Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe
Resource
win7-20240708-en
General
-
Target
7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe
-
Size
453KB
-
MD5
c32636271edfab1fd44baac7ffa2d1dd
-
SHA1
1494576d2d1e5a0f766ba41fe93e020e252274ce
-
SHA256
7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485
-
SHA512
346f1454960c445ab21c9652321c0710d17d3707d7dc1f1116e12d5f2dcccc000552389143194139f747913c34951090bd9e0d077cdb81a3ddf78811c1fb5584
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeF:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2308-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-439-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/520-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-522-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2296-539-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/376-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-580-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2908-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-595-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2660-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-662-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1044-1046-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2348-1060-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/956-1085-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1704-1099-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2324 u600280.exe 2804 608462.exe 2752 btbhnt.exe 2676 860684.exe 2748 vvddp.exe 1668 o080284.exe 2632 a8224.exe 2364 260644.exe 1724 w26866.exe 2912 1pjpp.exe 1800 jjvvj.exe 588 20446.exe 2068 u488000.exe 480 s8680.exe 1320 pjvvd.exe 2856 228228.exe 1568 q42200.exe 1156 5jjjd.exe 2540 lxllxxf.exe 1896 60840.exe 2160 3pdvj.exe 1004 fxfxxlx.exe 2380 dvpdj.exe 464 ffrrllx.exe 2516 m0842.exe 1720 7ppdp.exe 3016 9djpv.exe 1688 btnnbh.exe 112 lfflfxl.exe 1648 5pjjj.exe 2444 dvjjv.exe 3012 m6006.exe 2308 c200822.exe 2520 nththn.exe 2808 hhbbtt.exe 2716 5bnnnn.exe 2148 w48466.exe 2908 hbtthn.exe 2748 86884.exe 2576 w20062.exe 2760 8606624.exe 1756 pdvdp.exe 2948 m4206.exe 2660 e26240.exe 2156 pjpdp.exe 2836 5rlfrff.exe 588 g8286.exe 2068 826206.exe 684 hbnthh.exe 2288 o862880.exe 2868 q82800.exe 2932 dvpvd.exe 1152 hhhthh.exe 1508 20286.exe 2184 rrlxflr.exe 2252 08662.exe 520 o800006.exe 2232 486060.exe 1008 5lrrxfl.exe 852 64668.exe 616 6640622.exe 1056 ddvvj.exe 1252 0428846.exe 840 thbhnt.exe -
resource yara_rule behavioral1/memory/2308-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/520-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-522-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1860-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-954-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-1015-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2512-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2062884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 046244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e04422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6888884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4862668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22404.