Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe
-
Size
454KB
-
MD5
86678042be9645902123d3d0c34e4f90
-
SHA1
607b530c51f12783f119fc5512e8d84523261953
-
SHA256
3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906
-
SHA512
48681060f74736f5f1bd2c5ff8263781d7ee9f4abbffe0d7f8eae61acbd1bf94552a0e09be43463bd0258ff532ab60813762157b1a52db75eb6da03e1a81e8f1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2992-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-191-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1932-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-690-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-809-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-857-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1156-864-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2068-968-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 hdtrxt.exe 2896 hrtvv.exe 2952 dnpjrx.exe 3020 xxhxlx.exe 2996 pbrfdl.exe 2752 jfltxxv.exe 2620 njnphj.exe 1744 jjndl.exe 1660 rbnlj.exe 2080 dbltltv.exe 2012 ftbjhbt.exe 2816 prbvt.exe 2184 tfhtrvh.exe 1980 fllhpvn.exe 2408 bpjllr.exe 856 tdndp.exe 1932 fttvh.exe 2292 vdjtphr.exe 1760 tltrv.exe 2564 lvdhdj.exe 2424 bhdvv.exe 2312 rlnfx.exe 1992 ljffthp.exe 1052 xnnffj.exe 792 vtxvj.exe 1504 bbrbdr.exe 776 tvtpdfd.exe 1132 dhtdlp.exe 2440 pttnxj.exe 1852 hdvxt.exe 2396 lftjvp.exe 1168 jvppjb.exe 664 fdbjx.exe 1604 ptdbpd.exe 2448 frrxhd.exe 2472 dnfjv.exe 2856 xfhftd.exe 2952 jnftp.exe 3008 phbbn.exe 2760 nbptndf.exe 2868 bjnvx.exe 2436 nrttj.exe 2608 rrrlrtx.exe 308 rvrjjh.exe 2824 ddjrf.exe 1172 nljlfln.exe 2256 fpnbnt.exe 1624 jhvptb.exe 3052 pvrhx.exe 3032 vjfvvf.exe 2184 djtvft.exe 2696 pxlrd.exe 2528 ppxft.exe 2152 tdptvdn.exe 1468 vhtdv.exe 2260 npvnj.exe 2292 ftrlr.exe 2120 bbxjx.exe 2300 xdbtp.exe 2476 ptptff.exe 1900 jvnhbbv.exe 2160 bbhjvl.exe 1668 rtpbj.exe 1828 tvjhnb.exe -
resource yara_rule behavioral1/memory/2992-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvbbtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhlxxdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvbrjxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjpnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bltbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrbftd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhfdtdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdnbjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlxblpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnjrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlfttpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbtjxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlfvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trfhrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdnflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpbxvrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxpxjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phvhlhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhvxxjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvjjfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brpnrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhbhxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllhpvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlhxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpjth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plpxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3000 2992 3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe 30 PID 2992 wrote to memory of 3000 2992 3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe 30 PID 2992 wrote to memory of 3000 2992 3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe 30 PID 2992 wrote to memory of 3000 2992 3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe 30 PID 3000 wrote to memory of 2896 3000 hdtrxt.exe 31 PID 3000 wrote to memory of 2896 3000 hdtrxt.exe 31 PID 3000 wrote to memory of 2896 3000 hdtrxt.exe 31 PID 3000 wrote to memory of 2896 3000 hdtrxt.exe 31 PID 2896 wrote to memory of 2952 2896 hrtvv.exe 67 PID 2896 wrote to memory of 2952 2896 hrtvv.exe 67 PID 2896 wrote to memory of 2952 2896 hrtvv.exe 67 PID 2896 wrote to memory of 2952 2896 hrtvv.exe 67 PID 2952 wrote to memory of 3020 2952 dnpjrx.exe 33 PID 2952 wrote to memory of 3020 2952 dnpjrx.exe 33 PID 2952 wrote to memory of 3020 2952 dnpjrx.exe 33 PID 2952 wrote to memory of 3020 2952 dnpjrx.exe 33 PID 3020 wrote to memory of 2996 3020 xxhxlx.exe 34 PID 3020 wrote to memory of 2996 3020 xxhxlx.exe 34 PID 3020 wrote to memory of 2996 3020 xxhxlx.exe 34 PID 3020 wrote to memory of 2996 3020 xxhxlx.exe 34 PID 2996 wrote to memory of 2752 2996 pbrfdl.exe 35 PID 2996 wrote to memory of 2752 2996 pbrfdl.exe 35 PID 2996 wrote to memory of 2752 2996 pbrfdl.exe 35 PID 2996 wrote to memory of 2752 2996 pbrfdl.exe 35 PID 2752 wrote to memory of 2620 2752 jfltxxv.exe 36 PID 2752 wrote to memory of 2620 2752 jfltxxv.exe 36 PID 2752 wrote to memory of 2620 2752 jfltxxv.exe 36 PID 2752 wrote to memory of 2620 2752 jfltxxv.exe 36 PID 2620 wrote to memory of 1744 2620 njnphj.exe 37 PID 2620 wrote to memory of 1744 2620 njnphj.exe 37 PID 2620 wrote to memory of 1744 2620 njnphj.exe 37 PID 2620 wrote to memory of 1744 2620 njnphj.exe 37 PID 1744 wrote to memory of 1660 1744 jjndl.exe 38 PID 1744 wrote to memory of 1660 1744 jjndl.exe 38 PID 1744 wrote to memory of 1660 1744 jjndl.exe 38 PID 1744 wrote to memory of 1660 1744 jjndl.exe 38 PID 1660 wrote to memory of 2080 1660 rbnlj.exe 39 PID 1660 wrote to memory of 2080 1660 rbnlj.exe 39 PID 1660 wrote to memory of 2080 1660 rbnlj.exe 39 PID 1660 wrote to memory of 2080 1660 rbnlj.exe 39 PID 2080 wrote to memory of 2012 2080 dbltltv.exe 40 PID 2080 wrote to memory of 2012 2080 dbltltv.exe 40 PID 2080 wrote to memory of 2012 2080 dbltltv.exe 40 PID 2080 wrote to memory of 2012 2080 dbltltv.exe 40 PID 2012 wrote to memory of 2816 2012 ftbjhbt.exe 41 PID 2012 wrote to memory of 2816 2012 ftbjhbt.exe 41 PID 2012 wrote to memory of 2816 2012 ftbjhbt.exe 41 PID 2012 wrote to memory of 2816 2012 ftbjhbt.exe 41 PID 2816 wrote to memory of 2184 2816 prbvt.exe 42 PID 2816 wrote to memory of 2184 2816 prbvt.exe 42 PID 2816 wrote to memory of 2184 2816 prbvt.exe 42 PID 2816 wrote to memory of 2184 2816 prbvt.exe 42 PID 2184 wrote to memory of 1980 2184 tfhtrvh.exe 43 PID 2184 wrote to memory of 1980 2184 tfhtrvh.exe 43 PID 2184 wrote to memory of 1980 2184 tfhtrvh.exe 43 PID 2184 wrote to memory of 1980 2184 tfhtrvh.exe 43 PID 1980 wrote to memory of 2408 1980 fllhpvn.exe 44 PID 1980 wrote to memory of 2408 1980 fllhpvn.exe 44 PID 1980 wrote to memory of 2408 1980 fllhpvn.exe 44 PID 1980 wrote to memory of 2408 1980 fllhpvn.exe 44 PID 2408 wrote to memory of 856 2408 bpjllr.exe 45 PID 2408 wrote to memory of 856 2408 bpjllr.exe 45 PID 2408 wrote to memory of 856 2408 bpjllr.exe 45 PID 2408 wrote to memory of 856 2408 bpjllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe"C:\Users\Admin\AppData\Local\Temp\3872f35951eeabc9d9fd9caab949914a229d0c045e92197b940f56c5e1e26906N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hdtrxt.exec:\hdtrxt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hrtvv.exec:\hrtvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dnpjrx.exec:\dnpjrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xxhxlx.exec:\xxhxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pbrfdl.exec:\pbrfdl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jfltxxv.exec:\jfltxxv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\njnphj.exec:\njnphj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jjndl.exec:\jjndl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\rbnlj.exec:\rbnlj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\dbltltv.exec:\dbltltv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ftbjhbt.exec:\ftbjhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\prbvt.exec:\prbvt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tfhtrvh.exec:\tfhtrvh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\fllhpvn.exec:\fllhpvn.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\bpjllr.exec:\bpjllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\tdndp.exec:\tdndp.exe17⤵
- Executes dropped EXE
PID:856 -
\??\c:\fttvh.exec:\fttvh.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vdjtphr.exec:\vdjtphr.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tltrv.exec:\tltrv.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lvdhdj.exec:\lvdhdj.exe21⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bhdvv.exec:\bhdvv.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlnfx.exec:\rlnfx.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ljffthp.exec:\ljffthp.exe24⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xnnffj.exec:\xnnffj.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vtxvj.exec:\vtxvj.exe26⤵
- Executes dropped EXE
PID:792 -
\??\c:\bbrbdr.exec:\bbrbdr.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tvtpdfd.exec:\tvtpdfd.exe28⤵
- Executes dropped EXE
PID:776 -
\??\c:\dhtdlp.exec:\dhtdlp.exe29⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pttnxj.exec:\pttnxj.exe30⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hdvxt.exec:\hdvxt.exe31⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lftjvp.exec:\lftjvp.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvppjb.exec:\jvppjb.exe33⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fdbjx.exec:\fdbjx.exe34⤵
- Executes dropped EXE
PID:664 -
\??\c:\ptdbpd.exec:\ptdbpd.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\frrxhd.exec:\frrxhd.exe36⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dnfjv.exec:\dnfjv.exe37⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xfhftd.exec:\xfhftd.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jnftp.exec:\jnftp.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\phbbn.exec:\phbbn.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbptndf.exec:\nbptndf.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bjnvx.exec:\bjnvx.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nrttj.exec:\nrttj.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrrlrtx.exec:\rrrlrtx.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rvrjjh.exec:\rvrjjh.exe45⤵
- Executes dropped EXE
PID:308 -
\??\c:\ddjrf.exec:\ddjrf.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nljlfln.exec:\nljlfln.exe47⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fpnbnt.exec:\fpnbnt.exe48⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jhvptb.exec:\jhvptb.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pvrhx.exec:\pvrhx.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\vjfvvf.exec:\vjfvvf.exe51⤵
- Executes dropped EXE
PID:3032 -
