Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 06:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe
-
Size
453KB
-
MD5
10d047651ae5299be43fd05ccba3d280
-
SHA1
b9e007bb07584c2b47c91aa9db0d713df8b14e6f
-
SHA256
8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7
-
SHA512
6e4cf923241b9cce7e3a6c3503103b38a9128f8bc98962d098fe85d92dd9e024aea7ad8effb9427508b563c4d36043e6be9bfe0f7a4f36ff8b75bdf5b1cd3a5e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/368-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-377-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-439-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-454-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/980-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2644-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-654-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2944-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-715-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2236-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2612 plxrhrh.exe 644 rphdpr.exe 1192 bplphfh.exe 2520 rrjhr.exe 2876 rvdtjb.exe 2928 hjptvdl.exe 2972 ftdvfr.exe 2888 thbvh.exe 2720 lfdhtrv.exe 772 bxdpf.exe 1836 xrbpxj.exe 2904 pvpfnff.exe 1992 nrfjpvj.exe 2988 pjrbb.exe 2500 hvldhvb.exe 3008 jhrltx.exe 2108 tnhpj.exe 236 jrtnl.exe 2464 nrxjxbl.exe 2248 rxhvr.exe 2160 tttbrxf.exe 2568 jndvp.exe 2480 flpft.exe 2388 tbdxxbf.exe 1752 lddnnnt.exe 2032 flhlnr.exe 1816 xlvrpt.exe 936 vtpftd.exe 616 lvnpnxj.exe 2596 pvlfh.exe 2640 vpvdhpj.exe 2428 fbdrf.exe 368 dvjfx.exe 2344 vfnbrf.exe 2368 rpvrn.exe 2164 bhnrffd.exe 2856 bpxbd.exe 3016 nrvhdx.exe 1476 pnrhd.exe 2908 jxjhjfd.exe 2608 dlptpdd.exe 2944 vbpnfv.exe 3028 jxjlf.exe 2692 bldfpb.exe 2780 tlthpd.exe 2716 ptdxxt.exe 1080 nlfxlv.exe 1736 tlldfj.exe 2412 hjxljvt.exe 1508 hdjlxt.exe 2736 vbhhlfv.exe 2076 xddnpn.exe 2980 ltpnntn.exe 2128 jxlbptd.exe 1100 ddtxxl.exe 2252 vfvllf.exe 2360 dhxpn.exe 2232 fhjfbx.exe 2456 xvhfjb.exe 2416 rftdft.exe 980 jxjfnbl.exe 2356 xtrbd.exe 2532 lhxjjf.exe 1732 nvpxr.exe -
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/368-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-375-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2692-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-471-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/980-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-828-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlltl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrtltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjnhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnfhrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrtpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvpfdnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtbxvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnpth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvjxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvvvddr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfpln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrtfhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldnvlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrbthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phtxrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvftrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpprjhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjpjfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xprvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldhft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nllrdlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrrttv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxnvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhppxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2612 