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2324 2308 7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe 31 PID 2308 wrote to memory of 2324 2308 7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe 31 PID 2308 wrote to memory of 2324 2308 7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe 31 PID 2308 wrote to memory of 2324 2308 7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe 31 PID 2324 wrote to memory of 2804 2324 u600280.exe 32 PID 2324 wrote to memory of 2804 2324 u600280.exe 32 PID 2324 wrote to memory of 2804 2324 u600280.exe 32 PID 2324 wrote to memory of 2804 2324 u600280.exe 32 PID 2804 wrote to memory of 2752 2804 608462.exe 33 PID 2804 wrote to memory of 2752 2804 608462.exe 33 PID 2804 wrote to memory of 2752 2804 608462.exe 33 PID 2804 wrote to memory of 2752 2804 608462.exe 33 PID 2752 wrote to memory of 2676 2752 btbhnt.exe 34 PID 2752 wrote to memory of 2676 2752 btbhnt.exe 34 PID 2752 wrote to memory of 2676 2752 btbhnt.exe 34 PID 2752 wrote to memory of 2676 2752 btbhnt.exe 34 PID 2676 wrote to memory of 2748 2676 860684.exe 69 PID 2676 wrote to memory of 2748 2676 860684.exe 69 PID 2676 wrote to memory of 2748 2676 860684.exe 69 PID 2676 wrote to memory of 2748 2676 860684.exe 69 PID 2748 wrote to memory of 1668 2748 vvddp.exe 36 PID 2748 wrote to memory of 1668 2748 vvddp.exe 36 PID 2748 wrote to memory of 1668 2748 vvddp.exe 36 PID 2748 wrote to memory of 1668 2748 vvddp.exe 36 PID 1668 wrote to memory of 2632 1668 o080284.exe 37 PID 1668 wrote to memory of 2632 1668 o080284.exe 37 PID 1668 wrote to memory of 2632 1668 o080284.exe 37 PID 1668 wrote to memory of 2632 1668 o080284.exe 37 PID 2632 wrote to memory of 2364 2632 a8224.exe 38 PID 2632 wrote to memory of 2364 2632 a8224.exe 38 PID 2632 wrote to memory of 2364 2632 a8224.exe 38 PID 2632 wrote to memory of 2364 2632 a8224.exe 38 PID 2364 wrote to memory of 1724 2364 260644.exe 39 PID 2364 wrote to memory of 1724 2364 260644.exe 39 PID 2364 wrote to memory of 1724 2364 260644.exe 39 PID 2364 wrote to memory of 1724 2364 260644.exe 39 PID 1724 wrote to memory of 2912 1724 w26866.exe 40 PID 1724 wrote to memory of 2912 1724 w26866.exe 40 PID 1724 wrote to memory of 2912 1724 w26866.exe 40 PID 1724 wrote to memory of 2912 1724 w26866.exe 40 PID 2912 wrote to memory of 1800 2912 1pjpp.exe 41 PID 2912 wrote to memory of 1800 2912 1pjpp.exe 41 PID 2912 wrote to memory of 1800 2912 1pjpp.exe 41 PID 2912 wrote to memory of 1800 2912 1pjpp.exe 41 PID 1800 wrote to memory of 588 1800 jjvvj.exe 42 PID 1800 wrote to memory of 588 1800 jjvvj.exe 42 PID 1800 wrote to memory of 588 1800 jjvvj.exe 42 PID 1800 wrote to memory of 588 1800 jjvvj.exe 42 PID 588 wrote to memory of 2068 588 20446.exe 43 PID 588 wrote to memory of 2068 588 20446.exe 43 PID 588 wrote to memory of 2068 588 20446.exe 43 PID 588 wrote to memory of 2068 588 20446.exe 43 PID 2068 wrote to memory of 480 2068 u488000.exe 44 PID 2068 wrote to memory of 480 2068 u488000.exe 44 PID 2068 wrote to memory of 480 2068 u488000.exe 44 PID 2068 wrote to memory of 480 2068 u488000.exe 44 PID 480 wrote to memory of 1320 480 s8680.exe 45 PID 480 wrote to memory of 1320 480 s8680.exe 45 PID 480 wrote to memory of 1320 480 s8680.exe 45 PID 480 wrote to memory of 1320 480 s8680.exe 45 PID 1320 wrote to memory of 2856 1320 pjvvd.exe 46 PID 1320 wrote to memory of 2856 1320 pjvvd.exe 46 PID 1320 wrote to memory of 2856 1320 pjvvd.exe 46 PID 1320 wrote to memory of 2856 1320 pjvvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe"C:\Users\Admin\AppData\Local\Temp\7b5d17f6b39dbd6380f109fcedf98ef332f5dd89f9c8e63a5e30b7dfe23d8485.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\u600280.exec:\u600280.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\608462.exec:\608462.