Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe
Resource
win7-20240903-en
General
-
Target
56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe
-
Size
455KB
-
MD5
e335c5e0d5274bad2367ea221fbf71f9
-
SHA1
7d24e398c729d3e9c137b495e33d73de0413ef64
-
SHA256
56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172
-
SHA512
d8825d1f6e2d3679cbbaa6a17fbaf627aeb3596addac12535ec85786fbd57f68942933653f4e2c7a58a22469e924a41475f10f53b903222e073264ec460b5b7c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4300-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-1384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-1680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4680 djjdv.exe 3680 rlfxxrx.exe 1972 ntbtnh.exe 4676 vpvvv.exe 4016 pddvj.exe 2360 frrlfxx.exe 1700 bhhbtt.exe 2608 nnntnt.exe 4976 pdjdv.exe 4456 3xxrlfl.exe 1168 frlfxxr.exe 2104 7htbth.exe 3392 9vpjv.exe 928 7xlfxxr.exe 5096 flrlfxr.exe 5012 tnnhbt.exe 1656 9dpdp.exe 3112 flrfxrl.exe 1632 frxrfxx.exe 4648 hhtbhn.exe 3324 pjjdv.exe 3492 pdjdv.exe 3544 lflxxlf.exe 448 7btnhh.exe 3724 9tbbtb.exe 3668 ppdvv.exe 3616 rfrllff.exe 4004 nhhhhb.exe 3136 btnhbn.exe 944 jdvpj.exe 2832 lfrlrlf.exe 2648 rlrfxrl.exe 212 7tthbb.exe 8 vdjvp.exe 2084 rflxrxr.exe 4816 rxrxlrl.exe 3528 tntnbt.exe 4712 jpdvj.exe 1780 vvddv.exe 2796 1lrxrfx.exe 2112 tbnbtn.exe 920 9hnhhh.exe 4548 5vvjd.exe 4348 xxfxrrl.exe 4292 hntnbb.exe 1720 nhbnnb.exe 4416 3vdvv.exe 1248 fxflfxr.exe 2456 llllflf.exe 3680 hbtntn.exe 4704 ppvvp.exe 1408 7lrxxlf.exe 3688 frrlffx.exe 3124 tnhtnn.exe 4736 ddjdv.exe 4468 pjjdv.exe 1744 rxrxlfr.exe 3600 ttbthh.exe 3732 dpvdp.exe 4352 frrrllf.exe 2040 hntnhh.exe 884 btthnt.exe 928 jvjdp.exe 1952 lfllrrl.exe -
resource yara_rule behavioral2/memory/4300-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-901-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 4680 4300 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 82 PID 4300 wrote to memory of 4680 4300 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 82 PID 4300 wrote to memory of 4680 4300 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 82 PID 4680 wrote to memory of 3680 4680 djjdv.exe 131 PID 4680 wrote to memory of 3680 4680 djjdv.exe 131 PID 4680 wrote to memory of 3680 4680 djjdv.exe 131 PID 3680 wrote to memory of 1972 3680 rlfxxrx.exe 84 PID 3680 wrote to memory of 1972 3680 rlfxxrx.exe 84 PID 3680 wrote to memory of 1972 3680 rlfxxrx.exe 84 PID 1972 wrote to memory of 4676 1972 ntbtnh.exe 85 PID 1972 wrote to memory of 4676 1972 ntbtnh.exe 85 PID 1972 wrote to memory of 4676 1972 ntbtnh.exe 85 PID 4676 wrote to memory of 4016 4676 vpvvv.exe 86 PID 4676 wrote to memory of 4016 4676 vpvvv.exe 86 PID 4676 wrote to memory of 4016 4676 vpvvv.exe 86 PID 4016 wrote to memory of 2360 4016 pddvj.exe 87 PID 4016 wrote to memory of 2360 4016 pddvj.exe 87 PID 4016 wrote to memory of 2360 4016 pddvj.exe 87 PID 2360 wrote to memory of 1700 2360 frrlfxx.exe 88 PID 2360 wrote to memory of 1700 2360 frrlfxx.exe 88 PID 2360 wrote to memory of 1700 2360 frrlfxx.exe 88 PID 1700 wrote to memory of 2608 1700 bhhbtt.exe 89 PID 1700 wrote to memory of 2608 1700 bhhbtt.exe 89 PID 1700 wrote to memory