Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe
-
Size
453KB
-
MD5
58ff3c78deb7507550c8cc33a2bab2ea
-
SHA1
b415980c795b02e126d7df4787cf6e5fea182549
-
SHA256
43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a
-
SHA512
2854cc10ef2b0f05e9de90f89e291d73b472f92ebe8381a1110097c313ebc8b7eac34da3d1ce0ea584a4347e8cab099190898bb6b279bd88432cd1369b35c97b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2268-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-17-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-637-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2740-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-644-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-728-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1596-869-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-910-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1116 pftbvln.exe 1708 npdbfnj.exe 2432 rbfxhb.exe 2880 xljfld.exe 2744 jrlnh.exe 2928 jhtnt.exe 2644 jfjbt.exe 1904 jfnlr.exe 2672 trffp.exe 2688 ljxbvlx.exe 3016 lnrxfff.exe 1740 jtdjn.exe 1984 ltbjn.exe 2868 jbjfvd.exe 1884 flvdbvd.exe 1900 nvdrfxx.exe 1972 xtdbdv.exe 2168 jnxnrd.exe 2544 vldtttb.exe 2252 bbtjl.exe 1064 lthxh.exe 2392 tdfvffl.exe 1368 dbbhtll.exe 2424 jrrntj.exe 2004 hhdrrd.exe 1056 dfbbnh.exe 1540 lxbbb.exe 1412 bhtlf.exe 1532 jbnnn.exe 1344 vrlvj.exe 856 vvrdt.exe 1188 xhvjl.exe 2340 lvjbbp.exe 1596 nflpfx.exe 1116 xdjlpp.exe 2728 plbtt.exe 2884 fhpvnj.exe 2880 lfxlr.exe 1192 tfhbp.exe 2656 fvjbtpj.exe 2052 xnddb.exe 2932 vtltft.exe 1904 ftjjxx.exe 772 dvddjn.exe 1692 tlrjhbx.exe 3040 llxhlvl.exe 3016 xvdxntx.exe 1616 lhxjrb.exe 800 tdpftp.exe 2104 nlffv.exe 1932 rdfbb.exe 1460 fdxbnh.exe 2396 phnxfn.exe 1900 hfvtt.exe 2660 rbhpdh.exe 940 jprjpxp.exe 2056 nhnfhv.exe 2096 xpfpvd.exe 1100 jhbpjjt.exe 2816 xbblhj.exe 276 ppnvr.exe 1268 xdfjx.exe 2400 dbhxxf.exe 612 hvlpvn.exe -
resource yara_rule behavioral1/memory/2268-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-697-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3004-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-869-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfppvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxftnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlbprlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rljhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbhfhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvnjtll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xndvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvfxxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdtjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brrprdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlhxdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrfbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npdbfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdjlpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhxrphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhbfhtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfhlnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvtnplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxfplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhpnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprjpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlbffb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldlnfdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xptndx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntjhj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1116 2268 43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe 31 PID 2268 wrote to memory of 1116 2268 43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe 31 PID 2268 wrote to memory of 1116 2268 43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe 31 PID 2268 wrote to memory of 1116 2268 43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe 31 PID 1116 wrote to memory of 1708 1116 pftbvln.exe 32 PID 1116 wrote to memory of 1708 1116 pftbvln.exe 32 PID 1116 wrote to memory of 1708 1116 pftbvln.exe 32 PID 1116 wrote to memory of 1708 1116 pftbvln.exe 32 PID 1708 wrote to memory of 2432 1708 npdbfnj.exe 33 PID 1708 wrote to memory of 2432 1708 npdbfnj.exe 33 PID 1708 wrote to memory of 2432 1708 npdbfnj.exe 33 PID 1708 wrote to memory of 2432 1708 npdbfnj.exe 33 PID 2432 wrote to memory of 2880 2432 rbfxhb.exe 34 PID 2432 wrote to memory of 2880 2432 rbfxhb.exe 34 PID 2432 wrote to memory of 2880 2432 rbfxhb.exe 34 PID 2432 wrote to memory of 2880 2432 rbfxhb.exe 34 PID 2880 wrote to memory of 2744 2880 xljfld.exe 35 PID 2880 wrote to memory of 2744 2880 xljfld.exe 35 PID 2880 wrote to memory of 2744 2880 xljfld.exe 35 PID 2880 wrote to memory of 2744 2880 xljfld.exe 35 PID 2744 wrote to memory of 2928 2744 jrlnh.exe 36 PID 2744 wrote to memory of 2928 2744 jrlnh.exe 36 PID 2744 wrote to memory of 2928 2744 jrlnh.exe 36 PID 2744 wrote to memory of 2928 2744 jrlnh.exe 36 PID 2928 wrote to memory of 2644 2928 jhtnt.exe 37 PID 2928 wrote to memory of 2644 2928 jhtnt.exe 37 PID 2928 wrote to memory of 2644 2928 jhtnt.exe 37 PID 2928 wrote to memory of 2644 2928 jhtnt.exe 37 PID 2644 wrote to memory of 1904 2644 jfjbt.exe 38 PID 2644 wrote to memory of 1904 2644 jfjbt.exe 38 PID 2644 wrote to memory of 1904 2644 jfjbt.exe 38 PID 2644 wrote to memory of 1904 2644 jfjbt.exe 38 PID 1904 wrote to memory of 2672 1904 jfnlr.exe 39 PID 1904 wrote to memory of 2672 1904 jfnlr.exe 39 PID 1904 wrote to memory of 2672 1904 jfnlr.exe 39 PID 1904 wrote to memory of 2672 1904 jfnlr.exe 39 PID 2672 wrote to memory of 2688 2672 trffp.exe 40 PID 2672 wrote to memory of 2688 2672 trffp.exe 40 PID 2672 wrote to memory of 2688 2672 trffp.exe 40 PID 2672 wrote to memory of 2688 2672 trffp.exe 40 PID 2688 wrote to memory of 3016 2688 ljxbvlx.exe 41 PID 2688 wrote to memory of 3016 2688 ljxbvlx.exe 41 PID 2688 wrote to memory of 3016 2688 ljxbvlx.exe 41 PID 2688 wrote to memory of 3016 2688 ljxbvlx.exe 41 PID 3016 wrote to memory of 1740 3016 lnrxfff.exe 42 PID 3016 wrote to memory of 1740 3016 lnrxfff.exe 42 PID 3016 wrote to memory of 1740 3016 lnrxfff.exe 42 PID 3016 wrote to memory of 1740 3016 lnrxfff.exe 42 PID 1740 wrote to memory of 1984 1740 jtdjn.exe 43 PID 1740 wrote to memory of 1984 1740 jtdjn.exe 43 PID 1740 wrote to memory of 1984 1740 jtdjn.exe 43 PID 1740 wrote to memory of 1984 1740 jtdjn.exe 43 PID 1984 wrote to memory of 2868 1984 ltbjn.exe 44 PID 1984 wrote to memory of 2868 1984 ltbjn.exe 44 PID 1984 wrote to memory of 2868 1984 ltbjn.exe 44 PID 1984 wrote to memory of 2868 1984 ltbjn.exe 44 PID 2868 wrote to memory of 1884 2868 jbjfvd.exe 45 PID 2868 wrote to memory of 1884 2868 jbjfvd.exe 45 PID 2868 wrote to memory of 1884 2868 jbjfvd.exe 45 PID 2868 wrote to memory of 1884 2868 jbjfvd.exe 45 PID 1884 wrote to memory of 1900 1884 flvdbvd.exe 46 PID 1884 wrote to memory of 1900 1884 flvdbvd.exe 46 PID 1884 wrote to memory of 1900 1884 flvdbvd.exe 46 PID 1884 wrote to memory of 1900 1884 flvdbvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe"C:\Users\Admin\AppData\Local\Temp\43c18956538f3fd47aa064c9a4264ad06ca906b8b61cfb30c9aec99e26b3472a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\pftbvln.exec:\pftbvln.