Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe
Resource
win7-20241010-en
General
-
Target
8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe
-
Size
453KB
-
MD5
23e813baed57efd7093feb5451cdeec0
-
SHA1
724cf2591a013a9ba57352f0dfff54099f93a6a3
-
SHA256
8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40
-
SHA512
826fbce7f0b5cdb09a8a3923a3e05b5b3db6d178e30e50772e14da193c2f87973ee042204c8635659f5693e4063e0f82976ae82649c90a0906b8082585ef7269
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3012-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-22-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2956-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/744-139-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2636-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/632-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-382-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2284-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-525-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2096-558-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-605-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2440-657-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-718-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1864-783-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 rxjtf.exe 2504 ptvlt.exe 2956 xjjtl.exe 2888 bbtbx.exe 2136 rvfvlp.exe 2840 dhbftb.exe 2784 vljpxl.exe 2560 bvjdlh.exe 2708 rpvrr.exe 2380 prhtpx.exe 744 hdhtxnp.exe 2764 tdjpt.exe 3060 vpvbn.exe 2604 vdnpjvb.exe 3040 thfln.exe 2636 nnnrnd.exe 632 rfnjvv.exe 1824 bjxtphd.exe 2144 ttnftn.exe 2280 rnrvt.exe 2272 ptdfv.exe 112 pljjl.exe 524 jrnjfnh.exe 1792 lrhpj.exe 1804 pnbdlbh.exe 992 ppxfhb.exe 1752 nptljhn.exe 1776 fxnpjl.exe 2652 fnllnr.exe 1480 tfffr.exe 2712 jthlfnp.exe 2260 tjfphjn.exe 1820 vfvhrxn.exe 2436 vvvld.exe 2872 rdnlflr.exe 1600 hhtbfr.exe 2880 vtrvtn.exe 2928 ndhvfr.exe 2960 lvpjx.exe 2440 trvhpl.exe 2720 hnrrlf.exe 2840 nbfrp.exe 2544 xnnxh.exe 2224 njlxp.exe 2284 frjdpt.exe 1996 bhlhrn.exe 968 jnjtr.exe 2828 frtlt.exe 1264 jnfvdj.exe 2128 fpxrh.exe 2668 vfjlnvt.exe 3048 vrpjvbj.exe 2360 rxbfhlf.exe 1036 njjjrfl.exe 3032 rpfjbn.exe 1848 ldfvxj.exe 2124 jbbjbfr.exe 2188 vllfp.exe 2120 vxbdv.exe 1536 dplvnj.exe 2480 ldfpv.exe 2292 rvbbvx.exe 1284 vnrlbj.exe 1868 tvfvj.exe -
resource yara_rule behavioral1/memory/3012-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-558-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/320-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-786-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tffffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvbpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrvlhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbfhlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbvlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tblpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njvvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffhxjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbnfdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthjtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdfxhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnldxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdldhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnnlhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dthvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxnjphp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrrlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnvrrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpfpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfnvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvnjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djtvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbhhpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhxhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvhtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjrpvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdxnjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtpdrdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppxfhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2268 