Analysis
-
max time kernel
152s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 04:09
Static task
static1
Behavioral task
behavioral1
Sample
ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe
Resource
win7-20241010-en
General
-
Target
ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe
-
Size
91KB
-
MD5
ea35568f5eb608aec824bf329b62f488
-
SHA1
a4340335c17250cd3529b0013a9d1fd1f067c889
-
SHA256
ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e
-
SHA512
cca01f9acb201325e16ca66740731f72b1de128f333e0cda6c9149229f2f1ad7ec1910308119a779b11ab7b05fb79ee68733f9eb476d74fbe473d7c7a9e7b317
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkBB:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1z
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/2264-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-1216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2260 bprnbf.exe 1632 hpnfp.exe 2356 hnvfdh.exe 2740 rjjnttb.exe 2116 ftvhln.exe 2796 vrhnbb.exe 2652 tfhpdf.exe 1676 fvvltv.exe 1712 njdbjlx.exe 2956 nvxpd.exe 2988 tbxtnp.exe 1924 txbtn.exe 1748 ddhtfv.exe 2436 pxhdvt.exe 844 bpbfhjr.exe 2808 xdbhph.exe 1968 vdtvt.exe 1780 drltnn.exe 2344 xjtnv.exe 1916 xhthvf.exe 2380 fxdjf.exe 900 rjfvvl.exe 608 hndpj.exe 2312 hllfx.exe 940 nftph.exe 2168 jrlbjn.exe 936 jpthtr.exe 112 rfnhhb.exe 1524 flrhjlr.exe 584 jfvfpf.exe 2392 lrpjtd.exe 556 fhjrnbn.exe 2256 dnlvrr.exe 2816 rtxpbv.exe 1608 jnrlxlh.exe 2760 prvnntl.exe 2764 nrpfnn.exe 924 fpnpvhr.exe 2872 tfbbf.exe 2768 rhfph.exe 2460 tjrtbrn.exe 2644 tdjrndb.exe 264 hlhjpl.exe 1044 jjnjrrb.exe 1676 ltjnrh.exe 2212 drlhr.exe 2944 dhrrvnt.exe 2956 dvnljp.exe 1320 tdvxxvp.exe 2020 jlbpb.exe 1996 jhrndjv.exe 1856 hjdvjv.exe 1884 vnjfn.exe 2880 dhnbjr.exe 1948 bvbpfbb.exe 2324 fltvb.exe 1968 dhdlpvf.exe 2328 pfdtrf.exe 2108 jxlfdl.exe 2088 vbjvl.exe 2112 pdxrljp.exe 912 fjxbnxt.exe 832 rhnrbtx.exe 1860 vdhtnhh.exe -
resource yara_rule behavioral1/memory/2264-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-1216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtxpbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drlhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flnbxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnfnlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxnjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnvxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvblbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfrfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnldtpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdldfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tppvrdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjxtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpvrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbhdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxblfhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnnxbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhpfnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffrbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvrjprn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvbjtjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnbbhvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2260 2264 ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe 29 PID 2264 wrote to memory of 2260 2264 ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe 29 PID 2264 wrote to memory of 2260 2264 ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe 29 PID 2264 wrote to memory of 2260 2264 ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe 29 PID 2260 wrote to memory of 1632 2260 bprnbf.exe 30 PID 2260 wrote to memory of 1632 2260 bprnbf.exe 30 PID 2260 wrote to memory of 1632 2260 bprnbf.exe 30 PID 2260 wrote to memory of 1632 2260 bprnbf.exe 30 PID 1632 wrote to memory of 2356 1632 hpnfp.exe 31 PID 1632 wrote to memory of 2356 1632 hpnfp.exe 31 PID 1632 wrote to memory of 2356 1632 hpnfp.exe 31 PID 1632 wrote to memory of 2356 1632 hpnfp.exe 31 PID 2356 wrote to memory of 2740 2356 hnvfdh.exe 32 PID 2356 wrote to memory of 2740 2356 hnvfdh.exe 32 PID 2356 wrote to memory of 2740 2356 hnvfdh.exe 32 PID 2356 wrote to memory of 2740 2356 hnvfdh.exe 32 PID 2740 wrote to memory of 2116 2740 rjjnttb.exe 33 PID 2740 wrote to memory of 2116 2740 rjjnttb.exe 33 PID 2740 wrote to memory of 2116 2740 rjjnttb.exe 33 PID 2740 wrote to memory of 2116 2740 rjjnttb.exe 33 PID 2116 wrote to memory of 2796 2116 ftvhln.exe 34 PID 2116 wrote to memory of 2796 2116 ftvhln.exe 34 PID 2116 wrote to memory of 2796 2116 ftvhln.exe 34 PID 2116 wrote to memory of 2796 2116 ftvhln.exe 34 PID 2796 wrote to memory of 2652 2796 vrhnbb.exe 35 PID 2796 wrote to memory of 2652 2796 vrhnbb.exe 35 PID 2796 wrote to memory of 2652 2796 vrhnbb.exe 35 PID 2796 wrote to memory of 2652 2796 vrhnbb.exe 35 PID 2652 wrote to memory of 1676 2652 tfhpdf.exe 36 PID 2652 wrote to memory of 1676 2652 tfhpdf.exe 36 PID 2652 wrote to memory of 1676 2652 tfhpdf.exe 36 PID 2652 wrote to memory of 1676 2652 tfhpdf.exe 36 PID 1676 wrote to memory of 1712 1676 fvvltv.exe 37 PID 1676 wrote to memory of 1712 1676 fvvltv.exe 37 PID 1676 wrote to memory of 1712 1676 fvvltv.exe 37 PID 1676 wrote to memory of 1712 1676 fvvltv.exe 37 PID 1712 wrote to memory of 2956 1712 njdbjlx.exe 38 PID 1712 wrote to memory of 2956 1712 njdbjlx.exe 38 PID 1712 wrote to memory of 2956 1712 njdbjlx.exe 38 PID 1712 wrote to memory of 2956 1712 njdbjlx.exe 38 PID 2956 wrote to memory of 2988 2956 nvxpd.exe 39 PID 2956 wrote to memory of 2988 2956 nvxpd.exe 39 PID 2956 wrote to memory of 2988 2956 nvxpd.exe 39 PID 2956 wrote to memory of 2988 2956 nvxpd.exe 39 PID 2988 wrote to memory of 1924 2988 tbxtnp.exe 40 PID 2988 wrote to memory of 1924 2988 tbxtnp.exe 40 PID 2988 wrote to memory of 1924 2988 tbxtnp.exe 40 PID 2988 wrote to memory of 1924 2988 tbxtnp.exe 40 PID 1924 wrote to memory of 1748 1924 txbtn.exe 41 PID 1924 wrote to memory of 1748 1924 txbtn.exe 41 PID 1924 wrote to memory of 1748 1924 txbtn.exe 41 PID 1924 wrote to memory of 1748 1924 txbtn.exe 41 PID 1748 wrote to memory of 2436 1748 ddhtfv.exe 42 PID 1748 wrote to memory of 2436 1748 ddhtfv.exe 42 PID 1748 wrote to memory of 2436 1748 ddhtfv.exe 42 PID 1748 wrote to memory of 2436 1748 ddhtfv.exe 42 PID 2436 wrote to memory of 844 2436 pxhdvt.exe 43 PID 2436 wrote to memory of 844 2436 pxhdvt.exe 43 PID 2436 wrote to memory of 844 2436 pxhdvt.exe 43 PID 2436 wrote to memory of 844 2436 pxhdvt.exe 43 PID 844 wrote to memory of 2808 844 bpbfhjr.exe 44 PID 844 wrote to memory of 2808 844 bpbfhjr.exe 44 PID 844 wrote to memory of 2808 844 bpbfhjr.exe 44 PID 844 wrote to memory of 2808 844 bpbfhjr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe"C:\Users\Admin\AppData\Local\Temp\ace900d5b9aac885994f897dce6013eb42cad2a3a70c6d4987184ee35b2b800e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\bprnbf.exec:\bprnbf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\hpnfp.exec:\hpnfp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hnvfdh.exec:\hnvfdh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\rjjnttb.exec:\rjjnttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ftvhln.exec:\ftvhln.