Analysis
-
max time kernel
139s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 02:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe
Resource
win7-20241010-en
6 signatures
150 seconds
General
-
Target
8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe
-
Size
61KB
-
MD5
f2c1b49e9873f3f1a4baa2b407b87308
-
SHA1
0f1545db8235abd2602d76bc95d573c59f0001bb
-
SHA256
8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f
-
SHA512
3976b702d5721fb24e52a83fbf7d5d34799f312c80d37d98c3ffcdb925b4cc858f5e9f6bbbd0f4fd060013e6e95e373277e20bede98b0a9fdb677b08e992af7f
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiT:0cdpeeBSHHMHLf9RyIEQT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/2948-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-195-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1880-235-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1880-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-306-0x0000000077650000-0x000000007776F000-memory.dmp family_blackmoon behavioral1/memory/2836-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-307-0x0000000077550000-0x000000007764A000-memory.dmp family_blackmoon behavioral1/memory/852-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-148-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1120-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-67-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3012-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-57-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2156-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-403-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2640-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-410-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1760-449-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2672-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-476-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-515-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1880-522-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/644-548-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2260-586-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-613-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2556-705-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2828-712-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2728-719-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/1120-726-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2420-746-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-791-0x00000000005C0000-0x00000000005E9000-memory.dmp family_blackmoon behavioral1/memory/2052-793-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-819-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2896-913-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-915-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1740-925-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3040-975-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-1020-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1728-1033-0x00000000002E0000-0x0000000000309000-memory.dmp family_blackmoon behavioral1/memory/1980-1058-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1980-1083-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2320 rfnvdbv.exe 2156 lxbnbl.exe 2948 rrxhfh.exe 2848 xdjdvlp.exe 3012 rpbrpb.exe 2224 bdtrtn.exe 2964 jpnrndp.exe 2816 vrnnh.exe 960 trhdxhh.exe 3068 tfxtrfh.exe 3000 fxtpdr.exe 1508 dnddxbp.exe 2316 pfjhl.exe 1120 xtfbx.exe 892 djrddv.exe 1140 xbtxlpv.exe 1280 xnfxbl.exe 1324 lfhnfl.exe 2404 nplpp.exe 2092 ftnpptr.exe 1468 rxlhxxj.exe 852 trvvxp.exe 1008 npjbf.exe 1880 hfbrlpr.exe 1556 dfxhndt.exe 1096 dhxbtr.exe 596 bnlxv.exe 1388 xlvvbx.exe 1356 ljlbt.exe 548 tfnjtlx.exe 2104 nhnhph.exe 888 dlfdrf.exe 2004 jxrlhv.exe 1620 nrxpfxn.exe 2952 lfblvjn.exe 2992 hrrvb.exe 2948 fdfvprx.exe 2896 tpppj.exe 2904 rthvnb.exe 3012 phbprp.exe 2740 rnhjb.exe 2912 ftbhlf.exe 2964 fthxf.exe 1304 jpldttn.exe 2776 vbthpj.exe 2360 pddhnt.exe 3036 nrdrpbl.exe 2552 ppbpjth.exe 2640 hlnvjnr.exe 2132 pvbdll.exe 2448 nfffll.exe 2548 fdjhjv.exe 2044 lxbrpv.exe 1760 tvflpdp.exe 2672 fxnbhl.exe 2256 vbhdvdj.exe 2452 nlxdrb.exe 2344 vdtvh.exe 964 jhlfhpb.exe 600 vhtvrp.exe 2536 npvlhl.exe 2708 bxjbjn.exe 2508 pntjxh.exe 1008 nvnjnbn.