Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe
-
Size
456KB
-
MD5
a7f9ade8b35a7ab920f0611e01a25578
-
SHA1
81bb778fdb969dbeae54c7fcfe0937afd84ccfc8
-
SHA256
972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9
-
SHA512
0b39e4d98dff04c06a5a22c65017e2ac6e3b833e54ad261e78ca114f0478aeb2df06787ea60a55632c78f0a75ecfd1cc477e9a39d0cf6d68cb3dcfa62d7d3878
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwr:q7Tc2NYHUrAwfMp3CDRwr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/840-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/368-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-432-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/800-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-605-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2184-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-621-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2388 pffvnrf.exe 2184 npxrbn.exe 2920 hrtdjfx.exe 2992 jlxtt.exe 3000 bnpbh.exe 2756 bxdprh.exe 2768 jhptnbv.exe 2772 bhthjpx.exe 2812 nxphvn.exe 2100 hxhpfjt.exe 2092 vxbrbp.exe 2500 vnvrdpv.exe 3056 lhtbf.exe 2176 xrhpd.exe 2972 lbrvb.exe 2024 xdbpp.exe 1448 vhltv.exe 1704 bnlppd.exe 2228 nvxfv.exe 2452 jrxprd.exe 368 hrptf.exe 2432 lndvv.exe 2652 djblvvx.exe 2516 lphtvd.exe 1832 pbnllld.exe 288 vlvxpb.exe 1816 tdfvh.exe 1672 ddbbv.exe 2008 xxpfh.exe 1560 bvxhjp.exe 2280 xdttr.exe 2656 lfbprdh.exe 2380 nbdvxj.exe 1356 lbrlxrp.exe 2144 trxddtp.exe 2856 bnpbv.exe 2988 hxhrhb.exe 2864 dxnnvr.exe 1708 jvdbnrn.exe 2316 ljffll.exe 2776 djtpp.exe 2716 jrvbv.exe 2832 tjdxvl.exe 2732 nppxjxl.exe 2616 rtnldvh.exe 1060 lrvljt.exe 2508 jrbnvtl.exe 1916 nxxxd.exe 2352 djbpj.exe 2092 nrjljd.exe 2888 xltxj.exe 2064 xddfld.exe 2952 hjbvtv.exe 2968 xlnrphb.exe 1312 rdndp.exe 800 dhtpln.exe 1108 vvxrl.exe 1728 dnnvhr.exe 2260 jxjdr.exe 2236 xjrxj.exe 2684 tlbfr.exe 2052 nfrtff.exe 2216 vhrnf.exe 2484 pjdff.exe -
resource yara_rule behavioral1/memory/840-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/368-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-864-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjrbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xddfld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpbrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phfrbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bltfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvxhjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxjdvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thjjrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfvpnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvvdfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drdbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxnxjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbtjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnrlxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flhxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhxnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnhfjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljrnvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhjvbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbnfpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 840 wrote to memory of 2388 840 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 29 PID 840 wrote to memory of 2388 840 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 29 PID 840 wrote to memory of 2388 840 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 29 PID 840 wrote to memory of 2388 