Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe
Resource
win7-20241010-en
General
-
Target
95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe
-
Size
454KB
-
MD5
1c46f433d5bc771d0de821f7832ac6b8
-
SHA1
052f91b495772a532b78742ee2a534a024286ca4
-
SHA256
95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288
-
SHA512
64bfccdb5aba6c5ef87c9c9006ce5369d36b40e616d9306dce50e082dfa646d716488f15f0dc5bd94618b315081d6644282d5700fd6234b320d50c7bdfea49a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/3024-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-386-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2728-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-458-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1072-739-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1072-759-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2112-817-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1520-838-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-846-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2432-910-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-942-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2756-951-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2608 bnxrpjf.exe 2176 dvnpnnx.exe 1144 xrdbfn.exe 2520 tjjbtx.exe 2880 vnbrn.exe 2792 pplrnh.exe 2528 hptjl.exe 2696 jppxbt.exe 2680 tfrnvpl.exe 2716 jtfjvh.exe 1372 lhbtx.exe 2092 vjpvnn.exe 1560 xbrbv.exe 2996 rhrdbx.exe 2848 xpdvfd.exe 3012 tfbnth.exe 1100 vffnjr.exe 236 vdldnv.exe 2456 lvlbh.exe 2548 pdrrdfn.exe 2400 drdxnnj.exe 2192 fxtvrd.exe 2112 bxbnpx.exe 1732 tfprbt.exe 2224 ldxplnj.exe 1804 tvnjlfb.exe 856 nnxdbjf.exe 2040 pfvlflf.exe 788 lbdnrxj.exe 320 dtpxbvf.exe 1964 pfvhbdx.exe 1540 lxrrxr.exe 860 vbfln.exe 1592 rjppfr.exe 636 tldjxf.exe 2044 jppdndn.exe 1192 hhrfxfh.exe 2504 xtnxd.exe 2812 vlvvh.exe 2920 htfxhnv.exe 2896 hfldf.exe 3036 phjnptl.exe 2828 ftnnjx.exe 1664 tnnljbh.exe 1920 xbxvp.exe 2832 ppbtfh.exe 1388 ddpxp.exe 1496 nxfxbb.exe 2852 nrbpnth.exe 2904 rxltdhb.exe 2728 nrltvfd.exe 2984 jrpvl.exe 2996 trjhtp.exe 2912 fxrnh.exe 1900 ltxddj.exe 1656 dvvxpxt.exe 2252 lrnjrp.exe 984 xbpll.exe 2232 tphff.exe 2476 djpxhdt.exe 2844 dnnjxhx.exe 588 vpfbdvl.exe 1956 njfhpbp.exe 2544 rlllxh.exe -
resource yara_rule behavioral1/memory/3024-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-943-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddfpjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjfprj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddbfnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vldrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvbflld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvnvbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxvppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prbfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdthl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvdxln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltjfxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njvhtpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjfbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdbhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptjhnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbvhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvxpxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhlpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plppnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfphdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdrdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjhnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhtxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvldbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvbtrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2608 