Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 08:15
Static task
static1
Behavioral task
behavioral1
Sample
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe
Resource
win7-20241010-en
General
-
Target
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe
-
Size
60KB
-
MD5
c4a43197a645839e22ad1f015eecc7e4
-
SHA1
20b93c3df473d034bf2be39798e9b1e56b101df1
-
SHA256
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611
-
SHA512
85c31158e33b792642764b1a3363558330e7bf041e13f0e551d0affe206936bb987060eee79dfaee6d11a42426558b1bcca334c94e09bd41805bf5707e804088
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIm2hR0fD:ymb3NkkiQ3mdBjFIsIrhRkD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2476-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/652-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fvdjhb.exenxdrr.exefpbbfx.exejdftlfh.exepvphthv.exenpjvxxb.exepvjhphb.exeblhfndv.exenhxxbll.exefvbbn.exenfbjrt.exexrbtv.exexbtjl.exetlrnv.exetnpxth.exehxvpv.exedljhxhp.exervbvp.exefdnpfd.exebxnhfr.exepddpdd.exednvxp.exenhnttd.exeftplxxx.exejjprn.exefvlxt.exelbtvn.exednvbv.exelfnfxn.exeflbdph.exepffxn.exelpxhhx.exendvrl.exejtxrf.exedvfpjln.exebrrttx.exefxdpthb.exebdfrjhp.exehbfnvbj.exehbpbrlx.exennthbp.exedljtj.exenddvfhb.exefnfxtln.exetdvtbbv.exejprpdr.exerlnlrt.exejrhnn.exetddtffl.exedhrtbvb.exerrhpr.exelvxrn.exehtvdp.exehhftvt.exexnrbl.exedjjtvj.exexthnhh.exehfxhj.exedpvrvr.exebjpdh.exevtxpr.exexhvdvnr.exetplfd.exefvtdl.exepid Process 2888 fvdjhb.exe 2796 nxdrr.exe 2696 fpbbfx.exe 2880 jdftlfh.exe 2692 pvphthv.exe 1892 npjvxxb.exe 2192 pvjhphb.exe 1056 blhfndv.exe 2232 nhxxbll.exe 1844 fvbbn.exe 1728 nfbjrt.exe 2964 xrbtv.exe 2996 xbtjl.exe 1020 tlrnv.exe 592 tnpxth.exe 2520 hxvpv.exe 948 dljhxhp.exe 2228 rvbvp.exe 2324 fdnpfd.exe 1808 bxnhfr.exe 904 pddpdd.exe 652 dnvxp.exe 1528 nhnttd.exe 1652 ftplxxx.exe 2336 jjprn.exe 2268 fvlxt.exe 2576 lbtvn.exe 1096 dnvbv.exe 552 lfnfxn.exe 3068 flbdph.exe 1536 pffxn.exe 2808 lpxhhx.exe 2496 ndvrl.exe 1568 jtxrf.exe 2668 dvfpjln.exe 2684 brrttx.exe 2776 fxdpthb.exe 2732 bdfrjhp.exe 1912 hbfnvbj.exe 2692 hbpbrlx.exe 2704 nnthbp.exe 2200 dljtj.exe 1180 nddvfhb.exe 2172 fnfxtln.exe 3028 tdvtbbv.exe 1696 jprpdr.exe 2748 rlnlrt.exe 2372 jrhnn.exe 2860 tddtffl.exe 2992 dhrtbvb.exe 464 rrhpr.exe 520 lvxrn.exe 1140 htvdp.exe 2516 hhftvt.exe 2620 xnrbl.exe 1420 djjtvj.exe 672 xthnhh.exe 1072 hfxhj.exe 1484 dpvrvr.exe 1944 bjpdh.exe 1252 vtxpr.exe 1540 xhvdvnr.exe 2076 tplfd.exe 2560 fvtdl.exe -
Processes:
resource yara_rule behavioral1/memory/2476-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/652-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pvvhjp.exenbvttn.exehlxrlv.exexbnrtj.exedjjtvj.exetjvflxd.exetvnhrtb.exevxjxnvv.exehvjjtnj.exerhtxr.exerrxhr.exelpfjbvr.exebvjjlnb.exebbblnxf.exelfphrd.exedhdjr.exebjpdh.exehvtrf.exehxnlxf.exehjxfx.exeftrbb.exerhbrlhn.exehxvpv.exejxnfl.exelnbbv.exexdlbnrj.exexplth.exelbxvfx.exehdjxnbl.exexhbtphf.exelhpdf.exefjjbrxl.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvhjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbvttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxrlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbnrtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjtvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjvflxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnhrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxjxnvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvjjtnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpfjbvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvjjlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbblnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfphrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhdjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjpdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxnlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbrlhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnbbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdlbnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxvfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdjxnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbtphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhpdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjbrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exefvdjhb.exenxdrr.exefpbbfx.exejdftlfh.exepvphthv.exenpjvxxb.exepvjhphb.exeblhfndv.exenhxxbll.exefvbbn.exenfbjrt.exexrbtv.exexbtjl.exetlrnv.exetnpxth.exedescription pid Process procid_target PID 2476 wrote to memory of 2888 2476 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 30 PID 2476 wrote to memory of 2888 2476 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 30 PID 2476 wrote to memory of 2888 2476 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 30 PID 2476 wrote to memory of 2888 2476 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 30 PID 2888 wrote to memory of 2796 2888 fvdjhb.exe 31 PID 2888 wrote to memory of 2796 2888 fvdjhb.exe 31 PID 2888 wrote to memory of 2796 2888 fvdjhb.exe 31 PID 2888 wrote to memory of 2796 2888 fvdjhb.exe 31 PID 2796 wrote to memory of 2696 2796 nxdrr.exe 32 PID 2796 wrote to memory of 2696 2796 nxdrr.exe 32 PID 2796 wrote to memory of 2696 2796 nxdrr.exe 32 PID 2796 wrote to memory of 2696 2796 nxdrr.exe 32 PID 2696 wrote to memory of 2880 2696 fpbbfx.exe 33 PID 2696 wrote to memory of 2880 2696 fpbbfx.exe 33 PID 2696 wrote to memory of 2880 2696 fpbbfx.exe 33 PID 2696 wrote to memory of 2880 2696 fpbbfx.exe 33 PID 2880 wrote to memory of 2692 2880 jdftlfh.exe 34 PID 2880 wrote to memory of 2692 2880 jdftlfh.exe 34 PID 2880 wrote to memory of 2692 2880 jdftlfh.exe 34 PID 2880 wrote to memory of 2692 2880 jdftlfh.exe 34 PID 2692 wrote to memory of 1892 2692 pvphthv.exe 35 PID 2692 wrote to memory of 1892 2692 pvphthv.exe 35 PID 2692 wrote to memory of 1892 2692 pvphthv.exe 35 PID 2692 wrote to memory of 1892 2692 pvphthv.exe 35 PID 1892 wrote to memory of 2192 1892 npjvxxb.exe 36 PID 1892 wrote to memory of 2192 1892 npjvxxb.exe 36 PID 1892 wrote to memory of 2192 1892 npjvxxb.exe 36 PID 1892 wrote to memory of 2192 1892 npjvxxb.exe 36 PID 2192 wrote to memory of 1056 2192 pvjhphb.exe 37 PID 2192 wrote to memory of 1056 2192 pvjhphb.exe 37 PID 2192 wrote to memory of 1056 2192 pvjhphb.exe 37 PID 2192 wrote to memory of 1056 2192 pvjhphb.exe 37 PID 1056 wrote to memory of 2232 1056 blhfndv.exe 38 PID 1056 wrote to memory of 2232 1056 blhfndv.exe 38 PID 1056 wrote to memory of 2232 1056 blhfndv.exe 38 PID 1056 wrote to memory of 2232 1056 blhfndv.exe 38 PID 2232 wrote to memory of 1844 2232 nhxxbll.exe 39 PID 2232 wrote to memory of 1844 2232 nhxxbll.exe 39 PID 2232 wrote to memory of 1844 2232 nhxxbll.exe 39 PID 2232 wrote to memory of 1844 2232 nhxxbll.exe 39 PID 1844 wrote to memory of 1728 1844 fvbbn.exe 40 PID 1844 wrote to memory of 1728 1844 fvbbn.exe 40 PID 1844 wrote to memory of 1728 1844 fvbbn.exe 40 PID 1844 wrote to memory of 1728 1844 fvbbn.exe 40 PID 1728 wrote to memory of 2964 1728 nfbjrt.exe 41 PID 1728 wrote to memory of 2964 1728 nfbjrt.exe 41 PID 1728 wrote to memory of 2964 1728 nfbjrt.exe 41 PID 1728 wrote to memory of 2964 1728 nfbjrt.exe 41 PID 2964 wrote to memory of 2996 2964 xrbtv.exe 42 PID 2964 wrote to memory of 2996 2964 xrbtv.exe 42 PID 2964 wrote to memory of 2996 2964 xrbtv.exe 42 PID 2964 wrote to memory of 2996 2964 xrbtv.exe 42 PID 2996 wrote to memory of 1020 2996 xbtjl.exe 43 PID 2996 wrote to memory of 1020 2996 xbtjl.exe 43 PID 2996 wrote to memory of 1020 2996 xbtjl.exe 43 PID 2996 wrote to memory of 1020 2996 xbtjl.exe 43 PID 1020 wrote to memory of 592 1020 tlrnv.exe 44 PID 1020 wrote to memory of 592 1020 tlrnv.exe 44 PID 1020 wrote