpxttr.exe 37 PID 2932 wrote to memory of 2168 2932 dpxttr.exe 37 PID 2168 wrote to memory of 2708 2168 nfrbjpf.exe 38 PID 2168 wrote to memory of 2708 2168 nfrbjpf.exe 38 PID 2168 wrote to memory of 2708 2168 nfrbjpf.exe 38 PID 2168 wrote to memory of 2708 2168 nfrbjpf.exe 38 PID 2708 wrote to memory of 2684 2708 xllvh.exe 39 PID 2708 wrote to memory of 2684 2708 xllvh.exe 39 PID 2708 wrote to memory of 2684 2708 xllvh.exe 39 PID 2708 wrote to memory of 2684 2708 xllvh.exe 39 PID 2684 wrote to memory of 1032 2684 jphblnl.exe 40 PID 2684 wrote to memory of 1032 2684 jphblnl.exe 40 PID 2684 wrote to memory of 1032 2684 jphblnl.exe 40 PID 2684 wrote to memory of 1032 2684 jphblnl.exe 40 PID 1032 wrote to memory of 2892 1032 jbrntr.exe 41 PID 1032 wrote to memory of 2892 1032 jbrntr.exe 41 PID 1032 wrote to memory of 2892 1032 jbrntr.exe 41 PID 1032 wrote to memory of 2892 1032 jbrntr.exe 41 PID 2892 wrote to memory of 564 2892 djjvj.exe 42 PID 2892 wrote to memory of 564 2892 djjvj.exe 42 PID 2892 wrote to memory of 564 2892 djjvj.exe 42 PID 2892 wrote to memory of 564 2892 djjvj.exe 42 PID 564 wrote to memory of 1600 564 bhldr.exe 43 PID 564 wrote to memory of 1600 564 bhldr.exe 43 PID 564 wrote to memory of 1600 564 bhldr.exe 43 PID 564 wrote to memory of 1600 564 bhldr.exe 43 PID 1600 wrote to memory of 1264 1600 rdxjx.exe 44 PID 1600 wrote to memory of 1264 1600 rdxjx.exe 44 PID 1600 wrote to memory of 1264 1600 rdxjx.exe 44 PID 1600 wrote to memory of 1264 1600 rdxjx.exe 44 PID 1264 wrote to memory of 2752 1264 dldft.exe 45 PID 1264 wrote to memory of 2752 1264 dldft.exe 45 PID 1264 wrote to memory of 2752 1264 dldft.exe 45 PID 1264 wrote to memory of 2752 1264 dldft.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe"C:\Users\Admin\AppData\Local\Temp\f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\bnfpr.exec:\bnfpr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jbhjvr.exec:\jbhjvr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jlxfrhh.exec:\jlxfrhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bbdrnhl.exec:\bbdrnhl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rxbxxx.exec:\rxbxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\lbbrhb.exec:\lbbrhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\dpxttr.exec:\dpxttr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nfrbjpf.exec:\nfrbjpf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xllvh.exec:\xllvh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jphblnl.exec:\jphblnl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\jbrntr.exec:\jbrntr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\djjvj.exec:\djjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bhldr.exec:\bhldr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\rdxjx.exec:\rdxjx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\dldft.exec:\dldft.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\tnjnvjx.exec:\tnjnvjx.exe17⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fvnlnj.exec:\fvnlnj.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vtrxhd.exec:\vtrxhd.exe19⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pxlxd.exec:\pxlxd.exe20⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rvjpx.exec:\rvjpx.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bnrjjh.exec:\bnrjjh.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vxxtlpp.exec:\vxxtlpp.exe23⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jtxtv.exec:\jtxtv.exe24⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hrxlrn.exec:\hrxlrn.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rtlffj.exec:\rtlffj.exe26⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xvntj.exec:\xvntj.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lrdjd.exec:\lrdjd.exe28⤵
- Executes dropped EXE
PID:864 -
\??\c:\xvrjrjn.exec:\xvrjrjn.exe29⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dxprhrt.exec:\dxprhrt.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\htrpd.exec:\htrpd.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pttxbr.exec:\pttxbr.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hxlnt.exec:\hxlnt.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vbbthpx.exec:\vbbthpx.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lbbjr.exec:\lbbjr.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tbljlp.exec:\tbljlp.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hvvdn.exec:\hvvdn.exe37⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tpfvvp.exec:\tpfvvp.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nxfrf.exec:\nxfrf.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fvdbnf.exec:\fvdbnf.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tthlvhv.exec:\tthlvhv.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xvxrfx.exec:\xvxrfx.exe42⤵
