Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe
Resource
win7-20240903-en
General
-
Target
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe
-
Size
453KB
-
MD5
8ed18ab56af2ed7a15f895f87fd9ba8f
-
SHA1
6d028d5984cc852029e3c0c2877ba7d50328b020
-
SHA256
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a
-
SHA512
f8b5b14f023948fd50a6c317a535bae1c0534f162a8ddb1479ea1bbdb8491121411c6a7575a397cd03f8a604dc501602bbf3e59281bd972bd77e83ad191b9c49
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/3068-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-449-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/760-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-745-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/400-770-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1596-864-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2840-877-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2824-890-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 xffrfrx.exe 2172 rlflrrl.exe 1492 tbthtb.exe 2284 pjvdv.exe 2820 lfrrxfl.exe 2720 hthntn.exe 2712 fxxlrxf.exe 2316 nhbhtb.exe 2356 btntbh.exe 2668 1rrxlxx.exe 1232 nhbhtb.exe 1932 fxlxlll.exe 620 3ttbnn.exe 1972 3hhnbb.exe 1364 fxxfrxl.exe 316 nhthtt.exe 1580 lffrxfr.exe 2912 jjvvj.exe 2964 ffxlxxr.exe 2980 tnbhtn.exe 2540 ppjpv.exe 3008 9dppv.exe 2968 ddvvj.exe 540 9jvdj.exe 2032 llrrxrr.exe 1540 tnhnbn.exe 3052 jddpj.exe 1280 nhtbhh.exe 2444 fxrrffr.exe 2056 ddpvj.exe 1144 xxrflrl.exe 2348 lrxllxl.exe 2164 1lxfllr.exe 3016 7lfxllr.exe 2704 9pjpv.exe 2700 pjdpd.exe 2840 rlxlrrx.exe 2468 btnnhh.exe 2740 pjjpd.exe 2688 9rlfrlx.exe 2864 xrfflrx.exe 2944 7hbhtb.exe 2708 nhbhtb.exe 2716 vjddv.exe 2480 xrlrxxl.exe 1696 9fxlrrx.exe 1616 httbhh.exe 2656 jjvjj.exe 1584 vvpjp.exe 2664 5xrlxxx.exe 1956 3rffllr.exe 2004 ttnthh.exe 2152 vvpvj.exe 2532 vppvd.exe 1752 rlrfrxf.exe 2684 nbnttb.exe 2992 9hnntb.exe 2160 pdppv.exe 2144 9rrllll.exe 1672 hhbnbb.exe 2128 1hhttb.exe 2968 ddvvd.exe 1740 pjdpv.exe 1620 xfxrffr.exe -
resource yara_rule behavioral1/memory/3068-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-1015-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2368 3068 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 3068 wrote to memory of 2368 3068 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 3068 wrote to memory of 2368 3068 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 3068 wrote to memory of 2368 3068 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 2368 wrote to memory of 2172 2368 xffrfrx.exe 31 PID 2368 wrote to memory of 2172 2368 xffrfrx.exe 31 PID 2368 wrote to memory of 2172 2368 xffrfrx.exe 31 PID 2368 wrote to memory of 2172 2368 xffrfrx.exe 31 PID 2172 wrote to memory of 1492 2172 rlflrrl.exe 32 PID 2172 wrote to memory of 1492 2172 rlflrrl.exe 32 PID 2172 wrote to memory of 1492 2172 rlflrrl.exe 32 PID 2172 wrote to memory of 1492 2172 rlflrrl.exe 32 PID 1492 wrote to memory of 2284 1492 tbthtb.exe 33 PID 1492 wrote to memory of 2284 1492 tbthtb.exe 33 PID 1492 wrote to memory of 2284 1492 tbthtb.exe 33 PID 1492 wrote to memory of 2284 1492 tbthtb.exe 33 PID 2284 wrote to memory of 2820 2284 pjvdv.exe 34 PID 2284 wrote to memory of 2820 2284 pjvdv.exe 