Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24/11/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
-
Size
349KB
-
MD5
c127df286098c6e50dcc0f98b10238be
-
SHA1
01493860a0e40fa19b8e9787316dc79f9db6d558
-
SHA256
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606
-
SHA512
d005189b32569ca993f161e097f60762db154c053fdd432f1c2dd3c853ffdb8399acfec88e77cef27048b4c7ddbde2e08c2cbcbf7162eda1e5c4615db3f473d1
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA4K:l7TcbWXZshJX2VGd4K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2076-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2524-10-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2912-27-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2912-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3008-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1048-56-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1336-68-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2508-83-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2748-93-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1700-103-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2280-111-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1656-125-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1352-142-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1112-160-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1540-163-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/368-178-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2504-188-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/976-205-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2460-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1512-251-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1772-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/668-270-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1328-273-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1328-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2524-312-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1620-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3016-359-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/836-384-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1928-418-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2188-509-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2204-522-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1508-529-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1040-611-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2936-645-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1836-677-0x0000000000260000-0x0000000000288000-memory.dmp family_blackmoon behavioral1/memory/1044-685-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2544-686-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1652-693-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/784-700-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2960-720-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 pfdfnvj.exe 2912 pptxnd.exe 3008 nxvnfpx.exe 3020 hhrhh.exe 1048 rxjvxdn.exe 2796 drfbbx.exe 1336 hhxprdp.exe 2508 npflhtl.exe 2748 pfbbl.exe 1700 nbpbrf.exe 2280 ftvnf.exe 2304 xhjvjrd.exe 1656 bnbtvrd.exe 2860 vxxfpt.exe 1352 xldbrf.exe 1112 lpttp.exe 1540 htfxdd.exe 368 bbntnbx.exe 2504 hljbpdl.exe 2260 hlxvtfv.exe 976 frrnpr.exe 1596 bhndlnv.exe 2444 vrrfnx.exe 1684 xbnnl.exe 2460 btdvltb.exe 1512 fjnpr.exe 1772 rbdblpp.exe 668 dhfvj.exe 1328 npjblvv.exe 704 bprljt.exe 1688 flrhnl.exe 2344 fhjtlnb.exe 2524 njvrbv.exe 1620 hpxlxtl.exe 2396 jnvlvdt.exe 2984 brrjll.exe 2972 bdvjnhl.exe 568 tlhpxn.exe 2032 jplbtdn.exe 3016 tplvjjr.exe 2548 plbrd.exe 2056 ldvfd.exe 644 tlxnv.exe 836 lnvxt.exe 2508 pbvrb.exe 1920 flvrphd.exe 1472 nhvrxt.exe 2252 rdbphv.exe 1928 hrjfftl.exe 436 bbblpph.exe 2332 fhbrl.exe 3004 hvttv.exe 3024 hrhfhl.exe 1412 xffjl.exe 760 tthrtdr.exe 2372 jrbrbhj.exe 1524 rjhdvtn.exe 2432 jlbdrfd.exe 2256 tdnbxfn.exe 2360 vrpthv.exe 2068 rjhhlj.exe 1716 rtnnxj.exe 2188 ltnpx.exe 1624 xhtdpt.exe -
resource yara_rule behavioral1/memory/2076-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2524-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2912-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1048-56-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2796-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-68-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2508-83-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2748-93-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1700-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2280-111-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1656-125-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1352-142-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