Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe
Resource
win7-20241010-en
General
-
Target
9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe
-
Size
456KB
-
MD5
d17cb72a06af14a37de251fd11a040b7
-
SHA1
b51c640a3e55dbe1d3a7443a10c3c2be60fb6eb1
-
SHA256
9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed
-
SHA512
6eed4447a383766e6f682dbadbca8aaf8ae76362e199b5361246de0234767d66ba398f2ad78c9391c77e9c4b89ca225e56f46c4c4a6b275ff2e23e2b7c6df8d5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2364-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-224-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-417-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2028-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/112-824-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1132-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2364 vrjhpfb.exe 2420 brxnbr.exe 2040 txvhx.exe 2312 bvbhhx.exe 2896 pxxdlvh.exe 2972 xrlnfxr.exe 2864 tvxrn.exe 2484 bhfldjx.exe 2988 fddnjjl.exe 944 tlptplh.exe 2904 hftpxxf.exe 1460 jpblbh.exe 2740 ljntd.exe 1108 xxddnfn.exe 2676 jhntvl.exe 2600 rnjxb.exe 588 bpnbdlp.exe 2216 fnpbh.exe 2232 llnnf.exe 2176 dvlpb.exe 2280 xbhlv.exe 560 jbdddvb.exe 2468 vfbbhdn.exe 1800 rtfln.exe 1356 vrxvpl.exe 2552 pvntlrv.exe 1712 trfhbxd.exe 112 hfrfxth.exe 2628 rntvv.exe 276 nvhlndh.exe 2172 rdhxblh.exe 2372 bdbpb.exe 1740 dnrvvhp.exe 2364 hrhrnr.exe 1704 bnxnv.exe 2036 lnrlvvj.exe 2160 blhpbbr.exe 3012 ttljvn.exe 2480 bpdnftd.exe 2960 jrptjb.exe 2920 jflrl.exe 2848 ptltfxn.exe 2880 brbpt.exe 2540 pvbrph.exe 2564 dhfpt.exe 1084 xfrfhx.exe 3056 tdblb.exe 2904 llddxnl.exe 2136 xtlxp.exe 1780 rfrntnr.exe 2512 dpljjx.exe 2028 dlnpl.exe 1400 lprrp.exe 696 rnxbvf.exe 564 pftppp.exe 3008 tbbntb.exe 2216 rdhfh.exe 1348 hfdvpb.exe 2176 hjtbxt.exe 2060 bprxp.exe 856 ntbhftt.exe 2700 vfffxf.exe 2468 vjdbd.exe 1080 jvlrvvp.exe -
resource yara_rule behavioral1/memory/2364-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-417-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2028-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-1140-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpbjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxlbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rntvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhvvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npfrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhhbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npfvhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njljvfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpnxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftvrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prjpjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjptvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtdtbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdnrtjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phftpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpntxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxthpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrrnxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdhpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxlnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnrvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprdjnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2364 1740 9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe 63 PID 1740 wrote to memory of 2364 1740 9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe 63 PID 1740 wrote to memory of 