3024 95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe 29 PID 3024 wrote to memory of 2608 3024 95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe 29 PID 3024 wrote to memory of 2608 3024 95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe 29 PID 3024 wrote to memory of 2608 3024 95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe 29 PID 2608 wrote to memory of 2176 2608 bnxrpjf.exe 30 PID 2608 wrote to memory of 2176 2608 bnxrpjf.exe 30 PID 2608 wrote to memory of 2176 2608 bnxrpjf.exe 30 PID 2608 wrote to memory of 2176 2608 bnxrpjf.exe 30 PID 2176 wrote to memory of 1144 2176 dvnpnnx.exe 31 PID 2176 wrote to memory of 1144 2176 dvnpnnx.exe 31 PID 2176 wrote to memory of 1144 2176 dvnpnnx.exe 31 PID 2176 wrote to memory of 1144 2176 dvnpnnx.exe 31 PID 1144 wrote to memory of 2520 1144 xrdbfn.exe 32 PID 1144 wrote to memory of 2520 1144 xrdbfn.exe 32 PID 1144 wrote to memory of 2520 1144 xrdbfn.exe 32 PID 1144 wrote to memory of 2520 1144 xrdbfn.exe 32 PID 2520 wrote to memory of 2880 2520 tjjbtx.exe 33 PID 2520 wrote to memory of 2880 2520 tjjbtx.exe 33 PID 2520 wrote to memory of 2880 2520 tjjbtx.exe 33 PID 2520 wrote to memory of 2880 2520 tjjbtx.exe 33 PID 2880 wrote to memory of 2792 2880 vnbrn.exe 34 PID 2880 wrote to memory of 2792 2880 vnbrn.exe 34 PID 2880 wrote to memory of 2792 2880 vnbrn.exe 34 PID 2880 wrote to memory of 2792 2880 vnbrn.exe 34 PID 2792 wrote to memory of 2528 2792 pplrnh.exe 35 PID 2792 wrote to memory of 2528 2792 pplrnh.exe 35 PID 2792 wrote to memory of 2528 2792 pplrnh.exe 35 PID 2792 wrote to memory of 2528 2792 pplrnh.exe 35 PID 2528 wrote to memory of 2696 2528 hptjl.exe 36 PID 2528 wrote to memory of 2696 2528 hptjl.exe 36 PID 2528 wrote to memory of 2696 2528 hptjl.exe 36 PID 2528 wrote to memory of 2696 2528 hptjl.exe 36 PID 2696 wrote to memory of 2680 2696 jppxbt.exe 37 PID 2696 wrote to memory of 2680 2696 jppxbt.exe 37 PID 2696 wrote to memory of 2680 2696 jppxbt.exe 37 PID 2696 wrote to memory of 2680 2696 jppxbt.exe 37 PID 2680 wrote to memory of 2716 2680 tfrnvpl.exe 38 PID 2680 wrote to memory of 2716 2680 tfrnvpl.exe 38 PID 2680 wrote to memory of 2716 2680 tfrnvpl.exe 38 PID 2680 wrote to memory of 2716 2680 tfrnvpl.exe 38 PID 2716 wrote to memory of 1372 2716 jtfjvh.exe 39 PID 2716 wrote to memory of 1372 2716 jtfjvh.exe 39 PID 2716 wrote to memory of 1372 2716 jtfjvh.exe 39 PID 2716 wrote to memory of 1372 2716 jtfjvh.exe 39 PID 1372 wrote to memory of 2092 1372 lhbtx.exe 40 PID 1372 wrote to memory of 2092 1372 lhbtx.exe 40 PID 1372 wrote to memory of 2092 1372 lhbtx.exe 40 PID 1372 wrote to memory of 2092 1372 lhbtx.exe 40 PID 2092 wrote to memory of 1560 2092 vjpvnn.exe 41 PID 2092 wrote to memory of 1560 2092 vjpvnn.exe 41 PID 2092 wrote to memory of 1560 2092 vjpvnn.exe 41 PID 2092 wrote to memory of 1560 2092 vjpvnn.exe 41 PID 1560 wrote to memory of 2996 1560 xbrbv.exe 42 PID 1560 wrote to memory of 2996 1560 xbrbv.exe 42 PID 1560 wrote to memory of 2996 1560 xbrbv.exe 42 PID 1560 wrote to memory of 2996 1560 xbrbv.exe 42 PID 2996 wrote to memory of 2848 2996 rhrdbx.exe 43 PID 2996 wrote to memory of 2848 2996 rhrdbx.exe 43 PID 2996 wrote to memory of 2848 2996 rhrdbx.exe 43 PID 2996 wrote to memory of 2848 2996 rhrdbx.exe 43 PID 2848 wrote to memory of 3012 2848 xpdvfd.exe 44 PID 2848 wrote to memory of 3012 2848 xpdvfd.exe 44 PID 2848 wrote to memory of 3012 2848 xpdvfd.exe 44 PID 2848 wrote to memory of 3012 2848 xpdvfd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe"C:\Users\Admin\AppData\Local\Temp\95e73277c66487cbda056581adcc46596f86bf96030ea06d1662e07318089288.