1112-151-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1112-160-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1540-163-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/368-178-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2504-188-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/976-205-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2460-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1512-251-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1772-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1328-273-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1328-280-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/704-282-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2524-312-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1620-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3016-359-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/836-384-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1928-418-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3004-431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-522-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1508-529-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1544-550-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1040-582-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2936-638-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2936-645-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1044-685-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/384-733-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftvndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdnvjff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phfvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvdhxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxxbjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbldrfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfvbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllblb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frftpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfvnrnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nldlnff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrxjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbjffjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptxnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpvltb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjdvxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpbrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlplnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftvnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthrtdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfbpxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjdxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vthtxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjfxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndhhpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpfrlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpvdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdtlhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftdfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlpjfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrjvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxxlr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2076 2524 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 30 PID 2524 wrote to memory of 2076 2524 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 30 PID 2524 wrote to memory of 2076 2524 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 30 PID 2524 wrote to memory of 2076 2524 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 30 PID 2076 wrote to memory of 2912 2076 pfdfnvj.exe 31 PID 2076 wrote to memory of 2912 2076 pfdfnvj.exe 31 PID 2076 wrote to memory of 2912 2076 pfdfnvj.exe 31 PID 2076 wrote to memory of 2912 2076 pfdfnvj.exe 31 PID 2912 wrote to memory of 3008 2912 pptxnd.exe 32 PID 2912 wrote to memory of 3008 2912 pptxnd.exe 32 PID 2912 wrote to memory of 3008 2912 pptxnd.exe 32 PID 2912 wrote to memory of 3008 2912 pptxnd.exe 32 PID 3008 wrote to memory of 3020 3008 nxvnfpx.exe 33 PID 3008 wrote to memory of 3020 3008 nxvnfpx.exe 33 PID 3008 wrote to memory of 3020 3008 nxvnfpx.exe 33 PID 3008 wrote to memory of 3020 3008 nxvnfpx.exe 33 PID 3020 wrote to memory of 1048 3020 hhrhh.exe 34 PID 3020 wrote to memory of 1048 3020 hhrhh.exe 34 PID 3020 wrote to memory of 1048 3020 hhrhh.exe 34 PID 3020 wrote to memory of 1048 3020 hhrhh.exe 34 PID 1048 wrote to memory of 2796 1048 rxjvxdn.exe 35 PID 1048 wrote to memory of 2796 1048 rxjvxdn.exe 35 PID 1048 wrote to memory of 2796 1048 rxjvxdn.exe 35 PID 