Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe
-
Size
455KB
-
MD5
7574fc0a1572fdde00fdedfd50cd1185
-
SHA1
f26a39e92474d33a229570fab2ae3da84717d8d3
-
SHA256
adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5
-
SHA512
86028168a543d043a52ee24890ad5f6b9478d8b765c0a6fd77aca982f2d898e86607f3e776ed6a3150f84df363694a2b97877c47a8bb87905a354d7bcaee707b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0K:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2796-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-77-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-84-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/916-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-192-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1060-201-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1472-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-443-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2232-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-555-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2332-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-589-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-682-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-748-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2952-975-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-1064-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 flntd.exe 2812 vttdjxf.exe 2704 phttb.exe 2692 xbfvn.exe 2884 ffbpxr.exe 2720 tpbxd.exe 2644 pfflxjx.exe 916 vdrfjt.exe 1932 httjrn.exe 2212 flptn.exe 2260 xtntdr.exe 2424 fvbltpj.exe 2960 prjxf.exe 2252 xtndpd.exe 2372 bvhdhbj.exe 1776 fdtxhdp.exe 1052 hfdtrxt.exe 2180 bxpbjdv.exe 2360 hrfph.exe 2532 tbnxf.exe 1060 rlnnjp.exe 2320 rnbjbj.exe 1472 ffbtrxf.exe 2272 pvhxt.exe 2456 lbtprhb.exe 2536 hdhfphn.exe 1736 ppvtr.exe 1956 dvtnln.exe 2636 bdrdr.exe 284 rxdxbt.exe 1248 rrntlrl.exe 1072 lvvlrjh.exe 2872 hrrjbl.exe 1568 txfhtt.exe 2892 xbbrbjl.exe 2916 fbvrt.exe 2848 txhlnn.exe 2832 jljlp.exe 2708 jpbjh.exe 2788 djxxr.exe 2404 bjfvvv.exe 2288 lbdplx.exe 1952 blbjbd.exe 1596 vndlp.exe 1184 pxfrjh.exe 2408 xpdtl.exe 1880 jbnhn.exe 3004 hfnlx.exe 1936 lrvpb.exe 2768 pnvjfn.exe 3000 bbhnn.exe 1656 jxxlxjp.exe 2988 ffvtlfl.exe 2372 fdjtd.exe 516 hrljx.exe 2224 xxrptj.exe 2164 nptfx.exe 2232 frbplhr.exe 2504 vbddbjn.exe 2532 xxbvpv.exe 1280 pxdvx.exe 2128 rhrvpvd.exe 2320 vxttttl.exe 2560 bvldh.exe -
resource yara_rule behavioral1/memory/2796-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-84-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/916-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-1064-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrtfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhlxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldhpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjjlnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhdbfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdbbbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdhfphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frnlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxdllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnlhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhdxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxdthp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtrdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppnnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drnprlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjhvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbtprhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhvdjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdpfvlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbptbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndnrlv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2856 