Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe
Resource
win7-20241010-en
General
-
Target
e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe
-
Size
347KB
-
MD5
d39d1a14153143d31d0dbd9acad218e4
-
SHA1
7a4b7e3ca8a43a40ced6601fb98aecd6d742f2af
-
SHA256
e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3
-
SHA512
2127321eef7ce5afcf18231c2a5eb35a87cbe1d70ee839a6af41206d4faa4c13418fa6d0517bef71e923722d748a30dbb6bae2b1d6a88534e2a5bd279c28d7bc
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAu:l7TcbWXZshJX2VGdu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2684-12-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/844-10-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2792-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2792-29-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2164-39-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2620-51-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2716-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1780-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/636-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/684-85-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/396-95-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1776-122-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2680-128-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/340-140-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2956-149-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2340-158-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2464-167-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2420-180-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2068-178-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/980-213-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2492-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1528-248-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1512-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1676-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2024-291-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1916-322-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2804-334-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2804-335-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2980-348-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2332-362-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2836-411-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1956-425-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2432-463-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2400-484-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2328-497-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2400-505-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/364-552-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2736-611-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2864-632-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/2920-640-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2636-652-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1296-693-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2336-747-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3032-863-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2056-865-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2672-872-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 bhdhvvp.exe 2792 dddjjv.exe 2164 xdjrf.exe 2716 tdppv.exe 2620 txndt.exe 1780 jjjhpf.exe 636 jpndn.exe 684 dnpbtf.exe 396 jjrpnhn.exe 1296 pjvphn.exe 552 rvdtll.exe 1776 jpdplb.exe 2680 vddjpxv.exe 340 hvxlpll.exe 2956 bxxnhr.exe 2340 rtphbph.exe 2464 phxvfr.exe 2068 xpppb.exe 2420 hxpnt.exe 2328 hfhbjvf.exe 1516 vtjnbdv.exe 980 hbjtfl.exe 2492 pljljd.exe 2156 ftvdr.exe 2076 xnjdnn.exe 1528 vlbtd.exe 1512 nntrdhj.exe 2040 bhjnft.exe 1008 hlnrj.exe 1676 vfrddt.exe 2024 tblbd.exe 880 nvdfpd.exe 2248 vfpxnlt.exe 1748 ltprp.exe 1916 npbfv.exe 2796 pdfrj.exe 2804 rtbjh.exe 2724 pjxxx.exe 2980 bpbrhr.exe 2896 pnbpx.exe 2332 txfdbp.exe 2608 tlhdlnd.exe 3056 rvbtrx.exe 1364 pxttn.exe 2168 drljv.exe 2940 hjlfnfn.exe 396 vbphvt.exe 2836 lfnbr.exe 2900 xfdpb.exe 1956 dpdrr.exe 1380 tfhfljv.exe 3036 tptrr.exe 1768 rffhln.exe 800 xbhnxx.exe 812 hvvlntv.exe 2432 fpdvrn.exe 2348 rpvpnbn.exe 2352 hpvbttp.exe 2400 hdrlpvb.exe 2108 tpfbhvn.exe 2328 drjhrh.exe 1516 pvdjl.exe 1136 xhpht.exe 2492 fftnnt.exe -
