Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe
Resource
win7-20240903-en
General
-
Target
c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe
-
Size
454KB
-
MD5
98a4fcbc050461cb68e375be281a3856
-
SHA1
e60fad020adfa73376674ddc9dd1eea63779298f
-
SHA256
c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee
-
SHA512
dc51829148fdfb0e871a446f0ae867c780d6831ca5afd9c0ab3a475adf91e507168aac823c1cf4668c4cedc53b81f1fdd20370d0157a4bd55e5890f5f4288fd4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec4:q7Tc2NYHUrAwfMp3CDc4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2628-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-143-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-214-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1632-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-244-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2436-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-513-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2056-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-749-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2628 jjjpd.exe 2720 lfxxllx.exe 2712 jdppd.exe 2848 1fxflrr.exe 2568 rxxlllx.exe 2584 9vpjv.exe 2144 rfrfllx.exe 1352 9pppv.exe 2168 ttbbnt.exe 2200 7vpdj.exe 2824 rllxflf.exe 2420 bthntb.exe 1684 jjdjp.exe 2708 rlffrrf.exe 2972 btnthh.exe 584 jjvdv.exe 2368 5nhhtb.exe 2220 bbtbhn.exe 1860 1vpvd.exe 1012 rlflrxf.exe 1060 jjdjp.exe 2116 ddpvj.exe 1632 fxllxxl.exe 108 bthhtt.exe 2352 pvppd.exe 2436 hhbhnn.exe 2112 djdpv.exe 2056 llxfllr.exe 1852 dvjjp.exe 2128 fxxfflf.exe 1600 hbtthn.exe 1588 jddjj.exe 2732 tnhttb.exe 2640 ddjjv.exe 2544 rrrllrf.exe 2700 hbnbbn.exe 2696 hhttbh.exe 2984 pdvdp.exe 1756 1lllrxl.exe 3048 hnhnbh.exe 2968 1tnnbn.exe 2408 djjvd.exe 2240 rlxllrx.exe 2164 btnhnn.exe 880 nhhnbh.exe 2860 jjdjj.exe 2332 vpppp.exe 784 fxxxflr.exe 332 5htbtb.exe 2940 dvvvj.exe 2004 9vvjp.exe 2972 7xlxflf.exe 644 bbtbbn.exe 2900 7nbtnn.exe 2208 dppvd.exe 2232 lrlxlxl.exe 1860 ttntth.exe 2108 bhbhnb.exe 1200 pjpvj.exe 1144 rxlllxf.exe 1736 3nbhnn.exe 1632 nhttbb.exe 2492 jjjpj.exe 1380 5fxxffr.exe -
resource yara_rule behavioral1/memory/2628-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-288-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1588-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-850-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2628 1600 c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe 30 PID 1600 wrote to memory of 2628 1600 c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe 30 PID 1600 wrote to memory of 2628 1600 c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe 30 PID 1600 wrote to memory of 2628 1600 c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe 30 PID 2628 wrote to memory of 2720 2628 jjjpd.exe 31 PID 2628 wrote to memory of 2720 2628 jjjpd.exe 31 PID 2628 wrote to memory of 2720 2628 jjjpd.exe 31 PID 2628 wrote to memory of 2720 2628 jjjpd.exe 31 PID 2720 wrote to memory of 2712 2720 lfxxllx.exe 32 PID 2720 wrote to memory of 2712 2720 lfxxllx.exe 32 PID 2720 wrote to memory of 2712 2720 lfxxllx.exe 32 PID 2720 wrote to memory of 2712 2720 lfxxllx.exe 32 PID 2712 wrote to memory of 2848 2712 jdppd.exe 33 PID 2712 wrote to memory of 2848 2712 jdppd.exe 33 PID 2712 wrote to memory of 2848 2712 jdppd.exe 33 PID 2712 