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfptvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtddddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhxdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnfxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptvnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjtpfjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfpjpph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldpxjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pprnhxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txnnxdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flldrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdvxjrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxptpbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flpljnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffxbhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbbpjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxtrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnxlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlrpln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rprvbft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnhrjtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2320 2572 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 29 PID 2572 wrote to memory of 2320 2572 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 29 PID 2572 wrote to memory of 2320 2572 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 29 PID 2572 wrote to memory of 2320 2572 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 29 PID 2320 wrote to memory of 2156 2320 rfnvdbv.exe 30 PID 2320 wrote to memory of 2156 2320 rfnvdbv.exe 30 PID 2320 wrote to memory of 2156 2320 rfnvdbv.exe 30 PID 2320 wrote to memory of 2156 2320 rfnvdbv.exe 30 PID 2156 wrote to memory of 2948 2156 lxbnbl.exe 66 PID 2156 wrote to memory of 2948 2156 lxbnbl.exe 66 PID 2156 wrote to memory of 2948 2156 lxbnbl.exe 66 PID 2156 wrote to memory of 2948 2156 lxbnbl.exe 66 PID 2948 wrote to memory of 2848 2948 rrxhfh.exe 32 PID 2948 wrote to memory of 2848 2948 rrxhfh.exe 32 PID 2948 wrote to memory of 2848 2948 rrxhfh.exe 32 PID 2948 wrote to memory of 2848 2948 rrxhfh.exe 32 PID 2848 wrote to memory of 3012 2848 xdjdvlp.exe 33 PID 2848 wrote to memory of 3012 2848 xdjdvlp.exe 33 PID 2848 wrote to memory of 3012 2848 xdjdvlp.exe 33 PID 2848 wrote to memory of 3012 2848 xdjdvlp.exe 33 PID 3012 wrote to memory of 2224 3012 rpbrpb.exe 34 PID 3012 wrote to memory of 2224 3012 rpbrpb.exe 34 PID 3012 wrote to memory of 2224 3012 rpbrpb.exe 34 PID 3012 wrote to memory of 2224 3012 rpbrpb.exe 34 PID 2224 wrote to memory of 2964 2224 bdtrtn.exe 35 PID 2224 wrote to memory of 2964 2224 bdtrtn.exe 35 PID 2224 wrote to memory of 2964 2224 bdtrtn.exe 35 PID 2224 wrote to memory of 2964 2224 bdtrtn.exe 35 PID 2964 wrote to memory of 2816 2964 jpnrndp.exe 36 PID 2964 wrote to memory of 2816 2964 jpnrndp.exe 36 PID 2964 wrote to memory of 2816 2964 jpnrndp.exe 36 PID 2964 wrote to memory of 2816 2964 jpnrndp.exe 36 PID 2816 wrote to memory of 960 2816 vrnnh.exe 37 PID 2816 wrote to memory of 960 2816 vrnnh.exe 37 PID 2816 wrote to memory of 960 2816 vrnnh.exe 37 PID 2816 wrote to memory of 960 2816 vrnnh.exe 37 PID 960 wrote to memory of 3068 960 trhdxhh.exe 38 PID 960 wrote to memory of 3068 960 trhdxhh.exe 38 PID 960 wrote to memory of 3068 960 trhdxhh.exe 38 PID 960 wrote to memory of 3068 960 trhdxhh.exe 38 PID 3068 wrote to memory of 3000 3068 tfxtrfh.exe 39 PID 3068 wrote to memory of 3000 3068 tfxtrfh.exe 39 PID 3068 wrote to memory of 3000 3068 tfxtrfh.exe 39 PID 3068 wrote to memory of 3000 3068 tfxtrfh.exe 39 PID 3000 wrote to memory of 1508 3000 fxtpdr.exe 40 PID 3000 wrote to memory of 1508 3000 fxtpdr.exe 40 PID 3000 wrote to memory of 1508 3000 fxtpdr.exe 40 PID 3000 wrote to memory of 1508 3000 fxtpdr.exe 40 PID 1508 wrote to memory of 2316 1508 dnddxbp.exe 