Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe
Resource
win7-20241010-en
General
-
Target
e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe
-
Size
455KB
-
MD5
d957c7df21012ad14533b6be5e41378e
-
SHA1
f1cb66aebad7cbd9981756f0a77be00ff7c471b7
-
SHA256
e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa
-
SHA512
91e1036ac142dc94753c72a070b36663e4259eecb5b3ef706ba806908763e2185e7d521f538c80af1453ffde646bdb8f44593a4c96089be984d3cc9111776426
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/524-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/868-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-46-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2920-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-246-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1056-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-292-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2556-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-437-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2852-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-459-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1812-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-483-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/952-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1416-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-535-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1416-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/236-563-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/236-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-590-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1700-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-599-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-673-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-692-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 fdvvt.exe 2208 bpddx.exe 868 jptnn.exe 2888 nhdnvjb.exe 2744 brrhr.exe 2920 ppdtdnx.exe 2676 dxxbnnh.exe 2692 txdlp.exe 2148 hlplbhp.exe 2680 tptdld.exe 2952 pplxvl.exe 1740 lfhjjt.exe 2968 fjnpvh.exe 1948 ltflb.exe 1464 bphdj.exe 3008 vnrtt.exe 2384 rdhtvp.exe 840 xjjtpd.exe 2084 tnlhtf.exe 2096 tnldp.exe 1520 xtrld.exe 1480 dhfppvv.exe 1704 tbptvr.exe 2400 htrbrtn.exe 2856 jxtpd.exe 1056 dxvhb.exe 1588 lldphxd.exe 2416 xffbf.exe 2488 pllfdlx.exe 2180 jvnhtt.exe 1012 lnppf.exe 880 ffxdjh.exe 1552 pdhplpx.exe 2556 thvhxxb.exe 1516 vdfbp.exe 2388 xnnxhtp.exe 2456 fhhptjr.exe 2892 ddvntj.exe 3056 xrrrh.exe 2776 nfbtv.exe 2824 pflldrb.exe 2788 ltrjtpx.exe 2380 jpvxf.exe 2684 pxxxvtf.exe 1104 xjvdxn.exe 2600 pftvtj.exe 1692 vxhddhf.exe 2804 bjlbpf.exe 2952 bdhvrr.exe 2972 nxbbb.exe 2852 vdvtltn.exe 852 xnxllx.exe 1932 xprlbx.exe 1900 htfprbl.exe 2660 rvndlrt.exe 1628 hhxldrj.exe 2344 vjrrxdb.exe 2176 xpjhtn.exe 1812 hphdxfj.exe 2224 tppxj.exe 1268 jrthhh.exe 1368 xnlhvhn.exe 952 pvtvnh.exe 2424 bnhnx.exe -
resource yara_rule behavioral1/memory/524-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-250-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2180-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-626-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2824-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-707-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2300-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-866-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbptvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfbpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nflttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldvlvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvttnvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tftprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphtfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhjbnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxpvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxbdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbvfxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfllxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pllfdