Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe
-
Size
453KB
-
MD5
a2b37b0e1585822eadc97b6f951dd2b3
-
SHA1
d733f6aa95c724cf7720277b47023dc59b7e3b6f
-
SHA256
aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002
-
SHA512
396950ad88e34b13f2b011e549146710ac26f99d068e6a1d85af85e33cac1fcb7d74b157eb02ba5d1598bdc57e67d3846034c484e8e5ea56b23ba83ea55e09ac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-309-0x0000000077280000-0x000000007739F000-memory.dmp family_blackmoon behavioral1/memory/1516-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-656-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-820-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2996-836-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2268-857-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/696-870-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2660-889-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 7bnnnt.exe 2792 vjdpv.exe 2536 ddpdj.exe 2780 nbhbnn.exe 2552 dvpdd.exe 2528 rffrffl.exe 2648 btbnhh.exe 2308 vjdjd.exe 1900 pjvjd.exe 1168 ddddv.exe 2740 9hbhbn.exe 2304 pjpvp.exe 2744 7btthh.exe 2772 frfrxxf.exe 2936 hbthhb.exe 2492 jdpvd.exe 480 9bnnbh.exe 2176 9dpdp.exe 2216 fxllffr.exe 912 3lxxffl.exe 2040 lrrxrxr.exe 868 jdpvd.exe 1576 9frrflx.exe 1968 vpjpj.exe 1252 5fxfrxl.exe 1016 ddvdp.exe 1732 rlfrxff.exe 2996 nbtbnn.exe 756 jdvdp.exe 2004 rffllll.exe 2388 hbnthh.exe 876 jjvjj.exe 1784 nhnnbb.exe 952 lfxxflx.exe 1516 pjddj.exe 2228 1xrxrrr.exe 2564 hbtnhn.exe 2876 vddjd.exe 2696 1dvvv.exe 2732 rfrxrrx.exe 3028 3hnntt.exe 2576 dvjjj.exe 2648 fffflrx.exe 1624 fxrfrrf.exe 1080 hthhnn.exe 2136 ddvjv.exe 2988 9xrrllr.exe 2972 fffrrlx.exe 1920 nhtnbb.exe 2896 dvjdj.exe 2704 dvvvd.exe 2932 xlffffr.exe 2892 hhbbbn.exe 1556 3pddj.exe 1680 xllrxfl.exe 768 7frlrll.exe 2100 nbhhhh.exe 2324 dpdvd.exe 1564 dvjjv.exe 2992 lfxlxrx.exe 2364 9nhhtt.exe 2416 jdvdv.exe 1760 pjpvj.exe 896 rrflxxf.exe -
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-128-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2744-126-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/480-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-292-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/952-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-656-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2972-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-813-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2224 2196 aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe 30 PID 2196 wrote to memory of 2224 2196 aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe 30 PID 2196 wrote to memory of 2224 2196 aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe 30 PID 2196 wrote to memory of 2224 2196 aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe 30 PID 2224 wrote to memory of 2792 2224 7bnnnt.exe 31 PID 2224 wrote to memory of 2792 2224 7bnnnt.exe 31 PID 2224 wrote to memory of 2792 2224 7bnnnt.exe 31 PID 2224 wrote to memory of 2792 2224 7bnnnt.exe 31 PID 2792 wrote to memory of 2536 2792 vjdpv.exe 32 PID 2792 wrote to memory of 2536 2792 vjdpv.exe 32 PID 2792 wrote to memory of 2536 2792 vjdpv.exe 32 PID 2792 wrote to memory of 2536 2792 vjdpv.exe 32 PID 2536 wrote to memory of 2780 2536 ddpdj.exe 33 PID 2536 wrote to memory of 2780 2536 ddpdj.exe 33 PID 2536 wrote to memory of 2780 2536 ddpdj.exe 33 PID 2536 wrote to memory of 2780 2536 ddpdj.exe 33 PID 2780 wrote to memory of 2552 2780 nbhbnn.exe 34 PID 2780 wrote to memory of 2552 2780 nbhbnn.exe 34 PID 2780 wrote to memory of 2552 2780 nbhbnn.exe 34 PID 2780 wrote to memory of 2552 2780 nbhbnn.exe 34 PID 2552 wrote to memory of 2528 2552 dvpdd.exe 35 PID 2552 wrote to memory of 2528 2552 dvpdd.exe 35 PID 2552 wrote to memory of 2528 2552 dvpdd.exe 35 PID 2552 wrote to memory of 2528 2552 dvpdd.exe 35 PID 2528 wrote to memory of 2648 2528 rffrffl.exe 36 PID 2528 wrote to memory of 2648 