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\btbhnt.exec:\btbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\860684.exec:\860684.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vvddp.exec:\vvddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\o080284.exec:\o080284.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\a8224.exec:\a8224.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\260644.exec:\260644.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\w26866.exec:\w26866.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\1pjpp.exec:\1pjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jjvvj.exec:\jjvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\20446.exec:\20446.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\u488000.exec:\u488000.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\s8680.exec:\s8680.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\pjvvd.exec:\pjvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\228228.exec:\228228.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\q42200.exec:\q42200.exe18⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5jjjd.exec:\5jjjd.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156 -
\??\c:\lxllxxf.exec:\lxllxxf.exe20⤵
- Executes dropped EXE
PID:2540 -
\??\c:\60840.exec:\60840.exe21⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3pdvj.exec:\3pdvj.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxfxxlx.exec:\fxfxxlx.exe23⤵
- Executes dropped EXE
PID:1004 -
\??\c:\dvpdj.exec:\dvpdj.exe24⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ffrrllx.exec:\ffrrllx.exe25⤵
- Executes dropped EXE
PID:464 -
\??\c:\m0842.exec:\m0842.exe26⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7ppdp.exec:\7ppdp.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9djpv.exec:\9djpv.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\btnnbh.exec:\btnnbh.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lfflfxl.exec:\lfflfxl.exe30⤵
- Executes dropped EXE
PID:112 -
\??\c:\5pjjj.exec:\5pjjj.exe31⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvjjv.exec:\dvjjv.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\m6006.exec:\m6006.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\c200822.exec:\c200822.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nththn.exec:\nththn.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hhbbtt.exec:\hhbbtt.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5bnnnn.exec:\5bnnnn.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\w48466.exec:\w48466.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbtthn.exec:\hbtthn.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\86884.exec:\86884.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\w20062.exec:\w20062.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\8606624.exec:\8606624.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pdvdp.exec:\pdvdp.exe43⤵
- Executes dropped EXE
PID:1756 -
\??\c:\m4206.exec:\m4206.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\e26240.exec:\e26240.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjpdp.exec:\pjpdp.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\5rlfrff.exec:\5rlfrff.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\g8286.exec:\g8286.exe48⤵
- Executes dropped EXE
PID:588 -
\??\c:\826206.exec:\826206.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hbnthh.exec:\hbnthh.exe50⤵
- Executes dropped EXE
PID:684 -
\??\c:\o862880.exec:\o862880.exe51⤵
- Executes dropped EXE
PID:2288 -