2364 1740 9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe 63 PID 1740 wrote to memory of 2364 1740 9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe 63 PID 2364 wrote to memory of 2420 2364 vrjhpfb.exe 31 PID 2364 wrote to memory of 2420 2364 vrjhpfb.exe 31 PID 2364 wrote to memory of 2420 2364 vrjhpfb.exe 31 PID 2364 wrote to memory of 2420 2364 vrjhpfb.exe 31 PID 2420 wrote to memory of 2040 2420 brxnbr.exe 32 PID 2420 wrote to memory of 2040 2420 brxnbr.exe 32 PID 2420 wrote to memory of 2040 2420 brxnbr.exe 32 PID 2420 wrote to memory of 2040 2420 brxnbr.exe 32 PID 2040 wrote to memory of 2312 2040 txvhx.exe 33 PID 2040 wrote to memory of 2312 2040 txvhx.exe 33 PID 2040 wrote to memory of 2312 2040 txvhx.exe 33 PID 2040 wrote to memory of 2312 2040 txvhx.exe 33 PID 2312 wrote to memory of 2896 2312 bvbhhx.exe 34 PID 2312 wrote to memory of 2896 2312 bvbhhx.exe 34 PID 2312 wrote to memory of 2896 2312 bvbhhx.exe 34 PID 2312 wrote to memory of 2896 2312 bvbhhx.exe 34 PID 2896 wrote to memory of 2972 2896 pxxdlvh.exe 35 PID 2896 wrote to memory of 2972 2896 pxxdlvh.exe 35 PID 2896 wrote to memory of 2972 2896 pxxdlvh.exe 35 PID 2896 wrote to memory of 2972 2896 pxxdlvh.exe 35 PID 2972 wrote to memory of 2864 2972 xrlnfxr.exe 36 PID 2972 wrote to memory of 2864 2972 xrlnfxr.exe 36 PID 2972 wrote to memory of 2864 2972 xrlnfxr.exe 36 PID 2972 wrote to memory of 2864 2972 xrlnfxr.exe 36 PID 2864 wrote to memory of 2484 2864 tvxrn.exe 37 PID 2864 wrote to memory of 2484 2864 tvxrn.exe 37 PID 2864 wrote to memory of 2484 2864 tvxrn.exe 37 PID 2864 wrote to memory of 2484 2864 tvxrn.exe 37 PID 2484 wrote to memory of 2988 2484 bhfldjx.exe 38 PID 2484 wrote to memory of 2988 2484 bhfldjx.exe 38 PID 2484 wrote to memory of 2988 2484 bhfldjx.exe 38 PID 2484 wrote to memory of 2988 2484 bhfldjx.exe 38 PID 2988 wrote to memory of 944 2988 fddnjjl.exe 39 PID 2988 wrote to memory of 944 2988 fddnjjl.exe 39 PID 2988 wrote to memory of 944 2988 fddnjjl.exe 39 PID 2988 wrote to memory of 944 2988 fddnjjl.exe 39 PID 944 wrote to memory of 2904 944 tlptplh.exe 77 PID 944 wrote to memory of 2904 944 tlptplh.exe 77 PID 944 wrote to memory of 2904 944 tlptplh.exe 77 PID 944 wrote to memory of 2904 944 tlptplh.exe 77 PID 2904 wrote to memory of 1460 2904 hftpxxf.exe 41 PID 2904 wrote to memory of 1460 2904 hftpxxf.exe 41 PID 2904 wrote to memory of 1460 2904 hftpxxf.exe 41 PID 2904 wrote to memory of 1460 2904 hftpxxf.exe 41 PID 1460 wrote to memory of 2740 1460 jpblbh.exe 42 PID 1460 wrote to memory of 2740 1460 jpblbh.exe 42 PID 1460 wrote to memory of 2740 1460 jpblbh.exe 42 PID 1460 wrote to memory of 2740 1460 jpblbh.exe 42 PID 2740 wrote to memory of 1108 2740 ljntd.exe 43 PID 2740 wrote to memory of 1108 2740 ljntd.exe 43 PID 2740 wrote to memory of 1108 2740 ljntd.exe 43 PID 2740 wrote to memory of 1108 2740 ljntd.exe 43 PID 1108 wrote to memory of 2676 1108 xxddnfn.exe 44 PID 1108 wrote to memory of 2676 1108 xxddnfn.exe 44 PID 1108 wrote to memory of 2676 1108 xxddnfn.exe 44 PID 1108 wrote to memory of 2676 1108 xxddnfn.exe 44 PID 2676 wrote to memory of 2600 2676 jhntvl.exe 173 PID 2676 wrote to memory of 2600 2676 jhntvl.exe 173 PID 2676 wrote to memory of 2600 2676 jhntvl.exe 173 PID 2676 wrote to memory of 2600 2676 jhntvl.exe 173
