Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe
-
Size
454KB
-
MD5
26946031d86409d8811b1257cd90055d
-
SHA1
cf502ac452b5df12cdddd245645dbdfeee4278be
-
SHA256
d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c
-
SHA512
b1722659d5c5e730050d06881b7b9d6f938cb8bfc2bd2b9798ee96d664a5c786fb5fda35a9e3ad927a0663989b5ab7284b8e385ca3cc09a65f549077b748fd49
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2544-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-51-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2796-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-171-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2416-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-680-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2940-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2348 rlrrrff.exe 680 rlxxffx.exe 2504 jdppp.exe 1392 1frrxxl.exe 2788 9hbhtb.exe 2744 7dvjp.exe 2796 pdddd.exe 2804 jvjjj.exe 2584 xrlrxfl.exe 2756 dvjpj.exe 2100 rfrrxxl.exe 1924 xlrffxr.exe 2488 ttbnbb.exe 2644 xxlxllx.exe 2408 7htnnn.exe 1384 pjpdd.exe 1016 rlxfrfr.exe 2928 3nhhht.exe 2904 dpdpj.exe 2416 ddvpd.exe 2156 bthbhh.exe 444 pppdp.exe 2972 rxxfrfr.exe 1500 3nbbhn.exe 2064 9bbntn.exe 2556 pjpjv.exe 2120 dvdjp.exe 556 1fxrxfr.exe 1916 dpjpj.exe 1416 rxfxlrr.exe 1568 7xxlrfx.exe 2124 9jdjv.exe 1512 rlxfxfr.exe 680 nhhnbn.exe 2900 jjdjp.exe 2728 ffflxfr.exe 2808 bbntnt.exe 2896 1pdvv.exe 3008 vvvjv.exe 2620 llfrlrl.exe 2420 9nhntb.exe 2592 vpvdj.exe 2604 9vpvj.exe 2908 rxrfxrf.exe 1656 3nbtbh.exe 2648 vdpjp.exe 1688 xrfrflx.exe 2116 rlxfxfl.exe 1256 ttnnnt.exe 2484 vddpv.exe 1552 flflfrl.exe 2356 xrflxfx.exe 1592 bthntb.exe 2676 ddvvp.exe 792 lfxfrxf.exe 2988 1xllflx.exe 2684 bthhtb.exe 2268 ddpjd.exe 2184 jdvdp.exe 1432 xlfxxfl.exe 2976 5btbhh.exe 1732 1vdpj.exe 1160 ppjvv.exe 1208 xxfxlxx.exe -
resource yara_rule behavioral1/memory/2544-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-1167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-1267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-1293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-1306-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2348 2544 d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe 30 PID 2544 wrote to memory of 2348 2544 d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe 30 PID 2544 wrote to memory of 2348 2544 d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe 30 PID 2544 wrote to memory of 2348 2544 d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe 30 PID 2348 wrote to memory of 680 2348 rlrrrff.exe 31 PID 2348 wrote to memory of 680 2348 rlrrrff.exe 31 PID 2348 wrote to memory of 680 2348 rlrrrff.exe 31 PID 2348 wrote to memory of 680 2348 rlrrrff.exe 31 PID 680 wrote to memory of 2504 680 rlxxffx.exe 32 PID 680 wrote to memory of 2504 680 rlxxffx.exe 32 PID 680 wrote to memory of 2504 680 rlxxffx.exe 32 PID 680 wrote to memory of 2504 680 rlxxffx.exe 32 PID 2504 wrote to memory of 1392 2504 jdppp.exe 33 PID 2504 wrote to memory of 1392 2504 jdppp.exe 33 PID 2504 wrote to memory of 1392 2504 jdppp.exe 33 PID 2504 wrote to memory of 1392 2504 jdppp.exe 33 PID 1392 wrote to memory of 2788 1392 1frrxxl.exe 34 PID 1392 wrote to memory of 2788 