\??\c:\djtvft.exec:\djtvft.exe52⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pxlrd.exec:\pxlrd.exe53⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ppxft.exec:\ppxft.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tdptvdn.exec:\tdptvdn.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vhtdv.exec:\vhtdv.exe56⤵
- Executes dropped EXE
PID:1468 -
\??\c:\npvnj.exec:\npvnj.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ftrlr.exec:\ftrlr.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bbxjx.exec:\bbxjx.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xdbtp.exec:\xdbtp.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ptptff.exec:\ptptff.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jvnhbbv.exec:\jvnhbbv.exe62⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bbhjvl.exec:\bbhjvl.exe63⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rtpbj.exec:\rtpbj.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tvjhnb.exec:\tvjhnb.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hdvjtf.exec:\hdvjtf.exe66⤵PID:236
-
\??\c:\vrjhd.exec:\vrjhd.exe67⤵PID:1500
-
\??\c:\rfdphbn.exec:\rfdphbn.exe68⤵PID:1372
-
\??\c:\hppbvx.exec:\hppbvx.exe69⤵PID:1748
-
\??\c:\dlvtnhd.exec:\dlvtnhd.exe70⤵PID:584
-
\??\c:\lbrhp.exec:\lbrhp.exe71⤵PID:2000
-
\??\c:\pvrtth.exec:\pvrtth.exe72⤵PID:2132
-
\??\c:\vlnxxbx.exec:\vlnxxbx.exe73⤵PID:2712
-
\??\c:\rjfjrrh.exec:\rjfjrrh.exe74⤵PID:2396
-
\??\c:\fnllh.exec:\fnllh.exe75⤵PID:1156
-
\??\c:\dlpnndb.exec:\dlpnndb.exe76⤵PID:2384
-
\??\c:\tvjprlf.exec:\tvjprlf.exe77⤵PID:1700
-
\??\c:\dnxxx.exec:\dnxxx.exe78⤵PID:1604
-
\??\c:\rfjxh.exec:\rfjxh.exe79⤵PID:3000
-
\??\c:\pjdhr.exec:\pjdhr.exe80⤵PID:2960
-
\??\c:\xdhrbr.exec:\xdhrbr.exe81⤵PID:2900
-
\??\c:\pxppl.exec:\pxppl.exe82⤵PID:2784
-
\??\c:\hbvbnlb.exec:\hbvbnlb.exe83⤵PID:2616
-
\??\c:\xdfvvfd.exec:\xdfvvfd.exe84⤵PID:2780
-
\??\c:\pvhxtvh.exec:\pvhxtvh.exe85⤵PID:3016
-
\??\c:\ljpxr.exec:\ljpxr.exe86⤵PID:2204
-
\??\c:\rfbhbht.exec:\rfbhbht.exe87⤵PID:2728
-
\??\c:\dnbpxj.exec:\dnbpxj.exe88⤵PID:1936
-
\??\c:\btpddp.exec:\btpddp.exe89⤵PID:1708
-
\??\c:\dhffj.exec:\dhffj.exe90⤵
- System Location Discovery: System Language Discovery
PID:2716 -
\??\c:\bppvdh.exec:\bppvdh.exe91⤵PID:1172
-
\??\c:\fjbffbl.exec:\fjbffbl.exe92⤵PID:2156
-
\??\c:\fjjbtbr.exec:\fjjbtbr.exe93⤵PID:3044
-
\??\c:\jhljh.exec:\jhljh.exe94⤵PID:2108
-
\??\c:\bbvhvvv.exec:\bbvhvvv.exe95⤵PID:940
-
\??\c:\xxdftpj.exec:\xxdftpj.exe96⤵PID:1968
-
\??\c:\dtjttt.exec:\dtjttt.exe97⤵PID:2696
-
\??\c:\nrrjrjl.exec:\nrrjrjl.exe98⤵PID:2656
-
\??\c:\xnlxtf.exec:\xnlxtf.exe99⤵PID:1956
-
\??\c:\ljpdhxr.exec:\ljpdhxr.exe100⤵PID:856
-
\??\c:\nrllpvp.exec:\nrllpvp.exe101⤵PID:2260
-
\??\c:\ptlfxdf.exec:\ptlfxdf.exe102⤵PID:2292
-
\??\c:\xptfp.exec:\xptfp.exe103⤵PID:2304
-
\??\c:\hvhrdp.exec:\hvhrdp.exe104⤵PID:908
-
\??\c:\nrblp.exec:\nrblp.exe105⤵PID:560
-
\??\c:\fxxpd.exec:\fxxpd.exe106⤵PID:1896
-
\??\c:\xnjhf.exec:\xnjhf.exe107⤵PID:760
-
\??\c:\dddhj.exec:\dddhj.exe108⤵PID:1992
-
\??\c:\vfhfrn.exec:\vfhfrn.exe109⤵PID:1828
-
\??\c:\vhnfr.exec:\vhnfr.exe110⤵PID:1380
-
\??\c:\lfffnd.exec:\lfffnd.exe111⤵PID:1504
-
\??\c:\rldbrj.exec:\rldbrj.exe112⤵PID:936
-
\??\c:\hrttjdj.exec:\hrttjdj.exe113⤵PID:2680
-
\??\c:\hrdfd.exec:\hrdfd.exe114⤵PID:596
-
\??\c:\dlvjxn.exec:\dlvjxn.exe115⤵PID:1840
-
\??\c:\bthvh.exec:\bthvh.exe116⤵PID:1852
-
\??\c:\nflfptd.exec:\nflfptd.exe117⤵PID:1928
-
\??\c:\pprntrp.exec:\pprntrp.exe118⤵PID:2664
-
\??\c:\lbhxjhd.exec:\lbhxjhd.exe119⤵PID:1156
-
\??\c:\bhnxxxx.exec:\bhnxxxx.exe120⤵
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\ttnhlrx.exec:\ttnhlrx.exe121⤵PID:1700
-
\??\c:\lbvvtvn.exec:\lbvvtvn.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-