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe"C:\Users\Admin\AppData\Local\Temp\9ee289939d251496071047870dccbc3a3f69ecd75729920db65335d7d7179eed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\vrjhpfb.exec:\vrjhpfb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\brxnbr.exec:\brxnbr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\txvhx.exec:\txvhx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\bvbhhx.exec:\bvbhhx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\pxxdlvh.exec:\pxxdlvh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xrlnfxr.exec:\xrlnfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tvxrn.exec:\tvxrn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bhfldjx.exec:\bhfldjx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\fddnjjl.exec:\fddnjjl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\tlptplh.exec:\tlptplh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\hftpxxf.exec:\hftpxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\jpblbh.exec:\jpblbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\ljntd.exec:\ljntd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xxddnfn.exec:\xxddnfn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jhntvl.exec:\jhntvl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rnjxb.exec:\rnjxb.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bpnbdlp.exec:\bpnbdlp.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\fnpbh.exec:\fnpbh.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\llnnf.exec:\llnnf.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dvlpb.exec:\dvlpb.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xbhlv.exec:\xbhlv.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jbdddvb.exec:\jbdddvb.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\vfbbhdn.exec:\vfbbhdn.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rtfln.exec:\rtfln.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vrxvpl.exec:\vrxvpl.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\pvntlrv.exec:\pvntlrv.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\trfhbxd.exec:\trfhbxd.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hfrfxth.exec:\hfrfxth.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\rntvv.exec:\rntvv.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\nvhlndh.exec:\nvhlndh.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\rdhxblh.exec:\rdhxblh.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bdbpb.exec:\bdbpb.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dnrvvhp.exec:\dnrvvhp.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hrhrnr.exec:\hrhrnr.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bnxnv.exec:\bnxnv.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lnrlvvj.exec:\lnrlvvj.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\blhpbbr.exec:\blhpbbr.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttljvn.exec:\ttljvn.exe39⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bpdnftd.exec:\bpdnftd.exe40⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jrptjb.exec:\jrptjb.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jflrl.exec:\jflrl.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ptltfxn.exec:\ptltfxn.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\brbpt.exec:\brbpt.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pvbrph.exec:\pvbrph.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dhfpt.exec:\dhfpt.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xfrfhx.exec:\xfrfhx.exe47⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tdblb.exec:\tdblb.exe48⤵
- Executes dropped EXE
PID:3056 -
\??\c:\llddxnl.exec:\llddxnl.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xtlxp.exec:\xtlxp.exe50⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rfrntnr.exec:\rfrntnr.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dpljjx.exec:\dpljjx.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dlnpl.exec:\dlnpl.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lprrp.exec:\lprrp.exe54⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rnxbvf.exec:\rnxbvf.exe55⤵
