Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:08 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe
-
Size
453KB
-
MD5
8a0c3ae1868afe61bc92f803e3adc8a0
-
SHA1
13dabc4b970fb1b95dd4ce0d5606eac7e24f035d
-
SHA256
696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aa
-
SHA512
90493171a712a0f2679d83d04ea5abdb9a333c75414accf8918167950c8b356689ebc992a2eeed0bd12964736152cc360a63a32734b2e410e0a1b6e2d5143322
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2392-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-44-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3032-54-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3032-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-273-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2276-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-301-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2940-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-459-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2400-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-592-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1996-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-908-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2668-928-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-941-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-962-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-997-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1476-1039-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2392 lxlffff.exe 2912 nbhttt.exe 2776 vjpvv.exe 2888 i826802.exe 3032 8606224.exe 2708 tthntt.exe 2728 i046064.exe 2100 2084662.exe 1004 dvjpd.exe 1956 064228.exe 2096 s2884.exe 1808 2682880.exe 2868 dvjdj.exe 1080 82062.exe 1920 i804044.exe 684 42006.exe 264 xlxxfxl.exe 1324 086848.exe 2588 vjjdj.exe 2508 hhnhbn.exe 2196 226484.exe 1352 btnthn.exe 904 ppddj.exe 288 lrrrrlr.exe 3036 dvvdp.exe 3064 60802.exe 1864 048646.exe 2324 pvvdj.exe 2276 3nhhtb.exe 2188 220024.exe 1504 8826842.exe 1256 0428068.exe 1984 djdvj.exe 1712 86286.exe 2920 826800.exe 2804 vdddp.exe 2936 dvpvd.exe 2956 9lxxfff.exe 3012 vdpvp.exe 2664 bthnnn.exe 2420 06244.exe 2504 860644.exe 1524 jdpjv.exe 1788 bttbnt.exe 2332 44280.exe 1956 djpjp.exe 992 9nbhnb.exe 1996 80846.exe 588 24228.exe 2856 868400.exe 2992 a2624.exe 1908 48624.exe 2380 268026.exe 684 5dpdd.exe 596 jjdpj.exe 2140 0426284.exe 2520 hhthhn.exe 2400 hthhhb.exe 2384 nhtbhn.exe 2136 0800224.exe 1288 hhthnt.exe 1392 ffxfrrf.exe 948 268422.exe 1776 06204.exe -
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m6288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s8406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i826802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u488626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66420.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6428064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q00622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2392 2124 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 30 PID 2124 wrote to memory of 2392 2124 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 30 PID 2124 wrote to memory of 2392 2124 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 30 PID 2124 wrote to memory of 2392 2124 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 30 PID 2392 wrote to memory of 2912 2392 lxlffff.exe 31 PID 2392 wrote to