34 PID 2284 wrote to memory of 2820 2284 pjvdv.exe 34 PID 2284 wrote to memory of 2820 2284 pjvdv.exe 34 PID 2820 wrote to memory of 2720 2820 lfrrxfl.exe 35 PID 2820 wrote to memory of 2720 2820 lfrrxfl.exe 35 PID 2820 wrote to memory of 2720 2820 lfrrxfl.exe 35 PID 2820 wrote to memory of 2720 2820 lfrrxfl.exe 35 PID 2720 wrote to memory of 2712 2720 hthntn.exe 36 PID 2720 wrote to memory of 2712 2720 hthntn.exe 36 PID 2720 wrote to memory of 2712 2720 hthntn.exe 36 PID 2720 wrote to memory of 2712 2720 hthntn.exe 36 PID 2712 wrote to memory of 2316 2712 fxxlrxf.exe 37 PID 2712 wrote to memory of 2316 2712 fxxlrxf.exe 37 PID 2712 wrote to memory of 2316 2712 fxxlrxf.exe 37 PID 2712 wrote to memory of 2316 2712 fxxlrxf.exe 37 PID 2316 wrote to memory of 2356 2316 nhbhtb.exe 38 PID 2316 wrote to memory of 2356 2316 nhbhtb.exe 38 PID 2316 wrote to memory of 2356 2316 nhbhtb.exe 38 PID 2316 wrote to memory of 2356 2316 nhbhtb.exe 38 PID 2356 wrote to memory of 2668 2356 btntbh.exe 39 PID 2356 wrote to memory of 2668 2356 btntbh.exe 39 PID 2356 wrote to memory of 2668 2356 btntbh.exe 39 PID 2356 wrote to memory of 2668 2356 btntbh.exe 39 PID 2668 wrote to memory of 1232 2668 1rrxlxx.exe 40 PID 2668 wrote to memory of 1232 2668 1rrxlxx.exe 40 PID 2668 wrote to memory of 1232 2668 1rrxlxx.exe 40 PID 2668 wrote to memory of 1232 2668 1rrxlxx.exe 40 PID 1232 wrote to memory of 1932 1232 nhbhtb.exe 41 PID 1232 wrote to memory of 1932 1232 nhbhtb.exe 41 PID 1232 wrote to memory of 1932 1232 nhbhtb.exe 41 PID 1232 wrote to memory of 1932 1232 nhbhtb.exe 41 PID 1932 wrote to memory of 620 1932 fxlxlll.exe 42 PID 1932 wrote to memory of 620 1932 fxlxlll.exe 42 PID 1932 wrote to memory of 620 1932 fxlxlll.exe 42 PID 1932 wrote to memory of 620 1932 fxlxlll.exe 42 PID 620 wrote to memory of 1972 620 3ttbnn.exe 43 PID 620 wrote to memory of 1972 620 3ttbnn.exe 43 PID 620 wrote to memory of 1972 620 3ttbnn.exe 43 PID 620 wrote to memory of 1972 620 3ttbnn.exe 43 PID 1972 wrote to memory of 1364 1972 3hhnbb.exe 44 PID 1972 wrote to memory of 1364 1972 3hhnbb.exe 44 PID 1972 wrote to memory of 1364 1972 3hhnbb.exe 44 PID 1972 wrote to memory of 1364 1972 3hhnbb.exe 44 PID 1364 wrote to memory of 316 1364 fxxfrxl.exe 45 PID 1364 wrote to memory of 316 1364 fxxfrxl.exe 45 PID 1364 wrote to memory of 316 1364 fxxfrxl.exe 45 PID 1364 wrote to memory of 316 1364 fxxfrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe"C:\Users\Admin\AppData\Local\Temp\57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xffrfrx.exec:\xffrfrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rlflrrl.exec:\rlflrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\tbthtb.exec:\tbthtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\pjvdv.exec:\pjvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\hthntn.exec:\hthntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\fxxlrxf.exec:\fxxlrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nhbhtb.exec:\nhbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\btntbh.exec:\btntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\1rrxlxx.exec:\1rrxlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhbhtb.exec:\nhbhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\fxlxlll.exec:\fxlxlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\3ttbnn.exec:\3ttbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\3hhnbb.exec:\3hhnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\nhthtt.exec:\nhthtt.exe17⤵