of 2608 1700 bhhbtt.exe 89 PID 2608 wrote to memory of 4976 2608 nnntnt.exe 90 PID 2608 wrote to memory of 4976 2608 nnntnt.exe 90 PID 2608 wrote to memory of 4976 2608 nnntnt.exe 90 PID 4976 wrote to memory of 4456 4976 pdjdv.exe 91 PID 4976 wrote to memory of 4456 4976 pdjdv.exe 91 PID 4976 wrote to memory of 4456 4976 pdjdv.exe 91 PID 4456 wrote to memory of 1168 4456 3xxrlfl.exe 92 PID 4456 wrote to memory of 1168 4456 3xxrlfl.exe 92 PID 4456 wrote to memory of 1168 4456 3xxrlfl.exe 92 PID 1168 wrote to memory of 2104 1168 frlfxxr.exe 93 PID 1168 wrote to memory of 2104 1168 frlfxxr.exe 93 PID 1168 wrote to memory of 2104 1168 frlfxxr.exe 93 PID 2104 wrote to memory of 3392 2104 7htbth.exe 94 PID 2104 wrote to memory of 3392 2104 7htbth.exe 94 PID 2104 wrote to memory of 3392 2104 7htbth.exe 94 PID 3392 wrote to memory of 928 3392 9vpjv.exe 95 PID 3392 wrote to memory of 928 3392 9vpjv.exe 95 PID 3392 wrote to memory of 928 3392 9vpjv.exe 95 PID 928 wrote to memory of 5096 928 7xlfxxr.exe 96 PID 928 wrote to memory of 5096 928 7xlfxxr.exe 96 PID 928 wrote to memory of 5096 928 7xlfxxr.exe 96 PID 5096 wrote to memory of 5012 5096 flrlfxr.exe 97 PID 5096 wrote to memory of 5012 5096 flrlfxr.exe 97 PID 5096 wrote to memory of 5012 5096 flrlfxr.exe 97 PID 5012 wrote to memory of 1656 5012 tnnhbt.exe 98 PID 5012 wrote to memory of 1656 5012 tnnhbt.exe 98 PID 5012 wrote to memory of 1656 5012 tnnhbt.exe 98 PID 1656 wrote to memory of 3112 1656 9dpdp.exe 99 PID 1656 wrote to memory of 3112 1656 9dpdp.exe 99 PID 1656 wrote to memory of 3112 1656 9dpdp.exe 99 PID 3112 wrote to memory of 1632 3112 flrfxrl.exe 100 PID 3112 wrote to memory of 1632 3112 flrfxrl.exe 100 PID 3112 wrote to memory of 1632 3112 flrfxrl.exe 100 PID 1632 wrote to memory of 4648 1632 frxrfxx.exe 101 PID 1632 wrote to memory of 4648 1632 frxrfxx.exe 101 PID 1632 wrote to memory of 4648 1632 frxrfxx.exe 101 PID 4648 wrote to memory of 3324 4648 hhtbhn.exe 102 PID 4648 wrote to memory of 3324 4648 hhtbhn.exe 102 PID 4648 wrote to memory of 3324 4648 hhtbhn.exe 102 PID 3324 wrote to memory of 3492 3324 pjjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe"C:\Users\Admin\AppData\Local\Temp\56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\djjdv.exec:\djjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\rlfxxrx.exec:\rlfxxrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\ntbtnh.exec:\ntbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vpvvv.exec:\vpvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\pddvj.exec:\pddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\frrlfxx.exec:\frrlfxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bhhbtt.exec:\bhhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\nnntnt.exec:\nnntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pdjdv.exec:\pdjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\3xxrlfl.exec:\3xxrlfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\frlfxxr.exec:\frlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\7htbth.exec:\7htbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9vpjv.exec:\9vpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\7xlfxxr.exec