memory of 2912 2392 lxlffff.exe 31 PID 2392 wrote to memory of 2912 2392 lxlffff.exe 31 PID 2392 wrote to memory of 2912 2392 lxlffff.exe 31 PID 2912 wrote to memory of 2776 2912 nbhttt.exe 32 PID 2912 wrote to memory of 2776 2912 nbhttt.exe 32 PID 2912 wrote to memory of 2776 2912 nbhttt.exe 32 PID 2912 wrote to memory of 2776 2912 nbhttt.exe 32 PID 2776 wrote to memory of 2888 2776 vjpvv.exe 33 PID 2776 wrote to memory of 2888 2776 vjpvv.exe 33 PID 2776 wrote to memory of 2888 2776 vjpvv.exe 33 PID 2776 wrote to memory of 2888 2776 vjpvv.exe 33 PID 2888 wrote to memory of 3032 2888 i826802.exe 34 PID 2888 wrote to memory of 3032 2888 i826802.exe 34 PID 2888 wrote to memory of 3032 2888 i826802.exe 34 PID 2888 wrote to memory of 3032 2888 i826802.exe 34 PID 3032 wrote to memory of 2708 3032 8606224.exe 35 PID 3032 wrote to memory of 2708 3032 8606224.exe 35 PID 3032 wrote to memory of 2708 3032 8606224.exe 35 PID 3032 wrote to memory of 2708 3032 8606224.exe 35 PID 2708 wrote to memory of 2728 2708 tthntt.exe 36 PID 2708 wrote to memory of 2728 2708 tthntt.exe 36 PID 2708 wrote to memory of 2728 2708 tthntt.exe 36 PID 2708 wrote to memory of 2728 2708 tthntt.exe 36 PID 2728 wrote to memory of 2100 2728 i046064.exe 37 PID 2728 wrote to memory of 2100 2728 i046064.exe 37 PID 2728 wrote to memory of 2100 2728 i046064.exe 37 PID 2728 wrote to memory of 2100 2728 i046064.exe 37 PID 2100 wrote to memory of 1004 2100 2084662.exe 38 PID 2100 wrote to memory of 1004 2100 2084662.exe 38 PID 2100 wrote to memory of 1004 2100 2084662.exe 38 PID 2100 wrote to memory of 1004 2100 2084662.exe 38 PID 1004 wrote to memory of 1956 1004 dvjpd.exe 39 PID 1004 wrote to memory of 1956 1004 dvjpd.exe 39 PID 1004 wrote to memory of 1956 1004 dvjpd.exe 39 PID 1004 wrote to memory of 1956 1004 dvjpd.exe 39 PID 1956 wrote to memory of 2096 1956 064228.exe 40 PID 1956 wrote to memory of 2096 1956 064228.exe 40 PID 1956 wrote to memory of 2096 1956 064228.exe 40 PID 1956 wrote to memory of 2096 1956 064228.exe 40 PID 2096 wrote to memory of 1808 2096 s2884.exe 41 PID 2096 wrote to memory of 1808 2096 s2884.exe 41 PID 2096 wrote to memory of 1808 2096 s2884.exe 41 PID 2096 wrote to memory of 1808 2096 s2884.exe 41 PID 1808 wrote to memory of 2868 1808 2682880.exe 42 PID 1808 wrote to memory of 2868 1808 2682880.exe 42 PID 1808 wrote to memory of 2868 1808 2682880.exe 42 PID 1808 wrote to memory of 2868 1808 2682880.exe 42 PID 2868 wrote to memory of 1080 2868 dvjdj.exe 43 PID 2868 wrote to memory of 1080 2868 dvjdj.exe 43 PID 2868 wrote to memory of 1080 2868 dvjdj.exe 43 PID 2868 wrote to memory of 1080 2868 dvjdj.exe 43 PID 1080 wrote to memory of 1920 1080 82062.exe 44 PID 1080 wrote to memory of 1920 1080 82062.exe 44 PID 1080 wrote to memory of 1920 1080 82062.exe 44 PID 1080 wrote to memory of 1920 1080 82062.exe 44 PID 1920 wrote to memory of 684 1920 i804044.exe 45 PID 1920 wrote to memory of 684 1920 i804044.exe 45 PID 1920 wrote to memory of 684 1920 i804044.exe 45 PID 1920 wrote to memory of 684 1920 i804044.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe"C:\Users\Admin\AppData\Local\Temp\696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lxlffff.exec:\lxlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\nbhttt.exec:\nbhttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vjpvv.exec:\vjpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\i826802.exec:\i826802.