Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe
Resource
win7-20241010-en
General
-
Target
45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe
-
Size
457KB
-
MD5
1fa6d07912974090dc03334ebeeb538a
-
SHA1
55bcca7f286f1a8c4d2a774f89cffcb96f2b2d8d
-
SHA256
45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e
-
SHA512
96d831ed6e50d64cd87a65d67196ed43261774c591e467cad008eba58671e5aac0a0b93bf960c563c54d546414e43ed7e415d6d124246e87645b1eb883008b8d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRII:q7Tc2NYHUrAwfMp3CDRII
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1820-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-176-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1280-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-408-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2604-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-429-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-436-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-546-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1252-556-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1628-583-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2820-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-631-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 fpthljd.exe 2836 nlffb.exe 2976 tbdrvl.exe 2732 bxdxhbx.exe 2752 nhtljr.exe 2864 flpfljh.exe 2736 lvrprb.exe 2608 xtvjh.exe 2396 bvbfdf.exe 1332 djjxtrd.exe 1264 txbprxn.exe 2132 hrpxjx.exe 2468 tjnth.exe 2360 pfrxnh.exe 2400 hnpnn.exe 632 jjlhxx.exe 1788 pbxntjl.exe 1280 xjhrt.exe 2280 nfntp.exe 2176 dpvddxr.exe 900 hpjnxhp.exe 1528 xljtbl.exe 2680 jrvtbj.exe 948 dlvjp.exe 2324 bbjndf.exe 1676 ftvlvd.exe 1696 pjftf.exe 1044 tbdhljt.exe 956 ppxnh.exe 1040 fvxfh.exe 1924 rhjvbf.exe 1968 phtpdvn.exe 548 hfdbjdt.exe 1820 rrxvjxj.exe 2056 rxxfv.exe 2436 pdjprn.exe 2952 fvrjb.exe 2876 vjjpjpt.exe 2316 hnrhxb.exe 2748 lrjrbld.exe 2912 pvfnbp.exe 2840 fxflv.exe 2892 jbdvp.exe 2804 fpjlnl.exe 2740 pvjpj.exe 2824 xdrdj.exe 2388 vdvpflh.exe 1384 vbvpjv.exe 2084 xvvbxn.exe 2604 jtxjdjt.exe 3056 bnvjvrh.exe 2500 htvtpxl.exe 2212 tntdnh.exe 3036 hxltd.exe 1032 njhnbr.exe 2044 fhlfj.exe 2676 tfvldx.exe 2080 vfbjxb.exe 2164 lblndlt.exe 112 rhrjptl.exe 616 lpfdx.exe 2292 tnnfnv.exe 2516 pdfbhdv.exe 2680 vdbpljp.exe -
resource yara_rule behavioral1/memory/1820-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-546-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2820-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-830-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tffxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjpdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdxdxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffbxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntrbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvpdfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnfxpvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvfnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npjhbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxpntrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhjlfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrnftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdjxrdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnldvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtdhbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvlflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhvbxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdhjnjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppfrdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bddtljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpdjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdttjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plfdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnlnrxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrvtbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdfdjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xblblnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djtfxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptnrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbpfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxhx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3008 