2344 8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe 29 PID 2344 wrote to memory of 2612 2344 8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe 29 PID 2344 wrote to memory of 2612 2344 8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe 29 PID 2344 wrote to memory of 2612 2344 8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe 29 PID 2612 wrote to memory of 644 2612 plxrhrh.exe 30 PID 2612 wrote to memory of 644 2612 plxrhrh.exe 30 PID 2612 wrote to memory of 644 2612 plxrhrh.exe 30 PID 2612 wrote to memory of 644 2612 plxrhrh.exe 30 PID 644 wrote to memory of 1192 644 rphdpr.exe 31 PID 644 wrote to memory of 1192 644 rphdpr.exe 31 PID 644 wrote to memory of 1192 644 rphdpr.exe 31 PID 644 wrote to memory of 1192 644 rphdpr.exe 31 PID 1192 wrote to memory of 2520 1192 bplphfh.exe 32 PID 1192 wrote to memory of 2520 1192 bplphfh.exe 32 PID 1192 wrote to memory of 2520 1192 bplphfh.exe 32 PID 1192 wrote to memory of 2520 1192 bplphfh.exe 32 PID 2520 wrote to memory of 2876 2520 rrjhr.exe 33 PID 2520 wrote to memory of 2876 2520 rrjhr.exe 33 PID 2520 wrote to memory of 2876 2520 rrjhr.exe 33 PID 2520 wrote to memory of 2876 2520 rrjhr.exe 33 PID 2876 wrote to memory of 2928 2876 rvdtjb.exe 34 PID 2876 wrote to memory of 2928 2876 rvdtjb.exe 34 PID 2876 wrote to memory of 2928 2876 rvdtjb.exe 34 PID 2876 wrote to memory of 2928 2876 rvdtjb.exe 34 PID 2928 wrote to memory of 2972 2928 hjptvdl.exe 35 PID 2928 wrote to memory of 2972 2928 hjptvdl.exe 35 PID 2928 wrote to memory of 2972 2928 hjptvdl.exe 35 PID 2928 wrote to memory of 2972 2928 hjptvdl.exe 35 PID 2972 wrote to memory of 2888 2972 ftdvfr.exe 36 PID 2972 wrote to memory of 2888 2972 ftdvfr.exe 36 PID 2972 wrote to memory of 2888 2972 ftdvfr.exe 36 PID 2972 wrote to memory of 2888 2972 ftdvfr.exe 36 PID 2888 wrote to memory of 2720 2888 thbvh.exe 37 PID 2888 wrote to memory of 2720 2888 thbvh.exe 37 PID 2888 wrote to memory of 2720 2888 thbvh.exe 37 PID 2888 wrote to memory of 2720 2888 thbvh.exe 37 PID 2720 wrote to memory of 772 2720 lfdhtrv.exe 38 PID 2720 wrote to memory of 772 2720 lfdhtrv.exe 38 PID 2720 wrote to memory of 772 2720 lfdhtrv.exe 38 PID 2720 wrote to memory of 772 2720 lfdhtrv.exe 38 PID 772 wrote to memory of 1836 772 bxdpf.exe 39 PID 772 wrote to memory of 1836 772 bxdpf.exe 39 PID 772 wrote to memory of 1836 772 bxdpf.exe 39 PID 772 wrote to memory of 1836 772 bxdpf.exe 39 PID 1836 wrote to memory of 2904 1836 xrbpxj.exe 40 PID 1836 wrote to memory of 2904 1836 xrbpxj.exe 40 PID 1836 wrote to memory of 2904 1836 xrbpxj.exe 40 PID 1836 wrote to memory of 2904 1836 xrbpxj.exe 40 PID 2904 wrote to memory of 1992 2904 pvpfnff.exe 41 PID 2904 wrote to memory of 1992 2904 pvpfnff.exe 41 PID 2904 wrote to memory of 1992 2904 pvpfnff.exe 41 PID 2904 wrote to memory of 1992 2904 pvpfnff.exe 41 PID 1992 wrote to memory of 2988 1992 nrfjpvj.exe 42 PID 1992 wrote to memory of 2988 1992 nrfjpvj.exe 42 PID 1992 wrote to memory of 2988 1992 nrfjpvj.exe 42 PID 1992 wrote to memory of 2988 1992 nrfjpvj.exe 42 PID 2988 wrote to memory of 2500 2988 pjrbb.exe 43 PID 2988 wrote to memory of 2500 2988 pjrbb.exe 43 PID 2988 wrote to memory of 2500 2988 pjrbb.exe 43 PID 2988 wrote to memory of 2500 2988 pjrbb.exe 43 PID 2500 wrote to memory of 3008 2500 hvldhvb.exe 44 PID 2500 wrote to memory of 3008 2500 hvldhvb.exe 44 PID 2500 wrote to memory of 3008 2500 hvldhvb.exe 44 PID 2500 wrote to memory of 3008 2500 