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\8606224.exec:\8606224.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tthntt.exec:\tthntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\i046064.exec:\i046064.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\2084662.exec:\2084662.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\dvjpd.exec:\dvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\064228.exec:\064228.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\s2884.exec:\s2884.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\2682880.exec:\2682880.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\dvjdj.exec:\dvjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\82062.exec:\82062.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\i804044.exec:\i804044.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\42006.exec:\42006.exe17⤵
- Executes dropped EXE
PID:684 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\086848.exec:\086848.exe19⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vjjdj.exec:\vjjdj.exe20⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hhnhbn.exec:\hhnhbn.exe21⤵
- Executes dropped EXE
PID:2508 -
\??\c:\226484.exec:\226484.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\btnthn.exec:\btnthn.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ppddj.exec:\ppddj.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\lrrrrlr.exec:\lrrrrlr.exe25⤵
- Executes dropped EXE
PID:288 -
\??\c:\dvvdp.exec:\dvvdp.exe26⤵
- Executes dropped EXE
PID:3036 -
\??\c:\60802.exec:\60802.exe27⤵
- Executes dropped EXE
PID:3064 -
\??\c:\048646.exec:\048646.exe28⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pvvdj.exec:\pvvdj.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3nhhtb.exec:\3nhhtb.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\220024.exec:\220024.exe31⤵
- Executes dropped EXE
PID:2188 -
\??\c:\8826842.exec:\8826842.exe32⤵
- Executes dropped EXE
PID:1504 -
\??\c:\0428068.exec:\0428068.exe33⤵
- Executes dropped EXE
PID:1256 -
\??\c:\djdvj.exec:\djdvj.exe34⤵
- Executes dropped EXE
PID:1984 -
\??\c:\608422.exec:\608422.exe35⤵PID:2940
-
\??\c:\86286.exec:\86286.exe36⤵
- Executes dropped EXE
PID:1712 -
\??\c:\826800.exec:\826800.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vdddp.exec:\vdddp.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dvpvd.exec:\dvpvd.exe39⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9lxxfff.exec:\9lxxfff.exe40⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vdpvp.exec:\vdpvp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3012 -
\??\c:\bthnnn.exec:\bthnnn.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\06244.exec:\06244.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\860644.exec:\860644.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jdpjv.exec:\jdpjv.exe45⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bttbnt.exec:\bttbnt.exe46⤵
- Executes dropped EXE
PID:1788 -
\??\c:\44280.exec:\44280.exe47⤵
- Executes dropped EXE
PID:2332 -
\??\c:\djpjp.exec:\djpjp.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9nbhnb.exec:\9nbhnb.exe49⤵
- Executes dropped EXE
PID:992 -
\??\c:\80846.exec:\80846.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\24228.exec:\24228.exe51⤵
- Executes dropped EXE
PID:588 -
\??\c:\868400.exec:\868400.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\a2624.exec:\a2624.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\48624.exec:\48624.exe54⤵