1820 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 29 PID 1820 wrote to memory of 3008 1820 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 29 PID 1820 wrote to memory of 3008 1820 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 29 PID 1820 wrote to memory of 3008 1820 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 29 PID 3008 wrote to memory of 2836 3008 fpthljd.exe 30 PID 3008 wrote to memory of 2836 3008 fpthljd.exe 30 PID 3008 wrote to memory of 2836 3008 fpthljd.exe 30 PID 3008 wrote to memory of 2836 3008 fpthljd.exe 30 PID 2836 wrote to memory of 2976 2836 nlffb.exe 31 PID 2836 wrote to memory of 2976 2836 nlffb.exe 31 PID 2836 wrote to memory of 2976 2836 nlffb.exe 31 PID 2836 wrote to memory of 2976 2836 nlffb.exe 31 PID 2976 wrote to memory of 2732 2976 tbdrvl.exe 32 PID 2976 wrote to memory of 2732 2976 tbdrvl.exe 32 PID 2976 wrote to memory of 2732 2976 tbdrvl.exe 32 PID 2976 wrote to memory of 2732 2976 tbdrvl.exe 32 PID 2732 wrote to memory of 2752 2732 bxdxhbx.exe 33 PID 2732 wrote to memory of 2752 2732 bxdxhbx.exe 33 PID 2732 wrote to memory of 2752 2732 bxdxhbx.exe 33 PID 2732 wrote to memory of 2752 2732 bxdxhbx.exe 33 PID 2752 wrote to memory of 2864 2752 nhtljr.exe 34 PID 2752 wrote to memory of 2864 2752 nhtljr.exe 34 PID 2752 wrote to memory of 2864 2752 nhtljr.exe 34 PID 2752 wrote to memory of 2864 2752 nhtljr.exe 34 PID 2864 wrote to memory of 2736 2864 flpfljh.exe 35 PID 2864 wrote to memory of 2736 2864 flpfljh.exe 35 PID 2864 wrote to memory of 2736 2864 flpfljh.exe 35 PID 2864 wrote to memory of 2736 2864 flpfljh.exe 35 PID 2736 wrote to memory of 2608 2736 lvrprb.exe 36 PID 2736 wrote to memory of 2608 2736 lvrprb.exe 36 PID 2736 wrote to memory of 2608 2736 lvrprb.exe 36 PID 2736 wrote to memory of 2608 2736 lvrprb.exe 36 PID 2608 wrote to memory of 2396 2608 xtvjh.exe 37 PID 2608 wrote to memory of 2396 2608 xtvjh.exe 37 PID 2608 wrote to memory of 2396 2608 xtvjh.exe 37 PID 2608 wrote to memory of 2396 2608 xtvjh.exe 37 PID 2396 wrote to memory of 1332 2396 bvbfdf.exe 38 PID 2396 wrote to memory of 1332 2396 bvbfdf.exe 38 PID 2396 wrote to memory of 1332 2396 bvbfdf.exe 38 PID 2396 wrote to memory of 1332 2396 bvbfdf.exe 38 PID 1332 wrote to memory of 1264 1332 djjxtrd.exe 39 PID 1332 wrote to memory of 1264 1332 djjxtrd.exe 39 PID 1332 wrote to memory of 1264 1332 djjxtrd.exe 39 PID 1332 wrote to memory of 1264 1332 djjxtrd.exe 39 PID 1264 wrote to memory of 2132 1264 txbprxn.exe 40 PID 1264 wrote to memory of 2132 1264 txbprxn.exe 40 PID 1264 wrote to memory of 2132 1264 txbprxn.exe 40 PID 1264 wrote to memory of 2132 1264 txbprxn.exe 40 PID 2132 wrote to memory of 2468 2132 hrpxjx.exe 41 PID 2132 wrote to memory of 2468 2132 hrpxjx.exe 41 PID 2132 wrote to memory of 2468 2132 hrpxjx.exe 41 PID 2132 wrote to memory of 2468 2132 hrpxjx.exe 41 PID 2468 wrote to memory of 2360 2468 tjnth.exe 42 PID 2468 wrote to memory of 2360 2468 tjnth.exe 42 PID 2468 wrote to memory of 2360 2468 tjnth.exe 42 PID 2468 wrote to memory of 2360 2468 tjnth.exe 42 PID 2360 wrote to memory of 2400 2360 pfrxnh.exe 43 PID 2360 wrote to memory of 2400 2360 pfrxnh.exe 43 PID 2360 wrote to memory of 2400 2360 pfrxnh.exe 43 PID 2360 wrote to memory of 2400 2360 pfrxnh.exe 43 PID 2400 wrote to memory of 632 2400 hnpnn.exe 44 PID 2400 wrote to memory of 632 2400 hnpnn.exe 44 PID 2400 wrote to memory of 632 2400 hnpnn.exe 44 PID 2400 wrote to memory of 632 2400 hnpnn.