\??\c:\q82800.exec:\q82800.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dvpvd.exec:\dvpvd.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhhthh.exec:\hhhthh.exe54⤵
- Executes dropped EXE
PID:1152 -
\??\c:\20286.exec:\20286.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rrlxflr.exec:\rrlxflr.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\08662.exec:\08662.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\o800006.exec:\o800006.exe58⤵
- Executes dropped EXE
PID:520 -
\??\c:\486060.exec:\486060.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\5lrrxfl.exec:\5lrrxfl.exe60⤵
- Executes dropped EXE
PID:1008 -
\??\c:\64668.exec:\64668.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\6640622.exec:\6640622.exe62⤵
- Executes dropped EXE
PID:616 -
\??\c:\ddvvj.exec:\ddvvj.exe63⤵
- Executes dropped EXE
PID:1056 -
\??\c:\0428846.exec:\0428846.exe64⤵
- Executes dropped EXE
PID:1252 -
\??\c:\thbhnt.exec:\thbhnt.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\vpjdv.exec:\vpjdv.exe66⤵PID:1688
-
\??\c:\20480.exec:\20480.exe67⤵PID:1264
-
\??\c:\fflrxfl.exec:\fflrxfl.exe68⤵PID:712
-
\??\c:\48628.exec:\48628.exe69⤵PID:1868
-
\??\c:\5vjpv.exec:\5vjpv.exe70⤵PID:2296
-
\??\c:\82624.exec:\82624.exe71⤵PID:1860
-
\??\c:\044628.exec:\044628.exe72⤵PID:1564
-
\??\c:\3vjpv.exec:\3vjpv.exe73⤵PID:2664
-
\??\c:\bthbnn.exec:\bthbnn.exe74⤵PID:1788
-
\??\c:\bhbtnn.exec:\bhbtnn.exe75⤵PID:2752
-
\??\c:\xxrfxxl.exec:\xxrfxxl.exe76⤵PID:376
-
\??\c:\nhhntt.exec:\nhhntt.exe77⤵PID:2876
-
\??\c:\26006.exec:\26006.exe78⤵PID:2908
-
\??\c:\08006.exec:\08006.exe79⤵PID:2560
-
\??\c:\042440.exec:\042440.exe80⤵PID:2612
-
\??\c:\o084606.exec:\o084606.exe81⤵PID:2632
-
\??\c:\btnbnn.exec:\btnbnn.exe82⤵PID:2532
-
\??\c:\42628.exec:\42628.exe83⤵PID:1832
-
\??\c:\jjvjd.exec:\jjvjd.exe84⤵
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\tbbhnn.exec:\tbbhnn.exe85⤵PID:2660
-
\??\c:\2044484.exec:\2044484.exe86⤵PID:2240
-
\??\c:\jdvdj.exec:\jdvdj.exe87⤵PID:1060
-
\??\c:\608022.exec:\608022.exe88⤵PID:1876
-
\??\c:\hbbnnt.exec:\hbbnnt.exe89⤵PID:1764
-
\??\c:\dvpdj.exec:\dvpdj.exe90⤵PID:1320
-
\??\c:\208462.exec:\208462.exe91⤵PID:3008
-
\??\c:\9xlflrf.exec:\9xlflrf.exe92⤵PID:2736
-
\??\c:\824640.exec:\824640.exe93⤵PID:1772
-
\??\c:\4862842.exec:\4862842.exe94⤵PID:2964
-
\??\c:\3vddj.exec:\3vddj.exe95⤵PID:2384
-
\??\c:\pppvj.exec:\pppvj.exe96⤵PID:1600
-
\??\c:\3rrxxxf.exec:\3rrxxxf.exe97⤵PID:1100
-
\??\c:\dvdjp.exec:\dvdjp.exe98⤵PID:2252
-
\??\c:\08286.exec:\08286.exe99⤵PID:2136
-
\??\c:\vpvdj.exec:\vpvdj.exe100⤵PID:404
-
\??\c:\jdvdj.exec:\jdvdj.exe101⤵
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\24462.exec:\24462.exe102⤵PID:960
-
\??\c:\hthbnt.exec:\hthbnt.exe103⤵PID:2968
-
\??\c:\bbtbhn.exec:\bbtbhn.exe104⤵PID:788
-
\??\c:\vdvdj.exec:\vdvdj.exe105⤵PID:1828
-
\??\c:\vvpdv.exec:\vvpdv.exe106⤵PID:1292
-
\??\c:\60024.exec:\60024.exe107⤵PID:1780
-
\??\c:\3rrflrf.exec:\3rrflrf.exe108⤵PID:1688
-
\??\c:\2668620.exec:\2668620.exe109⤵PID:1264
-
\??\c:\9frrrxx.exec:\9frrrxx.exe110⤵PID:1880
-
\??\c:\828800.exec:\828800.exe111⤵PID:1868
-
\??\c:\8082266.exec:\8082266.exe112⤵PID:2992
-
\??\c:\g6284.exec:\g6284.exe113⤵PID:1260
-
\??\c:\k02260.exec:\k02260.exe114⤵PID:2520
-
\??\c:\3thbbb.exec:\3thbbb.exe115⤵PID:1564
-
\??\c:\s6444.exec:\s6444.exe116⤵PID:2956
-
\??\c:\g4600.exec:\g4600.exe117⤵PID:2756
-
\??\c:\pddjj.exec:\pddjj.exe118⤵PID:2128
-
\??\c:\26068.exec:\26068.exe119⤵PID:376
-
\??\c:\e02228.exec:\e02228.exe120⤵PID:2340
-
\??\c:\dvvvd.exec:\dvvvd.exe121⤵PID:2732
-
\??\c:\rfrfxrx.exec:\rfrfxrx.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-