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\npdbfnj.exec:\npdbfnj.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\rbfxhb.exec:\rbfxhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xljfld.exec:\xljfld.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jrlnh.exec:\jrlnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jhtnt.exec:\jhtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jfjbt.exec:\jfjbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jfnlr.exec:\jfnlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\trffp.exec:\trffp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ljxbvlx.exec:\ljxbvlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lnrxfff.exec:\lnrxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jtdjn.exec:\jtdjn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ltbjn.exec:\ltbjn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jbjfvd.exec:\jbjfvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\flvdbvd.exec:\flvdbvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\nvdrfxx.exec:\nvdrfxx.exe17⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xtdbdv.exec:\xtdbdv.exe18⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jnxnrd.exec:\jnxnrd.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vldtttb.exec:\vldtttb.exe20⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbtjl.exec:\bbtjl.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lthxh.exec:\lthxh.exe22⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tdfvffl.exec:\tdfvffl.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dbbhtll.exec:\dbbhtll.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jrrntj.exec:\jrrntj.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhdrrd.exec:\hhdrrd.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\dfbbnh.exec:\dfbbnh.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lxbbb.exec:\lxbbb.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bhtlf.exec:\bhtlf.exe29⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jbnnn.exec:\jbnnn.exe30⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vrlvj.exec:\vrlvj.exe31⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vvrdt.exec:\vvrdt.exe32⤵
- Executes dropped EXE
PID:856 -
\??\c:\xhvjl.exec:\xhvjl.exe33⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lvjbbp.exec:\lvjbbp.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nflpfx.exec:\nflpfx.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xdjlpp.exec:\xdjlpp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116 -
\??\c:\plbtt.exec:\plbtt.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fhpvnj.exec:\fhpvnj.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lfxlr.exec:\lfxlr.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tfhbp.exec:\tfhbp.exe40⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fvjbtpj.exec:\fvjbtpj.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xnddb.exec:\xnddb.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vtltft.exec:\vtltft.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ftjjxx.exec:\ftjjxx.exe44⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dvddjn.exec:\dvddjn.exe45⤵
- Executes dropped EXE
PID:772 -
\??\c:\tlrjhbx.exec:\tlrjhbx.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\llxhlvl.exec:\llxhlvl.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xvdxntx.exec:\xvdxntx.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lhxjrb.exec:\lhxjrb.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tdpftp.exec:\tdpftp.exe50⤵
- Executes dropped EXE
PID:800 -