wrote to memory of 2848 2712 jdppd.exe 33 PID 2848 wrote to memory of 2568 2848 1fxflrr.exe 34 PID 2848 wrote to memory of 2568 2848 1fxflrr.exe 34 PID 2848 wrote to memory of 2568 2848 1fxflrr.exe 34 PID 2848 wrote to memory of 2568 2848 1fxflrr.exe 34 PID 2568 wrote to memory of 2584 2568 rxxlllx.exe 35 PID 2568 wrote to memory of 2584 2568 rxxlllx.exe 35 PID 2568 wrote to memory of 2584 2568 rxxlllx.exe 35 PID 2568 wrote to memory of 2584 2568 rxxlllx.exe 35 PID 2584 wrote to memory of 2144 2584 9vpjv.exe 36 PID 2584 wrote to memory of 2144 2584 9vpjv.exe 36 PID 2584 wrote to memory of 2144 2584 9vpjv.exe 36 PID 2584 wrote to memory of 2144 2584 9vpjv.exe 36 PID 2144 wrote to memory of 1352 2144 rfrfllx.exe 37 PID 2144 wrote to memory of 1352 2144 rfrfllx.exe 37 PID 2144 wrote to memory of 1352 2144 rfrfllx.exe 37 PID 2144 wrote to memory of 1352 2144 rfrfllx.exe 37 PID 1352 wrote to memory of 2168 1352 9pppv.exe 38 PID 1352 wrote to memory of 2168 1352 9pppv.exe 38 PID 1352 wrote to memory of 2168 1352 9pppv.exe 38 PID 1352 wrote to memory of 2168 1352 9pppv.exe 38 PID 2168 wrote to memory of 2200 2168 ttbbnt.exe 39 PID 2168 wrote to memory of 2200 2168 ttbbnt.exe 39 PID 2168 wrote to memory of 2200 2168 ttbbnt.exe 39 PID 2168 wrote to memory of 2200 2168 ttbbnt.exe 39 PID 2200 wrote to memory of 2824 2200 7vpdj.exe 40 PID 2200 wrote to memory of 2824 2200 7vpdj.exe 40 PID 2200 wrote to memory of 2824 2200 7vpdj.exe 40 PID 2200 wrote to memory of 2824 2200 7vpdj.exe 40 PID 2824 wrote to memory of 2420 2824 rllxflf.exe 41 PID 2824 wrote to memory of 2420 2824 rllxflf.exe 41 PID 2824 wrote to memory of 2420 2824 rllxflf.exe 41 PID 2824 wrote to memory of 2420 2824 rllxflf.exe 41 PID 2420 wrote to memory of 1684 2420 bthntb.exe 42 PID 2420 wrote to memory of 1684 2420 bthntb.exe 42 PID 2420 wrote to memory of 1684 2420 bthntb.exe 42 PID 2420 wrote to memory of 1684 2420 bthntb.exe 42 PID 1684 wrote to memory of 2708 1684 jjdjp.exe 43 PID 1684 wrote to memory of 2708 1684 jjdjp.exe 43 PID 1684 wrote to memory of 2708 1684 jjdjp.exe 43 PID 1684 wrote to memory of 2708 1684 jjdjp.exe 43 PID 2708 wrote to memory of 2972 2708 rlffrrf.exe 44 PID 2708 wrote to memory of 2972 2708 rlffrrf.exe 44 PID 2708 wrote to memory of 2972 2708 rlffrrf.exe 44 PID 2708 wrote to memory of 2972 2708 rlffrrf.exe 44 PID 2972 wrote to memory of 584 2972 btnthh.exe 45 PID 2972 wrote to memory of 584 2972 btnthh.exe 45 PID 2972 wrote to memory of 584 2972 btnthh.exe 45 PID 2972 wrote to memory of 584 2972 btnthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe"C:\Users\Admin\AppData\Local\Temp\c617a8b3a8311dad9c4099dacb3dcf9c015f69b4ab3df6b24517ad5a66c63aee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\jjjpd.exec:\jjjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\lfxxllx.exec:\lfxxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdppd.exec:\jdppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1fxflrr.exec:\1fxflrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rxxlllx.exec:\rxxlllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9vpjv.exec:\9vpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rfrfllx.exec:\rfrfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\9pppv.exec:\9pppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\ttbbnt.exec:\ttbbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\7vpdj.exec:\7vpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rllxflf.exec:\rllxflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bthntb.exec:\bthntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jjdjp.exec:\jjdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rlffrrf.exec:\rlffrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\btnthh.exec:\btnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jjvdv.exec:\jjvdv.exe17⤵