1392 1frrxxl.exe 34 PID 1392 wrote to memory of 2788 1392 1frrxxl.exe 34 PID 1392 wrote to memory of 2788 1392 1frrxxl.exe 34 PID 2788 wrote to memory of 2744 2788 9hbhtb.exe 35 PID 2788 wrote to memory of 2744 2788 9hbhtb.exe 35 PID 2788 wrote to memory of 2744 2788 9hbhtb.exe 35 PID 2788 wrote to memory of 2744 2788 9hbhtb.exe 35 PID 2744 wrote to memory of 2796 2744 7dvjp.exe 37 PID 2744 wrote to memory of 2796 2744 7dvjp.exe 37 PID 2744 wrote to memory of 2796 2744 7dvjp.exe 37 PID 2744 wrote to memory of 2796 2744 7dvjp.exe 37 PID 2796 wrote to memory of 2804 2796 pdddd.exe 38 PID 2796 wrote to memory of 2804 2796 pdddd.exe 38 PID 2796 wrote to memory of 2804 2796 pdddd.exe 38 PID 2796 wrote to memory of 2804 2796 pdddd.exe 38 PID 2804 wrote to memory of 2584 2804 jvjjj.exe 39 PID 2804 wrote to memory of 2584 2804 jvjjj.exe 39 PID 2804 wrote to memory of 2584 2804 jvjjj.exe 39 PID 2804 wrote to memory of 2584 2804 jvjjj.exe 39 PID 2584 wrote to memory of 2756 2584 xrlrxfl.exe 40 PID 2584 wrote to memory of 2756 2584 xrlrxfl.exe 40 PID 2584 wrote to memory of 2756 2584 xrlrxfl.exe 40 PID 2584 wrote to memory of 2756 2584 xrlrxfl.exe 40 PID 2756 wrote to memory of 2100 2756 dvjpj.exe 41 PID 2756 wrote to memory of 2100 2756 dvjpj.exe 41 PID 2756 wrote to memory of 2100 2756 dvjpj.exe 41 PID 2756 wrote to memory of 2100 2756 dvjpj.exe 41 PID 2100 wrote to memory of 1924 2100 rfrrxxl.exe 42 PID 2100 wrote to memory of 1924 2100 rfrrxxl.exe 42 PID 2100 wrote to memory of 1924 2100 rfrrxxl.exe 42 PID 2100 wrote to memory of 1924 2100 rfrrxxl.exe 42 PID 1924 wrote to memory of 2488 1924 xlrffxr.exe 43 PID 1924 wrote to memory of 2488 1924 xlrffxr.exe 43 PID 1924 wrote to memory of 2488 1924 xlrffxr.exe 43 PID 1924 wrote to memory of 2488 1924 xlrffxr.exe 43 PID 2488 wrote to memory of 2644 2488 ttbnbb.exe 44 PID 2488 wrote to memory of 2644 2488 ttbnbb.exe 44 PID 2488 wrote to memory of 2644 2488 ttbnbb.exe 44 PID 2488 wrote to memory of 2644 2488 ttbnbb.exe 44 PID 2644 wrote to memory of 2408 2644 xxlxllx.exe 45 PID 2644 wrote to memory of 2408 2644 xxlxllx.exe 45 PID 2644 wrote to memory of 2408 2644 xxlxllx.exe 45 PID 2644 wrote to memory of 2408 2644 xxlxllx.exe 45 PID 2408 wrote to memory of 1384 2408 7htnnn.exe 46 PID 2408 wrote to memory of 1384 2408 7htnnn.exe 46 PID 2408 wrote to memory of 1384 2408 7htnnn.exe 46 PID 2408 wrote to memory of 1384 2408 7htnnn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe"C:\Users\Admin\AppData\Local\Temp\d0cf433627eb145069e89bdb195692db138c362627f14be8e25f3c83b878ed1c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rlrrrff.exec:\rlrrrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rlxxffx.exec:\rlxxffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\jdppp.exec:\jdppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\1frrxxl.exec:\1frrxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\9hbhtb.exec:\9hbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7dvjp.exec:\7dvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pdddd.exec:\pdddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jvjjj.exec:\jvjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\dvjpj.exec:\dvjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xlrffxr.exec:\xlrffxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\ttbnbb.exec:\ttbnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xxlxllx.exec:\xxlxllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7htnnn.exec:\7htnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pjpdd.exec:\pjpdd.exe17⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rlxfrfr.exec:\rlxfrfr.exe18⤵