- Executes dropped EXE
PID:316 -
\??\c:\lffrxfr.exec:\lffrxfr.exe18⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jjvvj.exec:\jjvvj.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ffxlxxr.exec:\ffxlxxr.exe20⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tnbhtn.exec:\tnbhtn.exe21⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ppjpv.exec:\ppjpv.exe22⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9dppv.exec:\9dppv.exe23⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ddvvj.exec:\ddvvj.exe24⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9jvdj.exec:\9jvdj.exe25⤵
- Executes dropped EXE
PID:540 -
\??\c:\llrrxrr.exec:\llrrxrr.exe26⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnhnbn.exec:\tnhnbn.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jddpj.exec:\jddpj.exe28⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nhtbhh.exec:\nhtbhh.exe29⤵
- Executes dropped EXE
PID:1280 -
\??\c:\fxrrffr.exec:\fxrrffr.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ddpvj.exec:\ddpvj.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xxrflrl.exec:\xxrflrl.exe32⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lrxllxl.exec:\lrxllxl.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1lxfllr.exec:\1lxfllr.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7lfxllr.exec:\7lfxllr.exe35⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9pjpv.exec:\9pjpv.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjdpd.exec:\pjdpd.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rlxlrrx.exec:\rlxlrrx.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\btnnhh.exec:\btnnhh.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjjpd.exec:\pjjpd.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9rlfrlx.exec:\9rlfrlx.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xrfflrx.exec:\xrfflrx.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7hbhtb.exec:\7hbhtb.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhbhtb.exec:\nhbhtb.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vjddv.exec:\vjddv.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe46⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9fxlrrx.exec:\9fxlrrx.exe47⤵
- Executes dropped EXE
PID:1696 -
\??\c:\httbhh.exec:\httbhh.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjvjj.exec:\jjvjj.exe49⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvpjp.exec:\vvpjp.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5xrlxxx.exec:\5xrlxxx.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3rffllr.exec:\3rffllr.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ttnthh.exec:\ttnthh.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvpvj.exec:\vvpvj.exe54⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vppvd.exec:\vppvd.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rlrfrxf.exec:\rlrfrxf.exe56⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nbnttb.exec:\nbnttb.