:\7xlfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\flrlfxr.exec:\flrlfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\tnnhbt.exec:\tnnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\9dpdp.exec:\9dpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\flrfxrl.exec:\flrfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\frxrfxx.exec:\frxrfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hhtbhn.exec:\hhtbhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\pjjdv.exec:\pjjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\pdjdv.exec:\pdjdv.exe23⤵
- Executes dropped EXE
PID:3492 -
\??\c:\lflxxlf.exec:\lflxxlf.exe24⤵
- Executes dropped EXE
PID:3544 -
\??\c:\7btnhh.exec:\7btnhh.exe25⤵
- Executes dropped EXE
PID:448 -
\??\c:\9tbbtb.exec:\9tbbtb.exe26⤵
- Executes dropped EXE
PID:3724 -
\??\c:\ppdvv.exec:\ppdvv.exe27⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rfrllff.exec:\rfrllff.exe28⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nhhhhb.exec:\nhhhhb.exe29⤵
- Executes dropped EXE
PID:4004 -
\??\c:\btnhbn.exec:\btnhbn.exe30⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jdvpj.exec:\jdvpj.exe31⤵
- Executes dropped EXE
PID:944 -
\??\c:\lfrlrlf.exec:\lfrlrlf.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rlrfxrl.exec:\rlrfxrl.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7tthbb.exec:\7tthbb.exe34⤵
- Executes dropped EXE
PID:212 -
\??\c:\vdjvp.exec:\vdjvp.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\rflxrxr.exec:\rflxrxr.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxrxlrl.exec:\rxrxlrl.exe37⤵
- Executes dropped EXE
PID:4816 -
\??\c:\tntnbt.exec:\tntnbt.exe38⤵
- Executes dropped EXE
PID:3528 -
\??\c:\jpdvj.exec:\jpdvj.exe39⤵
- Executes dropped EXE
PID:4712 -
\??\c:\vvddv.exec:\vvddv.exe40⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1lrxrfx.exec:\1lrxrfx.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tbnbtn.exec:\tbnbtn.exe42⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9hnhhh.exec:\9hnhhh.exe43⤵
- Executes dropped EXE
PID:920 -
\??\c:\5vvjd.exec:\5vvjd.exe44⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe45⤵
- Executes dropped EXE
PID:4348 -
\??\c:\hntnbb.exec:\hntnbb.exe46⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nhbnnb.exec:\nhbnnb.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3vdvv.exec:\3vdvv.exe48⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fxflfxr.exec:\fxflfxr.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\llllflf.exec:\llllflf.exe50⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbtntn.exec:\hbtntn.exe51⤵
- Executes dropped EXE
PID:3680 -
\??\c:\ppvvp.exec:\ppvvp.exe52⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7lrxxlf.exec:\7lrxxlf.exe53⤵
- Executes dropped EXE
PID:1408 -
\??\c:\frrlffx.exec:\frrlffx.exe54⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tnhtnn.exec:\tnhtnn.exe55⤵
- Executes dropped EXE
PID:3124 -
\??\c:\ddjdv.exec:\ddjdv.exe56⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
PID:4468 -
\??\c:\rxrxlfr.exec:\rxrxlfr.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ttbthh.exec:\ttbthh.exe59⤵
- Executes dropped EXE
PID:3600 -