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbtlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lplprfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjftbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtptd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbtxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvlnjrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbdtvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxvdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnppf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvdxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrlvjjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xftph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpjllfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpnljhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldnvrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htrbrtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htpxlfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfhjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbptj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjvnv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 524 wrote to memory of 2340 524 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 31 PID 524 wrote to memory of 2340 524 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 31 PID 524 wrote to memory of 2340 524 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 31 PID 524 wrote to memory of 2340 524 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 31 PID 2340 wrote to memory of 2208 2340 fdvvt.exe 32 PID 2340 wrote to memory of 2208 2340 fdvvt.exe 32 PID 2340 wrote to memory of 2208 2340 fdvvt.exe 32 PID 2340 wrote to memory of 2208 2340 fdvvt.exe 32 PID 2208 wrote to memory of 868 2208 bpddx.exe 33 PID 2208 wrote to memory of 868 2208 bpddx.exe 33 PID 2208 wrote to memory of 868 2208 bpddx.exe 33 PID 2208 wrote to memory of 868 2208 bpddx.exe 33 PID 868 wrote to memory of 2888 868 jptnn.exe 34 PID 868 wrote to memory of 2888 868 jptnn.exe 34 PID 868 wrote to memory of 2888 868 jptnn.exe 34 PID 868 wrote to memory of 2888 868 jptnn.exe 34 PID 2888 wrote to memory of 2744 2888 nhdnvjb.exe 35 PID 2888 wrote to memory of 2744 2888 nhdnvjb.exe 35 PID 2888 wrote to memory of 2744 2888 nhdnvjb.exe 35 PID 2888 wrote to memory of 2744 2888 nhdnvjb.exe 35 PID 2744 wrote to memory of 2920 2744 brrhr.exe 36 PID 2744 wrote to memory of 2920 2744 brrhr.exe 36 PID 2744 wrote to memory of 2920 2744 brrhr.exe 36 PID 2744 wrote to memory of 2920 2744 brrhr.exe 36 PID 2920 wrote to memory of 2676 2920 ppdtdnx.exe 37 PID 2920 wrote to memory of 2676 2920 ppdtdnx.exe 37 PID 2920 wrote to memory of 2676 2920 ppdtdnx.exe 37 PID 2920 wrote to memory of 2676 2920 ppdtdnx.exe 37 PID 2676 wrote to memory of 2692 2676 dxxbnnh.exe 38 PID 2676 wrote to memory of 2692 2676 dxxbnnh.exe 38 PID 2676 wrote to memory of 2692 2676 dxxbnnh.exe 38 PID 2676 wrote to memory of 2692 2676 dxxbnnh.exe 38 PID 2692 wrote to memory of 2148 2692 txdlp.exe 39 PID 2692 wrote to memory of 2148 2692 txdlp.exe 39 PID 2692 wrote to memory of 2148 2692 txdlp.exe 39 PID 2692 wrote to memory of 2148 2692 txdlp.exe 39 PID 2148 wrote to memory of 2680 2148 hlplbhp.exe 40 PID 2148 wrote to memory of 2680 2148 hlplbhp.exe 40 PID 2148 wrote to memory of 2680 2148 hlplbhp.exe 40 PID 2148 wrote to memory of 2680 2148 hlplbhp.exe 40 PID 2680 wrote to memory of 2952 2680 tptdld.exe 41 PID 2680 wrote to memory of 2952 2680 tptdld.exe 41 PID 2680 wrote to memory of 2952 2680 tptdld.exe 41 PID 2680 wrote to memory of 2952 2680 tptdld.exe 41 PID 2952 wrote to memory of 1740 2952 pplxvl.exe 42 PID 2952 wrote to memory of 1740 2952 pplxvl.exe 42 PID 2952 wrote to memory of 1740 2952 pplxvl.exe 42 PID 2952 wrote to memory of 1740 2952 pplxvl.exe 42 PID 1740 wrote to memory of 2968 1740 lfhjjt.exe 43 PID 1740 wrote to memory of 2968 1740 lfhjjt.exe 43 PID 1740 wrote to memory of 2968 1740 lfhjjt.exe 43 PID 1740 wrote to memory of 2968 1740 lfhjjt.exe 43 PID 2968 wrote to memory of 1948 2968 fjnpvh.exe 44 PID 2968 wrote to