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bnxrpjf.exec:\bnxrpjf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dvnpnnx.exec:\dvnpnnx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\xrdbfn.exec:\xrdbfn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\tjjbtx.exec:\tjjbtx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vnbrn.exec:\vnbrn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pplrnh.exec:\pplrnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hptjl.exec:\hptjl.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jppxbt.exec:\jppxbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tfrnvpl.exec:\tfrnvpl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jtfjvh.exec:\jtfjvh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lhbtx.exec:\lhbtx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\vjpvnn.exec:\vjpvnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\xbrbv.exec:\xbrbv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rhrdbx.exec:\rhrdbx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xpdvfd.exec:\xpdvfd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\tfbnth.exec:\tfbnth.exe17⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vffnjr.exec:\vffnjr.exe18⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vdldnv.exec:\vdldnv.exe19⤵
- Executes dropped EXE
PID:236 -
\??\c:\lvlbh.exec:\lvlbh.exe20⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pdrrdfn.exec:\pdrrdfn.exe21⤵
- Executes dropped EXE
PID:2548 -
\??\c:\drdxnnj.exec:\drdxnnj.exe22⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fxtvrd.exec:\fxtvrd.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bxbnpx.exec:\bxbnpx.exe24⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tfprbt.exec:\tfprbt.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ldxplnj.exec:\ldxplnj.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tvnjlfb.exec:\tvnjlfb.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nnxdbjf.exec:\nnxdbjf.exe28⤵
- Executes dropped EXE
PID:856 -
\??\c:\pfvlflf.exec:\pfvlflf.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lbdnrxj.exec:\lbdnrxj.exe30⤵
- Executes dropped EXE
PID:788 -
\??\c:\dtpxbvf.exec:\dtpxbvf.exe31⤵
- Executes dropped EXE
PID:320 -
\??\c:\pfvhbdx.exec:\pfvhbdx.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxrrxr.exec:\lxrrxr.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vbfln.exec:\vbfln.exe34⤵
- Executes dropped EXE
PID:860 -
\??\c:\rjppfr.exec:\rjppfr.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tldjxf.exec:\tldjxf.exe36⤵
- Executes dropped EXE
PID:636 -
\??\c:\jppdndn.exec:\jppdndn.exe37⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhrfxfh.exec:\hhrfxfh.exe38⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xtnxd.exec:\xtnxd.exe39⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vlvvh.exec:\vlvvh.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\htfxhnv.exec:\htfxhnv.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hfldf.exec:\hfldf.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\phjnptl.exec:\phjnptl.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ftnnjx.exec:\ftnnjx.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnnljbh.exec:\tnnljbh.exe45⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xbxvp.exec:\xbxvp.exe46⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ppbtfh.exec:\ppbtfh.exe47⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ddpxp.exec:\ddpxp.exe48⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nxfxbb.exec:\nxfxbb.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nrbpnth.exec:\nrbpnth.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rxltdhb.exec:\rxltdhb.