Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe
Resource
win7-20241010-en
General
-
Target
141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe
-
Size
453KB
-
MD5
0f11cf5335407caf1fcfcf3c8bcb3c60
-
SHA1
0621a07c5ca3db8501175efb13168e7f51933bbd
-
SHA256
141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9
-
SHA512
d531d625880816b18cdd600559c9dce5097f19fe554d66876955330bed07202acf8dfef21f637fd0cd414c6b1bc4bd2fb036b12b666f7e96698fd57d0db43d34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2776-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-37-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2248-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-329-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2916-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-578-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1568-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2844 nbxdv.exe 2736 pbdtvj.exe 2748 dlrpxb.exe 2248 rbpndj.exe 2636 fpxfddn.exe 2712 xvlfprv.exe 2932 blhbtr.exe 2176 xpldffh.exe 2128 trpblh.exe 760 ldnnt.exe 3000 nltflr.exe 980 dfvht.exe 1260 frfrdtx.exe 3020 htbhl.exe 1948 xdldjrn.exe 2136 xnbrlrx.exe 520 jllhx.exe 2432 fpjrhn.exe 2356 jffdt.exe 2004 xfdbv.exe 2560 rlbvd.exe 1608 flndtt.exe 848 xfnnf.exe 2524 jtxpjx.exe 1812 fdrrt.exe 3060 dxxxlft.exe 3004 fhlnpln.exe 324 nptbhh.exe 2548 pxvrxl.exe 1996 jlthx.exe 2040 djhfl.exe 868 phhftf.exe 292 xjltnn.exe 2872 xfdnffl.exe 1684 nnrrhpj.exe 2900 txdlbt.exe 2788 jtrxvpx.exe 2916 jfdbhj.exe 2748 ljprphp.exe 2868 pdfhh.exe 1712 tvpxn.exe 1520 rnjxrdj.exe 2616 ftbpxp.exe 2020 xdjtfxl.exe 2224 bdlbhj.exe 2344 fbbxf.exe 2436 rtflhpf.exe 2080 tdpfb.exe 592 jhrhdld.exe 2968 txxhv.exe 2816 xfnxf.exe 2972 vbvrfbf.exe 1264 vjfjnft.exe 1964 vvhnpf.exe 844 dtnnlbt.exe 2148 hlhprf.exe 2172 rjxtfb.exe 2512 lrtbfdh.exe 2520 ntpvfx.exe 1692 jbdhnlx.exe 1700 thxtvdr.exe 956 xplxpr.exe 872 jbhfd.exe 1608 ddrhdp.exe -
resource yara_rule behavioral1/memory/2844-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-889-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2224-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-969-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjpbhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlxpft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdtvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhrvphr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbfnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxtvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvtdtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtphtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbfdrnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfpbdxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlnbjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjrvvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlddlvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvvrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlbtlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpldffh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrjnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdpxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpldx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddtjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhljxrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdldjrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvtvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prlnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtphh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nltflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrtvrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lndxtpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbdpdt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2844 