840 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 29 PID 2388 wrote to memory of 2184 2388 pffvnrf.exe 30 PID 2388 wrote to memory of 2184 2388 pffvnrf.exe 30 PID 2388 wrote to memory of 2184 2388 pffvnrf.exe 30 PID 2388 wrote to memory of 2184 2388 pffvnrf.exe 30 PID 2184 wrote to memory of 2920 2184 npxrbn.exe 31 PID 2184 wrote to memory of 2920 2184 npxrbn.exe 31 PID 2184 wrote to memory of 2920 2184 npxrbn.exe 31 PID 2184 wrote to memory of 2920 2184 npxrbn.exe 31 PID 2920 wrote to memory of 2992 2920 hrtdjfx.exe 32 PID 2920 wrote to memory of 2992 2920 hrtdjfx.exe 32 PID 2920 wrote to memory of 2992 2920 hrtdjfx.exe 32 PID 2920 wrote to memory of 2992 2920 hrtdjfx.exe 32 PID 2992 wrote to memory of 3000 2992 jlxtt.exe 33 PID 2992 wrote to memory of 3000 2992 jlxtt.exe 33 PID 2992 wrote to memory of 3000 2992 jlxtt.exe 33 PID 2992 wrote to memory of 3000 2992 jlxtt.exe 33 PID 3000 wrote to memory of 2756 3000 bnpbh.exe 34 PID 3000 wrote to memory of 2756 3000 bnpbh.exe 34 PID 3000 wrote to memory of 2756 3000 bnpbh.exe 34 PID 3000 wrote to memory of 2756 3000 bnpbh.exe 34 PID 2756 wrote to memory of 2768 2756 bxdprh.exe 35 PID 2756 wrote to memory of 2768 2756 bxdprh.exe 35 PID 2756 wrote to memory of 2768 2756 bxdprh.exe 35 PID 2756 wrote to memory of 2768 2756 bxdprh.exe 35 PID 2768 wrote to memory of 2772 2768 jhptnbv.exe 36 PID 2768 wrote to memory of 2772 2768 jhptnbv.exe 36 PID 2768 wrote to memory of 2772 2768 jhptnbv.exe 36 PID 2768 wrote to memory of 2772 2768 jhptnbv.exe 36 PID 2772 wrote to memory of 2812 2772 bhthjpx.exe 37 PID 2772 wrote to memory of 2812 2772 bhthjpx.exe 37 PID 2772 wrote to memory of 2812 2772 bhthjpx.exe 37 PID 2772 wrote to memory of 2812 2772 bhthjpx.exe 37 PID 2812 wrote to memory of 2100 2812 nxphvn.exe 38 PID 2812 wrote to memory of 2100 2812 nxphvn.exe 38 PID 2812 wrote to memory of 2100 2812 nxphvn.exe 38 PID 2812 wrote to memory of 2100 2812 nxphvn.exe 38 PID 2100 wrote to memory of 2092 2100 hxhpfjt.exe 39 PID 2100 wrote to memory of 2092 2100 hxhpfjt.exe 39 PID 2100 wrote to memory of 2092 2100 hxhpfjt.exe 39 PID 2100 wrote to memory of 2092 2100 hxhpfjt.exe 39 PID 2092 wrote to memory of 2500 2092 vxbrbp.exe 40 PID 2092 wrote to memory of 2500 2092 vxbrbp.exe 40 PID 2092 wrote to memory of 2500 2092 vxbrbp.exe 40 PID 2092 wrote to memory of 2500 2092 vxbrbp.exe 40 PID 2500 wrote to memory of 3056 2500 vnvrdpv.exe 41 PID 2500 wrote to memory of 3056 2500 vnvrdpv.exe 41 PID 2500 wrote to memory of 3056 2500 vnvrdpv.exe 41 PID 2500 wrote to memory of 3056 2500 vnvrdpv.exe 41 PID 3056 wrote to memory of 2176 3056 lhtbf.exe 42 PID 3056 wrote to memory of 2176 3056 lhtbf.exe 42 PID 3056 wrote to memory of 2176 3056 lhtbf.exe 42 PID 3056 wrote to memory of 2176 3056 lhtbf.exe 42 PID 2176 wrote to memory of 2972 2176 xrhpd.exe 43 PID 2176 wrote to memory of 2972 2176 xrhpd.exe 43 PID 2176 wrote to memory of 2972 2176 xrhpd.exe 43 PID 2176 wrote to memory of 2972 2176 xrhpd.exe 43 PID 2972 wrote to memory of 2024 2972 lbrvb.exe 44 PID 2972 wrote to memory of 2024 2972 lbrvb.exe 44 PID 2972 wrote to memory of 2024 2972 lbrvb.exe 44 PID 2972 wrote to memory of 2024 2972 