Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:47
Behavioral task
behavioral1
Sample
d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe
-
Size
333KB
-
MD5
e2ef38dc1e48bdd8345b740d71c59ed1
-
SHA1
4cc3ae307f9190cdeee59eb43a7e34bf1a379ccd
-
SHA256
d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324
-
SHA512
3c1722e62292f1c506abdb37dbe799270d509e4a524b422688b159e01e2e3eed777c476206c7a2b15e1d1ecef75b440707e85b24eccfdc1d674c1dd5f768fb56
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeL:R4wFHoSHYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-98-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1324-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-201-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2784-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-313-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1900-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-325-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2840-342-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2256-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/492-910-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-1164-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2296-9241-0x0000000076D30000-0x0000000076E4F000-memory.dmp family_blackmoon behavioral1/memory/2296-9745-0x0000000076D30000-0x0000000076E4F000-memory.dmp family_blackmoon behavioral1/memory/2296-10756-0x0000000076D30000-0x0000000076E4F000-memory.dmp family_blackmoon behavioral1/memory/2296-11764-0x0000000076D30000-0x0000000076E4F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2052 nhtnbb.exe 1196 ffxlllr.exe 2580 hbthbh.exe 2464 vdpvd.exe 2204 nhthtb.exe 2988 5jvjv.exe 2848 rrrfrfr.exe 2896 bbnthb.exe 2772 pjdjj.exe 2604 tnnnbt.exe 2724 bthnbn.exe 2300 dvpvp.exe 1512 rrfxlrx.exe 108 ddppd.exe 1636 lrxrffl.exe 1140 3rfrxxf.exe 2504 3vjvd.exe 2368 thbtbb.exe 832 vjvvd.exe 1324 btntbb.exe 2700 nhbtbb.exe 580 dvjpp.exe 2208 rlxxflf.exe 3032 7jjvp.exe 3000 djjvj.exe 2784 lxllrrx.exe 1432 hbnntb.exe 2340 lrxrlff.exe 2428 hhthnt.exe 564 pjpjp.exe 2156 7xlxflr.exe 1908 nhthtt.exe 896 7djjp.exe 2056 5fxxllr.exe 1844 hbbhnn.exe 1588 tttbht.exe 2220 djjdp.exe 1196 xxrrxxf.exe 1964 ffflrfr.exe 1900 tntntt.exe 2732 9jppv.exe 2832 ppjdj.exe 2804 lfxlllx.exe 2840 hthbhh.exe 2256 tnhhbt.exe 2776 pjvjv.exe 2628 xxlffxl.exe 2616 1nthnh.exe 1828 tnhnbb.exe 1976 ddvpd.exe 1700 xllllrr.exe 1484 lfflfrx.exe 1088 tnbtbh.exe 784 jvjjj.exe 1652 vvddv.exe 1344 xrfxfxl.exe 592 3rlrfll.exe 2088 nhhnbb.exe 2672 ppjdd.exe 1640 vpvpd.exe 1948 xrxllfx.exe 1040 xrrrxfx.exe 2460 7ttbbh.exe 2196 pjdjj.exe -
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/2052-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016593-15.dat upx behavioral1/memory/1196-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2052-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000167dc-24.dat upx behavioral1/memory/2580-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c3d-32.dat upx behavioral1/files/0x0007000000016ca2-41.dat upx behavioral1/memory/2204-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd3-49.dat upx behavioral1/files/0x0009000000016cfe-58.dat upx behavioral1/memory/2988-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d0b-67.dat upx behavioral1/files/0x000600000001739a-74.dat upx behavioral1/memory/2896-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001739c-81.dat upx behavioral1/memory/2604-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173aa-92.dat upx behavioral1/memory/2604-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e4-100.dat upx behavioral1/memory/2300-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173fb-108.dat upx behavioral1/files/0x0006000000017403-120.dat upx behavioral1/memory/108-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1512-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017409-126.dat upx behavioral1/memory/1636-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001747b-135.dat upx behavioral1/memory/1140-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001748f-144.dat