Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe
Resource
win7-20241010-en
General
-
Target
bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe
-
Size
457KB
-
MD5
5d4abf117033436a48a3834cf4fac176
-
SHA1
05124be2c9adf5931f5215212f6dc27dc9e1f2b1
-
SHA256
bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387
-
SHA512
0a2160d829a6233756d356348bad29fe21c9eb2706fa05e4ea58e9f5bb5c00f8974aa75bac843fdbfaa0400329d080fb87cf55cbb75a991ddf4e16fc10e1cac2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeSHy:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-26-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2916-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-161-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/264-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1004-583-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-597-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2968-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-899-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2104-919-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-945-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2072-964-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-993-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 rffdbnx.exe 2792 fjvhd.exe 2916 httjf.exe 2708 jxnppv.exe 2724 ttbxnlx.exe 2720 lbprtnb.exe 432 lnlphnp.exe 1076 tbfbvdt.exe 912 frlhrdl.exe 2188 hlvbfpb.exe 2260 nbfdf.exe 2736 vfxvdnf.exe 2768 hjvhxdn.exe 3000 dtxhhl.exe 2464 dpdhnbl.exe 2376 pnpjhj.exe 264 nnhbhpn.exe 2064 jxvnr.exe 2236 xrbvbjp.exe 1980 fbdpdh.exe 1060 vjdbxpr.exe 1616 fdhlv.exe 1472 vtltjxx.exe 1712 pltdj.exe 1388 ljfdhjf.exe 548 bldvv.exe 2344 hrprff.exe 1580 lnlfl.exe 1352 nbtnfvv.exe 2480 xfrpttl.exe 1064 ntjnj.exe 1068 bbfvfdd.exe 2592 txxfvp.exe 2864 jrvnvv.exe 2812 rtphf.exe 2268 hbpvj.exe 2756 xlbhrd.exe 2692 jvjnnl.exe 2780 jlvdfl.exe 2712 bhvdddv.exe 2744 nnnffp.exe 2648 jpdvvjb.exe 920 brlnt.exe 1996 vxxbjr.exe 1952 rrplltl.exe 912 bdfpjnv.exe 2408 flxnp.exe 628 lnbtbd.exe 2996 nvbrvf.exe 2420 rxhbt.exe 2844 hrnlf.exe 2628 vftlxp.exe 1460 jxvdxxr.exe 700 njjhxf.exe 2368 bttflt.exe 2388 fjdjpbj.exe 2360 nvvpdh.exe 3056 vpjbx.exe 2504 fflxjrr.exe 2340 fxrtrbd.exe 956 bfvvrvj.exe 2632 ndtbrd.exe 2088 vjvltft.exe 816 vvxvrb.exe -
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-993-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdtptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlldtvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlplhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvljrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrntjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnvdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlljn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtdjjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhnxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrnjtjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlvrlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rndjlxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxtvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttrnhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvxdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddlfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfxdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnfhfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfhtxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvnrtxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvprvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhndxbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtltttf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xttpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvxrbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxprxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrfhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpxfhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdttf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjfrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dntbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvbfpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxfbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlhjdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2864 