- Executes dropped EXE
PID:1016 -
\??\c:\3nhhht.exec:\3nhhht.exe19⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpdpj.exec:\dpdpj.exe20⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ddvpd.exec:\ddvpd.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bthbhh.exec:\bthbhh.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pppdp.exec:\pppdp.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\rxxfrfr.exec:\rxxfrfr.exe24⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3nbbhn.exec:\3nbbhn.exe25⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9bbntn.exec:\9bbntn.exe26⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjpjv.exec:\pjpjv.exe27⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvdjp.exec:\dvdjp.exe28⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1fxrxfr.exec:\1fxrxfr.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\dpjpj.exec:\dpjpj.exe30⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rxfxlrr.exec:\rxfxlrr.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7xxlrfx.exec:\7xxlrfx.exe32⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9jdjv.exec:\9jdjv.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nhhnbn.exec:\nhhnbn.exe35⤵
- Executes dropped EXE
PID:680 -
\??\c:\jjdjp.exec:\jjdjp.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ffflxfr.exec:\ffflxfr.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bbntnt.exec:\bbntnt.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1pdvv.exec:\1pdvv.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvvjv.exec:\vvvjv.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\llfrlrl.exec:\llfrlrl.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\9nhntb.exec:\9nhntb.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vpvdj.exec:\vpvdj.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9vpvj.exec:\9vpvj.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rxrfxrf.exec:\rxrfxrf.exe45⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3nbtbh.exec:\3nbtbh.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vdpjp.exec:\vdpjp.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrfrflx.exec:\xrfrflx.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe49⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ttnnnt.exec:\ttnnnt.exe50⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vddpv.exec:\vddpv.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\flflfrl.exec:\flflfrl.exe52⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrflxfx.exec:\xrflxfx.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bthntb.exec:\bthntb.exe54⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ddvvp.exec:\ddvvp.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe56⤵
- Executes dropped EXE
PID:792 -