2776 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 30 PID 2776 wrote to memory of 2844 2776 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 30 PID 2776 wrote to memory of 2844 2776 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 30 PID 2776 wrote to memory of 2844 2776 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 30 PID 2844 wrote to memory of 2736 2844 nbxdv.exe 31 PID 2844 wrote to memory of 2736 2844 nbxdv.exe 31 PID 2844 wrote to memory of 2736 2844 nbxdv.exe 31 PID 2844 wrote to memory of 2736 2844 nbxdv.exe 31 PID 2736 wrote to memory of 2748 2736 pbdtvj.exe 32 PID 2736 wrote to memory of 2748 2736 pbdtvj.exe 32 PID 2736 wrote to memory of 2748 2736 pbdtvj.exe 32 PID 2736 wrote to memory of 2748 2736 pbdtvj.exe 32 PID 2748 wrote to memory of 2248 2748 dlrpxb.exe 33 PID 2748 wrote to memory of 2248 2748 dlrpxb.exe 33 PID 2748 wrote to memory of 2248 2748 dlrpxb.exe 33 PID 2748 wrote to memory of 2248 2748 dlrpxb.exe 33 PID 2248 wrote to memory of 2636 2248 rbpndj.exe 34 PID 2248 wrote to memory of 2636 2248 rbpndj.exe 34 PID 2248 wrote to memory of 2636 2248 rbpndj.exe 34 PID 2248 wrote to memory of 2636 2248 rbpndj.exe 34 PID 2636 wrote to memory of 2712 2636 fpxfddn.exe 35 PID 2636 wrote to memory of 2712 2636 fpxfddn.exe 35 PID 2636 wrote to memory of 2712 2636 fpxfddn.exe 35 PID 2636 wrote to memory of 2712 2636 fpxfddn.exe 35 PID 2712 wrote to memory of 2932 2712 xvlfprv.exe 36 PID 2712 wrote to memory of 2932 2712 xvlfprv.exe 36 PID 2712 wrote to memory of 2932 2712 xvlfprv.exe 36 PID 2712 wrote to memory of 2932 2712 xvlfprv.exe 36 PID 2932 wrote to memory of 2176 2932 blhbtr.exe 37 PID 2932 wrote to memory of 2176 2932 blhbtr.exe 37 PID 2932 wrote to memory of 2176 2932 blhbtr.exe 37 PID 2932 wrote to memory of 2176 2932 blhbtr.exe 37 PID 2176 wrote to memory of 2128 2176 xpldffh.exe 38 PID 2176 wrote to memory of 2128 2176 xpldffh.exe 38 PID 2176 wrote to memory of 2128 2176 xpldffh.exe 38 PID 2176 wrote to memory of 2128 2176 xpldffh.exe 38 PID 2128 wrote to memory of 760 2128 trpblh.exe 39 PID 2128 wrote to memory of 760 2128 trpblh.exe 39 PID 2128 wrote to memory of 760 2128 trpblh.exe 39 PID 2128 wrote to memory of 760 2128 trpblh.exe 39 PID 760 wrote to memory of 3000 760 ldnnt.exe 40 PID 760 wrote to memory of 3000 760 ldnnt.exe 40 PID 760 wrote to memory of 3000 760 ldnnt.exe 40 PID 760 wrote to memory of 3000 760 ldnnt.exe 40 PID 3000 wrote to memory of 980 3000 nltflr.exe 41 PID 3000 wrote to memory of 980 3000 nltflr.exe 41 PID 3000 wrote to memory of 980 3000 nltflr.exe 41 PID 3000 wrote to memory of 980 3000 nltflr.exe 41 PID 980 wrote to memory of 1260 980 dfvht.exe 42 PID 980 wrote to memory of 1260 980 dfvht.exe 42 PID 980 wrote to memory of 1260 980 dfvht.exe 42 PID 980 wrote to memory of 1260 980 dfvht.exe 42 PID 1260 wrote to memory of 3020 1260 frfrdtx.exe 43 PID 1260 wrote to memory of 3020 1260 frfrdtx.exe 43 PID 1260 wrote to memory of 3020 1260 frfrdtx.exe 43 PID 1260 wrote to memory of 3020 1260 frfrdtx.exe 43 PID 3020 wrote to memory of 1948 3020 htbhl.exe 44 PID 3020 wrote to memory of 1948 3020 htbhl.exe 44 PID 3020 wrote to memory of 1948 3020 htbhl.exe 44 PID 3020 wrote to memory of 1948 3020 htbhl.exe 44 PID 1948 wrote to memory of 2136 1948 xdldjrn.exe 45 PID 1948 wrote to memory of 2136 1948 xdldjrn.exe 45 PID 1948 wrote to memory of 2136 1948 xdldjrn.exe 45 PID 1948 wrote to memory of 2136 1948 xdldjrn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe"C:\Users\Admin\AppData\Local\Temp\141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nbxdv.exec:\nbxdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pbdtvj.exec:\pbdtvj.