upx behavioral1/memory/2504-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174ac-152.dat upx behavioral1/files/0x000600000001752f-161.dat upx behavioral1/memory/2368-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1324-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001620e-170.dat upx behavioral1/files/0x001500000001866d-177.dat upx behavioral1/memory/2700-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018690-193.dat upx behavioral1/files/0x0009000000018678-187.dat upx behavioral1/memory/2700-185-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3032-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001879b-203.dat upx behavioral1/memory/2208-200-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00060000000190cd-210.dat upx behavioral1/memory/2784-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190d6-218.dat upx behavioral1/files/0x00050000000191f3-225.dat upx behavioral1/files/0x00050000000191f7-236.dat upx behavioral1/memory/1432-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019218-242.dat upx behavioral1/files/0x0005000000019229-251.dat upx behavioral1/files/0x0005000000019234-258.dat upx behavioral1/files/0x000500000001924c-265.dat upx behavioral1/memory/896-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-300-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2052 2168 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 30 PID 2168 wrote to memory of 2052 2168 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 30 PID 2168 wrote to memory of 2052 2168 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 30 PID 2168 wrote to memory of 2052 2168 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 30 PID 2052 wrote to memory of 1196 2052 nhtnbb.exe 31 PID 2052 wrote to memory of 1196 2052 nhtnbb.exe 31 PID 2052 wrote to memory of 1196 2052 nhtnbb.exe 31 PID 2052 wrote to memory of 1196 2052 nhtnbb.exe 31 PID 1196 wrote to memory of 2580 1196 ffxlllr.exe 32 PID 1196 wrote to memory of 2580 1196 ffxlllr.exe 32 PID 1196 wrote to memory of 2580 1196 ffxlllr.exe 32 PID 1196 wrote to memory of 2580 1196 ffxlllr.exe 32 PID 2580 wrote to memory of 2464 2580 hbthbh.exe 33 PID 2580 wrote to memory of 2464 2580 hbthbh.exe 33 PID 2580 wrote to memory of 2464 2580 hbthbh.exe 33 PID 2580 wrote to memory of 2464 2580 hbthbh.exe 33 PID 2464 wrote to memory of 2204 2464 vdpvd.exe 34 PID 2464 wrote to memory of 2204 2464 vdpvd.exe 34 PID 2464 wrote to memory of 2204 2464 vdpvd.exe 34 PID 2464 wrote to memory of 2204 2464 vdpvd.exe 34 PID 2204 wrote to memory of 2988 2204 nhthtb.exe 35 PID 2204 wrote to memory of 2988 2204 nhthtb.exe 35 PID 2204 wrote to memory of 2988 2204 nhthtb.exe 35 PID 2204 wrote to memory of 2988 2204 nhthtb.exe 35 PID 2988 wrote to memory of 2848 2988 5jvjv.exe 36 PID 2988 wrote to memory of 2848 2988 5jvjv.exe 36 PID 2988 wrote to memory of 2848 2988 5jvjv.exe 36 PID 2988 wrote to memory of 2848 2988 5jvjv.exe 36 PID 2848 wrote to memory of 2896 2848 rrrfrfr.exe 37 PID 2848 wrote to memory of 2896 2848 rrrfrfr.exe 37 PID 2848 wrote to memory of 2896 2848 rrrfrfr.exe 37 PID 2848 wrote to memory of 2896 2848 rrrfrfr.exe 37 PID 2896 wrote to memory of 2772 2896 bbnthb.exe 38 PID 2896 wrote to memory of 2772 2896 bbnthb.exe 38 PID 2896 wrote to memory of 2772 2896 bbnthb.exe 38 PID 2896 wrote to memory of 2772 2896 bbnthb.exe 38 PID 2772 wrote to memory of 2604 2772 pjdjj.exe 39 PID 2772 wrote to memory of 2604 2772 pjdjj.exe 39 PID 2772 wrote to memory of 2604 2772 pjdjj.exe 39 PID 2772 wrote to memory of 2604 2772 pjdjj.exe 39 PID 2604 wrote to memory of 2724 2604 tnnnbt.exe 40 PID 2604 wrote to memory of 2724 2604 tnnnbt.exe 40 PID 2604 wrote to memory of 2724 2604 tnnnbt.exe 40 PID 2604 wrote to memory of 2724 2604 tnnnbt.exe 40 PID 2724 wrote to memory of 2300 2724 bthnbn.exe 41 PID 2724 wrote to memory of 2300 2724 bthnbn.exe 41 PID 2724 wrote to memory of 2300 2724 bthnbn.exe 41 PID 2724 wrote to memory of 2300 2724 bthnbn.exe 41 PID 2300 wrote to memory of 1512 2300 dvpvp.exe 42 PID 2300 wrote to memory of 