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe"C:\Users\Admin\AppData\Local\Temp\45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\fpthljd.exec:\fpthljd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nlffb.exec:\nlffb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\tbdrvl.exec:\tbdrvl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bxdxhbx.exec:\bxdxhbx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhtljr.exec:\nhtljr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\flpfljh.exec:\flpfljh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lvrprb.exec:\lvrprb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xtvjh.exec:\xtvjh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bvbfdf.exec:\bvbfdf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\djjxtrd.exec:\djjxtrd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\txbprxn.exec:\txbprxn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\hrpxjx.exec:\hrpxjx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\tjnth.exec:\tjnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\pfrxnh.exec:\pfrxnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\hnpnn.exec:\hnpnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jjlhxx.exec:\jjlhxx.exe17⤵
- Executes dropped EXE
PID:632 -
\??\c:\pbxntjl.exec:\pbxntjl.exe18⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xjhrt.exec:\xjhrt.exe19⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nfntp.exec:\nfntp.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dpvddxr.exec:\dpvddxr.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hpjnxhp.exec:\hpjnxhp.exe22⤵
- Executes dropped EXE
PID:900 -
\??\c:\xljtbl.exec:\xljtbl.exe23⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jrvtbj.exec:\jrvtbj.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\dlvjp.exec:\dlvjp.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\bbjndf.exec:\bbjndf.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ftvlvd.exec:\ftvlvd.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjftf.exec:\pjftf.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tbdhljt.exec:\tbdhljt.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ppxnh.exec:\ppxnh.exe30⤵
- Executes dropped EXE
PID:956 -
\??\c:\fvxfh.exec:\fvxfh.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rhjvbf.exec:\rhjvbf.exe32⤵
- Executes dropped EXE
PID:1924 -
\??\c:\phtpdvn.exec:\phtpdvn.exe33⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hfdbjdt.exec:\hfdbjdt.exe34⤵
- Executes dropped EXE
PID:548 -
\??\c:\rrxvjxj.exec:\rrxvjxj.exe35⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rxxfv.exec:\rxxfv.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pdjprn.exec:\pdjprn.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fvrjb.exec:\fvrjb.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vjjpjpt.exec:\vjjpjpt.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hnrhxb.exec:\hnrhxb.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lrjrbld.exec:\lrjrbld.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pvfnbp.exec:\pvfnbp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\fxflv.exec:\fxflv.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jbdvp.exec:\jbdvp.exe44⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fpjlnl.exec:\fpjlnl.exe45⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pvjpj.exec:\pvjpj.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xdrdj.exec:\xdrdj.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vdvpflh.exec:\vdvpflh.exe48⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vbvpjv.exec:\vbvpjv.exe49⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xvvbxn.exec:\xvvbxn.exe50⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jtxjdjt.exec:\jtxjdjt.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bnvjvrh.exec:\bnvjvrh.exe52⤵