resource yara_rule behavioral1/memory/2684-12-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/844-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2792-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2792-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2716-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2164-39-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2620-51-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1780-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/636-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/684-85-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/396-95-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1776-122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/340-140-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2956-149-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2340-158-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2464-167-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2420-180-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2068-178-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/980-213-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2492-217-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1528-240-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1528-248-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1512-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1676-286-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1916-322-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2804-334-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2896-349-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2980-348-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1364-376-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-403-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-411-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2168-410-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/3036-432-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1516-498-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2328-497-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1136-507-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1556-572-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2736-611-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2920-640-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1296-693-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2768-710-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2336-747-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2196-760-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1908-817-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2672-843-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3032-863-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvrxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnpfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxpdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfhhttr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldfnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbldftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pllpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfrpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnpxjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npjvbrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxvfhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlndpfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxdhvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrbhtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnvpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfxjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rltxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxdfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbfljb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbnjxhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfnbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlrdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhbppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfnvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbhbvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvljljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbnlljt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhfljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjxdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njlbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfrddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphxtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 2684 844 e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe 30 PID 844 wrote to memory of 2684 844 e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe 30 PID 844 wrote to memory of 2684 844 e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe 30 PID 844 wrote to memory of 2684 844 e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe 30 PID 2684 wrote to memory of 2792 2684 bhdhvvp.exe 31 PID 2684 wrote to memory of 2792 2684 bhdhvvp.exe 31 PID 2684 wrote to memory of 2792 2684 bhdhvvp.exe 31 PID 2684 wrote to memory of 2792 2684 bhdhvvp.exe 31 PID 2792 wrote to memory of 2164 2792 dddjjv.exe 32 PID 2792 wrote to memory of 2164 2792 dddjjv.exe 32 PID 2792 wrote to memory of 2164 2792 dddjjv.exe 32 PID 2792 wrote to memory of 2164 2792 dddjjv.exe 32 PID 2164 wrote to memory of 2716 2164 xdjrf.exe 33 PID 2164 wrote to memory of 2716 2164 xdjrf.exe 33 PID 2164 wrote to memory of 2716 2164 xdjrf.exe 33 PID 2164 wrote to memory of 2716 2164 xdjrf.exe 33 PID 2716 wrote to memory of 2620 2716 