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\dlrpxb.exec:\dlrpxb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rbpndj.exec:\rbpndj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\fpxfddn.exec:\fpxfddn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xvlfprv.exec:\xvlfprv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\blhbtr.exec:\blhbtr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xpldffh.exec:\xpldffh.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\trpblh.exec:\trpblh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ldnnt.exec:\ldnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\nltflr.exec:\nltflr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dfvht.exec:\dfvht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\frfrdtx.exec:\frfrdtx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\htbhl.exec:\htbhl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xdldjrn.exec:\xdldjrn.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xnbrlrx.exec:\xnbrlrx.exe17⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jllhx.exec:\jllhx.exe18⤵
- Executes dropped EXE
PID:520 -
\??\c:\fpjrhn.exec:\fpjrhn.exe19⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jffdt.exec:\jffdt.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xfdbv.exec:\xfdbv.exe21⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rlbvd.exec:\rlbvd.exe22⤵
- Executes dropped EXE
PID:2560 -
\??\c:\flndtt.exec:\flndtt.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xfnnf.exec:\xfnnf.exe24⤵
- Executes dropped EXE
PID:848 -
\??\c:\jtxpjx.exec:\jtxpjx.exe25⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fdrrt.exec:\fdrrt.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dxxxlft.exec:\dxxxlft.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fhlnpln.exec:\fhlnpln.exe28⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nptbhh.exec:\nptbhh.exe29⤵
- Executes dropped EXE
PID:324 -
\??\c:\pxvrxl.exec:\pxvrxl.exe30⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jlthx.exec:\jlthx.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\djhfl.exec:\djhfl.exe32⤵
- Executes dropped EXE
PID:2040 -
\??\c:\phhftf.exec:\phhftf.exe33⤵
- Executes dropped EXE
PID:868 -
\??\c:\xjltnn.exec:\xjltnn.exe34⤵
- Executes dropped EXE
PID:292 -
\??\c:\xfdnffl.exec:\xfdnffl.exe35⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nnrrhpj.exec:\nnrrhpj.exe36⤵
- Executes dropped EXE
PID:1684 -
\??\c:\txdlbt.exec:\txdlbt.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jtrxvpx.exec:\jtrxvpx.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jfdbhj.exec:\jfdbhj.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ljprphp.exec:\ljprphp.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdfhh.exec:\pdfhh.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\tvpxn.exec:\tvpxn.exe42⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rnjxrdj.exec:\rnjxrdj.exe43⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ftbpxp.exec:\ftbpxp.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xdjtfxl.exec:\xdjtfxl.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bdlbhj.exec:\bdlbhj.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fbbxf.exec:\fbbxf.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rtflhpf.exec:\rtflhpf.exe48⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tdpfb.exec:\tdpfb.exe49⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jhrhdld.exec:\jhrhdld.exe50⤵
- Executes dropped EXE
PID:592 -