\??\c:\nlffv.exec:\nlffv.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rdfbb.exec:\rdfbb.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fdxbnh.exec:\fdxbnh.exe53⤵
- Executes dropped EXE
PID:1460 -
\??\c:\phnxfn.exec:\phnxfn.exe54⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hfvtt.exec:\hfvtt.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rbhpdh.exec:\rbhpdh.exe56⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jprjpxp.exec:\jprjpxp.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:940 -
\??\c:\nhnfhv.exec:\nhnfhv.exe58⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xpfpvd.exec:\xpfpvd.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jhbpjjt.exec:\jhbpjjt.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xbblhj.exec:\xbblhj.exe61⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ppnvr.exec:\ppnvr.exe62⤵
- Executes dropped EXE
PID:276 -
\??\c:\xdfjx.exec:\xdfjx.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\dbhxxf.exec:\dbhxxf.exe64⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hvlpvn.exec:\hvlpvn.exe65⤵
- Executes dropped EXE
PID:612 -
\??\c:\frvhtxr.exec:\frvhtxr.exe66⤵PID:896
-
\??\c:\tvjfdjn.exec:\tvjfdjn.exe67⤵PID:1688
-
\??\c:\vxvvprl.exec:\vxvvprl.exe68⤵PID:1472
-
\??\c:\tbldpx.exec:\tbldpx.exe69⤵PID:1524
-
\??\c:\rrvfrn.exec:\rrvfrn.exe70⤵PID:2700
-
\??\c:\vvdvl.exec:\vvdvl.exe71⤵PID:2116
-
\??\c:\vvffpl.exec:\vvffpl.exe72⤵PID:1528
-
\??\c:\vllhv.exec:\vllhv.exe73⤵PID:2408
-
\??\c:\djfbx.exec:\djfbx.exe74⤵PID:1672
-
\??\c:\fhtvr.exec:\fhtvr.exe75⤵PID:2332
-
\??\c:\nxnnnpf.exec:\nxnnnpf.exe76⤵PID:2268
-
\??\c:\tjlrrx.exec:\tjlrrx.exe77⤵PID:2340
-
\??\c:\llbdndt.exec:\llbdndt.exe78⤵PID:1720
-
\??\c:\jhvvpr.exec:\jhvvpr.exe79⤵PID:2760
-
\??\c:\dlnfjj.exec:\dlnfjj.exe80⤵PID:2900
-
\??\c:\ljdrfvj.exec:\ljdrfvj.exe81⤵PID:2776
-
\??\c:\rvrnjjr.exec:\rvrnjjr.exe82⤵PID:2628
-
\??\c:\bdvdvxx.exec:\bdvdvxx.exe83⤵PID:2956
-
\??\c:\vlbhndp.exec:\vlbhndp.exe84⤵PID:2784
-
\??\c:\hvrvxl.exec:\hvrvxl.exe85⤵PID:2624
-
\??\c:\vftnnl.exec:\vftnnl.exe86⤵PID:2088
-
\??\c:\fvvnr.exec:\fvvnr.exe87⤵PID:2740
-
\??\c:\bprhxt.exec:\bprhxt.exe88⤵PID:772
-
\??\c:\fvjbtdx.exec:\fvjbtdx.exe89⤵PID:2708
-
\??\c:\djfbnt.exec:\djfbnt.exe90⤵PID:2804
-
\??\c:\rlppx.exec:\rlppx.exe91⤵PID:832
-
\??\c:\dpppnh.exec:\dpppnh.exe92⤵PID:2508
-
\??\c:\rxhbvh.exec:\rxhbvh.exe93⤵PID:2916
-
\??\c:\vnpddlp.exec:\vnpddlp.exe94⤵PID:2972
-
\??\c:\jpjnvl.exec:\jpjnvl.exe95⤵PID:1284
-
\??\c:\fpptvv.exec:\fpptvv.exe96⤵PID:2232
-
\??\c:\lrnnvbh.exec:\lrnnvbh.exe97⤵PID:1888
-
\??\c:\xvtfhbh.exec:\xvtfhbh.exe98⤵PID:1896
-
\??\c:\xxbxhhl.exec:\xxbxhhl.exe99⤵PID:3004
-
\??\c:\dxjjtf.exec:\dxjjtf.exe100⤵PID:2168
-
\??\c:\vrlnjjd.exec:\vrlnjjd.exe101⤵PID:1504
-
\??\c:\xbrjfr.exec:\xbrjfr.exe102⤵PID:1172
-
\??\c:\rvrpdb.exec:\rvrpdb.exe103⤵PID:1052
-
\??\c:\rxpdt.exec:\rxpdt.exe104⤵PID:1964
-
\??\c:\xtllt.exec:\xtllt.exe105⤵PID:640
-
\??\c:\dvbrtn.exec:\dvbrtn.exe106⤵PID:952
-
\??\c:\brtpvj.exec:\brtpvj.exe107⤵PID:1368
-
\??\c:\bhvlvx.exec:\bhvlvx.exe108⤵PID:2856
-
\??\c:\jbrpl.exec:\jbrpl.exe109⤵PID:2004
-
\??\c:\txrjn.exec:\txrjn.exe110⤵PID:1416
-
\??\c:\bjlvj.exec:\bjlvj.exe111⤵PID:1488
-
\??\c:\jfhll.exec:\jfhll.exe112⤵PID:2948
-
\??\c:\hhnxbxr.exec:\hhnxbxr.exe113⤵PID:1660
-
\??\c:\fvnrbtt.exec:\fvnrbtt.exe114⤵PID:2180
-
\??\c:\ddnxvd.exec:\ddnxvd.exe115⤵PID:1528
-
\??\c:\lftrttv.exec:\lftrttv.exe116⤵PID:2064
-
\??\c:\bfhdvrh.exec:\bfhdvrh.exe117⤵PID:1552
-
\??\c:\vntxddb.exec:\vntxddb.exe118⤵PID:2532
-
\??\c:\nxtxrpf.exec:\nxtxrpf.exe119⤵PID:2268
-
\??\c:\lbdnt.exec:\lbdnt.exe120⤵PID:2556
-
\??\c:\ffvfjpr.exec:\ffvfjpr.exe121⤵PID:1596
-
\??\c:\nfljflr.exec:\nfljflr.exe122⤵PID:2200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-