41 PID 1508 wrote to memory of 2316 1508 dnddxbp.exe 41 PID 1508 wrote to memory of 2316 1508 dnddxbp.exe 41 PID 1508 wrote to memory of 2316 1508 dnddxbp.exe 41 PID 2316 wrote to memory of 1120 2316 pfjhl.exe 42 PID 2316 wrote to memory of 1120 2316 pfjhl.exe 42 PID 2316 wrote to memory of 1120 2316 pfjhl.exe 42 PID 2316 wrote to memory of 1120 2316 pfjhl.exe 42 PID 1120 wrote to memory of 892 1120 xtfbx.exe 43 PID 1120 wrote to memory of 892 1120 xtfbx.exe 43 PID 1120 wrote to memory of 892 1120 xtfbx.exe 43 PID 1120 wrote to memory of 892 1120 xtfbx.exe 43 PID 892 wrote to memory of 1140 892 djrddv.exe 44 PID 892 wrote to memory of 1140 892 djrddv.exe 44 PID 892 wrote to memory of 1140 892 djrddv.exe 44 PID 892 wrote to memory of 1140 892 djrddv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe"C:\Users\Admin\AppData\Local\Temp\8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rfnvdbv.exec:\rfnvdbv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\lxbnbl.exec:\lxbnbl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\rrxhfh.exec:\rrxhfh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xdjdvlp.exec:\xdjdvlp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rpbrpb.exec:\rpbrpb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bdtrtn.exec:\bdtrtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jpnrndp.exec:\jpnrndp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vrnnh.exec:\vrnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\trhdxhh.exec:\trhdxhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\tfxtrfh.exec:\tfxtrfh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\fxtpdr.exec:\fxtpdr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dnddxbp.exec:\dnddxbp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\pfjhl.exec:\pfjhl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\xtfbx.exec:\xtfbx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\djrddv.exec:\djrddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\xbtxlpv.exec:\xbtxlpv.exe17⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xnfxbl.exec:\xnfxbl.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
\??\c:\lfhnfl.exec:\lfhnfl.exe19⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nplpp.exec:\nplpp.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ftnpptr.exec:\ftnpptr.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxlhxxj.exec:\rxlhxxj.exe22⤵
- Executes dropped EXE
PID:1468 -
\??\c:\trvvxp.exec:\trvvxp.exe23⤵
- Executes dropped EXE
PID:852 -
\??\c:\npjbf.exec:\npjbf.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hfbrlpr.exec:\hfbrlpr.exe25⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dfxhndt.exec:\dfxhndt.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\dhxbtr.exec:\dhxbtr.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\bnlxv.exec:\bnlxv.exe28⤵
- Executes dropped EXE
PID:596 -
\??\c:\xlvvbx.exec:\xlvvbx.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ljlbt.exec:\ljlbt.exe30⤵
- Executes dropped EXE
PID:1356 -
\??\c:\tfnjtlx.exec:\tfnjtlx.exe31⤵
- Executes dropped EXE
PID:548 -
\??\c:\nhnhph.exec:\nhnhph.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dlfdrf.exec:\dlfdrf.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\jxrlhv.exec:\jxrlhv.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhjbbtf.exec:\nhjbbtf.exe35⤵PID:2836
-
\??\c:\nrxpfxn.exec:\nrxpfxn.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lfblvjn.exec:\lfblvjn.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hrrvb.exec:\hrrvb.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fdfvprx.exec:\fdfvprx.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tpppj.exec:\tpppj.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rthvnb.exec:\rthvnb.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\phbprp.exec:\phbprp.exe42⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rnhjb.exec:\rnhjb.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ftbhlf.exec:\ftbhlf.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fthxf.exec:\fthxf.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jpldttn.exec:\jpldttn.exe46⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vbthpj.exec:\vbthpj.