Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6632cc628518a78f275422ffd286c250N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
6632cc628518a78f275422ffd286c250N.exe
-
Size
80KB
-
MD5
6632cc628518a78f275422ffd286c250
-
SHA1
14ffc461c763d7ee10a67431c270a19e75ea92d6
-
SHA256
6cad545e9478a4748b3894c64db71063385e8520633f47884cf4df01a0980aae
-
SHA512
99456111092fe6a5fc70340c8c790ff0ac85ce7f5dafeaa6b323338641538a7f56ff40fdc06d88d8653e09a764da65e3b0c2187f4227734944e94a7a110a4e80
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9tQL:ymb3NkkiQ3mdBjFo73tvn+Yp9tQL
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2928-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/612-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 vfblxb.exe 2872 xxpxnv.exe 2268 vdnbxf.exe 2420 jrdxjhx.exe 2756 dlprrtp.exe 2716 hnjph.exe 2072 nrjrjnj.exe 2392 vdnnt.exe 1312 rnvbn.exe 2632 xrdvr.exe 2984 pblhhr.exe 1016 hvfvjf.exe 2592 vjrxb.exe 2012 drthb.exe 2024 rfblvdd.exe 2284 tvldndh.exe 2324 bvrjdf.exe 2216 jbnff.exe 1828 njpthdh.exe 1248 jnjfxbr.exe 2372 xjjvnvv.exe 288 fvfrl.exe 3048 hvhrr.exe 1232 vjjlpd.exe 1244 bffnb.exe 1820 brhrvrb.exe 2396 jhxpx.exe 1692 pxtvhj.exe 584 bjfpt.exe 1536 rtdbjb.exe 612 rxrhtb.exe 2784 jtjvbpb.exe 2848 jppxt.exe 2892 blblrd.exe 2196 vnhbhd.exe 3004 nlftxtj.exe 2888 ftdnl.exe 2684 bhrtl.exe 2648 hjxxprr.exe 2812 lpfpxt.exe 2168 nlphl.exe 2720 xbjxhfb.exe 1768 xdbhn.exe 2408 dfvrbh.exe 2392 vvlrxbx.exe 1344 rnfnb.exe 2544 pnjjn.exe 1764 rfvvp.exe 2988 tnnpnnv.exe 2512 bdfnbt.exe 832 fxhjjl.exe 2020 vlhbjh.exe 2024 dnrrnpp.exe 1264 ldjnp.exe 2248 hljrdrf.exe 2308 rdrvr.exe 2224 jtxjpvh.exe 912 vxfdf.exe 2600 pfbtnhr.exe 1884 dlbdflb.exe 3056 xfvxfh.exe 2088 lpjfv.exe 1864 fbdbd.exe 1716 bpbtt.exe -
resource yara_rule behavioral1/memory/2928-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/612-313-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhlvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjltjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrdvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvrbnnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnpjpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhdjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxljjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdxfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjxhfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxpplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvxlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lljphr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjpftxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdltf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhjrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndvxpbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxtpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bblpjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njplbl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2296 2928 6632cc628518a78f275422ffd286c250N.exe 29 PID 2928 wrote to memory of 2296 2928 6632cc628518a78f275422ffd286c250N.exe 29 PID 2928 wrote to memory of 2296 2928 6632cc628518a78f275422ffd286c250N.exe 29 PID 2928 wrote to memory of 2296 2928 6632cc628518a78f275422ffd286c250N.exe 29 PID 2296 wrote to memory of 2872 2296 vfblxb.exe 30 PID 2296 wrote to memory of 2872 2296 vfblxb.exe 30 PID 2296 wrote to memory of 2872 2296 vfblxb.exe 30 PID 2296 wrote to memory of 2872 2296 vfblxb.exe 30 PID 2872 