memory of 1948 2968 fjnpvh.exe 44 PID 2968 wrote to memory of 1948 2968 fjnpvh.exe 44 PID 2968 wrote to memory of 1948 2968 fjnpvh.exe 44 PID 1948 wrote to memory of 1464 1948 ltflb.exe 45 PID 1948 wrote to memory of 1464 1948 ltflb.exe 45 PID 1948 wrote to memory of 1464 1948 ltflb.exe 45 PID 1948 wrote to memory of 1464 1948 ltflb.exe 45 PID 1464 wrote to memory of 3008 1464 bphdj.exe 46 PID 1464 wrote to memory of 3008 1464 bphdj.exe 46 PID 1464 wrote to memory of 3008 1464 bphdj.exe 46 PID 1464 wrote to memory of 3008 1464 bphdj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe"C:\Users\Admin\AppData\Local\Temp\e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\fdvvt.exec:\fdvvt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bpddx.exec:\bpddx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\jptnn.exec:\jptnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\nhdnvjb.exec:\nhdnvjb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\brrhr.exec:\brrhr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ppdtdnx.exec:\ppdtdnx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\dxxbnnh.exec:\dxxbnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\txdlp.exec:\txdlp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hlplbhp.exec:\hlplbhp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tptdld.exec:\tptdld.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pplxvl.exec:\pplxvl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\lfhjjt.exec:\lfhjjt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\fjnpvh.exec:\fjnpvh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\ltflb.exec:\ltflb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\bphdj.exec:\bphdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\vnrtt.exec:\vnrtt.exe17⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rdhtvp.exec:\rdhtvp.exe18⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xjjtpd.exec:\xjjtpd.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\tnlhtf.exec:\tnlhtf.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnldp.exec:\tnldp.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xtrld.exec:\xtrld.exe22⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dhfppvv.exec:\dhfppvv.exe23⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tbptvr.exec:\tbptvr.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\htrbrtn.exec:\htrbrtn.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\jxtpd.exec:\jxtpd.exe26⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dxvhb.exec:\dxvhb.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lldphxd.exec:\lldphxd.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xffbf.exec:\xffbf.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pllfdlx.exec:\pllfdlx.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488 -
\??\c:\jvnhtt.exec:\jvnhtt.exe31⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lnppf.exec:\lnppf.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1012 -
\??\c:\ffxdjh.exec:\ffxdjh.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\pdhplpx.exec:\pdhplpx.exe34⤵
- Executes dropped EXE
PID:1552 -
\??\c:\thvhxxb.exec:\thvhxxb.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vdfbp.exec:\vdfbp.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xnnxhtp.exec:\xnnxhtp.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fhhptjr.exec:\fhhptjr.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddvntj.exec:\ddvntj.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xrrrh.exec:\xrrrh.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nfbtv.exec:\nfbtv.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pflldrb.exec:\pflldrb.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ltrjtpx.exec:\ltrjtpx.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jpvxf.exec:\jpvxf.exe44⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pxxxvtf.exec:\pxxxvtf.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xjvdxn.exec:\xjvdxn.exe46⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pftvtj.exec:\pftvtj.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vxhddhf.exec:\vxhddhf.exe48⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bjlbpf.exec:\bjlbpf.exe49⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bdhvrr.exec:\bdhvrr.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nxbbb.exec:\nxbbb.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vdvtltn.exec:\vdvtltn.exe52⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xnxllx.exec:\xnxllx.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\xprlbx.exec:\xprlbx.exe54⤵