2796 adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe 30 PID 2796 wrote to memory of 2856 2796 adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe 30 PID 2796 wrote to memory of 2856 2796 adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe 30 PID 2796 wrote to memory of 2856 2796 adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe 30 PID 2856 wrote to memory of 2812 2856 flntd.exe 31 PID 2856 wrote to memory of 2812 2856 flntd.exe 31 PID 2856 wrote to memory of 2812 2856 flntd.exe 31 PID 2856 wrote to memory of 2812 2856 flntd.exe 31 PID 2812 wrote to memory of 2704 2812 vttdjxf.exe 32 PID 2812 wrote to memory of 2704 2812 vttdjxf.exe 32 PID 2812 wrote to memory of 2704 2812 vttdjxf.exe 32 PID 2812 wrote to memory of 2704 2812 vttdjxf.exe 32 PID 2704 wrote to memory of 2692 2704 phttb.exe 33 PID 2704 wrote to memory of 2692 2704 phttb.exe 33 PID 2704 wrote to memory of 2692 2704 phttb.exe 33 PID 2704 wrote to memory of 2692 2704 phttb.exe 33 PID 2692 wrote to memory of 2884 2692 xbfvn.exe 34 PID 2692 wrote to memory of 2884 2692 xbfvn.exe 34 PID 2692 wrote to memory of 2884 2692 xbfvn.exe 34 PID 2692 wrote to memory of 2884 2692 xbfvn.exe 34 PID 2884 wrote to memory of 2720 2884 ffbpxr.exe 35 PID 2884 wrote to memory of 2720 2884 ffbpxr.exe 35 PID 2884 wrote to memory of 2720 2884 ffbpxr.exe 35 PID 2884 wrote to memory of 2720 2884 ffbpxr.exe 35 PID 2720 wrote to memory of 2644 2720 tpbxd.exe 36 PID 2720 wrote to memory of 2644 2720 tpbxd.exe 36 PID 2720 wrote to memory of 2644 2720 tpbxd.exe 36 PID 2720 wrote to memory of 2644 2720 tpbxd.exe 36 PID 2644 wrote to memory of 916 2644 pfflxjx.exe 37 PID 2644 wrote to memory of 916 2644 pfflxjx.exe 37 PID 2644 wrote to memory of 916 2644 pfflxjx.exe 37 PID 2644 wrote to memory of 916 2644 pfflxjx.exe 37 PID 916 wrote to memory of 1932 916 vdrfjt.exe 38 PID 916 wrote to memory of 1932 916 vdrfjt.exe 38 PID 916 wrote to memory of 1932 916 vdrfjt.exe 38 PID 916 wrote to memory of 1932 916 vdrfjt.exe 38 PID 1932 wrote to memory of 2212 1932 httjrn.exe 39 PID 1932 wrote to memory of 2212 1932 httjrn.exe 39 PID 1932 wrote to memory of 2212 1932 httjrn.exe 39 PID 1932 wrote to memory of 2212 1932 httjrn.exe 39 PID 2212 wrote to memory of 2260 2212 flptn.exe 40 PID 2212 wrote to memory of 2260 2212 flptn.exe 40 PID 2212 wrote to memory of 2260 2212 flptn.exe 40 PID 2212 wrote to memory of 2260 2212 flptn.exe 40 PID 2260 wrote to memory of 2424 2260 xtntdr.exe 41 PID 2260 wrote to memory of 2424 2260 xtntdr.exe 41 PID 2260 wrote to memory of 2424 2260 xtntdr.exe 41 PID 2260 wrote to memory of 2424 2260 xtntdr.exe 41 PID 2424 wrote to memory of 2960 2424 fvbltpj.exe 42 PID 2424 wrote to memory of 2960 2424 fvbltpj.exe 42 PID 2424 wrote to memory of 2960 2424 fvbltpj.exe 42 PID 2424 wrote to memory of 2960 2424 fvbltpj.exe 42 PID 2960 wrote to memory of 2252 2960 prjxf.exe 43 PID 2960 wrote to memory of 2252 2960 prjxf.exe 43 PID 2960 wrote to memory of 2252 2960 prjxf.exe 43 PID 2960 wrote to memory of 2252 2960 prjxf.exe 43 PID 2252 wrote to memory of 2372 2252 xtndpd.exe 44 PID 2252 wrote to memory of 2372 2252 xtndpd.exe 44 PID 2252 wrote to memory of 2372 2252 xtndpd.exe 44 PID 2252 wrote to memory of 2372 2252 xtndpd.exe 44 PID 2372 wrote to memory of 1776 2372 bvhdhbj.exe 45 PID 2372 wrote to memory of 1776 2372 bvhdhbj.exe 45 PID 2372 wrote to memory of 1776 2372 bvhdhbj.exe 45 PID 2372 wrote to memory of 1776 2372 