\??\c:\1xllflx.exec:\1xllflx.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bthhtb.exec:\bthhtb.exe58⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ddpjd.exec:\ddpjd.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdvdp.exec:\jdvdp.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xlfxxfl.exec:\xlfxxfl.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5btbhh.exec:\5btbhh.exe62⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1vdpj.exec:\1vdpj.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ppjvv.exec:\ppjvv.exe64⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xxfxlxx.exec:\xxfxlxx.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\7llrffx.exec:\7llrffx.exe66⤵PID:1652
-
\??\c:\nhnnhh.exec:\nhnnhh.exe67⤵
- System Location Discovery: System Language Discovery
PID:1460 -
\??\c:\vpjvj.exec:\vpjvj.exe68⤵PID:2136
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe69⤵PID:352
-
\??\c:\lffxlrl.exec:\lffxlrl.exe70⤵PID:2248
-
\??\c:\9htbnn.exec:\9htbnn.exe71⤵PID:1020
-
\??\c:\pppdv.exec:\pppdv.exe72⤵PID:324
-
\??\c:\ddpdj.exec:\ddpdj.exe73⤵PID:2440
-
\??\c:\rlxxffr.exec:\rlxxffr.exe74⤵PID:1576
-
\??\c:\nnnbnn.exec:\nnnbnn.exe75⤵PID:2124
-
\??\c:\5tnbnt.exec:\5tnbnt.exe76⤵PID:1712
-
\??\c:\djjpd.exec:\djjpd.exe77⤵PID:1492
-
\??\c:\fxrxflr.exec:\fxrxflr.exe78⤵PID:2316
-
\??\c:\nhttbb.exec:\nhttbb.exe79⤵PID:1392
-
\??\c:\hbhnbh.exec:\hbhnbh.exe80⤵PID:2716
-
\??\c:\vvjvp.exec:\vvjvp.exe81⤵PID:2736
-
\??\c:\5rlrlrr.exec:\5rlrlrr.exe82⤵PID:3008
-
\??\c:\tnnnhh.exec:\tnnnhh.exe83⤵PID:2704
-
\??\c:\hbtbbb.exec:\hbtbbb.exe84⤵PID:2420
-
\??\c:\jjdvj.exec:\jjdvj.exe85⤵PID:2592
-
\??\c:\jppvj.exec:\jppvj.exe86⤵PID:2208
-
\??\c:\llfrffx.exec:\llfrffx.exe87⤵PID:2340
-
\??\c:\tnbhtb.exec:\tnbhtb.exe88⤵PID:1768
-
\??\c:\bbthtb.exec:\bbthtb.exe89⤵PID:2844
-
\??\c:\pdvjp.exec:\pdvjp.exe90⤵PID:2488
-
\??\c:\xrlrllf.exec:\xrlrllf.exe91⤵PID:2860
-
\??\c:\nnntbn.exec:\nnntbn.exe92⤵PID:1720
-
\??\c:\bthnbh.exec:\bthnbh.exe93⤵PID:1380
-
\??\c:\dpjjv.exec:\dpjjv.exe94⤵PID:1892
-
\??\c:\pjvdj.exec:\pjvdj.exe95⤵PID:2940
-
\??\c:\rlfrlrf.exec:\rlfrlrf.exe96⤵PID:1592
-
\??\c:\bnhnbh.exec:\bnhnbh.exe97⤵PID:2912
-
\??\c:\1jvpd.exec:\1jvpd.exe98⤵PID:2920
-
\??\c:\jjdpj.exec:\jjdpj.exe99⤵PID:2552
-
\??\c:\rrlfllx.exec:\rrlfllx.exe100⤵PID:2416
-
\??\c:\bhthth.exec:\bhthth.exe101⤵PID:2396
-
\??\c:\vjddp.exec:\vjddp.exe102⤵PID:1244
-
\??\c:\jdpvj.exec:\jdpvj.exe103⤵PID:668
-
\??\c:\xlxfrxr.exec:\xlxfrxr.exe104⤵PID:2568
-
\??\c:\tnbbbt.exec:\tnbbbt.exe105⤵PID:824
-
\??\c:\dvvdj.exec:\dvvdj.exe106⤵PID:768
-
\??\c:\dvpvp.exec:\dvpvp.exe107⤵PID:1608
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe108⤵PID:1756
-
\??\c:\bhtbnn.exec:\bhtbnn.exe109⤵PID:2120
-
\??\c:\nhtntt.exec:\nhtntt.exe110⤵PID:2352
-
\??\c:\dvjjd.exec:\dvjjd.exe111⤵PID:804
-
\??\c:\7rflfrx.exec:\7rflfrx.exe112⤵PID:876
-
\??\c:\thbhtb.exec:\thbhtb.exe113⤵PID:1416
-
\??\c:\hhbnhn.exec:\hhbnhn.exe114⤵PID:2348
-
\??\c:\jpddp.exec:\jpddp.exe115⤵PID:2292
-
\??\c:\lxxrrrf.exec:\lxxrrrf.exe116⤵PID:2124
-
\??\c:\7hthtt.exec:\7hthtt.exe117⤵PID:1712
-
\??\c:\btntbh.exec:\btntbh.exe118⤵PID:2376
-
\??\c:\ppdjv.exec:\ppdjv.exe119⤵PID:2256
-
\??\c:\fffrflx.exec:\fffrflx.exe120⤵PID:2732
-
\??\c:\rlrflll.exec:\rlrflll.exe121⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-