hvldhvb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe"C:\Users\Admin\AppData\Local\Temp\8e38ba3f3700941d0191775024cefc262c22997983c8814eff1ef6794c8a96c7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\plxrhrh.exec:\plxrhrh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rphdpr.exec:\rphdpr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\bplphfh.exec:\bplphfh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\rrjhr.exec:\rrjhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rvdtjb.exec:\rvdtjb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\hjptvdl.exec:\hjptvdl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ftdvfr.exec:\ftdvfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\thbvh.exec:\thbvh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lfdhtrv.exec:\lfdhtrv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bxdpf.exec:\bxdpf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\xrbpxj.exec:\xrbpxj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\pvpfnff.exec:\pvpfnff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nrfjpvj.exec:\nrfjpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pjrbb.exec:\pjrbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hvldhvb.exec:\hvldhvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jhrltx.exec:\jhrltx.exe17⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tnhpj.exec:\tnhpj.exe18⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jrtnl.exec:\jrtnl.exe19⤵
- Executes dropped EXE
PID:236 -
\??\c:\nrxjxbl.exec:\nrxjxbl.exe20⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rxhvr.exec:\rxhvr.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tttbrxf.exec:\tttbrxf.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jndvp.exec:\jndvp.exe23⤵
- Executes dropped EXE
PID:2568 -
\??\c:\flpft.exec:\flpft.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tbdxxbf.exec:\tbdxxbf.exe25⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lddnnnt.exec:\lddnnnt.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\flhlnr.exec:\flhlnr.exe27⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlvrpt.exec:\xlvrpt.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vtpftd.exec:\vtpftd.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\lvnpnxj.exec:\lvnpnxj.exe30⤵
- Executes dropped EXE
PID:616 -
\??\c:\pvlfh.exec:\pvlfh.exe31⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpvdhpj.exec:\vpvdhpj.exe32⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fbdrf.exec:\fbdrf.exe33⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dvjfx.exec:\dvjfx.exe34⤵
- Executes dropped EXE
PID:368 -
\??\c:\vfnbrf.exec:\vfnbrf.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rpvrn.exec:\rpvrn.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bhnrffd.exec:\bhnrffd.exe37⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bpxbd.exec:\bpxbd.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nrvhdx.exec:\nrvhdx.exe39⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pnrhd.exec:\pnrhd.exe40⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jxjhjfd.exec:\jxjhjfd.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dlptpdd.exec:\dlptpdd.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vbpnfv.exec:\vbpnfv.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jxjlf.exec:\jxjlf.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bldfpb.exec:\bldfpb.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tlthpd.exec:\tlthpd.exe46⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ptdxxt.exec:\ptdxxt.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nlfxlv.exec:\nlfxlv.exe48⤵
- Executes dropped EXE
PID:1080 -