bvhdhbj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe"C:\Users\Admin\AppData\Local\Temp\adcadb69832657c4673c0678d72021c16796516839c66004153be758f2bfeed5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\flntd.exec:\flntd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vttdjxf.exec:\vttdjxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\phttb.exec:\phttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xbfvn.exec:\xbfvn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ffbpxr.exec:\ffbpxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tpbxd.exec:\tpbxd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pfflxjx.exec:\pfflxjx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vdrfjt.exec:\vdrfjt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\httjrn.exec:\httjrn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\flptn.exec:\flptn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xtntdr.exec:\xtntdr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\fvbltpj.exec:\fvbltpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\prjxf.exec:\prjxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xtndpd.exec:\xtndpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\bvhdhbj.exec:\bvhdhbj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\fdtxhdp.exec:\fdtxhdp.exe17⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hfdtrxt.exec:\hfdtrxt.exe18⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bxpbjdv.exec:\bxpbjdv.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hrfph.exec:\hrfph.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tbnxf.exec:\tbnxf.exe21⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rlnnjp.exec:\rlnnjp.exe22⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rnbjbj.exec:\rnbjbj.exe23⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ffbtrxf.exec:\ffbtrxf.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pvhxt.exec:\pvhxt.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lbtprhb.exec:\lbtprhb.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\hdhfphn.exec:\hdhfphn.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\ppvtr.exec:\ppvtr.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvtnln.exec:\dvtnln.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bdrdr.exec:\bdrdr.exe30⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rxdxbt.exec:\rxdxbt.exe31⤵
- Executes dropped EXE
PID:284 -
\??\c:\rrntlrl.exec:\rrntlrl.exe32⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lvvlrjh.exec:\lvvlrjh.exe33⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hrrjbl.exec:\hrrjbl.exe34⤵
- Executes dropped EXE
PID:2872 -
\??\c:\txfhtt.exec:\txfhtt.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xbbrbjl.exec:\xbbrbjl.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fbvrt.exec:\fbvrt.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\txhlnn.exec:\txhlnn.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jljlp.exec:\jljlp.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jpbjh.exec:\jpbjh.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\djxxr.exec:\djxxr.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bjfvvv.exec:\bjfvvv.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lbdplx.exec:\lbdplx.exe43⤵
- Executes dropped EXE
PID:2288 -
\??\c:\blbjbd.exec:\blbjbd.exe44⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vndlp.exec:\vndlp.exe45⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pxfrjh.exec:\pxfrjh.exe46⤵
- Executes dropped EXE
PID:1184 -