\??\c:\dpvdp.exec:\dpvdp.exe60⤵
- Executes dropped EXE
PID:3732 -
\??\c:\frrrllf.exec:\frrrllf.exe61⤵
- Executes dropped EXE
PID:4352 -
\??\c:\hntnhh.exec:\hntnhh.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\btthnt.exec:\btthnt.exe63⤵
- Executes dropped EXE
PID:884 -
\??\c:\jvjdp.exec:\jvjdp.exe64⤵
- Executes dropped EXE
PID:928 -
\??\c:\lfllrrl.exec:\lfllrrl.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hnbtnh.exec:\hnbtnh.exe66⤵PID:4020
-
\??\c:\ttbnnn.exec:\ttbnnn.exe67⤵PID:1612
-
\??\c:\jddvp.exec:\jddvp.exe68⤵PID:1964
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe69⤵PID:3008
-
\??\c:\htbtnh.exec:\htbtnh.exe70⤵PID:1492
-
\??\c:\bntbhh.exec:\bntbhh.exe71⤵PID:4156
-
\??\c:\ppdvv.exec:\ppdvv.exe72⤵PID:3492
-
\??\c:\rflfxxr.exec:\rflfxxr.exe73⤵PID:2352
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe74⤵PID:1828
-
\??\c:\thhtnn.exec:\thhtnn.exe75⤵PID:4324
-
\??\c:\xxffxrl.exec:\xxffxrl.exe76⤵PID:4484
-
\??\c:\jjjvv.exec:\jjjvv.exe77⤵PID:748
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe78⤵PID:760
-
\??\c:\7tnhth.exec:\7tnhth.exe79⤵PID:2640
-
\??\c:\pjjpp.exec:\pjjpp.exe80⤵PID:1436
-
\??\c:\rrxrrll.exec:\rrxrrll.exe81⤵PID:1456
-
\??\c:\hhhtnt.exec:\hhhtnt.exe82⤵PID:3608
-
\??\c:\tnttnb.exec:\tnttnb.exe83⤵PID:1592
-
\??\c:\5vjdv.exec:\5vjdv.exe84⤵PID:1412
-
\??\c:\xxxlfxl.exec:\xxxlfxl.exe85⤵PID:4816
-
\??\c:\hhhbtn.exec:\hhhbtn.exe86⤵PID:844
-
\??\c:\dpdvp.exec:\dpdvp.exe87⤵PID:4672
-
\??\c:\xlrrffr.exec:\xlrrffr.exe88⤵PID:2396
-
\??\c:\nbnhhb.exec:\nbnhhb.exe89⤵
- System Location Discovery: System Language Discovery
PID:3728 -
\??\c:\ddvpj.exec:\ddvpj.exe90⤵PID:2300
-
\??\c:\rllflfl.exec:\rllflfl.exe91⤵PID:2576
-
\??\c:\7hnntt.exec:\7hnntt.exe92⤵PID:2020
-
\??\c:\dvvpj.exec:\dvvpj.exe93⤵PID:2596
-
\??\c:\lfllxxx.exec:\lfllxxx.exe94⤵PID:4348
-
\??\c:\ffxxrlf.exec:\ffxxrlf.exe95⤵PID:4140
-
\??\c:\pjpdv.exec:\pjpdv.exe96⤵PID:5048
-
\??\c:\jddvp.exec:\jddvp.exe97⤵PID:3292
-
\??\c:\fxrxrlx.exec:\fxrxrlx.exe98⤵PID:4628
-
\??\c:\hbnhtb.exec:\hbnhtb.exe99⤵PID:2696
-
\??\c:\vdvdv.exec:\vdvdv.exe100⤵PID:4236
-
\??\c:\lxlflff.exec:\lxlflff.exe101⤵PID:4372
-
\??\c:\hhbbnn.exec:\hhbbnn.exe102⤵PID:2212
-
\??\c:\djvpp.exec:\djvpp.exe103⤵PID:2732
-
\??\c:\lflffxf.exec:\lflffxf.exe104⤵
- System Location Discovery: System Language Discovery
PID:4684 -
\??\c:\jjdpj.exec:\jjdpj.exe105⤵PID:4168
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe106⤵PID:2444
-
\??\c:\btnhtb.exec:\btnhtb.exe107⤵PID:4868
-
\??\c:\djjdd.exec:\djjdd.exe108⤵PID:4520
-
\??\c:\flllffx.exec:\flllffx.exe109⤵PID:4808
-
\??\c:\hhhhhh.exec:\hhhhhh.exe110⤵PID:2552
-
\??\c:\nnbhth.exec:\nnbhth.exe111⤵PID:4352
-
\??\c:\ddvpj.exec:\ddvpj.exe112⤵PID:2040
-
\??\c:\lflfffx.exec:\lflfffx.exe113⤵PID:668
-
\??\c:\jpjvp.exec:\jpjvp.exe114⤵PID:5008
-
\??\c:\rllfxrl.exec:\rllfxrl.exe115⤵PID:4968
-
\??\c:\ntbbtt.exec:\ntbbtt.exe116⤵PID:468
-
\??\c:\nhnhbh.exec:\nhnhbh.exe117⤵PID:1760
-
\??\c:\jjpvj.exec:\jjpvj.exe118⤵PID:2228
-
\??\c:\nhhnnn.exec:\nhhnnn.exe119⤵PID:5088
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe120⤵PID:3108
-
\??\c:\7ppjv.exec:\7ppjv.exe121⤵PID:512
-
\??\c:\fllfxxr.exec:\fllfxxr.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-