to memory of 592 1020 tlrnv.exe 44 PID 1020 wrote to memory of 592 1020 tlrnv.exe 44 PID 592 wrote to memory of 2520 592 tnpxth.exe 45 PID 592 wrote to memory of 2520 592 tnpxth.exe 45 PID 592 wrote to memory of 2520 592 tnpxth.exe 45 PID 592 wrote to memory of 2520 592 tnpxth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe"C:\Users\Admin\AppData\Local\Temp\b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\fvdjhb.exec:\fvdjhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nxdrr.exec:\nxdrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\fpbbfx.exec:\fpbbfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jdftlfh.exec:\jdftlfh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pvphthv.exec:\pvphthv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\npjvxxb.exec:\npjvxxb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\pvjhphb.exec:\pvjhphb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\blhfndv.exec:\blhfndv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\nhxxbll.exec:\nhxxbll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\fvbbn.exec:\fvbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\nfbjrt.exec:\nfbjrt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xrbtv.exec:\xrbtv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xbtjl.exec:\xbtjl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tlrnv.exec:\tlrnv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\tnpxth.exec:\tnpxth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\hxvpv.exec:\hxvpv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\dljhxhp.exec:\dljhxhp.exe18⤵
- Executes dropped EXE
PID:948 -
\??\c:\rvbvp.exec:\rvbvp.exe19⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fdnpfd.exec:\fdnpfd.exe20⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bxnhfr.exec:\bxnhfr.exe21⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pddpdd.exec:\pddpdd.exe22⤵
- Executes dropped EXE
PID:904 -
\??\c:\dnvxp.exec:\dnvxp.exe23⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhnttd.exec:\nhnttd.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ftplxxx.exec:\ftplxxx.exe25⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jjprn.exec:\jjprn.exe26⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fvlxt.exec:\fvlxt.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lbtvn.exec:\lbtvn.exe28⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dnvbv.exec:\dnvbv.exe29⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lfnfxn.exec:\lfnfxn.exe30⤵
- Executes dropped EXE
PID:552 -
\??\c:\flbdph.exec:\flbdph.exe31⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pffxn.exec:\pffxn.exe32⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lpxhhx.exec:\lpxhhx.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ndvrl.exec:\ndvrl.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jtxrf.exec:\jtxrf.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\dvfpjln.exec:\dvfpjln.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\brrttx.exec:\brrttx.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxdpthb.exec:\fxdpthb.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bdfrjhp.exec:\bdfrjhp.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbfnvbj.exec:\hbfnvbj.exe40⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hbpbrlx.exec:\hbpbrlx.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nnthbp.exec:\nnthbp.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dljtj.exec:\dljtj.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nddvfhb.exec:\nddvfhb.exe44⤵
- Executes dropped EXE
PID:1180 -
\??\c:\fnfxtln.exec:\fnfxtln.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tdvtbbv.exec:\tdvtbbv.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jprpdr.exec:\jprpdr.exe47⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlnlrt.exec:\rlnlrt.exe48⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jrhnn.exec:\jrhnn.exe49⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tddtffl.exec:\tddtffl.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dhrtbvb.exec:\dhrtbvb.exe51⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rrhpr.exec:\rrhpr.exe52⤵