lbrvb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe"C:\Users\Admin\AppData\Local\Temp\972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\pffvnrf.exec:\pffvnrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\npxrbn.exec:\npxrbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hrtdjfx.exec:\hrtdjfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jlxtt.exec:\jlxtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\bnpbh.exec:\bnpbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\bxdprh.exec:\bxdprh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jhptnbv.exec:\jhptnbv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bhthjpx.exec:\bhthjpx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nxphvn.exec:\nxphvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hxhpfjt.exec:\hxhpfjt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vxbrbp.exec:\vxbrbp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\vnvrdpv.exec:\vnvrdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\lhtbf.exec:\lhtbf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xrhpd.exec:\xrhpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\lbrvb.exec:\lbrvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xdbpp.exec:\xdbpp.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vhltv.exec:\vhltv.exe18⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bnlppd.exec:\bnlppd.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nvxfv.exec:\nvxfv.exe20⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jrxprd.exec:\jrxprd.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hrptf.exec:\hrptf.exe22⤵
- Executes dropped EXE
PID:368 -
\??\c:\lndvv.exec:\lndvv.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\djblvvx.exec:\djblvvx.exe24⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lphtvd.exec:\lphtvd.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pbnllld.exec:\pbnllld.exe26⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vlvxpb.exec:\vlvxpb.exe27⤵
- Executes dropped EXE
PID:288 -
\??\c:\tdfvh.exec:\tdfvh.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\ddbbv.exec:\ddbbv.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xxpfh.exec:\xxpfh.exe30⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bvxhjp.exec:\bvxhjp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\xdttr.exec:\xdttr.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lfbprdh.exec:\lfbprdh.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbdvxj.exec:\nbdvxj.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lbrlxrp.exec:\lbrlxrp.exe35⤵
- Executes dropped EXE
PID:1356 -
\??\c:\trxddtp.exec:\trxddtp.exe36⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bnpbv.exec:\bnpbv.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hxhrhb.exec:\hxhrhb.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dxnnvr.exec:\dxnnvr.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvdbnrn.exec:\jvdbnrn.exe40⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ljffll.exec:\ljffll.exe41⤵
- Executes dropped EXE
PID:2316 -
\??\c:\djtpp.exec:\djtpp.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jrvbv.exec:\jrvbv.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tjdxvl.exec:\tjdxvl.exe44⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nppxjxl.exec:\nppxjxl.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rtnldvh.exec:\rtnldvh.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lrvljt.exec:\lrvljt.exe47⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jrbnvtl.exec:\jrbnvtl.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nxxxd.exec:\nxxxd.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\djbpj.exec:\djbpj.exe50⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nrjljd.exec:\nrjljd.exe51⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xltxj.exec:\xltxj.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xddfld.exec:\xddfld.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\hjbvtv.exec:\hjbvtv.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xlnrphb.exec:\xlnrphb.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rdndp.exec:\rdndp.exe56⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dhtpln.exec:\dhtpln.exe57⤵