wrote to memory of 2268 2872 xxpxnv.exe 31 PID 2872 wrote to memory of 2268 2872 xxpxnv.exe 31 PID 2872 wrote to memory of 2268 2872 xxpxnv.exe 31 PID 2872 wrote to memory of 2268 2872 xxpxnv.exe 31 PID 2268 wrote to memory of 2420 2268 vdnbxf.exe 32 PID 2268 wrote to memory of 2420 2268 vdnbxf.exe 32 PID 2268 wrote to memory of 2420 2268 vdnbxf.exe 32 PID 2268 wrote to memory of 2420 2268 vdnbxf.exe 32 PID 2420 wrote to memory of 2756 2420 jrdxjhx.exe 33 PID 2420 wrote to memory of 2756 2420 jrdxjhx.exe 33 PID 2420 wrote to memory of 2756 2420 jrdxjhx.exe 33 PID 2420 wrote to memory of 2756 2420 jrdxjhx.exe 33 PID 2756 wrote to memory of 2716 2756 dlprrtp.exe 34 PID 2756 wrote to memory of 2716 2756 dlprrtp.exe 34 PID 2756 wrote to memory of 2716 2756 dlprrtp.exe 34 PID 2756 wrote to memory of 2716 2756 dlprrtp.exe 34 PID 2716 wrote to memory of 2072 2716 hnjph.exe 35 PID 2716 wrote to memory of 2072 2716 hnjph.exe 35 PID 2716 wrote to memory of 2072 2716 hnjph.exe 35 PID 2716 wrote to memory of 2072 2716 hnjph.exe 35 PID 2072 wrote to memory of 2392 2072 nrjrjnj.exe 36 PID 2072 wrote to memory of 2392 2072 nrjrjnj.exe 36 PID 2072 wrote to memory of 2392 2072 nrjrjnj.exe 36 PID 2072 wrote to memory of 2392 2072 nrjrjnj.exe 36 PID 2392 wrote to memory of 1312 2392 vdnnt.exe 37 PID 2392 wrote to memory of 1312 2392 vdnnt.exe 37 PID 2392 wrote to memory of 1312 2392 vdnnt.exe 37 PID 2392 wrote to memory of 1312 2392 vdnnt.exe 37 PID 1312 wrote to memory of 2632 1312 rnvbn.exe 38 PID 1312 wrote to memory of 2632 1312 rnvbn.exe 38 PID 1312 wrote to memory of 2632 1312 rnvbn.exe 38 PID 1312 wrote to memory of 2632 1312 rnvbn.exe 38 PID 2632 wrote to memory of 2984 2632 xrdvr.exe 39 PID 2632 wrote to memory of 2984 2632 xrdvr.exe 39 PID 2632 wrote to memory of 2984 2632 xrdvr.exe 39 PID 2632 wrote to memory of 2984 2632 xrdvr.exe 39 PID 2984 wrote to memory of 1016 2984 pblhhr.exe 40 PID 2984 wrote to memory of 1016 2984 pblhhr.exe 40 PID 2984 wrote to memory of 1016 2984 pblhhr.exe 40 PID 2984 wrote to memory of 1016 2984 pblhhr.exe 40 PID 1016 wrote to memory of 2592 1016 hvfvjf.exe 41 PID 1016 wrote to memory of 2592 1016 hvfvjf.exe 41 PID 1016 wrote to memory of 2592 1016 hvfvjf.exe 41 PID 1016 wrote to memory of 2592 1016 hvfvjf.exe 41 PID 2592 wrote to memory of 2012 2592 vjrxb.exe 42 PID 2592 wrote to memory of 2012 2592 vjrxb.exe 42 PID 2592 wrote to memory of 2012 2592 vjrxb.exe 42 PID 2592 wrote to memory of 2012 2592 vjrxb.exe 42 PID 2012 wrote to memory of 2024 2012 drthb.exe 43 PID 2012 wrote to memory of 2024 2012 drthb.exe 43 PID 2012 wrote to memory of 2024 2012 drthb.exe 43 PID 2012 wrote to memory of 2024 2012 drthb.exe 43 PID 2024 wrote to memory of 2284 2024 rfblvdd.exe 44 PID 2024 wrote to memory of 2284 2024 rfblvdd.exe 44 PID 2024 wrote to memory of 2284 2024 rfblvdd.exe 44 PID 2024 wrote to memory of 2284 2024 rfblvdd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\6632cc628518a78f275422ffd286c250N.exe"C:\Users\Admin\AppData\Local\Temp\6632cc628518a78f275422ffd286c250N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\vfblxb.exec:\vfblxb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xxpxnv.exec:\xxpxnv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vdnbxf.exec:\vdnbxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\jrdxjhx.exec:\jrdxjhx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\dlprrtp.exec:\dlprrtp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hnjph.exec:\hnjph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nrjrjnj.exec:\nrjrjnj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vdnnt.exec:\vdnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rnvbn.exec:\rnvbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\xrdvr.exec:\xrdvr.