tdppv.exe 34 PID 2716 wrote to memory of 2620 2716 tdppv.exe 34 PID 2716 wrote to memory of 2620 2716 tdppv.exe 34 PID 2716 wrote to memory of 2620 2716 tdppv.exe 34 PID 2620 wrote to memory of 1780 2620 txndt.exe 35 PID 2620 wrote to memory of 1780 2620 txndt.exe 35 PID 2620 wrote to memory of 1780 2620 txndt.exe 35 PID 2620 wrote to memory of 1780 2620 txndt.exe 35 PID 1780 wrote to memory of 636 1780 jjjhpf.exe 36 PID 1780 wrote to memory of 636 1780 jjjhpf.exe 36 PID 1780 wrote to memory of 636 1780 jjjhpf.exe 36 PID 1780 wrote to memory of 636 1780 jjjhpf.exe 36 PID 636 wrote to memory of 684 636 jpndn.exe 37 PID 636 wrote to memory of 684 636 jpndn.exe 37 PID 636 wrote to memory of 684 636 jpndn.exe 37 PID 636 wrote to memory of 684 636 jpndn.exe 37 PID 684 wrote to memory of 396 684 dnpbtf.exe 38 PID 684 wrote to memory of 396 684 dnpbtf.exe 38 PID 684 wrote to memory of 396 684 dnpbtf.exe 38 PID 684 wrote to memory of 396 684 dnpbtf.exe 38 PID 396 wrote to memory of 1296 396 jjrpnhn.exe 39 PID 396 wrote to memory of 1296 396 jjrpnhn.exe 39 PID 396 wrote to memory of 1296 396 jjrpnhn.exe 39 PID 396 wrote to memory of 1296 396 jjrpnhn.exe 39 PID 1296 wrote to memory of 552 1296 pjvphn.exe 40 PID 1296 wrote to memory of 552 1296 pjvphn.exe 40 PID 1296 wrote to memory of 552 1296 pjvphn.exe 40 PID 1296 wrote to memory of 552 1296 pjvphn.exe 40 PID 552 wrote to memory of 1776 552 rvdtll.exe 41 PID 552 wrote to memory of 1776 552 rvdtll.exe 41 PID 552 wrote to memory of 1776 552 rvdtll.exe 41 PID 552 wrote to memory of 1776 552 rvdtll.exe 41 PID 1776 wrote to memory of 2680 1776 jpdplb.exe 42 PID 1776 wrote to memory of 2680 1776 jpdplb.exe 42 PID 1776 wrote to memory of 2680 1776 jpdplb.exe 42 PID 1776 wrote to memory of 2680 1776 jpdplb.exe 42 PID 2680 wrote to memory of 340 2680 vddjpxv.exe 43 PID 2680 wrote to memory of 340 2680 vddjpxv.exe 43 PID 2680 wrote to memory of 340 2680 vddjpxv.exe 43 PID 2680 wrote to memory of 340 2680 vddjpxv.exe 43 PID 340 wrote to memory of 2956 340 hvxlpll.exe 44 PID 340 wrote to memory of 2956 340 hvxlpll.exe 44 PID 340 wrote to memory of 2956 340 hvxlpll.exe 44 PID 340 wrote to memory of 2956 340 hvxlpll.exe 44 PID 2956 wrote to memory of 2340 2956 bxxnhr.exe 45 PID 2956 wrote to memory of 2340 2956 bxxnhr.exe 45 PID 2956 wrote to memory of 2340 2956 bxxnhr.exe 45 PID 2956 wrote to memory of 2340 2956 bxxnhr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe"C:\Users\Admin\AppData\Local\Temp\e6c93f896606d3bfe559599550668ac7cff5390e3bc323409873a599750198a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\bhdhvvp.exec:\bhdhvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dddjjv.exec:\dddjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xdjrf.exec:\xdjrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\tdppv.exec:\tdppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\txndt.exec:\txndt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jjjhpf.exec:\jjjhpf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jpndn.exec:\jpndn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\dnpbtf.exec:\dnpbtf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\jjrpnhn.exec:\jjrpnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\pjvphn.exec:\pjvphn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\rvdtll.exec:\rvdtll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\jpdplb.exec:\jpdplb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\vddjpxv.exec:\vddjpxv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hvxlpll.exec:\hvxlpll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\bxxnhr.exec:\bxxnhr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rtphbph.exec:\rtphbph.exe17⤵
- Executes dropped EXE
PID:2340 -
\??\c:\phxvfr.exec:\phxvfr.exe18⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xpppb.exec:\xpppb.exe19⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hxpnt.exec:\hxpnt.exe20⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hfhbjvf.exec:\hfhbjvf.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vtjnbdv.exec:\vtjnbdv.exe22⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hbjtfl.exec:\hbjtfl.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\pljljd.exec:\pljljd.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ftvdr.exec:\ftvdr.exe25⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xnjdnn.exec:\xnjdnn.exe26⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vlbtd.exec:\vlbtd.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nntrdhj.exec:\nntrdhj.exe28⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bhjnft.exec:\bhjnft.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hlnrj.exec:\hlnrj.exe30⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vfrddt.exec:\vfrddt.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\tblbd.exec:\tblbd.exe32⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nvdfpd.exec:\nvdfpd.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\vfpxnlt.exec:\vfpxnlt.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ltprp.exec:\ltprp.exe35⤵