- Executes dropped EXE
PID:800 -
\??\c:\vvxrl.exec:\vvxrl.exe58⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dnnvhr.exec:\dnnvhr.exe59⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jxjdr.exec:\jxjdr.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xjrxj.exec:\xjrxj.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tlbfr.exec:\tlbfr.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684 -
\??\c:\nfrtff.exec:\nfrtff.exe63⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vhrnf.exec:\vhrnf.exe64⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pjdff.exec:\pjdff.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\thbjl.exec:\thbjl.exe66⤵PID:2012
-
\??\c:\jflrvhf.exec:\jflrvhf.exe67⤵PID:696
-
\??\c:\brpjv.exec:\brpjv.exe68⤵PID:456
-
\??\c:\bdvlf.exec:\bdvlf.exe69⤵PID:1456
-
\??\c:\dvlhfx.exec:\dvlhfx.exe70⤵PID:2164
-
\??\c:\ppthtjd.exec:\ppthtjd.exe71⤵PID:1372
-
\??\c:\trvpnf.exec:\trvpnf.exe72⤵PID:1756
-
\??\c:\rjxft.exec:\rjxft.exe73⤵PID:2008
-
\??\c:\dvnrtrh.exec:\dvnrtrh.exe74⤵PID:2292
-
\??\c:\nptvbtv.exec:\nptvbtv.exe75⤵PID:1512
-
\??\c:\jxjxn.exec:\jxjxn.exe76⤵PID:1740
-
\??\c:\vphdbx.exec:\vphdbx.exe77⤵PID:836
-
\??\c:\vvjndhj.exec:\vvjndhj.exe78⤵PID:1132
-
\??\c:\pxjrdfr.exec:\pxjrdfr.exe79⤵PID:3008
-
\??\c:\ltlfpv.exec:\ltlfpv.exe80⤵PID:2184
-
\??\c:\bbblhr.exec:\bbblhr.exe81⤵PID:2980
-
\??\c:\rnrfnxj.exec:\rnrfnxj.exe82⤵PID:1604
-
\??\c:\plpjn.exec:\plpjn.exe83⤵PID:2872
-
\??\c:\rbvnd.exec:\rbvnd.exe84⤵PID:3004
-
\??\c:\xtxpfb.exec:\xtxpfb.exe85⤵PID:1940
-
\??\c:\dlrdb.exec:\dlrdb.exe86⤵PID:3024
-
\??\c:\rhfpv.exec:\rhfpv.exe87⤵PID:2768
-
\??\c:\bxxfp.exec:\bxxfp.exe88⤵PID:2728
-
\??\c:\xbtrb.exec:\xbtrb.exe89⤵
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\fpdff.exec:\fpdff.exe90⤵PID:1676
-
\??\c:\vnxtx.exec:\vnxtx.exe91⤵PID:2472
-
\??\c:\rrplrv.exec:\rrplrv.exe92⤵PID:1172
-
\??\c:\fbjbdj.exec:\fbjbdj.exe93⤵PID:1100
-
\??\c:\nhlbhrx.exec:\nhlbhrx.exe94⤵PID:3048
-
\??\c:\tfdpdl.exec:\tfdpdl.exe95⤵
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\jvtbbb.exec:\jvtbbb.exe96⤵PID:1400
-
\??\c:\rjvfxr.exec:\rjvfxr.exe97⤵PID:2004
-
\??\c:\dpvfr.exec:\dpvfr.exe98⤵PID:1260
-
\??\c:\ptjfr.exec:\ptjfr.exe99⤵PID:1812
-
\??\c:\dflfjbx.exec:\dflfjbx.exe100⤵PID:1616
-
\??\c:\drhnpdn.exec:\drhnpdn.exe101⤵PID:1768
-
\??\c:\pbbfrvr.exec:\pbbfrvr.exe102⤵PID:2908
-
\??\c:\lplrpd.exec:\lplrpd.exe103⤵PID:2088
-
\??\c:\hxvhtd.exec:\hxvhtd.exe104⤵PID:2452
-
\??\c:\lfnnpfl.exec:\lfnnpfl.exe105⤵PID:2080
-
\??\c:\pnnjtbl.exec:\pnnjtbl.exe106⤵PID:2140
-
\??\c:\rdjtb.exec:\rdjtb.exe107⤵PID:952
-
\??\c:\vntdhd.exec:\vntdhd.exe108⤵PID:1712
-
\??\c:\tvhfjpd.exec:\tvhfjpd.exe109⤵PID:2516
-
\??\c:\fxlrrhd.exec:\fxlrrhd.exe110⤵
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\nbdbpl.exec:\nbdbpl.exe111⤵PID:2444
-
\??\c:\hxhnh.exec:\hxhnh.exe112⤵PID:1556
-
\??\c:\pxhflpt.exec:\pxhflpt.exe113⤵PID:1816
-
\??\c:\lhdrvdr.exec:\lhdrvdr.exe114⤵PID:2000
-
\??\c:\dbnxn.exec:\dbnxn.exe115⤵PID:1372
-
\??\c:\bxrbbn.exec:\bxrbbn.exe116⤵PID:524
-
\??\c:\hjnxdnh.exec:\hjnxdnh.exe117⤵PID:2132
-
\??\c:\vxrnn.exec:\vxrnn.exe118⤵PID:2324
-
\??\c:\rbdjn.exec:\rbdjn.exe119⤵PID:2360
-
\??\c:\dthvn.exec:\dthvn.exe120⤵PID:840
-
\??\c:\xhpln.exec:\xhpln.exe121⤵PID:2552
-
\??\c:\bfvdjrx.exec:\bfvdjrx.exe122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-