- Executes dropped EXE
PID:584 -
\??\c:\5nhhtb.exec:\5nhhtb.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bbtbhn.exec:\bbtbhn.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1vpvd.exec:\1vpvd.exe20⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rlflrxf.exec:\rlflrxf.exe21⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jjdjp.exec:\jjdjp.exe22⤵
- Executes dropped EXE
PID:1060 -
\??\c:\ddpvj.exec:\ddpvj.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxllxxl.exec:\fxllxxl.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bthhtt.exec:\bthhtt.exe25⤵
- Executes dropped EXE
PID:108 -
\??\c:\pvppd.exec:\pvppd.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhbhnn.exec:\hhbhnn.exe27⤵
- Executes dropped EXE
PID:2436 -
\??\c:\djdpv.exec:\djdpv.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\llxfllr.exec:\llxfllr.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvjjp.exec:\dvjjp.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852 -
\??\c:\fxxfflf.exec:\fxxfflf.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbtthn.exec:\hbtthn.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jddjj.exec:\jddjj.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnhttb.exec:\tnhttb.exe34⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ddjjv.exec:\ddjjv.exe35⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rrrllrf.exec:\rrrllrf.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbnbbn.exec:\hbnbbn.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hhttbh.exec:\hhttbh.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pdvdp.exec:\pdvdp.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1lllrxl.exec:\1lllrxl.exe40⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hnhnbh.exec:\hnhnbh.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1tnnbn.exec:\1tnnbn.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\djjvd.exec:\djjvd.exe43⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rlxllrx.exec:\rlxllrx.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btnhnn.exec:\btnhnn.exe45⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhhnbh.exec:\nhhnbh.exe46⤵
- Executes dropped EXE
PID:880 -
\??\c:\jjdjj.exec:\jjdjj.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vpppp.exec:\vpppp.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxxxflr.exec:\fxxxflr.exe49⤵
- Executes dropped EXE
PID:784 -
\??\c:\5htbtb.exec:\5htbtb.exe50⤵
- Executes dropped EXE
PID:332 -
\??\c:\dvvvj.exec:\dvvvj.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9vvjp.exec:\9vvjp.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7xlxflf.exec:\7xlxflf.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bbtbbn.exec:\bbtbbn.exe54⤵
- Executes dropped EXE
PID:644 -