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vrhnbb.exec:\vrhnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tfhpdf.exec:\tfhpdf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\fvvltv.exec:\fvvltv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\njdbjlx.exec:\njdbjlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\nvxpd.exec:\nvxpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tbxtnp.exec:\tbxtnp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\txbtn.exec:\txbtn.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\ddhtfv.exec:\ddhtfv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\pxhdvt.exec:\pxhdvt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\bpbfhjr.exec:\bpbfhjr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\xdbhph.exec:\xdbhph.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vdtvt.exec:\vdtvt.exe18⤵
- Executes dropped EXE
PID:1968 -
\??\c:\drltnn.exec:\drltnn.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xjtnv.exec:\xjtnv.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xhthvf.exec:\xhthvf.exe21⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fxdjf.exec:\fxdjf.exe22⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rjfvvl.exec:\rjfvvl.exe23⤵
- Executes dropped EXE
PID:900 -
\??\c:\hndpj.exec:\hndpj.exe24⤵
- Executes dropped EXE
PID:608 -
\??\c:\hllfx.exec:\hllfx.exe25⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nftph.exec:\nftph.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\jrlbjn.exec:\jrlbjn.exe27⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jpthtr.exec:\jpthtr.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\rfnhhb.exec:\rfnhhb.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\flrhjlr.exec:\flrhjlr.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jfvfpf.exec:\jfvfpf.exe31⤵
- Executes dropped EXE
PID:584 -
\??\c:\lrpjtd.exec:\lrpjtd.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fhjrnbn.exec:\fhjrnbn.exe33⤵
- Executes dropped EXE
PID:556 -
\??\c:\dnlvrr.exec:\dnlvrr.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rtxpbv.exec:\rtxpbv.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\jnrlxlh.exec:\jnrlxlh.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\prvnntl.exec:\prvnntl.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nrpfnn.exec:\nrpfnn.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fpnpvhr.exec:\fpnpvhr.exe39⤵
- Executes dropped EXE
PID:924 -
\??\c:\tfbbf.exec:\tfbbf.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rhfph.exec:\rhfph.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tjrtbrn.exec:\tjrtbrn.exe42⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tdjrndb.exec:\tdjrndb.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hlhjpl.exec:\hlhjpl.exe44⤵
- Executes dropped EXE
PID:264 -
\??\c:\jjnjrrb.exec:\jjnjrrb.exe45⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ltjnrh.exec:\ltjnrh.exe46⤵
- Executes dropped EXE
PID:1676 -