\??\c:\xpdtl.exec:\xpdtl.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jbnhn.exec:\jbnhn.exe48⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hfnlx.exec:\hfnlx.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lrvpb.exec:\lrvpb.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pnvjfn.exec:\pnvjfn.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bbhnn.exec:\bbhnn.exe52⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jxxlxjp.exec:\jxxlxjp.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ffvtlfl.exec:\ffvtlfl.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fdjtd.exec:\fdjtd.exe55⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hrljx.exec:\hrljx.exe56⤵
- Executes dropped EXE
PID:516 -
\??\c:\xxrptj.exec:\xxrptj.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nptfx.exec:\nptfx.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\frbplhr.exec:\frbplhr.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vbddbjn.exec:\vbddbjn.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xxbvpv.exec:\xxbvpv.exe61⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pxdvx.exec:\pxdvx.exe62⤵
- Executes dropped EXE
PID:1280 -
\??\c:\rhrvpvd.exec:\rhrvpvd.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vxttttl.exec:\vxttttl.exe64⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bvldh.exec:\bvldh.exe65⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ptvlfr.exec:\ptvlfr.exe66⤵PID:1960
-
\??\c:\rplvfjf.exec:\rplvfjf.exe67⤵PID:1392
-
\??\c:\vrfpjdv.exec:\vrfpjdv.exe68⤵PID:1812
-
\??\c:\nfdndl.exec:\nfdndl.exe69⤵PID:2344
-
\??\c:\dlfth.exec:\dlfth.exe70⤵PID:1580
-
\??\c:\xjvtj.exec:\xjvtj.exe71⤵PID:2764
-
\??\c:\brrjjn.exec:\brrjjn.exe72⤵PID:2588
-
\??\c:\ddrldtp.exec:\ddrldtp.exe73⤵PID:2336
-
\??\c:\rhlnhx.exec:\rhlnhx.exe74⤵PID:864
-
\??\c:\frpvt.exec:\frpvt.exe75⤵PID:2508
-
\??\c:\njfjr.exec:\njfjr.exe76⤵PID:2332
-
\??\c:\pfrrj.exec:\pfrrj.exe77⤵PID:2888
-
\??\c:\jllxvr.exec:\jllxvr.exe78⤵PID:3064
-
\??\c:\rxxdvtb.exec:\rxxdvtb.exe79⤵PID:3048
-
\??\c:\bbhjj.exec:\bbhjj.exe80⤵PID:2892
-
\??\c:\nfnjvft.exec:\nfnjvft.exe81⤵PID:2916
-
\??\c:\trvpn.exec:\trvpn.exe82⤵PID:2840
-
\??\c:\thxrpn.exec:\thxrpn.exe83⤵PID:2896
-
\??\c:\fbfpl.exec:\fbfpl.exe84⤵PID:2112
-
\??\c:\vxlhp.exec:\vxlhp.exe85⤵PID:2172
-
\??\c:\xfddrr.exec:\xfddrr.exe86⤵PID:1172
-
\??\c:\rtnnd.exec:\rtnnd.exe87⤵PID:432
-
\??\c:\vjhvxf.exec:\vjhvxf.exe88⤵PID:1036
-
\??\c:\xvlbh.exec:\xvlbh.exe89⤵PID:916
-
\??\c:\fnvvpf.exec:\fnvvpf.exe90⤵PID:2784
-
\??\c:\vxxtn.exec:\vxxtn.exe91⤵PID:2852
-
\??\c:\ltdtd.exec:\ltdtd.exe92⤵PID:2212
-
\??\c:\xvxtxxt.exec:\xvxtxxt.exe93⤵PID:1156
-
\??\c:\lnvtnrj.exec:\lnvtnrj.exe94⤵PID:2968
-
\??\c:\lnxjxxj.exec:\lnxjxxj.exe95⤵PID:3036
-
\??\c:\jndjpb.exec:\jndjpb.exe96⤵PID:2628
-
\??\c:\pjfdhfv.exec:\pjfdhfv.exe97⤵PID:2396
-
\??\c:\dlvfnrx.exec:\dlvfnrx.exe98⤵PID:1084
-
\??\c:\jjphtvd.exec:\jjphtvd.exe99⤵PID:2020
-
\??\c:\nvljh.exec:\nvljh.exe100⤵PID:2368
-
\??\c:\bnphbrr.exec:\bnphbrr.exe101⤵PID:2388
-
\??\c:\nbllrlx.exec:\nbllrlx.exe102⤵PID:2180
-
\??\c:\xlnfx.exec:\xlnfx.exe103⤵PID:1980
-
\??\c:\rbljnt.exec:\rbljnt.exe104⤵PID:1856
-
\??\c:\rhbhvb.exec:\rhbhvb.exe105⤵PID:520
-
\??\c:\hxtjxj.exec:\hxtjxj.exe106⤵PID:680
-
\??\c:\pnbjlp.exec:\pnbjlp.exe107⤵PID:732
-
\??\c:\fdhrrhv.exec:\fdhrrhv.exe108⤵PID:876
-
\??\c:\lfnnt.exec:\lfnnt.exe109⤵PID:1472
-
\??\c:\tvlvt.exec:\tvlvt.exe110⤵PID:2040
-
\??\c:\tvxvn.exec:\tvxvn.exe111⤵PID:1228
-
\??\c:\nhtxnrb.exec:\nhtxnrb.exe112⤵PID:1548
-
\??\c:\bdhrdx.exec:\bdhrdx.exe113⤵PID:1692
-
\??\c:\xlvbbpx.exec:\xlvbbpx.exe114⤵PID:612
-
\??\c:\tlrfv.exec:\tlrfv.exe115⤵PID:1664
-
\??\c:\vxnrrpj.exec:\vxnrrpj.exe116⤵PID:1808
-
\??\c:\dlrfdn.exec:\dlrfdn.exe117⤵PID:1008
-
\??\c:\vdhddfd.exec:\vdhddfd.exe118⤵PID:284
-
\??\c:\rpdjp.exec:\rpdjp.exe119⤵PID:1048
-
\??\c:\fdrrdv.exec:\fdrrdv.exe120⤵PID:2596
-
\??\c:\nndtfjr.exec:\nndtfjr.exe121⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-