\??\c:\tlldfj.exec:\tlldfj.exe49⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hjxljvt.exec:\hjxljvt.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hdjlxt.exec:\hdjlxt.exe51⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vbhhlfv.exec:\vbhhlfv.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xddnpn.exec:\xddnpn.exe53⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ltpnntn.exec:\ltpnntn.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jxlbptd.exec:\jxlbptd.exe55⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ddtxxl.exec:\ddtxxl.exe56⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vfvllf.exec:\vfvllf.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dhxpn.exec:\dhxpn.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fhjfbx.exec:\fhjfbx.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xvhfjb.exec:\xvhfjb.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rftdft.exec:\rftdft.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jxjfnbl.exec:\jxjfnbl.exe62⤵
- Executes dropped EXE
PID:980 -
\??\c:\xtrbd.exec:\xtrbd.exe63⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lhxjjf.exec:\lhxjjf.exe64⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nvpxr.exec:\nvpxr.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tflhx.exec:\tflhx.exe66⤵PID:884
-
\??\c:\vxdrbbx.exec:\vxdrbbx.exe67⤵PID:1672
-
\??\c:\trtrjdx.exec:\trtrjdx.exe68⤵PID:1572
-
\??\c:\fprlhnv.exec:\fprlhnv.exe69⤵PID:1104
-
\??\c:\jvlrp.exec:\jvlrp.exe70⤵PID:972
-
\??\c:\npjbll.exec:\npjbll.exe71⤵PID:932
-
\??\c:\rpbvb.exec:\rpbvb.exe72⤵PID:2260
-
\??\c:\rtldx.exec:\rtldx.exe73⤵PID:616
-
\??\c:\jtdpbh.exec:\jtdpbh.exe74⤵PID:2268
-
\??\c:\hnplfph.exec:\hnplfph.exe75⤵PID:2436
-
\??\c:\rfnbbt.exec:\rfnbbt.exe76⤵PID:1540
-
\??\c:\fdvfdx.exec:\fdvfdx.exe77⤵PID:892
-
\??\c:\pxnrt.exec:\pxnrt.exe78⤵PID:2644
-
\??\c:\rdlffpv.exec:\rdlffpv.exe79⤵PID:2240
-
\??\c:\nptxxrd.exec:\nptxxrd.exe80⤵PID:2612
-
\??\c:\tbdtvlf.exec:\tbdtvlf.exe81⤵PID:1952
-
\??\c:\vvdrdr.exec:\vvdrdr.exe82⤵PID:2432
-
\??\c:\xtdpvhl.exec:\xtdpvhl.exe83⤵PID:2512
-
\??\c:\lthpjf.exec:\lthpjf.exe84⤵PID:2772
-
\??\c:\pxdfh.exec:\pxdfh.exe85⤵PID:2932
-
\??\c:\bnnhjl.exec:\bnnhjl.exe86⤵PID:2676
-
\??\c:\lbhnpp.exec:\lbhnpp.exe87⤵PID:2944
-
\??\c:\fhvbjb.exec:\fhvbjb.exe88⤵PID:3028
-
\??\c:\nblpfj.exec:\nblpfj.exe89⤵PID:2972
-
\??\c:\jvrxlfp.exec:\jvrxlfp.exe90⤵PID:2120
-
\??\c:\rthjrrf.exec:\rthjrrf.exe91⤵PID:2720
-
\??\c:\lvbhv.exec:\lvbhv.exe92⤵PID:2648
-
\??\c:\ldvnrx.exec:\ldvnrx.exe93⤵PID:2764
-
\??\c:\dlrdnrh.exec:\dlrdnrh.exe94⤵PID:1176
-
\??\c:\xnnvvd.exec:\xnnvvd.exe95⤵PID:1980
-
\??\c:\nrhjv.exec:\nrhjv.exe96⤵PID:2916
-
\??\c:\nldxb.exec:\nldxb.exe97⤵PID:1904
-
\??\c:\rthpl.exec:\rthpl.exe98⤵PID:1704
-
\??\c:\ldbdp.exec:\ldbdp.exe99⤵PID:776
-
\??\c:\ljrpd.exec:\ljrpd.exe100⤵PID:1676
-
\??\c:\xjjhd.exec:\xjjhd.exe101⤵PID:1708
-
\??\c:\tvvrbp.exec:\tvvrbp.exe102⤵PID:2236
-
\??\c:\rjxhf.exec:\rjxhf.exe103⤵PID:584
-
\??\c:\ttdbdr.exec:\ttdbdr.exe104⤵PID:2548
-
\??\c:\fbdfpfp.exec:\fbdfpfp.exe105⤵PID:460
-
\??\c:\fhvdxd.exec:\fhvdxd.exe106⤵PID:1712
-
\??\c:\hrtnnbd.exec:\hrtnnbd.exe107⤵PID:2112
-
\??\c:\plvbfrr.exec:\plvbfrr.exe108⤵PID:1068
-
\??\c:\xhhfl.exec:\xhhfl.exe109⤵PID:960
-
\??\c:\xtlxvn.exec:\xtlxvn.exe110⤵PID:1092
-
\??\c:\fblllxp.exec:\fblllxp.exe111⤵PID:1440
-
\??\c:\tjbtnp.exec:\tjbtnp.exe112⤵PID:1716
-
\??\c:\bjjfp.exec:\bjjfp.exe113⤵PID:1740
-
\??\c:\nfvhv.exec:\nfvhv.exe114⤵PID:2012
-
\??\c:\vpjpbht.exec:\vpjpbht.exe115⤵PID:936
-
\??\c:\hprvvbh.exec:\hprvvbh.exe116⤵PID:2324
-
\??\c:\tvfltxj.exec:\tvfltxj.exe117⤵PID:616
-
\??\c:\jjxjxn.exec:\jjxjxn.exe118⤵PID:2472
-
\??\c:\nxfhnf.exec:\nxfhnf.exe119⤵PID:1536
-
\??\c:\hnhbxn.exec:\hnhbxn.exe120⤵PID:1540
-
\??\c:\bjxfljn.exec:\bjxfljn.exe121⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-