1512 2300 dvpvp.exe 42 PID 2300 wrote to memory of 1512 2300 dvpvp.exe 42 PID 2300 wrote to memory of 1512 2300 dvpvp.exe 42 PID 1512 wrote to memory of 108 1512 rrfxlrx.exe 43 PID 1512 wrote to memory of 108 1512 rrfxlrx.exe 43 PID 1512 wrote to memory of 108 1512 rrfxlrx.exe 43 PID 1512 wrote to memory of 108 1512 rrfxlrx.exe 43 PID 108 wrote to memory of 1636 108 ddppd.exe 44 PID 108 wrote to memory of 1636 108 ddppd.exe 44 PID 108 wrote to memory of 1636 108 ddppd.exe 44 PID 108 wrote to memory of 1636 108 ddppd.exe 44 PID 1636 wrote to memory of 1140 1636 lrxrffl.exe 45 PID 1636 wrote to memory of 1140 1636 lrxrffl.exe 45 PID 1636 wrote to memory of 1140 1636 lrxrffl.exe 45 PID 1636 wrote to memory of 1140 1636 lrxrffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe"C:\Users\Admin\AppData\Local\Temp\d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nhtnbb.exec:\nhtnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ffxlllr.exec:\ffxlllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\hbthbh.exec:\hbthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\vdpvd.exec:\vdpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nhthtb.exec:\nhthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5jvjv.exec:\5jvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bbnthb.exec:\bbnthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pjdjj.exec:\pjdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tnnnbt.exec:\tnnnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\bthnbn.exec:\bthnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dvpvp.exec:\dvpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\rrfxlrx.exec:\rrfxlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\ddppd.exec:\ddppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\lrxrffl.exec:\lrxrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3rfrxxf.exec:\3rfrxxf.exe17⤵
- Executes dropped EXE
PID:1140 -
\??\c:\3vjvd.exec:\3vjvd.exe18⤵
- Executes dropped EXE
PID:2504 -
\??\c:\thbtbb.exec:\thbtbb.exe19⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vjvvd.exec:\vjvvd.exe20⤵
- Executes dropped EXE
PID:832 -
\??\c:\btntbb.exec:\btntbb.exe21⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nhbtbb.exec:\nhbtbb.exe22⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvjpp.exec:\dvjpp.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\rlxxflf.exec:\rlxxflf.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7jjvp.exec:\7jjvp.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\djjvj.exec:\djjvj.exe26⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lxllrrx.exec:\lxllrrx.exe27⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbnntb.exec:\hbnntb.exe28⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lrxrlff.exec:\lrxrlff.exe29⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hhthnt.exec:\hhthnt.exe30⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pjpjp.exec:\pjpjp.exe31⤵
- Executes dropped EXE
PID:564 -
\??\c:\7xlxflr.exec:\7xlxflr.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nhthtt.exec:\nhthtt.exe33⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7djjp.exec:\7djjp.exe34⤵
- Executes dropped EXE
PID:896 -
\??\c:\5fxxllr.exec:\5fxxllr.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hbbhnn.exec:\hbbhnn.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\tttbht.exec:\tttbht.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\djjdp.exec:\djjdp.exe38⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe39⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ffflrfr.exec:\ffflrfr.exe40⤵
- Executes dropped EXE
PID:1964 -