- Executes dropped EXE
PID:1932 -
\??\c:\htfprbl.exec:\htfprbl.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rvndlrt.exec:\rvndlrt.exe56⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hhxldrj.exec:\hhxldrj.exe57⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjrrxdb.exec:\vjrrxdb.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xpjhtn.exec:\xpjhtn.exe59⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hphdxfj.exec:\hphdxfj.exe60⤵
- Executes dropped EXE
PID:1812 -
\??\c:\tppxj.exec:\tppxj.exe61⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jrthhh.exec:\jrthhh.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xnlhvhn.exec:\xnlhvhn.exe63⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pvtvnh.exec:\pvtvnh.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\bnhnx.exec:\bnhnx.exe65⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jhvvlhd.exec:\jhvvlhd.exe66⤵PID:2120
-
\??\c:\ppvpj.exec:\ppvpj.exe67⤵PID:1416
-
\??\c:\djxtl.exec:\djxtl.exe68⤵PID:2580
-
\??\c:\vbhdt.exec:\vbhdt.exe69⤵PID:1540
-
\??\c:\hfjlrlv.exec:\hfjlrlv.exe70⤵PID:2356
-
\??\c:\xbrnp.exec:\xbrnp.exe71⤵PID:2092
-
\??\c:\rrdtxbb.exec:\rrdtxbb.exe72⤵PID:236
-
\??\c:\bftdp.exec:\bftdp.exe73⤵PID:1360
-
\??\c:\lbprv.exec:\lbprv.exe74⤵PID:2108
-
\??\c:\ntdjnn.exec:\ntdjnn.exe75⤵PID:2548
-
\??\c:\pnntbtl.exec:\pnntbtl.exe76⤵PID:1564
-
\??\c:\lrtbtr.exec:\lrtbtr.exe77⤵PID:1700
-
\??\c:\xvrddn.exec:\xvrddn.exe78⤵PID:2340
-
\??\c:\rpnnf.exec:\rpnnf.exe79⤵PID:2016
-
\??\c:\nlvrnx.exec:\nlvrnx.exe80⤵PID:2880
-
\??\c:\pvlnjrt.exec:\pvlnjrt.exe81⤵
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\flttf.exec:\flttf.exe82⤵PID:2772
-
\??\c:\ndjlxbf.exec:\ndjlxbf.exe83⤵PID:2776
-
\??\c:\xvtfdxj.exec:\xvtfdxj.exe84⤵PID:2824
-
\??\c:\rtdxx.exec:\rtdxx.exe85⤵PID:2788
-
\??\c:\tnbptdn.exec:\tnbptdn.exe86⤵PID:320
-
\??\c:\vhfjl.exec:\vhfjl.exe87⤵PID:2276
-
\??\c:\jbtlj.exec:\jbtlj.exe88⤵
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\hvlvpx.exec:\hvlvpx.exe89⤵PID:2600
-
\??\c:\njxhrnr.exec:\njxhrnr.exe90⤵PID:2832
-
\??\c:\bnbjnrb.exec:\bnbjnrb.exe91⤵PID:2992
-
\??\c:\pvplvff.exec:\pvplvff.exe92⤵PID:740
-
\??\c:\xlbjtxd.exec:\xlbjtxd.exe93⤵PID:1980
-
\??\c:\rjphx.exec:\rjphx.exe94⤵PID:2300
-
\??\c:\bffllbt.exec:\bffllbt.exe95⤵PID:1892
-
\??\c:\jrjjr.exec:\jrjjr.exe96⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\xxntj.exec:\xxntj.exe97⤵PID:3004
-
\??\c:\htpxlfv.exec:\htpxlfv.exe98⤵
- System Location Discovery: System Language Discovery
PID:2660 -
\??\c:\xbdnrv.exec:\xbdnrv.exe99⤵PID:2056
-
\??\c:\fvjddj.exec:\fvjddj.exe100⤵PID:2084
-
\??\c:\nnrbvt.exec:\nnrbvt.exe101⤵PID:1100
-
\??\c:\hntbjt.exec:\hntbjt.exe102⤵PID:1064
-
\??\c:\ddhjbnv.exec:\ddhjbnv.exe103⤵
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\ftxhp.exec:\ftxhp.exe104⤵PID:276
-
\??\c:\nnprp.exec:\nnprp.exe105⤵PID:1016
-
\??\c:\jdlnjj.exec:\jdlnjj.exe106⤵PID:1736
-
\??\c:\hfrvrb.exec:\hfrvrb.exe107⤵PID:2592
-
\??\c:\djvtrvh.exec:\djvtrvh.exe108⤵PID:2856
-
\??\c:\bbdpjf.exec:\bbdpjf.exe109⤵PID:2120
-
\??\c:\vfltlp.exec:\vfltlp.exe110⤵PID:1472
-
\??\c:\jvjfxlv.exec:\jvjfxlv.exe111⤵PID:2216
-
\??\c:\vlprhnx.exec:\vlprhnx.exe112⤵PID:2360
-
\??\c:\jjrdxr.exec:\jjrdxr.exe113⤵PID:2960
-
\??\c:\hjxpj.exec:\hjxpj.exe114⤵PID:1188
-
\??\c:\hhttbrl.exec:\hhttbrl.exe115⤵PID:2116
-
\??\c:\pfnvl.exec:\pfnvl.exe116⤵PID:864
-
\??\c:\prtfllx.exec:\prtfllx.exe117⤵PID:2524
-
\??\c:\nrbnfp.exec:\nrbnfp.exe118⤵PID:2212
-
\??\c:\vhxnpv.exec:\vhxnpv.exe119⤵PID:1596
-
\??\c:\nfrflt.exec:\nfrflt.exe120⤵PID:3032
-
\??\c:\jxhvlp.exec:\jxhvlp.exe121⤵PID:2728
-
\??\c:\lfdpt.exec:\lfdpt.exe122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-