1048 wrote to memory of 2796 1048 rxjvxdn.exe 35 PID 2796 wrote to memory of 1336 2796 drfbbx.exe 36 PID 2796 wrote to memory of 1336 2796 drfbbx.exe 36 PID 2796 wrote to memory of 1336 2796 drfbbx.exe 36 PID 2796 wrote to memory of 1336 2796 drfbbx.exe 36 PID 1336 wrote to memory of 2508 1336 hhxprdp.exe 37 PID 1336 wrote to memory of 2508 1336 hhxprdp.exe 37 PID 1336 wrote to memory of 2508 1336 hhxprdp.exe 37 PID 1336 wrote to memory of 2508 1336 hhxprdp.exe 37 PID 2508 wrote to memory of 2748 2508 npflhtl.exe 38 PID 2508 wrote to memory of 2748 2508 npflhtl.exe 38 PID 2508 wrote to memory of 2748 2508 npflhtl.exe 38 PID 2508 wrote to memory of 2748 2508 npflhtl.exe 38 PID 2748 wrote to memory of 1700 2748 pfbbl.exe 39 PID 2748 wrote to memory of 1700 2748 pfbbl.exe 39 PID 2748 wrote to memory of 1700 2748 pfbbl.exe 39 PID 2748 wrote to memory of 1700 2748 pfbbl.exe 39 PID 1700 wrote to memory of 2280 1700 nbpbrf.exe 40 PID 1700 wrote to memory of 2280 1700 nbpbrf.exe 40 PID 1700 wrote to memory of 2280 1700 nbpbrf.exe 40 PID 1700 wrote to memory of 2280 1700 nbpbrf.exe 40 PID 2280 wrote to memory of 2304 2280 ftvnf.exe 41 PID 2280 wrote to memory of 2304 2280 ftvnf.exe 41 PID 2280 wrote to memory of 2304 2280 ftvnf.exe 41 PID 2280 wrote to memory of 2304 2280 ftvnf.exe 41 PID 2304 wrote to memory of 1656 2304 xhjvjrd.exe 42 PID 2304 wrote to memory of 1656 2304 xhjvjrd.exe 42 PID 2304 wrote to memory of 1656 2304 xhjvjrd.exe 42 PID 2304 wrote to memory of 1656 2304 xhjvjrd.exe 42 PID 1656 wrote to memory of 2860 1656 bnbtvrd.exe 43 PID 1656 wrote to memory of 2860 1656 bnbtvrd.exe 43 PID 1656 wrote to memory of 2860 1656 bnbtvrd.exe 43 PID 1656 wrote to memory of 2860 1656 bnbtvrd.exe 43 PID 2860 wrote to memory of 1352 2860 vxxfpt.exe 44 PID 2860 wrote to memory of 1352 2860 vxxfpt.exe 44 PID 2860 wrote to memory of 1352 2860 vxxfpt.exe 44 PID 2860 wrote to memory of 1352 2860 vxxfpt.exe 44 PID 1352 wrote to memory of 1112 1352 xldbrf.exe 45 PID 1352 wrote to memory of 1112 1352 xldbrf.exe 45 PID 1352 wrote to memory of 1112 1352 xldbrf.exe 45 PID 1352 wrote to memory of 1112 1352 xldbrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pfdfnvj.exec:\pfdfnvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pptxnd.exec:\pptxnd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nxvnfpx.exec:\nxvnfpx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hhrhh.exec:\hhrhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rxjvxdn.exec:\rxjvxdn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\drfbbx.exec:\drfbbx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hhxprdp.exec:\hhxprdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\npflhtl.exec:\npflhtl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pfbbl.exec:\pfbbl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nbpbrf.exec:\nbpbrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\ftvnf.exec:\ftvnf.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xhjvjrd.exec:\xhjvjrd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\bnbtvrd.exec:\bnbtvrd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vxxfpt.exec:\vxxfpt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xldbrf.exec:\xldbrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\lpttp.exec:\lpttp.exe17⤵
- Executes dropped EXE
PID:1112 -
\??\c:\htfxdd.exec:\htfxdd.exe18⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bbntnbx.exec:\bbntnbx.exe19⤵
- Executes dropped EXE
PID:368 -
\??\c:\hljbpdl.exec:\hljbpdl.exe20⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hlxvtfv.exec:\hlxvtfv.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\frrnpr.exec:\frrnpr.exe22⤵
- Executes dropped EXE
PID:976 -
\??\c:\bhndlnv.exec:\bhndlnv.exe23⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vrrfnx.exec:\vrrfnx.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xbnnl.exec:\xbnnl.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\btdvltb.exec:\btdvltb.exe26⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fjnpr.exec:\fjnpr.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rbdblpp.exec:\rbdblpp.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dhfvj.exec:\dhfvj.exe29⤵
- Executes dropped EXE
PID:668 -
\??\c:\npjblvv.exec:\npjblvv.exe30⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bprljt.exec:\bprljt.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\flrhnl.exec:\flrhnl.exe32⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fhjtlnb.exec:\fhjtlnb.exe33⤵
- Executes dropped EXE
PID:2344 -
\??\c:\njvrbv.exec:\njvrbv.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hpxlxtl.exec:\hpxlxtl.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jnvlvdt.exec:\jnvlvdt.exe36⤵
- Executes dropped EXE
PID:2396 -