- Executes dropped EXE
PID:1276 -
\??\c:\fvbdtnd.exec:\fvbdtnd.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bfttptn.exec:\bfttptn.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dvpfrpr.exec:\dvpfrpr.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xnttx.exec:\xnttx.exe46⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jfnhhhj.exec:\jfnhhhj.exe47⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxtpxx.exec:\fxtpxx.exe48⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xphtdf.exec:\xphtdf.exe49⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jtfnlj.exec:\jtfnlj.exe50⤵
- Executes dropped EXE
PID:796 -
\??\c:\nprrxvv.exec:\nprrxvv.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pvtfttv.exec:\pvtfttv.exe52⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vxrtdt.exec:\vxrtdt.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hhfbb.exec:\hhfbb.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bpbln.exec:\bpbln.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\djbvj.exec:\djbvj.exe56⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jlnll.exec:\jlnll.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rpjpfjp.exec:\rpjpfjp.exe58⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hdxbft.exec:\hdxbft.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lbdbnvl.exec:\lbdbnvl.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\drdhjlr.exec:\drdhjlr.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vxdbxv.exec:\vxdbxv.exe62⤵
- Executes dropped EXE
PID:800 -
\??\c:\xlrdvvh.exec:\xlrdvvh.exe63⤵
- Executes dropped EXE
PID:960 -
\??\c:\lfhxv.exec:\lfhxv.exe64⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nbbxhjh.exec:\nbbxhjh.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hvtxl.exec:\hvtxl.exe66⤵PID:1556
-
\??\c:\hlnrb.exec:\hlnrb.exe67⤵PID:1520
-
\??\c:\hdtndf.exec:\hdtndf.exe68⤵PID:1144
-
\??\c:\ntfvnxf.exec:\ntfvnxf.exe69⤵
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\njtbdv.exec:\njtbdv.exe70⤵PID:2252
-
\??\c:\flxxjd.exec:\flxxjd.exe71⤵PID:316
-
\??\c:\vbxrj.exec:\vbxrj.exe72⤵PID:2368
-
\??\c:\dljxfxv.exec:\dljxfxv.exe73⤵PID:3068
-
\??\c:\vbttj.exec:\vbttj.exe74⤵PID:1636
-
\??\c:\vjtth.exec:\vjtth.exe75⤵PID:1936
-
\??\c:\rbvrfr.exec:\rbvrfr.exe76⤵PID:2836
-
\??\c:\vrpfxnv.exec:\vrpfxnv.exe77⤵PID:2492
-
\??\c:\bfbdp.exec:\bfbdp.exe78⤵PID:1540
-
\??\c:\thltndx.exec:\thltndx.exe79⤵PID:2440
-
\??\c:\pdjthnl.exec:\pdjthnl.exe80⤵PID:2908
-
\??\c:\bfndfrb.exec:\bfndfrb.exe81⤵PID:2176
-
\??\c:\dvljbpp.exec:\dvljbpp.exe82⤵PID:2800
-
\??\c:\lxhvn.exec:\lxhvn.exe83⤵PID:2948
-
\??\c:\pvddljd.exec:\pvddljd.exe84⤵PID:2916
-
\??\c:\nttlt.exec:\nttlt.exe85⤵PID:2680
-
\??\c:\jrbhl.exec:\jrbhl.exe86⤵PID:2704
-
\??\c:\fftbfvd.exec:\fftbfvd.exe87⤵PID:2992
-
\??\c:\xjhdbh.exec:\xjhdbh.exe88⤵PID:884
-
\??\c:\bdjxtp.exec:\bdjxtp.exe89⤵PID:932
-
\??\c:\dnfjtdn.exec:\dnfjtdn.exe90⤵PID:2032
-
\??\c:\xbdnv.exec:\xbdnv.exe91⤵PID:2112
-
\??\c:\ffjxt.exec:\ffjxt.exe92⤵PID:1780
-
\??\c:\nxdvpxv.exec:\nxdvpxv.exe93⤵PID:2012
-
\??\c:\lpjjttv.exec:\lpjjttv.exe94⤵
- System Location Discovery: System Language Discovery
PID:1940 -
\??\c:\hdpfx.exec:\hdpfx.exe95⤵PID:2868
-
\??\c:\hvlbttf.exec:\hvlbttf.exe96⤵PID:2852
-
\??\c:\hxxnd.exec:\hxxnd.exe97⤵PID:1028
-
\??\c:\djjlrjt.exec:\djjlrjt.exe98⤵PID:1860
-
\??\c:\phvpdtn.exec:\phvpdtn.exe99⤵PID:3040
-
\??\c:\bvnrtjv.exec:\bvnrtjv.exe100⤵PID:2172
-
\??\c:\dhrxl.exec:\dhrxl.exe101⤵PID:820
-
\??\c:\rfnvnv.exec:\rfnvnv.exe102⤵PID:1748
-
\??\c:\njtpxvb.exec:\njtpxvb.exe103⤵PID:2624
-
\??\c:\htdflb.exec:\htdflb.exe104⤵PID:1004
-
\??\c:\rhhdr.exec:\rhhdr.exe105⤵PID:1772
-
\??\c:\hrpdj.exec:\hrpdj.exe106⤵PID:1364
-
\??\c:\vtlhxvp.exec:\vtlhxvp.exe107⤵PID:748
-
\??\c:\lhhlhn.exec:\lhhlhn.exe108⤵PID:2240
-
\??\c:\hvjrl.exec:\hvjrl.exe109⤵PID:308
-
\??\c:\nhtrtt.exec:\nhtrtt.exe110⤵PID:2228
-
\??\c:\tdjphvt.exec:\tdjphvt.exe111⤵
- System Location Discovery: System Language Discovery
PID:1740 -
\??\c:\xrdvpdj.exec:\xrdvpdj.exe112⤵PID:2036
-
\??\c:\nfdbrfr.exec:\nfdbrfr.exe113⤵PID:2280
-
\??\c:\xhtvr.exec:\xhtvr.exe114⤵PID:2568
-
\??\c:\rtrjnb.exec:\rtrjnb.exe115⤵PID:2500
-
\??\c:\jbdnt.exec:\jbdnt.exe116⤵PID:1936
-
\??\c:\llhrlbr.exec:\llhrlbr.exe117⤵PID:2212
-
\??\c:\xppnbpl.exec:\xppnbpl.exe118⤵PID:1660
-
\??\c:\rfbhh.exec:\rfbhh.exe119⤵PID:2780
-
\??\c:\jthpfh.exec:\jthpfh.exe120⤵PID:2804
-
\??\c:\fvlnv.exec:\fvlnv.exe121⤵PID:2248
-
\??\c:\ldndp.exec:\ldndp.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-