3012 8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe 29 PID 3012 wrote to memory of 2268 3012 8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe 29 PID 3012 wrote to memory of 2268 3012 8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe 29 PID 3012 wrote to memory of 2268 3012 8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe 29 PID 2268 wrote to memory of 2504 2268 rxjtf.exe 30 PID 2268 wrote to memory of 2504 2268 rxjtf.exe 30 PID 2268 wrote to memory of 2504 2268 rxjtf.exe 30 PID 2268 wrote to memory of 2504 2268 rxjtf.exe 30 PID 2504 wrote to memory of 2956 2504 ptvlt.exe 31 PID 2504 wrote to memory of 2956 2504 ptvlt.exe 31 PID 2504 wrote to memory of 2956 2504 ptvlt.exe 31 PID 2504 wrote to memory of 2956 2504 ptvlt.exe 31 PID 2956 wrote to memory of 2888 2956 xjjtl.exe 32 PID 2956 wrote to memory of 2888 2956 xjjtl.exe 32 PID 2956 wrote to memory of 2888 2956 xjjtl.exe 32 PID 2956 wrote to memory of 2888 2956 xjjtl.exe 32 PID 2888 wrote to memory of 2136 2888 bbtbx.exe 33 PID 2888 wrote to memory of 2136 2888 bbtbx.exe 33 PID 2888 wrote to memory of 2136 2888 bbtbx.exe 33 PID 2888 wrote to memory of 2136 2888 bbtbx.exe 33 PID 2136 wrote to memory of 2840 2136 rvfvlp.exe 34 PID 2136 wrote to memory of 2840 2136 rvfvlp.exe 34 PID 2136 wrote to memory of 2840 2136 rvfvlp.exe 34 PID 2136 wrote to memory of 2840 2136 rvfvlp.exe 34 PID 2840 wrote to memory of 2784 2840 dhbftb.exe 35 PID 2840 wrote to memory of 2784 2840 dhbftb.exe 35 PID 2840 wrote to memory of 2784 2840 dhbftb.exe 35 PID 2840 wrote to memory of 2784 2840 dhbftb.exe 35 PID 2784 wrote to memory of 2560 2784 vljpxl.exe 36 PID 2784 wrote to memory of 2560 2784 vljpxl.exe 36 PID 2784 wrote to memory of 2560 2784 vljpxl.exe 36 PID 2784 wrote to memory of 2560 2784 vljpxl.exe 36 PID 2560 wrote to memory of 2708 2560 bvjdlh.exe 37 PID 2560 wrote to memory of 2708 2560 bvjdlh.exe 37 PID 2560 wrote to memory of 2708 2560 bvjdlh.exe 37 PID 2560 wrote to memory of 2708 2560 bvjdlh.exe 37 PID 2708 wrote to memory of 2380 2708 rpvrr.exe 38 PID 2708 wrote to memory of 2380 2708 rpvrr.exe 38 PID 2708 wrote to memory of 2380 2708 rpvrr.exe 38 PID 2708 wrote to memory of 2380 2708 rpvrr.exe 38 PID 2380 wrote to memory of 744 2380 prhtpx.exe 39 PID 2380 wrote to memory of 744 2380 prhtpx.exe 39 PID 2380 wrote to memory of 744 2380 prhtpx.exe 39 PID 2380 wrote to memory of 744 2380 prhtpx.exe 39 PID 744 wrote to memory of 2764 744 hdhtxnp.exe 40 PID 744 wrote to memory of 2764 744 hdhtxnp.exe 40 PID 744 wrote to memory of 2764 744 hdhtxnp.exe 40 PID 744 wrote to memory of 2764 744 hdhtxnp.exe 40 PID 2764 wrote to memory of 3060 2764 tdjpt.exe 41 PID 2764 wrote to memory of 3060 2764 tdjpt.exe 41 PID 2764 wrote to memory of 3060 2764 tdjpt.exe 41 PID 2764 wrote to memory of 3060 2764 tdjpt.exe 41 PID 3060 wrote to memory of 2604 3060 vpvbn.exe 42 PID 3060 wrote to memory of 2604 3060 vpvbn.exe 42 PID 3060 wrote to memory of 2604 3060 vpvbn.exe 42 PID 3060 wrote to memory of 2604 3060 vpvbn.exe 42 PID 2604 wrote to memory of 3040 2604 vdnpjvb.exe 43 PID 2604 wrote to memory of 3040 2604 vdnpjvb.exe 43 PID 2604 wrote to memory of 3040 2604 vdnpjvb.exe 43 PID 2604 wrote to memory of 3040 2604 vdnpjvb.exe 43 PID 3040 wrote to memory of 2636 3040 thfln.exe 44 PID 3040 wrote to memory of 2636 3040 thfln.exe 44 PID 3040 wrote to memory of 2636 3040 thfln.exe 44 PID 3040 wrote to memory of 2636 3040 thfln.