- Executes dropped EXE
PID:1748 -
\??\c:\npbfv.exec:\npbfv.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pdfrj.exec:\pdfrj.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rtbjh.exec:\rtbjh.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pjxxx.exec:\pjxxx.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bpbrhr.exec:\bpbrhr.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pnbpx.exec:\pnbpx.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\txfdbp.exec:\txfdbp.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tlhdlnd.exec:\tlhdlnd.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rvbtrx.exec:\rvbtrx.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pxttn.exec:\pxttn.exe45⤵
- Executes dropped EXE
PID:1364 -
\??\c:\drljv.exec:\drljv.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hjlfnfn.exec:\hjlfnfn.exe47⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vbphvt.exec:\vbphvt.exe48⤵
- Executes dropped EXE
PID:396 -
\??\c:\lfnbr.exec:\lfnbr.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2836 -
\??\c:\xfdpb.exec:\xfdpb.exe50⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dpdrr.exec:\dpdrr.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tfhfljv.exec:\tfhfljv.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\tptrr.exec:\tptrr.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rffhln.exec:\rffhln.exe54⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xbhnxx.exec:\xbhnxx.exe55⤵
- Executes dropped EXE
PID:800 -
\??\c:\hvvlntv.exec:\hvvlntv.exe56⤵
- Executes dropped EXE
PID:812 -
\??\c:\fpdvrn.exec:\fpdvrn.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rpvpnbn.exec:\rpvpnbn.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hpvbttp.exec:\hpvbttp.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hdrlpvb.exec:\hdrlpvb.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tpfbhvn.exec:\tpfbhvn.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\drjhrh.exec:\drjhrh.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pvdjl.exec:\pvdjl.exe63⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xhpht.exec:\xhpht.exe64⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fftnnt.exec:\fftnnt.exe65⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hdlrx.exec:\hdlrx.exe66⤵PID:280
-
\??\c:\lfhhttr.exec:\lfhhttr.exe67⤵
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\hlxpxf.exec:\hlxpxf.exe68⤵PID:1940
-
\??\c:\bbjltv.exec:\bbjltv.exe69⤵PID:3028
-
\??\c:\pbfnnn.exec:\pbfnnn.exe70⤵PID:364
-
\??\c:\tnhtfhp.exec:\tnhtfhp.exe71⤵PID:2064
-
\??\c:\rnxxp.exec:\rnxxp.exe72⤵PID:1404
-
\??\c:\pljvj.exec:\pljvj.exe73⤵
- System Location Discovery: System Language Discovery
PID:848 -
\??\c:\hlppj.exec:\hlppj.exe74⤵PID:1556
-
\??\c:\dhvrjpv.exec:\dhvrjpv.exe75⤵PID:2872
-
\??\c:\lpbjr.exec:\lpbjr.exe76⤵PID:2532
-
\??\c:\ljfnjxh.exec:\ljfnjxh.exe77⤵PID:2516
-
\??\c:\vdtblr.exec:\vdtblr.exe78⤵PID:1236
-
\??\c:\vrxbdh.exec:\vrxbdh.exe79⤵PID:1592
-
\??\c:\pvdltft.exec:\pvdltft.exe80⤵PID:2736
-
\??\c:\pxfblrl.exec:\pxfblrl.exe81⤵PID:2700
-
\??\c:\fnvrh.exec:\fnvrh.exe82⤵PID:2864
-
\??\c:\btprv.exec:\btprv.exe83⤵PID:2920
-
\??\c:\lttlthl.exec:\lttlthl.exe84⤵PID:2628
-
\??\c:\lfndv.exec:\lfndv.exe85⤵PID:2636
-
\??\c:\ltvhlr.exec:\ltvhlr.exe86⤵PID:1620
-
\??\c:\hrdnbh.exec:\hrdnbh.exe87⤵PID:2572
-
\??\c:\npdhnhj.exec:\npdhnhj.exe88⤵PID:3056
-
\??\c:\ntddbjh.exec:\ntddbjh.exe89⤵PID:576
-
\??\c:\dpdjnn.exec:\dpdjnn.exe90⤵PID:2168
-
\??\c:\rpvlp.exec:\rpvlp.exe91⤵
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\phldbrf.exec:\phldbrf.exe92⤵PID:1296
-
\??\c:\ljvnlv.exec:\ljvnlv.exe93⤵PID:1764
-
\??\c:\hjxdx.exec:\hjxdx.exe94⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\dvntt.exec:\dvntt.exe95⤵PID:2768
-
\??\c:\vrfpbx.exec:\vrfpbx.exe96⤵PID:2680
-
\??\c:\dhhtt.exec:\dhhtt.exe97⤵PID:2184
-
\??\c:\xlrbjtd.exec:\xlrbjtd.exe98⤵PID:700
-
\??\c:\dhnfvpf.exec:\dhnfvpf.exe99⤵PID:776
-
\??\c:\jthpr.exec:\jthpr.exe100⤵PID:2336
-
\??\c:\hvvdxbd.exec:\hvvdxbd.exe101⤵PID:2344
-
\??\c:\vfvhjp.exec:\vfvhjp.exe102⤵PID:2116
-
\??\c:\xnnhnr.exec:\xnnhnr.exe103⤵PID:2196
-
\??\c:\phlrvd.exec:\phlrvd.exe104⤵PID:2420
-
\??\c:\xttprn.exec:\xttprn.exe105⤵PID:2440
-
\??\c:\fpxljpv.exec:\fpxljpv.exe106⤵PID:2476
-
\??\c:\txlrht.exec:\txlrht.exe107⤵PID:2480
-
\??\c:\vfjbpj.exec:\vfjbpj.exe108⤵PID:1516
-
\??\c:\hxxlr.exec:\hxxlr.exe109⤵PID:2568
-
\??\c:\hlbxl.exec:\hlbxl.exe110⤵PID:1772
-
\??\c:\xjnrdvh.exec:\xjnrdvh.exe111⤵PID:1908
-
\??\c:\trlxl.exec:\trlxl.exe112⤵PID:2076
-
\??\c:\vxrbhtd.exec:\vxrbhtd.exe113⤵
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\llthjvx.exec:\llthjvx.exe114⤵PID:1720
-
\??\c:\dtpbl.exec:\dtpbl.exe115⤵PID:2056
-
\??\c:\trxlbtd.exec:\trxlbtd.exe116⤵PID:2672
-
\??\c:\lbdhrt.exec:\lbdhrt.exe117⤵PID:1628
-
\??\c:\fdhdnjt.exec:\fdhdnjt.exe118⤵PID:3032
-
\??\c:\bbbhlvv.exec:\bbbhlvv.exe119⤵PID:1100
-
\??\c:\hhbprx.exec:\hhbprx.exe120⤵PID:1980
-
\??\c:\hltdtlp.exec:\hltdtlp.exe121⤵PID:2532
-
\??\c:\vpplbx.exec:\vpplbx.exe122⤵PID:1692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-