- Executes dropped EXE
PID:1908 -
\??\c:\268026.exec:\268026.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5dpdd.exec:\5dpdd.exe56⤵
- Executes dropped EXE
PID:684 -
\??\c:\jjdpj.exec:\jjdpj.exe57⤵
- Executes dropped EXE
PID:596 -
\??\c:\0426284.exec:\0426284.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hhthhn.exec:\hhthhn.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hthhhb.exec:\hthhhb.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nhtbhn.exec:\nhtbhn.exe61⤵
- Executes dropped EXE
PID:2384 -
\??\c:\0800224.exec:\0800224.exe62⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhthnt.exec:\hhthnt.exe63⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe64⤵
- Executes dropped EXE
PID:1392 -
\??\c:\268422.exec:\268422.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\06204.exec:\06204.exe66⤵
- Executes dropped EXE
PID:1776 -
\??\c:\0084602.exec:\0084602.exe67⤵PID:1540
-
\??\c:\tnbtth.exec:\tnbtth.exe68⤵PID:496
-
\??\c:\5bbthn.exec:\5bbthn.exe69⤵PID:3064
-
\??\c:\06862.exec:\06862.exe70⤵PID:1720
-
\??\c:\604022.exec:\604022.exe71⤵PID:608
-
\??\c:\ttntht.exec:\ttntht.exe72⤵PID:2280
-
\??\c:\6286044.exec:\6286044.exe73⤵PID:1052
-
\??\c:\2640242.exec:\2640242.exe74⤵PID:1828
-
\??\c:\826884.exec:\826884.exe75⤵PID:2604
-
\??\c:\66062.exec:\66062.exe76⤵PID:2260
-
\??\c:\04204.exec:\04204.exe77⤵PID:2760
-
\??\c:\04224.exec:\04224.exe78⤵PID:2940
-
\??\c:\1rrfrxf.exec:\1rrfrxf.exe79⤵PID:1608
-
\??\c:\g4020.exec:\g4020.exe80⤵PID:2908
-
\??\c:\lfxrfrf.exec:\lfxrfrf.exe81⤵PID:2364
-
\??\c:\6022884.exec:\6022884.exe82⤵PID:2676
-
\??\c:\tnbbnn.exec:\tnbbnn.exe83⤵PID:2500
-
\??\c:\g6464.exec:\g6464.exe84⤵PID:2700
-
\??\c:\26464.exec:\26464.exe85⤵PID:2932
-
\??\c:\lfxlflx.exec:\lfxlflx.exe86⤵PID:2696
-
\??\c:\vddjv.exec:\vddjv.exe87⤵PID:2728
-
\??\c:\llfrffx.exec:\llfrffx.exe88⤵PID:2088
-
\??\c:\i646842.exec:\i646842.exe89⤵PID:2984
-
\??\c:\rrrxrxr.exec:\rrrxrxr.exe90⤵PID:1752
-
\??\c:\4802068.exec:\4802068.exe91⤵PID:1272
-
\??\c:\vpppd.exec:\vpppd.exe92⤵PID:2864
-
\??\c:\pjdjp.exec:\pjdjp.exe93⤵PID:2172
-
\??\c:\1xrxfrx.exec:\1xrxfrx.exe94⤵PID:1996
-
\??\c:\dvvjp.exec:\dvvjp.exe95⤵PID:2868
-
\??\c:\ppjpv.exec:\ppjpv.exe96⤵PID:2856
-
\??\c:\66462.exec:\66462.exe97⤵PID:2836
-
\??\c:\26424.exec:\26424.exe98⤵PID:2980
-
\??\c:\dvppd.exec:\dvppd.exe99⤵PID:2380
-
\??\c:\dvjvd.exec:\dvjvd.exe100⤵PID:1100
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe101⤵PID:2068
-
\??\c:\1dvdp.exec:\1dvdp.exe102⤵PID:2344
-
\??\c:\ddppv.exec:\ddppv.exe103⤵PID:1988
-
\??\c:\5tnbht.exec:\5tnbht.exe104⤵PID:2000
-
\??\c:\048680.exec:\048680.exe105⤵PID:1620
-
\??\c:\82004.exec:\82004.exe106⤵PID:736
-
\??\c:\ffrxflx.exec:\ffrxflx.exe107⤵PID:2964
-
\??\c:\7hhtbh.exec:\7hhtbh.exe108⤵PID:904
-
\??\c:\ttthhn.exec:\ttthhn.exe109⤵PID:2012
-
\??\c:\1dpvd.exec:\1dpvd.exe110⤵PID:1684
-
\??\c:\3ppvj.exec:\3ppvj.exe111⤵PID:3052
-
\??\c:\nnhhtb.exec:\nnhhtb.exe112⤵PID:544
-
\??\c:\9hnthh.exec:\9hnthh.exe113⤵PID:884
-
\??\c:\tnnbhh.exec:\tnnbhh.exe114⤵PID:1700
-
\??\c:\i206684.exec:\i206684.exe115⤵PID:2288
-
\??\c:\lrrlflf.exec:\lrrlflf.exe116⤵PID:304
-
\??\c:\48686.exec:\48686.exe117⤵PID:1916
-
\??\c:\xxflrxl.exec:\xxflrxl.exe118⤵PID:1716
-
\??\c:\26002.exec:\26002.exe119⤵PID:1636
-
\??\c:\djpjj.exec:\djpjj.exe120⤵PID:1984
-
\??\c:\260228.exec:\260228.exe121⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-