- Executes dropped EXE
PID:696 -
\??\c:\pftppp.exec:\pftppp.exe56⤵
- Executes dropped EXE
PID:564 -
\??\c:\tbbntb.exec:\tbbntb.exe57⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rdhfh.exec:\rdhfh.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hfdvpb.exec:\hfdvpb.exe59⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hjtbxt.exec:\hjtbxt.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bprxp.exec:\bprxp.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ntbhftt.exec:\ntbhftt.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\vfffxf.exec:\vfffxf.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vjdbd.exec:\vjdbd.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jvlrvvp.exec:\jvlrvvp.exe65⤵
- Executes dropped EXE
PID:1080 -
\??\c:\pjldtbh.exec:\pjldtbh.exe66⤵PID:960
-
\??\c:\xhfhnt.exec:\xhfhnt.exe67⤵PID:2576
-
\??\c:\hbblpfp.exec:\hbblpfp.exe68⤵PID:2440
-
\??\c:\xrphrn.exec:\xrphrn.exe69⤵PID:1712
-
\??\c:\fjbtbx.exec:\fjbtbx.exe70⤵PID:2376
-
\??\c:\prhdlx.exec:\prhdlx.exe71⤵PID:576
-
\??\c:\rrxnhp.exec:\rrxnhp.exe72⤵PID:1728
-
\??\c:\hbrjdn.exec:\hbrjdn.exe73⤵PID:2616
-
\??\c:\fvdnj.exec:\fvdnj.exe74⤵PID:1700
-
\??\c:\xhnhhr.exec:\xhnhhr.exe75⤵PID:1236
-
\??\c:\bpbhbx.exec:\bpbhbx.exe76⤵PID:2368
-
\??\c:\blbjx.exec:\blbjx.exe77⤵PID:2948
-
\??\c:\vxplpnl.exec:\vxplpnl.exe78⤵PID:2424
-
\??\c:\nlptvff.exec:\nlptvff.exe79⤵PID:1544
-
\??\c:\rndvxhj.exec:\rndvxhj.exe80⤵PID:2432
-
\??\c:\dblpxjr.exec:\dblpxjr.exe81⤵PID:2008
-
\??\c:\njljvfx.exec:\njljvfx.exe82⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\jxrpxp.exec:\jxrpxp.exe83⤵PID:3064
-
\??\c:\xhldnj.exec:\xhldnj.exe84⤵PID:2836
-
\??\c:\jpnpt.exec:\jpnpt.exe85⤵PID:2876
-
\??\c:\bpfffjv.exec:\bpfffjv.exe86⤵PID:2872
-
\??\c:\txnxn.exec:\txnxn.exe87⤵PID:2272
-
\??\c:\ltxxrdx.exec:\ltxxrdx.exe88⤵PID:2824
-
\??\c:\rrjhn.exec:\rrjhn.exe89⤵PID:1132
-
\??\c:\dfdlhl.exec:\dfdlhl.exe90⤵PID:2988
-
\??\c:\lbfhhtt.exec:\lbfhhtt.exe91⤵PID:2908
-
\??\c:\hnnnx.exec:\hnnnx.exe92⤵PID:2580
-
\??\c:\nprpr.exec:\nprpr.exe93⤵PID:2812
-
\??\c:\tdttbdd.exec:\tdttbdd.exe94⤵PID:2932
-
\??\c:\vhrxv.exec:\vhrxv.exe95⤵PID:2740
-
\??\c:\dbpdfj.exec:\dbpdfj.exe96⤵PID:3036
-
\??\c:\hvbhj.exec:\hvbhj.exe97⤵PID:1652
-
\??\c:\jxntbjv.exec:\jxntbjv.exe98⤵PID:1028
-
\??\c:\fnhjjnr.exec:\fnhjjnr.exe99⤵PID:2860
-
\??\c:\hrftv.exec:\hrftv.exe100⤵PID:2600
-
\??\c:\jfnfnnp.exec:\jfnfnnp.exe101⤵PID:608
-
\??\c:\vbtnj.exec:\vbtnj.exe102⤵PID:1956
-
\??\c:\trtfljn.exec:\trtfljn.exe103⤵PID:1964
-
\??\c:\jhfxv.exec:\jhfxv.exe104⤵PID:1396
-
\??\c:\hllbhnf.exec:\hllbhnf.exe105⤵PID:624
-
\??\c:\tlfflp.exec:\tlfflp.exe106⤵PID:3024
-
\??\c:\bhntx.exec:\bhntx.exe107⤵PID:2732
-
\??\c:\tpbffrh.exec:\tpbffrh.exe108⤵PID:2000
-
\??\c:\fnrbpf.exec:\fnrbpf.exe109⤵PID:1788
-
\??\c:\xprvn.exec:\xprvn.exe110⤵PID:2228
-
\??\c:\nxtrl.exec:\nxtrl.exe111⤵PID:2764
-
\??\c:\vtfdvn.exec:\vtfdvn.exe112⤵PID:1064
-
\??\c:\pxvjtx.exec:\pxvjtx.exe113⤵PID:1364
-
\??\c:\hpfblfh.exec:\hpfblfh.exe114⤵PID:112
-
\??\c:\fhvdfpd.exec:\fhvdfpd.exe115⤵PID:2376
-
\??\c:\pvnvn.exec:\pvnvn.exe116⤵PID:576
-
\??\c:\trtrfd.exec:\trtrfd.exe117⤵PID:1728
-
\??\c:\vpbldb.exec:\vpbldb.exe118⤵PID:2616
-
\??\c:\dbpppd.exec:\dbpppd.exe119⤵PID:2916
-
\??\c:\rdhlr.exec:\rdhlr.exe120⤵PID:2156
-
\??\c:\rxvrnr.exec:\rxvrnr.exe121⤵PID:1164
-
\??\c:\tvhvf.exec:\tvhvf.exe122⤵PID:1224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-