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nrltvfd.exec:\nrltvfd.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jrpvl.exec:\jrpvl.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\trjhtp.exec:\trjhtp.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxrnh.exec:\fxrnh.exe55⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ltxddj.exec:\ltxddj.exe56⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dvvxpxt.exec:\dvvxpxt.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\lrnjrp.exec:\lrnjrp.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xbpll.exec:\xbpll.exe59⤵
- Executes dropped EXE
PID:984 -
\??\c:\tphff.exec:\tphff.exe60⤵
- Executes dropped EXE
PID:2232 -
\??\c:\djpxhdt.exec:\djpxhdt.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dnnjxhx.exec:\dnnjxhx.exe62⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpfbdvl.exec:\vpfbdvl.exe63⤵
- Executes dropped EXE
PID:588 -
\??\c:\njfhpbp.exec:\njfhpbp.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rlllxh.exec:\rlllxh.exe65⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hvhvfth.exec:\hvhvfth.exe66⤵PID:2136
-
\??\c:\fldvrx.exec:\fldvrx.exe67⤵PID:1732
-
\??\c:\vhnxd.exec:\vhnxd.exe68⤵PID:1104
-
\??\c:\xnndn.exec:\xnndn.exe69⤵PID:1404
-
\??\c:\jrvph.exec:\jrvph.exe70⤵PID:2276
-
\??\c:\vxfrvxl.exec:\vxfrvxl.exe71⤵PID:856
-
\??\c:\vbrbb.exec:\vbrbb.exe72⤵PID:2040
-
\??\c:\vxbnpd.exec:\vxbnpd.exe73⤵PID:2268
-
\??\c:\bppxd.exec:\bppxd.exe74⤵PID:1124
-
\??\c:\dlnrdvr.exec:\dlnrdvr.exe75⤵PID:2436
-
\??\c:\xnntln.exec:\xnntln.exe76⤵PID:892
-
\??\c:\jnrxdj.exec:\jnrxdj.exe77⤵PID:2612
-
\??\c:\vlljjvh.exec:\vlljjvh.exe78⤵PID:2052
-
\??\c:\lblvl.exec:\lblvl.exe79⤵PID:644
-
\??\c:\thtlntf.exec:\thtlntf.exe80⤵PID:1216
-
\??\c:\xxbfdt.exec:\xxbfdt.exe81⤵PID:1260
-
\??\c:\xdxxphf.exec:\xdxxphf.exe82⤵PID:1668
-
\??\c:\rtlpb.exec:\rtlpb.exe83⤵PID:2772
-
\??\c:\jttfdb.exec:\jttfdb.exe84⤵PID:2940
-
\??\c:\ppllp.exec:\ppllp.exe85⤵PID:2816
-
\??\c:\dxnnlrx.exec:\dxnnlrx.exe86⤵PID:2896
-
\??\c:\xrrhl.exec:\xrrhl.exe87⤵PID:2144
-
\??\c:\xbpvrrj.exec:\xbpvrrj.exe88⤵PID:2828
-
\??\c:\lflttpf.exec:\lflttpf.exe89⤵PID:2664
-
\??\c:\lrjhlv.exec:\lrjhlv.exe90⤵PID:1920
-
\??\c:\nbpph.exec:\nbpph.exe91⤵PID:2832
-
\??\c:\fxldrfl.exec:\fxldrfl.exe92⤵PID:2708
-
\??\c:\hxdnn.exec:\hxdnn.exe93⤵PID:1496
-
\??\c:\jljlrrl.exec:\jljlrrl.exe94⤵
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\hdfjfjb.exec:\hdfjfjb.exe95⤵PID:2956
-
\??\c:\rrjjr.exec:\rrjjr.exe96⤵PID:1560
-
\??\c:\rdxhtdf.exec:\rdxhtdf.exe97⤵PID:700
-
\??\c:\jbnflt.exec:\jbnflt.exe98⤵PID:2500
-
\??\c:\lxnxnfn.exec:\lxnxnfn.exe99⤵PID:1704
-
\??\c:\rxhfxx.exec:\rxhfxx.exe100⤵PID:1072
-
\??\c:\nxdfl.exec:\nxdfl.exe101⤵PID:840
-
\??\c:\htnvrx.exec:\htnvrx.exe102⤵PID:2252
-
\??\c:\jjrtpxr.exec:\jjrtpxr.exe103⤵PID:820
-
\??\c:\bdnhv.exec:\bdnhv.exe104⤵PID:584
-
\??\c:\bpnhhvt.exec:\bpnhhvt.exe105⤵PID:2476
-
\??\c:\dvppvvj.exec:\dvppvvj.exe106⤵PID:2408
-
\??\c:\fxxvtb.exec:\fxxvtb.exe107⤵PID:1684
-
\??\c:\ldhvrrp.exec:\ldhvrrp.exe108⤵PID:2320
-
\??\c:\pvjjxh.exec:\pvjjxh.exe109⤵PID:2112
-
\??\c:\bpfrj.exec:\bpfrj.exe110⤵PID:1752
-
\??\c:\jxbdj.exec:\jxbdj.exe111⤵PID:1044
-
\??\c:\tftxpxh.exec:\tftxpxh.exe112⤵PID:2976
-
\??\c:\tbbnv.exec:\tbbnv.exe113⤵PID:2216
-
\??\c:\tpxhtpj.exec:\tpxhtpj.exe114⤵PID:2000
-
\??\c:\nrxldx.exec:\nrxldx.exe115⤵PID:1520
-
\??\c:\xxpjnpx.exec:\xxpjnpx.exe116⤵PID:616
-
\??\c:\dlbbth.exec:\dlbbth.exe117⤵PID:1332
-
\??\c:\rjhtb.exec:\rjhtb.exe118⤵PID:320
-
\??\c:\fvffx.exec:\fvffx.exe119⤵PID:1964
-
\??\c:\ljddjnd.exec:\ljddjnd.exe120⤵PID:2616
-
\??\c:\ddfpjlr.exec:\ddfpjlr.exe121⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\vjbfjvp.exec:\vjbfjvp.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-