- Executes dropped EXE
PID:3056 -
\??\c:\htvtpxl.exec:\htvtpxl.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tntdnh.exec:\tntdnh.exe54⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hxltd.exec:\hxltd.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\njhnbr.exec:\njhnbr.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fhlfj.exec:\fhlfj.exe57⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tfvldx.exec:\tfvldx.exe58⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vfbjxb.exec:\vfbjxb.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lblndlt.exec:\lblndlt.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rhrjptl.exec:\rhrjptl.exe61⤵
- Executes dropped EXE
PID:112 -
\??\c:\lpfdx.exec:\lpfdx.exe62⤵
- Executes dropped EXE
PID:616 -
\??\c:\tnnfnv.exec:\tnnfnv.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pdfbhdv.exec:\pdfbhdv.exe64⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vdbpljp.exec:\vdbpljp.exe65⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lntjfx.exec:\lntjfx.exe66⤵PID:2296
-
\??\c:\tbbrdbt.exec:\tbbrdbt.exe67⤵PID:1780
-
\??\c:\rdvfpb.exec:\rdvfpb.exe68⤵PID:1704
-
\??\c:\ddrdtpd.exec:\ddrdtpd.exe69⤵PID:1008
-
\??\c:\ndrhndn.exec:\ndrhndn.exe70⤵PID:1248
-
\??\c:\txrdxfd.exec:\txrdxfd.exe71⤵PID:1252
-
\??\c:\tbbvb.exec:\tbbvb.exe72⤵PID:1480
-
\??\c:\ntfnxt.exec:\ntfnxt.exe73⤵PID:944
-
\??\c:\pnbbpxj.exec:\pnbbpxj.exe74⤵PID:328
-
\??\c:\bljtn.exec:\bljtn.exe75⤵PID:1628
-
\??\c:\ftlln.exec:\ftlln.exe76⤵PID:2696
-
\??\c:\fppvnpb.exec:\fppvnpb.exe77⤵PID:2820
-
\??\c:\dflfblr.exec:\dflfblr.exe78⤵PID:2216
-
\??\c:\rbndxh.exec:\rbndxh.exe79⤵PID:792
-
\??\c:\hbpfd.exec:\hbpfd.exe80⤵
- System Location Discovery: System Language Discovery
PID:2836 -
\??\c:\brrdrn.exec:\brrdrn.exe81⤵PID:2860
-
\??\c:\pblrn.exec:\pblrn.exe82⤵PID:2852
-
\??\c:\jvdfnvt.exec:\jvdfnvt.exe83⤵PID:2440
-
\??\c:\fjbxf.exec:\fjbxf.exe84⤵PID:2772
-
\??\c:\rptjpdx.exec:\rptjpdx.exe85⤵PID:828
-
\??\c:\jtbrp.exec:\jtbrp.exe86⤵PID:2792
-
\??\c:\lvvnr.exec:\lvvnr.exe87⤵PID:760
-
\??\c:\vfvtffd.exec:\vfvtffd.exe88⤵PID:2804
-
\??\c:\dhtnbl.exec:\dhtnbl.exe89⤵PID:2736
-
\??\c:\rfrpn.exec:\rfrpn.exe90⤵PID:1620
-
\??\c:\flvdj.exec:\flvdj.exe91⤵PID:2536
-
\??\c:\nttpl.exec:\nttpl.exe92⤵PID:3052
-
\??\c:\thrbvh.exec:\thrbvh.exe93⤵PID:1240
-
\??\c:\jlphb.exec:\jlphb.exe94⤵PID:2128
-
\??\c:\tbdnjf.exec:\tbdnjf.exe95⤵PID:2300
-
\??\c:\plbfd.exec:\plbfd.exe96⤵PID:2636
-
\??\c:\pblfn.exec:\pblfn.exe97⤵PID:888
-
\??\c:\lvlrvn.exec:\lvlrvn.exe98⤵PID:2320
-
\??\c:\dvtltt.exec:\dvtltt.exe99⤵PID:2040
-
\??\c:\blbbd.exec:\blbbd.exe100⤵PID:2184
-
\??\c:\pbnbr.exec:\pbnbr.exe101⤵PID:1864
-
\??\c:\dxpntrf.exec:\dxpntrf.exe102⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\djfxhnd.exec:\djfxhnd.exe103⤵PID:2080
-
\??\c:\btvbnb.exec:\btvbnb.exe104⤵PID:2164
-
\??\c:\jdfjbl.exec:\jdfjbl.exe105⤵PID:1328
-
\??\c:\vhtnr.exec:\vhtnr.exe106⤵PID:1004
-
\??\c:\vvrftjx.exec:\vvrftjx.exe107⤵PID:1716
-
\??\c:\jvljn.exec:\jvljn.exe108⤵PID:2256
-
\??\c:\lvtxt.exec:\lvtxt.exe109⤵PID:992
-
\??\c:\hfxfxn.exec:\hfxfxn.exe110⤵PID:592
-
\??\c:\bnnfvbt.exec:\bnnfvbt.exe111⤵PID:820
-
\??\c:\jtjfxxd.exec:\jtjfxxd.exe112⤵PID:1776
-
\??\c:\pbpplxt.exec:\pbpplxt.exe113⤵PID:1744
-
\??\c:\fllxvr.exec:\fllxvr.exe114⤵PID:928
-
\??\c:\xjfbpl.exec:\xjfbpl.exe115⤵PID:2596
-
\??\c:\hrnldvv.exec:\hrnldvv.exe116⤵PID:2712
-
\??\c:\rxxphd.exec:\rxxphd.exe117⤵PID:876
-
\??\c:\bhxtp.exec:\bhxtp.exe118⤵PID:1692
-
\??\c:\fjhfxjt.exec:\fjhfxjt.exe119⤵PID:548
-
\??\c:\ntprn.exec:\ntprn.exe120⤵PID:2488
-
\??\c:\rvpdhx.exec:\rvpdhx.exe121⤵PID:2832
-
\??\c:\dhhpbb.exec:\dhhpbb.exe122⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-