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pddhnt.exec:\pddhnt.exe48⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nrdrpbl.exec:\nrdrpbl.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppbpjth.exec:\ppbpjth.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hlnvjnr.exec:\hlnvjnr.exe51⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pvbdll.exec:\pvbdll.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nfffll.exec:\nfffll.exe53⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fdjhjv.exec:\fdjhjv.exe54⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lxbrpv.exec:\lxbrpv.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tvflpdp.exec:\tvflpdp.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxnbhl.exec:\fxnbhl.exe57⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vbhdvdj.exec:\vbhdvdj.exe58⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nlxdrb.exec:\nlxdrb.exe59⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vdtvh.exec:\vdtvh.exe60⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jhlfhpb.exec:\jhlfhpb.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\vhtvrp.exec:\vhtvrp.exe62⤵
- Executes dropped EXE
PID:600 -
\??\c:\npvlhl.exec:\npvlhl.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bxjbjn.exec:\bxjbjn.exe64⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pntjxh.exec:\pntjxh.exe65⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nvnjnbn.exec:\nvnjnbn.exe66⤵
- Executes dropped EXE
PID:1008 -
\??\c:\drbxh.exec:\drbxh.exe67⤵PID:1880
-
\??\c:\ttjrrjx.exec:\ttjrrjx.exe68⤵PID:1600
-
\??\c:\jhvrhd.exec:\jhvrhd.exe69⤵PID:812
-
\??\c:\hfjbn.exec:\hfjbn.exe70⤵PID:832
-
\??\c:\xdtlfx.exec:\xdtlfx.exe71⤵PID:644
-
\??\c:\lbrnpp.exec:\lbrnpp.exe72⤵PID:972
-
\??\c:\pxvpd.exec:\pxvpd.exe73⤵PID:1676
-
\??\c:\rbvtdnj.exec:\rbvtdnj.exe74⤵PID:1356
-
\??\c:\txdpb.exec:\txdpb.exe75⤵PID:2124
-
\??\c:\vhpfv.exec:\vhpfv.exe76⤵PID:844
-
\??\c:\lxblrx.exec:\lxblrx.exe77⤵PID:2260
-
\??\c:\ldvbn.exec:\ldvbn.exe78⤵PID:1736
-
\??\c:\tftbfn.exec:\tftbfn.exe79⤵PID:1588
-
\??\c:\rxhxxhv.exec:\rxhxxhv.exe80⤵PID:2608
-
\??\c:\hxdpnh.exec:\hxdpnh.exe81⤵PID:1632
-
\??\c:\jxpxlhb.exec:\jxpxlhb.exe82⤵PID:2868
-
\??\c:\bxnlfr.exec:\bxnlfr.exe83⤵PID:2944
-
\??\c:\dhvnvpf.exec:\dhvnvpf.exe84⤵PID:2848
-
\??\c:\tbhndrd.exec:\tbhndrd.exe85⤵PID:2976
-
\??\c:\lpnjb.exec:\lpnjb.exe86⤵PID:1528
-
\??\c:\bnhvhfh.exec:\bnhvhfh.exe87⤵PID:2752
-
\??\c:\nnxrbh.exec:\nnxrbh.exe88⤵PID:2740
-
\??\c:\jtxllf.exec:\jtxllf.exe89⤵PID:2940
-
\??\c:\bfnvb.exec:\bfnvb.exe90⤵PID:2356
-
\??\c:\ttbblbh.exec:\ttbblbh.exe91⤵PID:1304
-
\??\c:\dhpvn.exec:\dhpvn.exe92⤵PID:620
-
\??\c:\phpjp.exec:\phpjp.exe93⤵PID:580
-
\??\c:\thffddh.exec:\thffddh.exe94⤵PID:2832
-
\??\c:\txhnjfj.exec:\txhnjfj.exe95⤵PID:2728
-
\??\c:\vlfrflj.exec:\vlfrflj.exe96⤵PID:2556
-
\??\c:\phhrhn.exec:\phhrhn.exe97⤵PID:2828
-
\??\c:\fnrtdxl.exec:\fnrtdxl.exe98⤵PID:2448
-
\??\c:\drfbpxh.exec:\drfbpxh.exe99⤵PID:1120
-
\??\c:\bldbxvn.exec:\bldbxvn.exe100⤵PID:2172
-
\??\c:\xhvdxhj.exec:\xhvdxhj.exe101⤵PID:2040
-
\??\c:\tdnnhnx.exec:\tdnnhnx.exe102⤵PID:2672
-
\??\c:\lxljdh.exec:\lxljdh.exe103⤵PID:2420
-
\??\c:\lthxf.exec:\lthxf.exe104⤵PID:956
-
\??\c:\vrdrxf.exec:\vrdrxf.exe105⤵PID:1784
-
\??\c:\jlpph.exec:\jlpph.exe106⤵PID:856
-
\??\c:\thrpdnn.exec:\thrpdnn.exe107⤵PID:2136
-
\??\c:\bbdlh.exec:\bbdlh.exe108⤵PID:2380
-
\??\c:\lptnhj.exec:\lptnhj.exe109⤵PID:2708
-
\??\c:\jfptvx.exec:\jfptvx.exe110⤵
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\rfpxf.exec:\rfpxf.exe111⤵PID:1008
-
\??\c:\dhxtj.exec:\dhxtj.exe112⤵PID:1712
-
\??\c:\nxxlnv.exec:\nxxlnv.exe113⤵PID:1428
-
\??\c:\jvldd.exec:\jvldd.exe114⤵PID:1504
-
\??\c:\rvhptlp.exec:\rvhptlp.exe115⤵PID:1684
-
\??\c:\jvrlnh.exec:\jvrlnh.exe116⤵PID:944
-
\??\c:\hfxrbjp.exec:\hfxrbjp.exe117⤵PID:928
-
\??\c:\tntpjnx.exec:\tntpjnx.exe118⤵PID:2292
-
\??\c:\nnjflxn.exec:\nnjflxn.exe119⤵PID:548
-
\??\c:\dxdxh.exec:\dxdxh.exe120⤵PID:2028
-
\??\c:\lnnll.exec:\lnnll.exe121⤵PID:2200
-
\??\c:\fnjhxd.exec:\fnjhxd.exe122⤵PID:840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-