\??\c:\7nbtnn.exec:\7nbtnn.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dppvd.exec:\dppvd.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ttntth.exec:\ttntth.exe58⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bhbhnb.exec:\bhbhnb.exe59⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pjpvj.exec:\pjpvj.exe60⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rxlllxf.exec:\rxlllxf.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3nbhnn.exec:\3nbhnn.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhttbb.exec:\nhttbb.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jjjpj.exec:\jjjpj.exe64⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5fxxffr.exec:\5fxxffr.exe65⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bbtbnt.exec:\bbtbnt.exe66⤵
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\1nbttb.exec:\1nbttb.exe67⤵PID:856
-
\??\c:\jdddp.exec:\jdddp.exe68⤵PID:1668
-
\??\c:\rrlxflx.exec:\rrlxflx.exe69⤵PID:1956
-
\??\c:\tththh.exec:\tththh.exe70⤵
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\nhnntb.exec:\nhnntb.exe71⤵PID:276
-
\??\c:\jvpdj.exec:\jvpdj.exe72⤵PID:1928
-
\??\c:\rfxfflf.exec:\rfxfflf.exe73⤵PID:2728
-
\??\c:\bhbhtb.exec:\bhbhtb.exe74⤵PID:1640
-
\??\c:\tnhhtb.exec:\tnhhtb.exe75⤵PID:2768
-
\??\c:\pjdpp.exec:\pjdpp.exe76⤵PID:2656
-
\??\c:\xfrfrxl.exec:\xfrfrxl.exe77⤵PID:2720
-
\??\c:\7xxlrxf.exec:\7xxlrxf.exe78⤵PID:2776
-
\??\c:\7bbbhh.exec:\7bbbhh.exe79⤵PID:2780
-
\??\c:\dvpdd.exec:\dvpdd.exe80⤵PID:2600
-
\??\c:\vpjjv.exec:\vpjjv.exe81⤵PID:2552
-
\??\c:\flrfxxl.exec:\flrfxxl.exe82⤵PID:2588
-
\??\c:\1hnttt.exec:\1hnttt.exe83⤵PID:2992
-
\??\c:\vpjvj.exec:\vpjvj.exe84⤵PID:3012
-
\??\c:\5vpdd.exec:\5vpdd.exe85⤵PID:1924
-
\??\c:\xrfxrlx.exec:\xrfxrlx.exe86⤵PID:1516
-
\??\c:\bbtbbh.exec:\bbtbbh.exe87⤵PID:2132
-
\??\c:\pvjpv.exec:\pvjpv.exe88⤵PID:2816
-
\??\c:\dvvdd.exec:\dvvdd.exe89⤵PID:380
-
\??\c:\rrlxllr.exec:\rrlxllr.exe90⤵PID:1496
-
\??\c:\7hnnbh.exec:\7hnnbh.exe91⤵PID:2264
-
\??\c:\nnnbnt.exec:\nnnbnt.exe92⤵PID:332
-
\??\c:\dvpvj.exec:\dvpvj.exe93⤵PID:2940
-
\??\c:\xrfxfrl.exec:\xrfxfrl.exe94⤵PID:1036
-
\??\c:\1rxlflr.exec:\1rxlflr.exe95⤵PID:2972
-
\??\c:\3nhntt.exec:\3nhntt.exe96⤵PID:644
-
\??\c:\pvvjv.exec:\pvvjv.exe97⤵PID:3064
-
\??\c:\xffrxff.exec:\xffrxff.exe98⤵PID:2476
-
\??\c:\7xxlrrx.exec:\7xxlrrx.exe99⤵PID:1484
-
\??\c:\tbthtb.exec:\tbthtb.exe100⤵PID:1860
-
\??\c:\jdpvp.exec:\jdpvp.exe101⤵PID:2340
-
\??\c:\3llrffr.exec:\3llrffr.exe102⤵PID:2172
-
\??\c:\fxrxffr.exec:\fxrxffr.exe103⤵PID:2480
-
\??\c:\3hhttn.exec:\3hhttn.exe104⤵PID:1336
-
\??\c:\vjjpp.exec:\vjjpp.exe105⤵PID:108
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe106⤵PID:552
-
\??\c:\xxxxrfl.exec:\xxxxrfl.exe107⤵PID:3032
-
\??\c:\nnnhnb.exec:\nnnhnb.exe108⤵PID:1216
-
\??\c:\jjvvj.exec:\jjvvj.exe109⤵PID:2324
-
\??\c:\7frxlxr.exec:\7frxlxr.exe110⤵PID:1808
-
\??\c:\rrfrllx.exec:\rrfrllx.exe111⤵PID:1700
-
\??\c:\3htbhb.exec:\3htbhb.exe112⤵PID:1692
-
\??\c:\djddj.exec:\djddj.exe113⤵PID:1028
-
\??\c:\dvjpp.exec:\dvjpp.exe114⤵PID:2716
-
\??\c:\9rlxfff.exec:\9rlxfff.exe115⤵PID:1584
-
\??\c:\1nbnth.exec:\1nbnth.exe116⤵PID:2628
-
\??\c:\pjdjp.exec:\pjdjp.exe117⤵PID:2884
-
\??\c:\vpdvp.exec:\vpdvp.exe118⤵
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\lfxflrf.exec:\lfxflrf.exe119⤵PID:2576
-
\??\c:\nnbttt.exec:\nnbttt.exe120⤵PID:2636
-
\??\c:\7htbbn.exec:\7htbbn.exe121⤵PID:2532
-
\??\c:\dvppp.exec:\dvppp.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-