2772 bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe 30 PID 2772 wrote to memory of 2864 2772 bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe 30 PID 2772 wrote to memory of 2864 2772 bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe 30 PID 2772 wrote to memory of 2864 2772 bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe 30 PID 2864 wrote to memory of 2792 2864 rffdbnx.exe 31 PID 2864 wrote to memory of 2792 2864 rffdbnx.exe 31 PID 2864 wrote to memory of 2792 2864 rffdbnx.exe 31 PID 2864 wrote to memory of 2792 2864 rffdbnx.exe 31 PID 2792 wrote to memory of 2916 2792 fjvhd.exe 32 PID 2792 wrote to memory of 2916 2792 fjvhd.exe 32 PID 2792 wrote to memory of 2916 2792 fjvhd.exe 32 PID 2792 wrote to memory of 2916 2792 fjvhd.exe 32 PID 2916 wrote to memory of 2708 2916 httjf.exe 33 PID 2916 wrote to memory of 2708 2916 httjf.exe 33 PID 2916 wrote to memory of 2708 2916 httjf.exe 33 PID 2916 wrote to memory of 2708 2916 httjf.exe 33 PID 2708 wrote to memory of 2724 2708 jxnppv.exe 34 PID 2708 wrote to memory of 2724 2708 jxnppv.exe 34 PID 2708 wrote to memory of 2724 2708 jxnppv.exe 34 PID 2708 wrote to memory of 2724 2708 jxnppv.exe 34 PID 2724 wrote to memory of 2720 2724 ttbxnlx.exe 35 PID 2724 wrote to memory of 2720 2724 ttbxnlx.exe 35 PID 2724 wrote to memory of 2720 2724 ttbxnlx.exe 35 PID 2724 wrote to memory of 2720 2724 ttbxnlx.exe 35 PID 2720 wrote to memory of 432 2720 lbprtnb.exe 36 PID 2720 wrote to memory of 432 2720 lbprtnb.exe 36 PID 2720 wrote to memory of 432 2720 lbprtnb.exe 36 PID 2720 wrote to memory of 432 2720 lbprtnb.exe 36 PID 432 wrote to memory of 1076 432 lnlphnp.exe 37 PID 432 wrote to memory of 1076 432 lnlphnp.exe 37 PID 432 wrote to memory of 1076 432 lnlphnp.exe 37 PID 432 wrote to memory of 1076 432 lnlphnp.exe 37 PID 1076 wrote to memory of 912 1076 tbfbvdt.exe 38 PID 1076 wrote to memory of 912 1076 tbfbvdt.exe 38 PID 1076 wrote to memory of 912 1076 tbfbvdt.exe 38 PID 1076 wrote to memory of 912 1076 tbfbvdt.exe 38 PID 912 wrote to memory of 2188 912 frlhrdl.exe 39 PID 912 wrote to memory of 2188 912 frlhrdl.exe 39 PID 912 wrote to memory of 2188 912 frlhrdl.exe 39 PID 912 wrote to memory of 2188 912 frlhrdl.exe 39 PID 2188 wrote to memory of 2260 2188 hlvbfpb.exe 40 PID 2188 wrote to memory of 2260 2188 hlvbfpb.exe 40 PID 2188 wrote to memory of 2260 2188 hlvbfpb.exe 40 PID 2188 wrote to memory of 2260 2188 hlvbfpb.exe 40 PID 2260 wrote to memory of 2736 2260 nbfdf.exe 41 PID 2260 wrote to memory of 2736 2260 nbfdf.exe 41 PID 2260 wrote to memory of 2736 2260 nbfdf.exe 41 PID 2260 wrote to memory of 2736 2260 nbfdf.exe 41 PID 2736 wrote to memory of 2768 2736 vfxvdnf.exe 42 PID 2736 wrote to memory of 2768 2736 vfxvdnf.exe 42 PID 2736 wrote to memory of 2768 2736 vfxvdnf.exe 42 PID 2736 wrote to memory of 2768 2736 vfxvdnf.exe 42 PID 2768 wrote to memory of 3000 2768 hjvhxdn.exe 43 PID 2768 wrote to memory of 3000 2768 hjvhxdn.exe 43 PID 2768 wrote to memory of 3000 2768 hjvhxdn.exe 43 PID 2768 wrote to memory of 3000 2768 hjvhxdn.exe 43 PID 3000 wrote to memory of 2464 3000 dtxhhl.exe 44 PID 3000 wrote to memory of 2464 3000 dtxhhl.exe 44 PID 3000 wrote to memory of 2464 3000 dtxhhl.exe 44 PID 3000 wrote to memory of 2464 3000 dtxhhl.exe 44 PID 2464 wrote to memory of 2376 2464 dpdhnbl.exe 45 PID 2464 wrote to memory of 2376 2464 dpdhnbl.exe 45 PID 2464 wrote to memory of 2376 2464 dpdhnbl.exe 45 PID 2464 wrote to memory of 2376 2464 dpdhnbl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe"C:\Users\Admin\AppData\Local\Temp\bd2f8780c1968f9070d0a2ef71d8924e1b1792492b90804fcd95fa22e6f5f387.