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe"C:\Users\Admin\AppData\Local\Temp\8a7bed5d0a00d32141f4f104af12df14745b33b1c28f93105ca4776670bc5e40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rxjtf.exec:\rxjtf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\ptvlt.exec:\ptvlt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xjjtl.exec:\xjjtl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bbtbx.exec:\bbtbx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rvfvlp.exec:\rvfvlp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\dhbftb.exec:\dhbftb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vljpxl.exec:\vljpxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bvjdlh.exec:\bvjdlh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rpvrr.exec:\rpvrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\prhtpx.exec:\prhtpx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hdhtxnp.exec:\hdhtxnp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\tdjpt.exec:\tdjpt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vpvbn.exec:\vpvbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\vdnpjvb.exec:\vdnpjvb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\thfln.exec:\thfln.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nnnrnd.exec:\nnnrnd.exe17⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rfnjvv.exec:\rfnjvv.exe18⤵
- Executes dropped EXE
PID:632 -
\??\c:\bjxtphd.exec:\bjxtphd.exe19⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ttnftn.exec:\ttnftn.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\rnrvt.exec:\rnrvt.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ptdfv.exec:\ptdfv.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pljjl.exec:\pljjl.exe23⤵
- Executes dropped EXE
PID:112 -
\??\c:\jrnjfnh.exec:\jrnjfnh.exe24⤵
- Executes dropped EXE
PID:524 -
\??\c:\lrhpj.exec:\lrhpj.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pnbdlbh.exec:\pnbdlbh.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ppxfhb.exec:\ppxfhb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:992 -
\??\c:\nptljhn.exec:\nptljhn.exe28⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fxnpjl.exec:\fxnpjl.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fnllnr.exec:\fnllnr.exe30⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tfffr.exec:\tfffr.exe31⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jthlfnp.exec:\jthlfnp.exe32⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tjfphjn.exec:\tjfphjn.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vfvhrxn.exec:\vfvhrxn.exe34⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vvvld.exec:\vvvld.exe35⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rdnlflr.exec:\rdnlflr.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hhtbfr.exec:\hhtbfr.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vtrvtn.exec:\vtrvtn.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ndhvfr.exec:\ndhvfr.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lvpjx.exec:\lvpjx.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\trvhpl.exec:\trvhpl.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hnrrlf.exec:\hnrrlf.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nbfrp.exec:\nbfrp.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xnnxh.exec:\xnnxh.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\njlxp.exec:\njlxp.exe45⤵
- Executes dropped EXE
PID:2224 -
\??\c:\frjdpt.exec:\frjdpt.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bhlhrn.exec:\bhlhrn.exe47⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jnjtr.exec:\jnjtr.exe48⤵
- Executes dropped EXE
PID:968 -