\??\c:\drlhr.exec:\drlhr.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\dhrrvnt.exec:\dhrrvnt.exe48⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dvnljp.exec:\dvnljp.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tdvxxvp.exec:\tdvxxvp.exe50⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jlbpb.exec:\jlbpb.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jhrndjv.exec:\jhrndjv.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hjdvjv.exec:\hjdvjv.exe53⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vnjfn.exec:\vnjfn.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dhnbjr.exec:\dhnbjr.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bvbpfbb.exec:\bvbpfbb.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fltvb.exec:\fltvb.exe57⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dhdlpvf.exec:\dhdlpvf.exe58⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pfdtrf.exec:\pfdtrf.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jxlfdl.exec:\jxlfdl.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vbjvl.exec:\vbjvl.exe61⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pdxrljp.exec:\pdxrljp.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fjxbnxt.exec:\fjxbnxt.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\rhnrbtx.exec:\rhnrbtx.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\vdhtnhh.exec:\vdhtnhh.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\phvhbnx.exec:\phvhbnx.exe66⤵PID:2440
-
\??\c:\jfhblpv.exec:\jfhblpv.exe67⤵PID:1588
-
\??\c:\hjhnbj.exec:\hjhnbj.exe68⤵PID:1340
-
\??\c:\ptphrh.exec:\ptphrh.exe69⤵PID:1892
-
\??\c:\pfvjrjp.exec:\pfvjrjp.exe70⤵PID:1512
-
\??\c:\tdljl.exec:\tdljl.exe71⤵PID:2284
-
\??\c:\xjhhdd.exec:\xjhhdd.exe72⤵PID:3064
-
\??\c:\rtttrb.exec:\rtttrb.exe73⤵PID:1752
-
\??\c:\tvdbjtl.exec:\tvdbjtl.exe74⤵PID:468
-
\??\c:\bdrdn.exec:\bdrdn.exe75⤵PID:2276
-
\??\c:\dnhxblb.exec:\dnhxblb.exe76⤵PID:928
-
\??\c:\pdjnf.exec:\pdjnf.exe77⤵PID:2940
-
\??\c:\dvpxvvd.exec:\dvpxvvd.exe78⤵PID:1040
-
\??\c:\fltnnxn.exec:\fltnnxn.exe79⤵PID:2776
-
\??\c:\hxbfnl.exec:\hxbfnl.exe80⤵PID:2784
-
\??\c:\nffxxhp.exec:\nffxxhp.exe81⤵PID:1824
-
\??\c:\plfjt.exec:\plfjt.exe82⤵PID:920
-
\??\c:\tftxxv.exec:\tftxxv.exe83⤵PID:2992
-
\??\c:\rrxljf.exec:\rrxljf.exe84⤵PID:2748
-
\??\c:\pfntdnv.exec:\pfntdnv.exe85⤵PID:2636
-
\??\c:\ttbfhhj.exec:\ttbfhhj.exe86⤵PID:2476
-
\??\c:\xxvtph.exec:\xxvtph.exe87⤵PID:2912
-
\??\c:\vhrjlvl.exec:\vhrjlvl.exe88⤵PID:2228
-
\??\c:\fdvlrt.exec:\fdvlrt.exe89⤵PID:2612
-
\??\c:\bjxrnr.exec:\bjxrnr.exe90⤵PID:2824
-
\??\c:\phjxfhb.exec:\phjxfhb.exe91⤵PID:2720
-
\??\c:\rldvlfh.exec:\rldvlfh.exe92⤵PID:2968
-
\??\c:\pxxtjb.exec:\pxxtjb.exe93⤵PID:1016
-
\??\c:\bhfnh.exec:\bhfnh.exe94⤵PID:1692
-
\??\c:\jvbtllj.exec:\jvbtllj.exe95⤵PID:2432
-
\??\c:\nrtrbn.exec:\nrtrbn.exe96⤵PID:520
-
\??\c:\rxjdb.exec:\rxjdb.exe97⤵PID:1988
-
\??\c:\tbnlbjt.exec:\tbnlbjt.exe98⤵PID:1460
-
\??\c:\vfvdpfl.exec:\vfvdpfl.exe99⤵PID:1980
-
\??\c:\xrrlt.exec:\xrrlt.exe100⤵PID:1944
-
\??\c:\bvjpnjl.exec:\bvjpnjl.exe101⤵PID:2172
-
\??\c:\jjfpx.exec:\jjfpx.exe102⤵PID:2340
-
\??\c:\txxdppv.exec:\txxdppv.exe103⤵
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\pbjll.exec:\pbjll.exe104⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\tdrpjl.exec:\tdrpjl.exe105⤵PID:2380
-
\??\c:\vthdlfb.exec:\vthdlfb.exe106⤵PID:384
-
\??\c:\xnbttph.exec:\xnbttph.exe107⤵PID:1292
-
\??\c:\rvxpbv.exec:\rvxpbv.exe108⤵PID:956
-
\??\c:\pxltjx.exec:\pxltjx.exe109⤵PID:1368
-
\??\c:\vvlrll.exec:\vvlrll.exe110⤵PID:2472
-
\??\c:\rrvjf.exec:\rrvjf.exe111⤵PID:2348
-
\??\c:\fnvlvd.exec:\fnvlvd.exe112⤵PID:1052
-
\??\c:\fvtxrrj.exec:\fvtxrrj.exe113⤵PID:1792
-
\??\c:\jvrph.exec:\jvrph.exe114⤵PID:948
-
\??\c:\ltbtb.exec:\ltbtb.exe115⤵PID:2300
-
\??\c:\flnhnh.exec:\flnhnh.exe116⤵PID:1212
-
\??\c:\bvxjjhl.exec:\bvxjjhl.exe117⤵PID:2556
-
\??\c:\vfdprx.exec:\vfdprx.exe118⤵PID:2392
-
\??\c:\bnvfnrb.exec:\bnvfnrb.exe119⤵PID:2552
-
\??\c:\xdfht.exec:\xdfht.exe120⤵PID:2712
-
\??\c:\vtdhnr.exec:\vtdhnr.exe121⤵PID:2508
-
\??\c:\rlhphpr.exec:\rlhphpr.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-