\??\c:\tntntt.exec:\tntntt.exe41⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9jppv.exec:\9jppv.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ppjdj.exec:\ppjdj.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lfxlllx.exec:\lfxlllx.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hthbhh.exec:\hthbhh.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnhhbt.exec:\tnhhbt.exe46⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pjvjv.exec:\pjvjv.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxlffxl.exec:\xxlffxl.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1nthnh.exec:\1nthnh.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnhnbb.exec:\tnhnbb.exe50⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ddvpd.exec:\ddvpd.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xllllrr.exec:\xllllrr.exe52⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lfflfrx.exec:\lfflfrx.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tnbtbh.exec:\tnbtbh.exe54⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jvjjj.exec:\jvjjj.exe55⤵
- Executes dropped EXE
PID:784 -
\??\c:\vvddv.exec:\vvddv.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xrfxfxl.exec:\xrfxfxl.exe57⤵
- Executes dropped EXE
PID:1344 -
\??\c:\3rlrfll.exec:\3rlrfll.exe58⤵
- Executes dropped EXE
PID:592 -
\??\c:\nhhnbb.exec:\nhhnbb.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ppjdd.exec:\ppjdd.exe60⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vpvpd.exec:\vpvpd.exe61⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xrxllfx.exec:\xrxllfx.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xrrrxfx.exec:\xrrrxfx.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7ttbbh.exec:\7ttbbh.exe64⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjdjj.exec:\pjdjj.exe65⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pjddd.exec:\pjddd.exe66⤵PID:2136
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe67⤵PID:580
-
\??\c:\7rffrxl.exec:\7rffrxl.exe68⤵PID:620
-
\??\c:\tnntbb.exec:\tnntbb.exe69⤵PID:876
-
\??\c:\5pvjd.exec:\5pvjd.exe70⤵PID:2996
-
\??\c:\vppjp.exec:\vppjp.exe71⤵PID:2692
-
\??\c:\1rlfffr.exec:\1rlfffr.exe72⤵PID:820
-
\??\c:\5rffllr.exec:\5rffllr.exe73⤵PID:1080
-
\??\c:\thhtbn.exec:\thhtbn.exe74⤵PID:924
-
\??\c:\7dvjv.exec:\7dvjv.exe75⤵PID:752
-
\??\c:\ddvdv.exec:\ddvdv.exe76⤵PID:2524
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe77⤵PID:2132
-
\??\c:\llflffl.exec:\llflffl.exe78⤵PID:2228
-
\??\c:\hnhtht.exec:\hnhtht.exe79⤵PID:536
-
\??\c:\dvjjv.exec:\dvjjv.exe80⤵PID:2180
-
\??\c:\dvvvd.exec:\dvvvd.exe81⤵PID:1908
-
\??\c:\ffrlxxl.exec:\ffrlxxl.exe82⤵PID:1836
-
\??\c:\lfxxllx.exec:\lfxxllx.exe83⤵PID:1996
-
\??\c:\btnbhn.exec:\btnbhn.exe84⤵PID:1564
-
\??\c:\1vjjp.exec:\1vjjp.exe85⤵PID:2356
-
\??\c:\pvjvp.exec:\pvjvp.exe86⤵PID:2360
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe87⤵PID:2140
-
\??\c:\nhhntb.exec:\nhhntb.exe88⤵PID:1196
-
\??\c:\3tntnb.exec:\3tntnb.exe89⤵PID:1164
-
\??\c:\7vpvv.exec:\7vpvv.exe90⤵PID:1900
-
\??\c:\lfxrxfl.exec:\lfxrxfl.exe91⤵PID:2828
-
\??\c:\fxlxfff.exec:\fxlxfff.exe92⤵PID:2204
-
\??\c:\5bbbhn.exec:\5bbbhn.exe93⤵PID:2736
-
\??\c:\5bnntt.exec:\5bnntt.exe94⤵PID:2720
-
\??\c:\3dvvd.exec:\3dvvd.exe95⤵PID:2640
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe96⤵PID:2740
-
\??\c:\1xllrlr.exec:\1xllrlr.exe97⤵PID:2600
-
\??\c:\tnhtbb.exec:\tnhtbb.exe98⤵PID:2796
-
\??\c:\thtntt.exec:\thtntt.exe99⤵PID:2620
-
\??\c:\dvpdj.exec:\dvpdj.exe100⤵PID:3064
-
\??\c:\fxxflxl.exec:\fxxflxl.exe101⤵PID:1976
-
\??\c:\9hbhhn.exec:\9hbhhn.exe102⤵PID:844
-
\??\c:\1bthhn.exec:\1bthhn.exe103⤵PID:1728
-
\??\c:\vjvdd.exec:\vjvdd.exe104⤵PID:1972
-
\??\c:\jjdjd.exec:\jjdjd.exe105⤵PID:108
-
\??\c:\xrffrlr.exec:\xrffrlr.exe106⤵PID:1076
-
\??\c:\rfxrxrx.exec:\rfxrxrx.exe107⤵PID:532
-
\??\c:\9btbhn.exec:\9btbhn.exe108⤵PID:880
-
\??\c:\vpjvj.exec:\vpjvj.exe109⤵PID:2592
-
\??\c:\vpppd.exec:\vpppd.exe110⤵PID:1840
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe111⤵PID:1848
-
\??\c:\xrrllrx.exec:\xrrllrx.exe112⤵PID:1496
-
\??\c:\bthntn.exec:\bthntn.exe113⤵PID:2948
-
\??\c:\5jvpv.exec:\5jvpv.exe114⤵PID:2084
-
\??\c:\jjjjp.exec:\jjjjp.exe115⤵PID:572
-
\??\c:\rxlfrrx.exec:\rxlfrrx.exe116⤵PID:2376
-
\??\c:\thttbt.exec:\thttbt.exe117⤵PID:856
-
\??\c:\bnbhnn.exec:\bnbhnn.exe118⤵PID:2028
-
\??\c:\pjvpv.exec:\pjvpv.exe119⤵PID:340
-
\??\c:\vvpdp.exec:\vvpdp.exe120⤵
- System Location Discovery: System Language Discovery
PID:2992 -
\??\c:\7xrxxll.exec:\7xrxxll.exe121⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-