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rffdbnx.exec:\rffdbnx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fjvhd.exec:\fjvhd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\httjf.exec:\httjf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jxnppv.exec:\jxnppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ttbxnlx.exec:\ttbxnlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\lbprtnb.exec:\lbprtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lnlphnp.exec:\lnlphnp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\tbfbvdt.exec:\tbfbvdt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\frlhrdl.exec:\frlhrdl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\hlvbfpb.exec:\hlvbfpb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\nbfdf.exec:\nbfdf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\vfxvdnf.exec:\vfxvdnf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hjvhxdn.exec:\hjvhxdn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dtxhhl.exec:\dtxhhl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dpdhnbl.exec:\dpdhnbl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\pnpjhj.exec:\pnpjhj.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nnhbhpn.exec:\nnhbhpn.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\jxvnr.exec:\jxvnr.exe19⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xrbvbjp.exec:\xrbvbjp.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fbdpdh.exec:\fbdpdh.exe21⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vjdbxpr.exec:\vjdbxpr.exe22⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fdhlv.exec:\fdhlv.exe23⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vtltjxx.exec:\vtltjxx.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pltdj.exec:\pltdj.exe25⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ljfdhjf.exec:\ljfdhjf.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bldvv.exec:\bldvv.exe27⤵
- Executes dropped EXE
PID:548 -
\??\c:\hrprff.exec:\hrprff.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lnlfl.exec:\lnlfl.exe29⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nbtnfvv.exec:\nbtnfvv.exe30⤵
- Executes dropped EXE
PID:1352 -
\??\c:\xfrpttl.exec:\xfrpttl.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ntjnj.exec:\ntjnj.exe32⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bbfvfdd.exec:\bbfvfdd.exe33⤵
- Executes dropped EXE
PID:1068 -
\??\c:\txxfvp.exec:\txxfvp.exe34⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jrvnvv.exec:\jrvnvv.exe35⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rtphf.exec:\rtphf.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbpvj.exec:\hbpvj.exe37⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xlbhrd.exec:\xlbhrd.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jvjnnl.exec:\jvjnnl.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jlvdfl.exec:\jlvdfl.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bhvdddv.exec:\bhvdddv.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nnnffp.exec:\nnnffp.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jpdvvjb.exec:\jpdvvjb.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\brlnt.exec:\brlnt.exe44⤵
- Executes dropped EXE
PID:920 -
\??\c:\vxxbjr.exec:\vxxbjr.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rrplltl.exec:\rrplltl.exe46⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bdfpjnv.exec:\bdfpjnv.exe47⤵
- Executes dropped EXE
PID:912 -
\??\c:\flxnp.exec:\flxnp.exe48⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lnbtbd.exec:\lnbtbd.exe49⤵
- Executes dropped EXE