\??\c:\brrjll.exec:\brrjll.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bdvjnhl.exec:\bdvjnhl.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tlhpxn.exec:\tlhpxn.exe39⤵
- Executes dropped EXE
PID:568 -
\??\c:\jplbtdn.exec:\jplbtdn.exe40⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tplvjjr.exec:\tplvjjr.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\plbrd.exec:\plbrd.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ldvfd.exec:\ldvfd.exe43⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tlxnv.exec:\tlxnv.exe44⤵
- Executes dropped EXE
PID:644 -
\??\c:\lnvxt.exec:\lnvxt.exe45⤵
- Executes dropped EXE
PID:836 -
\??\c:\pbvrb.exec:\pbvrb.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\flvrphd.exec:\flvrphd.exe47⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nhvrxt.exec:\nhvrxt.exe48⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rdbphv.exec:\rdbphv.exe49⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hrjfftl.exec:\hrjfftl.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bbblpph.exec:\bbblpph.exe51⤵
- Executes dropped EXE
PID:436 -
\??\c:\fhbrl.exec:\fhbrl.exe52⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hvttv.exec:\hvttv.exe53⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hrhfhl.exec:\hrhfhl.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xffjl.exec:\xffjl.exe55⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tthrtdr.exec:\tthrtdr.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\jrbrbhj.exec:\jrbrbhj.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rjhdvtn.exec:\rjhdvtn.exe58⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jlbdrfd.exec:\jlbdrfd.exe59⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tdnbxfn.exec:\tdnbxfn.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vrpthv.exec:\vrpthv.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rjhhlj.exec:\rjhhlj.exe62⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rtnnxj.exec:\rtnnxj.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ltnpx.exec:\ltnpx.exe64⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xhtdpt.exec:\xhtdpt.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ffpnfh.exec:\ffpnfh.exe66⤵PID:2204
-
\??\c:\jpnhdj.exec:\jpnhdj.exe67⤵PID:1508
-
\??\c:\tlnllnd.exec:\tlnllnd.exe68⤵PID:2460
-
\??\c:\hjhpl.exec:\hjhpl.exe69⤵PID:2704
-
\??\c:\fhrvjd.exec:\fhrvjd.exe70⤵PID:1648
-
\??\c:\jthftr.exec:\jthftr.exe71⤵PID:1544
-
\??\c:\rbplhb.exec:\rbplhb.exe72⤵PID:1236
-
\??\c:\jvpfv.exec:\jvpfv.exe73⤵PID:1332
-
\??\c:\xbnntx.exec:\xbnntx.exe74⤵PID:2764
-
\??\c:\dxtrr.exec:\dxtrr.exe75⤵PID:1032
-
\??\c:\hpvbvnh.exec:\hpvbvnh.exe76⤵PID:1040
-
\??\c:\hdlxl.exec:\hdlxl.exe77⤵PID:2344
-
\??\c:\tjfltx.exec:\tjfltx.exe78⤵PID:2576
-
\??\c:\hpvdpjd.exec:\hpvdpjd.exe79⤵PID:1620
-
\??\c:\lfvnrnf.exec:\lfvnrnf.exe80⤵
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\pvnjxh.exec:\pvnjxh.exe81⤵PID:2904
-
\??\c:\fdvbx.exec:\fdvbx.exe82⤵PID:3000
-
\??\c:\lbtlhr.exec:\lbtlhr.exe83⤵PID:3064
-
\??\c:\fbdlt.exec:\fbdlt.exe84⤵PID:2936
-
\??\c:\xnjbblb.exec:\xnjbblb.exe85⤵PID:2892
-
\??\c:\pltprx.exec:\pltprx.exe86⤵PID:2820
-
\??\c:\hrpjh.exec:\hrpjh.exe87⤵PID:2544
-
\??\c:\bvnxfd.exec:\bvnxfd.exe88⤵PID:1652
-
\??\c:\bvhpbjj.exec:\bvhpbjj.exe89⤵PID:1836
-
\??\c:\rtjhb.exec:\rtjhb.exe90⤵PID:1044
-
\??\c:\rvtxtr.exec:\rvtxtr.exe91⤵PID:572
-
\??\c:\vfjfhv.exec:\vfjfhv.exe92⤵PID:784
-
\??\c:\thjdbf.exec:\thjdbf.exe93⤵PID:2416
-
\??\c:\xjbdtf.exec:\xjbdtf.exe94⤵PID:2872
-
\??\c:\bpfnlf.exec:\bpfnlf.exe95⤵PID:2960
-
\??\c:\drjllr.exec:\drjllr.exe96⤵
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\fvdpnlr.exec:\fvdpnlr.exe97⤵PID:2448
-
\??\c:\pbtndhr.exec:\pbtndhr.exe98⤵PID:384
-
\??\c:\jdhnr.exec:\jdhnr.exe99⤵
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\vvnrb.exec:\vvnrb.exe100⤵PID:2180
-
\??\c:\jpvxn.exec:\jpvxn.exe101⤵PID:2392
-
\??\c:\tfljxfr.exec:\tfljxfr.exe102⤵PID:2404
-
\??\c:\fldtj.exec:\fldtj.exe103⤵PID:2440
-
\??\c:\xxljp.exec:\xxljp.exe104⤵PID:2260
-
\??\c:\tnjjv.exec:\tnjjv.exe105⤵PID:892
-
\??\c:\dvlhjhj.exec:\dvlhjhj.exe106⤵PID:2692
-
\??\c:\vfbpfj.exec:\vfbpfj.exe107⤵PID:1804
-
\??\c:\hffdnnb.exec:\hffdnnb.exe108⤵PID:2064
-
\??\c:\tddhrbb.exec:\tddhrbb.exe109⤵PID:1964
-
\??\c:\fthfd.exec:\fthfd.exe110⤵PID:592
-
\??\c:\nlppfb.exec:\nlppfb.exe111⤵PID:680
-
\??\c:\nptbnb.exec:\nptbnb.exe112⤵PID:2092
-
\??\c:\xdxdhf.exec:\xdxdhf.exe113⤵PID:2664
-
\??\c:\nlrdthh.exec:\nlrdthh.exe114⤵PID:816
-
\??\c:\ftbxpb.exec:\ftbxpb.exe115⤵PID:1764
-
\??\c:\tfrjd.exec:\tfrjd.exe116⤵PID:940
-
\??\c:\tvrpn.exec:\tvrpn.exe117⤵PID:2636
-
\??\c:\tnnvv.exec:\tnnvv.exe118⤵PID:2388
-
\??\c:\nttrnvx.exec:\nttrnvx.exe119⤵PID:2488
-
\??\c:\rjxvjrp.exec:\rjxvjrp.exe120⤵PID:604
-
\??\c:\nrpjv.exec:\nrpjv.exe121⤵PID:2076
-
\??\c:\hhhfvfb.exec:\hhhfvfb.exe122⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-