\??\c:\txxhv.exec:\txxhv.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xfnxf.exec:\xfnxf.exe52⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vbvrfbf.exec:\vbvrfbf.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vjfjnft.exec:\vjfjnft.exe54⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vvhnpf.exec:\vvhnpf.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dtnnlbt.exec:\dtnnlbt.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\hlhprf.exec:\hlhprf.exe57⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rjxtfb.exec:\rjxtfb.exe58⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lrtbfdh.exec:\lrtbfdh.exe59⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ntpvfx.exec:\ntpvfx.exe60⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jbdhnlx.exec:\jbdhnlx.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thxtvdr.exec:\thxtvdr.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xplxpr.exec:\xplxpr.exe63⤵
- Executes dropped EXE
PID:956 -
\??\c:\jbhfd.exec:\jbhfd.exe64⤵
- Executes dropped EXE
PID:872 -
\??\c:\ddrhdp.exec:\ddrhdp.exe65⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fprrhx.exec:\fprrhx.exe66⤵PID:848
-
\??\c:\vlhxtp.exec:\vlhxtp.exe67⤵PID:816
-
\??\c:\jdxfnpt.exec:\jdxfnpt.exe68⤵PID:1756
-
\??\c:\lrtvrn.exec:\lrtvrn.exe69⤵
- System Location Discovery: System Language Discovery
PID:1336 -
\??\c:\bhfnltb.exec:\bhfnltb.exe70⤵PID:1768
-
\??\c:\tjfjhb.exec:\tjfjhb.exe71⤵PID:2264
-
\??\c:\fvfdpp.exec:\fvfdpp.exe72⤵PID:324
-
\??\c:\jvbvvx.exec:\jvbvvx.exe73⤵PID:1008
-
\??\c:\xrjnpbh.exec:\xrjnpbh.exe74⤵PID:2228
-
\??\c:\rtnrp.exec:\rtnrp.exe75⤵PID:2552
-
\??\c:\nldtvjt.exec:\nldtvjt.exe76⤵PID:2220
-
\??\c:\djrtfrj.exec:\djrtfrj.exe77⤵PID:2292
-
\??\c:\tvrlrrj.exec:\tvrlrrj.exe78⤵PID:2180
-
\??\c:\lrldhh.exec:\lrldhh.exe79⤵PID:1568
-
\??\c:\jlddb.exec:\jlddb.exe80⤵PID:2864
-
\??\c:\prbrrh.exec:\prbrrh.exe81⤵PID:2764
-
\??\c:\xrjnxj.exec:\xrjnxj.exe82⤵
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\lfphr.exec:\lfphr.exe83⤵PID:2768
-
\??\c:\tffpt.exec:\tffpt.exe84⤵PID:2692
-
\??\c:\xjvbdj.exec:\xjvbdj.exe85⤵PID:2648
-
\??\c:\hhbbdvx.exec:\hhbbdvx.exe86⤵PID:2636
-
\??\c:\ljbvr.exec:\ljbvr.exe87⤵PID:2712
-
\??\c:\xlddlvn.exec:\xlddlvn.exe88⤵
- System Location Discovery: System Language Discovery
PID:1036 -
\??\c:\ntfrtbh.exec:\ntfrtbh.exe89⤵PID:2940
-
\??\c:\dblfbt.exec:\dblfbt.exe90⤵PID:2324
-
\??\c:\phxnrj.exec:\phxnrj.exe91⤵PID:2380
-
\??\c:\dhnvbtr.exec:\dhnvbtr.exe92⤵PID:2440
-
\??\c:\lhdfpn.exec:\lhdfpn.exe93⤵PID:2928
-
\??\c:\xxrvdf.exec:\xxrvdf.exe94⤵PID:2980
-
\??\c:\ddbxrr.exec:\ddbxrr.exe95⤵PID:2704
-
\??\c:\hldvv.exec:\hldvv.exe96⤵PID:2984
-
\??\c:\ptxbrxx.exec:\ptxbrxx.exe97⤵PID:2416
-
\??\c:\jtvxdt.exec:\jtvxdt.exe98⤵PID:2284
-
\??\c:\bplln.exec:\bplln.exe99⤵PID:1776
-
\??\c:\xjlrvfd.exec:\xjlrvfd.exe100⤵PID:824
-
\??\c:\nhbfbx.exec:\nhbfbx.exe101⤵PID:2160
-
\??\c:\ppbxf.exec:\ppbxf.exe102⤵PID:2156
-
\??\c:\vdxdtj.exec:\vdxdtj.exe103⤵PID:2068
-
\??\c:\bbrnft.exec:\bbrnft.exe104⤵PID:2520
-
\??\c:\djvjjtl.exec:\djvjjtl.exe105⤵PID:1692
-
\??\c:\xdnltlr.exec:\xdnltlr.exe106⤵PID:1700
-
\??\c:\jjlhvx.exec:\jjlhvx.exe107⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\nhdfj.exec:\nhdfj.exe108⤵PID:680
-
\??\c:\pttrrb.exec:\pttrrb.exe109⤵PID:2428
-
\??\c:\hvpbbn.exec:\hvpbbn.exe110⤵PID:1340
-
\??\c:\rfjtld.exec:\rfjtld.exe111⤵PID:1812
-
\??\c:\vrttj.exec:\vrttj.exe112⤵PID:2320
-
\??\c:\bpnlh.exec:\bpnlh.exe113⤵
- System Location Discovery: System Language Discovery
PID:1464 -
\??\c:\bxfnf.exec:\bxfnf.exe114⤵PID:2276
-
\??\c:\rbbnrd.exec:\rbbnrd.exe115⤵PID:1800
-
\??\c:\jjdll.exec:\jjdll.exe116⤵PID:2352
-
\??\c:\npdxrvr.exec:\npdxrvr.exe117⤵PID:2308
-
\??\c:\rfjpltt.exec:\rfjpltt.exe118⤵PID:2032
-
\??\c:\dnbtrvj.exec:\dnbtrvj.exe119⤵PID:2332
-
\??\c:\xrbfl.exec:\xrbfl.exe120⤵PID:868
-
\??\c:\tdhft.exec:\tdhft.exe121⤵PID:2292
-
\??\c:\jvplrnl.exec:\jvplrnl.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-