PID:628 -
\??\c:\nvbrvf.exec:\nvbrvf.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rxhbt.exec:\rxhbt.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hrnlf.exec:\hrnlf.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vftlxp.exec:\vftlxp.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jxvdxxr.exec:\jxvdxxr.exe54⤵
- Executes dropped EXE
PID:1460 -
\??\c:\njjhxf.exec:\njjhxf.exe55⤵
- Executes dropped EXE
PID:700 -
\??\c:\bttflt.exec:\bttflt.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fjdjpbj.exec:\fjdjpbj.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nvvpdh.exec:\nvvpdh.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vpjbx.exec:\vpjbx.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fflxjrr.exec:\fflxjrr.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fxrtrbd.exec:\fxrtrbd.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bfvvrvj.exec:\bfvvrvj.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\ndtbrd.exec:\ndtbrd.exe63⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vjvltft.exec:\vjvltft.exe64⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vvxvrb.exec:\vvxvrb.exe65⤵
- Executes dropped EXE
PID:816 -
\??\c:\btpph.exec:\btpph.exe66⤵PID:2552
-
\??\c:\tvjpn.exec:\tvjpn.exe67⤵PID:568
-
\??\c:\lhndxbb.exec:\lhndxbb.exe68⤵
- System Location Discovery: System Language Discovery
PID:1388 -
\??\c:\lrxnr.exec:\lrxnr.exe69⤵PID:1736
-
\??\c:\lvhtjxd.exec:\lvhtjxd.exe70⤵PID:2432
-
\??\c:\ddhdtl.exec:\ddhdtl.exe71⤵PID:1816
-
\??\c:\jtrhnnx.exec:\jtrhnnx.exe72⤵PID:2764
-
\??\c:\nvllp.exec:\nvllp.exe73⤵PID:1004
-
\??\c:\htjjnn.exec:\htjjnn.exe74⤵PID:2328
-
\??\c:\bjxln.exec:\bjxln.exe75⤵PID:2604
-
\??\c:\xxntt.exec:\xxntt.exe76⤵PID:2824
-
\??\c:\jpjdprj.exec:\jpjdprj.exe77⤵PID:2772
-
\??\c:\bvbnp.exec:\bvbnp.exe78⤵PID:3048
-
\??\c:\tvpvrx.exec:\tvpvrx.exe79⤵PID:1536
-
\??\c:\xnpbll.exec:\xnpbll.exe80⤵PID:2848
-
\??\c:\hhjtxbb.exec:\hhjtxbb.exe81⤵PID:3028
-
\??\c:\xbtxp.exec:\xbtxp.exe82⤵PID:2908
-
\??\c:\ndplltf.exec:\ndplltf.exe83⤵PID:1412
-
\??\c:\pvdnv.exec:\pvdnv.exe84⤵PID:2380
-
\??\c:\bljdr.exec:\bljdr.exe85⤵PID:1236
-
\??\c:\hljbj.exec:\hljbj.exe86⤵PID:2976
-
\??\c:\lndrfbj.exec:\lndrfbj.exe87⤵PID:2972
-
\??\c:\tnppj.exec:\tnppj.exe88⤵PID:2000
-
\??\c:\rvbxp.exec:\rvbxp.exe89⤵PID:3068
-
\??\c:\jjdlft.exec:\jjdlft.exe90⤵PID:2520
-
\??\c:\ljvhxr.exec:\ljvhxr.exe91⤵PID:1652
-
\??\c:\btlhl.exec:\btlhl.exe92⤵PID:1372
-
\??\c:\tfvlpbp.exec:\tfvlpbp.exe93⤵PID:2968
-
\??\c:\bxxdx.exec:\bxxdx.exe94⤵PID:3008
-
\??\c:\bbxfbbb.exec:\bbxfbbb.exe95⤵
- System Location Discovery: System Language Discovery
PID:908 -
\??\c:\xdhjrf.exec:\xdhjrf.exe96⤵PID:2844
-
\??\c:\djtxj.exec:\djtxj.exe97⤵PID:2628
-
\??\c:\xjrlvp.exec:\xjrlvp.exe98⤵PID:1928
-
\??\c:\xrvlrl.exec:\xrvlrl.exe99⤵PID:2136
-
\??\c:\plnntv.exec:\plnntv.exe100⤵PID:2008
-
\??\c:\dbdnn.exec:\dbdnn.exe101⤵PID:2384
-
\??\c:\hrppd.exec:\hrppd.exe102⤵PID:2360
-
\??\c:\vtbvvbj.exec:\vtbvvbj.exe103⤵PID:1648
-
\??\c:\fftbjj.exec:\fftbjj.exe104⤵PID:2504
-
\??\c:\pdnpddt.exec:\pdnpddt.exe105⤵PID:828
-
\??\c:\xnxln.exec:\xnxln.exe106⤵PID:952
-
\??\c:\bhjnbjx.exec:\bhjnbjx.exe107⤵PID:876
-
\??\c:\dhnvbr.exec:\dhnvbr.exe108⤵PID:2124
-
\??\c:\bppdx.exec:\bppdx.exe109⤵PID:1512
-
\??\c:\lhlvd.exec:\lhlvd.exe110⤵PID:1976
-
\??\c:\ljjllfx.exec:\ljjllfx.exe111⤵PID:1740
-
\??\c:\nnfbj.exec:\nnfbj.exe112⤵PID:3032
-
\??\c:\vtdrh.exec:\vtdrh.exe113⤵PID:1736
-
\??\c:\dnlbpxp.exec:\dnlbpxp.exe114⤵PID:2324
-
\??\c:\vtvfj.exec:\vtvfj.exe115⤵PID:284
-
\??\c:\fxvfd.exec:\fxvfd.exe116⤵PID:924
-
\??\c:\hhbnjf.exec:\hhbnjf.exe117⤵PID:544
-
\??\c:\fnbnt.exec:\fnbnt.exe118⤵PID:1048
-
\??\c:\xllrn.exec:\xllrn.exe119⤵PID:2604
-
\??\c:\nhlvbj.exec:\nhlvbj.exe120⤵PID:2824
-
\??\c:\hrhnrhr.exec:\hrhnrhr.exe121⤵PID:3064
-
\??\c:\flldlj.exec:\flldlj.exe122⤵PID:1660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-