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pblhhr.exec:\pblhhr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hvfvjf.exec:\hvfvjf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\vjrxb.exec:\vjrxb.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\drthb.exec:\drthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rfblvdd.exec:\rfblvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\tvldndh.exec:\tvldndh.exe17⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bvrjdf.exec:\bvrjdf.exe18⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jbnff.exec:\jbnff.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\njpthdh.exec:\njpthdh.exe20⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jnjfxbr.exec:\jnjfxbr.exe21⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xjjvnvv.exec:\xjjvnvv.exe22⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fvfrl.exec:\fvfrl.exe23⤵
- Executes dropped EXE
PID:288 -
\??\c:\hvhrr.exec:\hvhrr.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vjjlpd.exec:\vjjlpd.exe25⤵
- Executes dropped EXE
PID:1232 -
\??\c:\bffnb.exec:\bffnb.exe26⤵
- Executes dropped EXE
PID:1244 -
\??\c:\brhrvrb.exec:\brhrvrb.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jhxpx.exec:\jhxpx.exe28⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pxtvhj.exec:\pxtvhj.exe29⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bjfpt.exec:\bjfpt.exe30⤵
- Executes dropped EXE
PID:584 -
\??\c:\rtdbjb.exec:\rtdbjb.exe31⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rxrhtb.exec:\rxrhtb.exe32⤵
- Executes dropped EXE
PID:612 -
\??\c:\jtjvbpb.exec:\jtjvbpb.exe33⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jppxt.exec:\jppxt.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\blblrd.exec:\blblrd.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vnhbhd.exec:\vnhbhd.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nlftxtj.exec:\nlftxtj.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\ftdnl.exec:\ftdnl.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bhrtl.exec:\bhrtl.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hjxxprr.exec:\hjxxprr.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lpfpxt.exec:\lpfpxt.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nlphl.exec:\nlphl.exe42⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xbjxhfb.exec:\xbjxhfb.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\xdbhn.exec:\xdbhn.exe44⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dfvrbh.exec:\dfvrbh.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vvlrxbx.exec:\vvlrxbx.exe46⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rnfnb.exec:\rnfnb.exe47⤵
- Executes dropped EXE
PID:1344 -
\??\c:\pnjjn.exec:\pnjjn.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rfvvp.exec:\rfvvp.exe49⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tnnpnnv.exec:\tnnpnnv.exe50⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bdfnbt.exec:\bdfnbt.exe51⤵
- Executes dropped EXE
PID:2512 -
\??\c:\fxhjjl.exec:\fxhjjl.exe52⤵
- Executes dropped EXE
PID:832 -