\??\c:\frtlt.exec:\frtlt.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jnfvdj.exec:\jnfvdj.exe50⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fpxrh.exec:\fpxrh.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vfjlnvt.exec:\vfjlnvt.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vrpjvbj.exec:\vrpjvbj.exe53⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rxbfhlf.exec:\rxbfhlf.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\njjjrfl.exec:\njjjrfl.exe55⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rpfjbn.exec:\rpfjbn.exe56⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ldfvxj.exec:\ldfvxj.exe57⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jbbjbfr.exec:\jbbjbfr.exe58⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vllfp.exec:\vllfp.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\vxbdv.exec:\vxbdv.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dplvnj.exec:\dplvnj.exe61⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ldfpv.exec:\ldfpv.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rvbbvx.exec:\rvbbvx.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vnrlbj.exec:\vnrlbj.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tvfvj.exec:\tvfvj.exe65⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hhthff.exec:\hhthff.exe66⤵PID:1304
-
\??\c:\pnrnllj.exec:\pnrnllj.exe67⤵PID:1532
-
\??\c:\fjdnnrt.exec:\fjdnnrt.exe68⤵PID:2324
-
\??\c:\nrphvrn.exec:\nrphvrn.exe69⤵PID:1704
-
\??\c:\pfhxr.exec:\pfhxr.exe70⤵PID:2096
-
\??\c:\llfxp.exec:\llfxp.exe71⤵PID:2484
-
\??\c:\rxjvjlp.exec:\rxjvjlp.exe72⤵PID:320
-
\??\c:\plvhn.exec:\plvhn.exe73⤵PID:1728
-
\??\c:\vblfhl.exec:\vblfhl.exe74⤵PID:2456
-
\??\c:\rnpdr.exec:\rnpdr.exe75⤵PID:1700
-
\??\c:\lbltbp.exec:\lbltbp.exe76⤵PID:2696
-
\??\c:\fhjlfb.exec:\fhjlfb.exe77⤵PID:3012
-
\??\c:\txlfjbl.exec:\txlfjbl.exe78⤵PID:2056
-
\??\c:\vtbfrvf.exec:\vtbfrvf.exe79⤵PID:2976
-
\??\c:\nxdvtdt.exec:\nxdvtdt.exe80⤵PID:2216
-
\??\c:\fbbdt.exec:\fbbdt.exe81⤵PID:1600
-
\??\c:\xhnpv.exec:\xhnpv.exe82⤵PID:2876
-
\??\c:\fhbftb.exec:\fhbftb.exe83⤵PID:2312
-
\??\c:\jbjpthj.exec:\jbjpthj.exe84⤵PID:2960
-
\??\c:\djlhrp.exec:\djlhrp.exe85⤵PID:2440
-
\??\c:\xfnldxp.exec:\xfnldxp.exe86⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\nhthbtb.exec:\nhthbtb.exe87⤵PID:2768
-
\??\c:\dvhpnl.exec:\dvhpnl.exe88⤵PID:2608
-
\??\c:\tdpnppt.exec:\tdpnppt.exe89⤵PID:2572
-
\??\c:\rhpbd.exec:\rhpbd.exe90⤵PID:1668
-
\??\c:\jdplj.exec:\jdplj.exe91⤵PID:2220
-
\??\c:\nhflvj.exec:\nhflvj.exe92⤵PID:2536
-
\??\c:\xphlxx.exec:\xphlxx.exe93⤵PID:2576
-
\??\c:\xnfpdb.exec:\xnfpdb.exe94⤵PID:2132
-
\??\c:\jvhtpn.exec:\jvhtpn.exe95⤵PID:2240
-
\??\c:\tfjdrtx.exec:\tfjdrtx.exe96⤵PID:2500
-
\??\c:\dvfdnn.exec:\dvfdnn.exe97⤵PID:2308
-
\??\c:\xtfrhvx.exec:\xtfrhvx.exe98⤵PID:2392
-
\??\c:\lnxrnhb.exec:\lnxrnhb.exe99⤵PID:2416
-
\??\c:\jtxhbt.exec:\jtxhbt.exe100⤵PID:1224
-
\??\c:\bljnv.exec:\bljnv.exe101⤵PID:1140
-
\??\c:\dhpnjd.exec:\dhpnjd.exe102⤵PID:2204
-
\??\c:\jnxxbvn.exec:\jnxxbvn.exe103⤵PID:2080
-
\??\c:\njvvn.exec:\njvvn.exe104⤵
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\jxdhd.exec:\jxdhd.exe105⤵PID:1864
-
\??\c:\ddffdd.exec:\ddffdd.exe106⤵PID:516
-
\??\c:\hhnrbvx.exec:\hhnrbvx.exe107⤵PID:2524
-
\??\c:\tlxddj.exec:\tlxddj.exe108⤵PID:1328
-
\??\c:\vpjlrl.exec:\vpjlrl.exe109⤵PID:2620
-
\??\c:\rtxbh.exec:\rtxbh.exe110⤵PID:896
-
\??\c:\xnndnx.exec:\xnndnx.exe111⤵PID:2256
-
\??\c:\frhprvt.exec:\frhprvt.exe112⤵PID:1508
-
\??\c:\xxttbdx.exec:\xxttbdx.exe113⤵PID:2244
-
\??\c:\tbndrhh.exec:\tbndrhh.exe114⤵PID:932
-
\??\c:\rlvdxhf.exec:\rlvdxhf.exe115⤵PID:2096
-
\??\c:\rpfrn.exec:\rpfrn.exe116⤵PID:1732
-
\??\c:\dddtxlh.exec:\dddtxlh.exe117⤵PID:304
-
\??\c:\pdjrhtd.exec:\pdjrhtd.exe118⤵PID:1924
-
\??\c:\bvfjn.exec:\bvfjn.exe119⤵PID:2564
-
\??\c:\rflnf.exec:\rflnf.exe120⤵PID:1872
-
\??\c:\rnjrjd.exec:\rnjrjd.exe121⤵PID:2260
-
\??\c:\nnvpn.exec:\nnvpn.exe122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-