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9hnntb.exec:\9hnntb.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pdppv.exec:\pdppv.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9rrllll.exec:\9rrllll.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hhbnbb.exec:\hhbnbb.exe61⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1hhttb.exec:\1hhttb.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ddvvd.exec:\ddvvd.exe63⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pjdpv.exec:\pjdpv.exe64⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xfxrffr.exec:\xfxrffr.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ntbnhb.exec:\ntbnhb.exe66⤵PID:760
-
\??\c:\7bbthh.exec:\7bbthh.exe67⤵PID:1540
-
\??\c:\jpddv.exec:\jpddv.exe68⤵PID:1764
-
\??\c:\vdpvj.exec:\vdpvj.exe69⤵PID:2524
-
\??\c:\5xlxllx.exec:\5xlxllx.exe70⤵PID:2300
-
\??\c:\hbntnt.exec:\hbntnt.exe71⤵PID:2584
-
\??\c:\nnbnbh.exec:\nnbnbh.exe72⤵PID:2056
-
\??\c:\5pjjv.exec:\5pjjv.exe73⤵PID:296
-
\??\c:\1lrxlrf.exec:\1lrxlrf.exe74⤵PID:2380
-
\??\c:\1thhhh.exec:\1thhhh.exe75⤵PID:1644
-
\??\c:\nnttht.exec:\nnttht.exe76⤵PID:2164
-
\??\c:\ddvpd.exec:\ddvpd.exe77⤵PID:2280
-
\??\c:\djjdj.exec:\djjdj.exe78⤵PID:3028
-
\??\c:\rxxlrxf.exec:\rxxlrxf.exe79⤵PID:1680
-
\??\c:\hnhnbn.exec:\hnhnbn.exe80⤵PID:2820
-
\??\c:\bthnbb.exec:\bthnbb.exe81⤵PID:2804
-
\??\c:\3jdjp.exec:\3jdjp.exe82⤵PID:2632
-
\??\c:\flxxflx.exec:\flxxflx.exe83⤵PID:2744
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe84⤵PID:2756
-
\??\c:\btnthn.exec:\btnthn.exe85⤵PID:2612
-
\??\c:\vvpvd.exec:\vvpvd.exe86⤵PID:1784
-
\??\c:\xrlxffx.exec:\xrlxffx.exe87⤵PID:1924
-
\??\c:\rfxxllx.exec:\rfxxllx.exe88⤵PID:1936
-
\??\c:\btntnt.exec:\btntnt.exe89⤵PID:808
-
\??\c:\vvvpj.exec:\vvvpj.exe90⤵PID:2876
-
\??\c:\vvjvd.exec:\vvjvd.exe91⤵PID:784
-
\??\c:\5lfrrxx.exec:\5lfrrxx.exe92⤵PID:1156
-
\??\c:\1bnhnn.exec:\1bnhnn.exe93⤵PID:532
-
\??\c:\ttnttb.exec:\ttnttb.exe94⤵PID:2388
-
\??\c:\dvvpp.exec:\dvvpp.exe95⤵PID:1716
-
\??\c:\7rfflll.exec:\7rfflll.exe96⤵PID:1984
-
\??\c:\7xfxffr.exec:\7xfxffr.exe97⤵PID:1908
-
\??\c:\btnbtt.exec:\btnbtt.exe98⤵PID:1756
-
\??\c:\5pdjp.exec:\5pdjp.exe99⤵PID:1752
-
\??\c:\pdvdp.exec:\pdvdp.exe100⤵PID:2928
-
\??\c:\lfxrxlr.exec:\lfxrxlr.exe101⤵PID:2992
-
\??\c:\ttntnn.exec:\ttntnn.exe102⤵PID:2160
-
\??\c:\thnnbh.exec:\thnnbh.exe103⤵PID:2064
-
\??\c:\9vjjd.exec:\9vjjd.exe104⤵PID:2948
-
\??\c:\fxrrffx.exec:\fxrrffx.exe105⤵PID:2128
-
\??\c:\1frlxxf.exec:\1frlxxf.exe106⤵PID:400
-
\??\c:\hhttbb.exec:\hhttbb.exe107⤵PID:2136
-
\??\c:\pvjdj.exec:\pvjdj.exe108⤵PID:1772
-
\??\c:\5xxxllx.exec:\5xxxllx.exe109⤵PID:1240
-
\??\c:\fxxfxlf.exec:\fxxfxlf.exe110⤵PID:2400
-
\??\c:\thbbhn.exec:\thbbhn.exe111⤵PID:2976
-
\??\c:\vjvvd.exec:\vjvvd.exe112⤵PID:2112
-
\??\c:\pjjpd.exec:\pjjpd.exe113⤵PID:2300
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe114⤵PID:872
-
\??\c:\lfxfllr.exec:\lfxfllr.exe115⤵PID:864
-
\??\c:\bnntbh.exec:\bnntbh.exe116⤵PID:1736
-
\??\c:\vjppv.exec:\vjppv.exe117⤵PID:1708
-
\??\c:\vpjdj.exec:\vpjdj.exe118⤵PID:2100
-
\??\c:\xxrxflx.exec:\xxrxflx.exe119⤵PID:2896
-
\??\c:\7hbthh.exec:\7hbthh.exe120⤵PID:1296
-
\??\c:\1bhhnn.exec:\1bhhnn.exe121⤵PID:1596
-
\??\c:\9vppj.exec:\9vppj.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-