\??\c:\vlhbjh.exec:\vlhbjh.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dnrrnpp.exec:\dnrrnpp.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ldjnp.exec:\ldjnp.exe55⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hljrdrf.exec:\hljrdrf.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rdrvr.exec:\rdrvr.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jtxjpvh.exec:\jtxjpvh.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vxfdf.exec:\vxfdf.exe59⤵
- Executes dropped EXE
PID:912 -
\??\c:\pfbtnhr.exec:\pfbtnhr.exe60⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dlbdflb.exec:\dlbdflb.exe61⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xfvxfh.exec:\xfvxfh.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lpjfv.exec:\lpjfv.exe63⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fbdbd.exec:\fbdbd.exe64⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bpbtt.exec:\bpbtt.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lvfphxb.exec:\lvfphxb.exe66⤵PID:1012
-
\??\c:\rftvxdj.exec:\rftvxdj.exe67⤵PID:1844
-
\??\c:\tbhjrxr.exec:\tbhjrxr.exe68⤵PID:1756
-
\??\c:\tlxpxb.exec:\tlxpxb.exe69⤵PID:1868
-
\??\c:\vjhphrv.exec:\vjhphrv.exe70⤵PID:2548
-
\??\c:\xlbhjv.exec:\xlbhjv.exe71⤵PID:888
-
\??\c:\txvdhjl.exec:\txvdhjl.exe72⤵PID:2552
-
\??\c:\nhrnd.exec:\nhrnd.exe73⤵PID:2992
-
\??\c:\jlhpx.exec:\jlhpx.exe74⤵PID:2468
-
\??\c:\rbbjtf.exec:\rbbjtf.exe75⤵PID:2832
-
\??\c:\vdjxp.exec:\vdjxp.exe76⤵PID:2840
-
\??\c:\jdljv.exec:\jdljv.exe77⤵PID:2872
-
\??\c:\tnpnrdh.exec:\tnpnrdh.exe78⤵PID:1516
-
\??\c:\npffnh.exec:\npffnh.exe79⤵PID:2824
-
\??\c:\rxpplj.exec:\rxpplj.exe80⤵
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\bbfrx.exec:\bbfrx.exe81⤵PID:2864
-
\??\c:\ljvrlj.exec:\ljvrlj.exe82⤵PID:2756
-
\??\c:\xlhlvd.exec:\xlhlvd.exe83⤵
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\pvbjvn.exec:\pvbjvn.exe84⤵PID:632
-
\??\c:\rtnfpnp.exec:\rtnfpnp.exe85⤵PID:2716
-
\??\c:\lpxhxt.exec:\lpxhxt.exe86⤵PID:2628
-
\??\c:\jjttfjb.exec:\jjttfjb.exe87⤵PID:2504
-
\??\c:\npllxht.exec:\npllxht.exe88⤵PID:2100
-
\??\c:\hnpdrnx.exec:\hnpdrnx.exe89⤵PID:1312
-
\??\c:\hnxfj.exec:\hnxfj.exe90⤵PID:2348
-
\??\c:\jnlxhl.exec:\jnlxhl.exe91⤵PID:2128
-
\??\c:\rdlxnt.exec:\rdlxnt.exe92⤵PID:3016
-
\??\c:\hnfxx.exec:\hnfxx.exe93⤵PID:1712
-
\??\c:\jpdfrf.exec:\jpdfrf.exe94⤵PID:2592
-
\??\c:\jtflnb.exec:\jtflnb.exe95⤵PID:2020
-
\??\c:\rxbtj.exec:\rxbtj.exe96⤵PID:1324
-
\??\c:\xvxlrl.exec:\xvxlrl.exe97⤵PID:1264
-
\??\c:\tvnjh.exec:\tvnjh.exe98⤵PID:2456
-
\??\c:\hvrxvvr.exec:\hvrxvvr.exe99⤵PID:2308
-
\??\c:\rjndr.exec:\rjndr.exe100⤵PID:2216
-
\??\c:\jvdvnjr.exec:\jvdvnjr.exe101⤵PID:912
-
\??\c:\fplnr.exec:\fplnr.exe102⤵PID:1068
-
\??\c:\xbbvj.exec:\xbbvj.exe103⤵PID:1528
-
\??\c:\nldhdnv.exec:\nldhdnv.exe104⤵PID:1384
-
\??\c:\pnpjpnd.exec:\pnpjpnd.exe105⤵
- System Location Discovery: System Language Discovery
PID:2088 -
\??\c:\jthntt.exec:\jthntt.exe106⤵PID:1864
-
\??\c:\jxxhrv.exec:\jxxhrv.exe107⤵PID:1716
-
\??\c:\xdfjvr.exec:\xdfjvr.exe108⤵PID:1012
-
\??\c:\xhppvvh.exec:\xhppvvh.exe109⤵PID:1844
-
\??\c:\rnrblb.exec:\rnrblb.exe110⤵PID:1756
-
\??\c:\xpnjj.exec:\xpnjj.exe111⤵PID:1868
-
\??\c:\fnvrd.exec:\fnvrd.exe112⤵PID:1736
-
\??\c:\rpblrj.exec:\rpblrj.exe113⤵PID:888
-
\??\c:\fxlrnf.exec:\fxlrnf.exe114⤵PID:2532
-
\??\c:\jtnrdn.exec:\jtnrdn.exe115⤵PID:2992
-
\??\c:\hdbjfh.exec:\hdbjfh.exe116⤵PID:2468
-
\??\c:\nbbnxf.exec:\nbbnxf.exe117⤵PID:2832
-
\??\c:\bjpld.exec:\bjpld.exe118⤵PID:2840
-
\??\c:\tnbpflx.exec:\tnbpflx.exe119⤵PID:2872
-
\??\c:\vjplt.exec:\vjplt.exe120⤵PID:2196
-
\??\c:\xdpjv.exec:\xdpjv.exe121⤵PID:2824
-
\??\c:\ljblnl.exec:\ljblnl.exe122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-