- Executes dropped EXE
PID:464 -
\??\c:\lvxrn.exec:\lvxrn.exe53⤵
- Executes dropped EXE
PID:520 -
\??\c:\htvdp.exec:\htvdp.exe54⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hhftvt.exec:\hhftvt.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xnrbl.exec:\xnrbl.exe56⤵
- Executes dropped EXE
PID:2620 -
\??\c:\djjtvj.exec:\djjtvj.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\xthnhh.exec:\xthnhh.exe58⤵
- Executes dropped EXE
PID:672 -
\??\c:\hfxhj.exec:\hfxhj.exe59⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dpvrvr.exec:\dpvrvr.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bjpdh.exec:\bjpdh.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\vtxpr.exec:\vtxpr.exe62⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xhvdvnr.exec:\xhvdvnr.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tplfd.exec:\tplfd.exe64⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fvtdl.exec:\fvtdl.exe65⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lfxvfff.exec:\lfxvfff.exe66⤵PID:2036
-
\??\c:\hbxxp.exec:\hbxxp.exe67⤵PID:1508
-
\??\c:\phxdlt.exec:\phxdlt.exe68⤵PID:1752
-
\??\c:\lljvbp.exec:\lljvbp.exe69⤵PID:2124
-
\??\c:\hltdp.exec:\hltdp.exe70⤵PID:1144
-
\??\c:\tptrx.exec:\tptrx.exe71⤵PID:764
-
\??\c:\hdjxnbl.exec:\hdjxnbl.exe72⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\rdjpn.exec:\rdjpn.exe73⤵PID:2804
-
\??\c:\vdjxvp.exec:\vdjxvp.exe74⤵PID:2928
-
\??\c:\rjjjh.exec:\rjjjh.exe75⤵PID:2876
-
\??\c:\thhdrpl.exec:\thhdrpl.exe76⤵PID:1700
-
\??\c:\hjhdb.exec:\hjhdb.exe77⤵PID:2868
-
\??\c:\rrjfnfl.exec:\rrjfnfl.exe78⤵PID:2872
-
\??\c:\tlthnfn.exec:\tlthnfn.exe79⤵PID:2880
-
\??\c:\ftfpv.exec:\ftfpv.exe80⤵PID:2652
-
\??\c:\dbtpxh.exec:\dbtpxh.exe81⤵PID:2712
-
\??\c:\njvlvtv.exec:\njvlvtv.exe82⤵PID:636
-
\??\c:\lxxlljt.exec:\lxxlljt.exe83⤵PID:1976
-
\??\c:\nhltphd.exec:\nhltphd.exe84⤵PID:2704
-
\??\c:\jxnfl.exec:\jxnfl.exe85⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\phffnv.exec:\phffnv.exe86⤵PID:2636
-
\??\c:\xtfnhll.exec:\xtfnhll.exe87⤵PID:2532
-
\??\c:\vxrrhxt.exec:\vxrrhxt.exe88⤵PID:1844
-
\??\c:\pljtdrh.exec:\pljtdrh.exe89⤵PID:1680
-
\??\c:\rpdfvd.exec:\rpdfvd.exe90⤵PID:2952
-
\??\c:\hlhtfd.exec:\hlhtfd.exe91⤵PID:3036
-
\??\c:\nfxpbr.exec:\nfxpbr.exe92⤵PID:2760
-
\??\c:\nvrdxxh.exec:\nvrdxxh.exe93⤵PID:428
-
\??\c:\hhlnfl.exec:\hhlnfl.exe94⤵PID:2480
-
\??\c:\xnfndp.exec:\xnfndp.exe95⤵PID:2380
-
\??\c:\prbvv.exec:\prbvv.exe96⤵PID:1956
-
\??\c:\vjpvrnv.exec:\vjpvrnv.exe97⤵PID:2088
-
\??\c:\prfff.exec:\prfff.exe98⤵PID:2456
-
\??\c:\xbhhtp.exec:\xbhhtp.exe99⤵PID:1228
-
\??\c:\fflxd.exec:\fflxd.exe100⤵PID:2548
-
\??\c:\vjjxxxl.exec:\vjjxxxl.exe101⤵PID:2024
-
\??\c:\lblxjj.exec:\lblxjj.exe102⤵PID:1624
-
\??\c:\bpdjlt.exec:\bpdjlt.exe103⤵PID:1080
-
\??\c:\lhtpxld.exec:\lhtpxld.exe104⤵PID:800
-
\??\c:\jvvhf.exec:\jvvhf.exe105⤵PID:1296
-
\??\c:\nhjlrpn.exec:\nhjlrpn.exe106⤵PID:952
-
\??\c:\hhhxpv.exec:\hhhxpv.exe107⤵PID:2416
-
\??\c:\lxvhjl.exec:\lxvhjl.exe108⤵PID:1924
-
\??\c:\xtvtjnn.exec:\xtvtjnn.exe109⤵PID:536
-
\??\c:\xtbbrj.exec:\xtbbrj.exe110⤵PID:2128
-
\??\c:\fnpflxv.exec:\fnpflxv.exe111⤵PID:616
-
\??\c:\rprxdl.exec:\rprxdl.exe112⤵PID:1960
-
\??\c:\lfpxn.exec:\lfpxn.exe113⤵PID:2772
-
\??\c:\tpjxlx.exec:\tpjxlx.exe114⤵PID:2104
-
\??\c:\jhvpt.exec:\jhvpt.exe115⤵PID:2792
-
\??\c:\bjbrnv.exec:\bjbrnv.exe116⤵PID:2896
-
\??\c:\pnbnpf.exec:\pnbnpf.exe117⤵PID:2280
-
\??\c:\xnxldl.exec:\xnxldl.exe118⤵PID:2796
-
\??\c:\txfthlr.exec:\txfthlr.exe119⤵PID:2848
-
\??\c:\tvvxd.exec:\tvvxd.exe120⤵PID:1208
-
\??\c:\frfvx.exec:\frfvx.exe121⤵PID:2732
-
\??\c:\trhvnj.exec:\trhvnj.exe122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-