2528 rffrffl.exe 36 PID 2528 wrote to memory of 2648 2528 rffrffl.exe 36 PID 2528 wrote to memory of 2648 2528 rffrffl.exe 36 PID 2648 wrote to memory of 2308 2648 btbnhh.exe 37 PID 2648 wrote to memory of 2308 2648 btbnhh.exe 37 PID 2648 wrote to memory of 2308 2648 btbnhh.exe 37 PID 2648 wrote to memory of 2308 2648 btbnhh.exe 37 PID 2308 wrote to memory of 1900 2308 vjdjd.exe 38 PID 2308 wrote to memory of 1900 2308 vjdjd.exe 38 PID 2308 wrote to memory of 1900 2308 vjdjd.exe 38 PID 2308 wrote to memory of 1900 2308 vjdjd.exe 38 PID 1900 wrote to memory of 1168 1900 pjvjd.exe 39 PID 1900 wrote to memory of 1168 1900 pjvjd.exe 39 PID 1900 wrote to memory of 1168 1900 pjvjd.exe 39 PID 1900 wrote to memory of 1168 1900 pjvjd.exe 39 PID 1168 wrote to memory of 2740 1168 ddddv.exe 40 PID 1168 wrote to memory of 2740 1168 ddddv.exe 40 PID 1168 wrote to memory of 2740 1168 ddddv.exe 40 PID 1168 wrote to memory of 2740 1168 ddddv.exe 40 PID 2740 wrote to memory of 2304 2740 9hbhbn.exe 41 PID 2740 wrote to memory of 2304 2740 9hbhbn.exe 41 PID 2740 wrote to memory of 2304 2740 9hbhbn.exe 41 PID 2740 wrote to memory of 2304 2740 9hbhbn.exe 41 PID 2304 wrote to memory of 2744 2304 pjpvp.exe 42 PID 2304 wrote to memory of 2744 2304 pjpvp.exe 42 PID 2304 wrote to memory of 2744 2304 pjpvp.exe 42 PID 2304 wrote to memory of 2744 2304 pjpvp.exe 42 PID 2744 wrote to memory of 2772 2744 7btthh.exe 43 PID 2744 wrote to memory of 2772 2744 7btthh.exe 43 PID 2744 wrote to memory of 2772 2744 7btthh.exe 43 PID 2744 wrote to memory of 2772 2744 7btthh.exe 43 PID 2772 wrote to memory of 2936 2772 frfrxxf.exe 44 PID 2772 wrote to memory of 2936 2772 frfrxxf.exe 44 PID 2772 wrote to memory of 2936 2772 frfrxxf.exe 44 PID 2772 wrote to memory of 2936 2772 frfrxxf.exe 44 PID 2936 wrote to memory of 2492 2936 hbthhb.exe 45 PID 2936 wrote to memory of 2492 2936 hbthhb.exe 45 PID 2936 wrote to memory of 2492 2936 hbthhb.exe 45 PID 2936 wrote to memory of 2492 2936 hbthhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe"C:\Users\Admin\AppData\Local\Temp\aaadec0e582d30469e62c78f7785f81bc18d2d4b571d368ede3c7ced5c4f2002.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\7bnnnt.exec:\7bnnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vjdpv.exec:\vjdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ddpdj.exec:\ddpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\nbhbnn.exec:\nbhbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\dvpdd.exec:\dvpdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\rffrffl.exec:\rffrffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\btbnhh.exec:\btbnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vjdjd.exec:\vjdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\pjvjd.exec:\pjvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\ddddv.exec:\ddddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\9hbhbn.exec:\9hbhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjpvp.exec:\pjpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\7btthh.exec:\7btthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\frfrxxf.exec:\frfrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbthhb.exec:\hbthhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jdpvd.exec:\jdpvd.exe17⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9bnnbh.exec:\9bnnbh.exe18⤵
- Executes dropped EXE
PID:480 -
\??\c:\9dpdp.exec:\9dpdp.exe19⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxllffr.exec:\fxllffr.exe20⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3lxxffl.exec:\3lxxffl.exe21⤵
- Executes dropped EXE
PID:912 -
\??\c:\lrrxrxr.exec:\lrrxrxr.exe22⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdpvd.exec:\jdpvd.exe23⤵
- Executes dropped EXE
PID:868 -
\??\c:\9frrflx.exec:\9frrflx.exe24⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vpjpj.exec:\vpjpj.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5fxfrxl.exec:\5fxfrxl.exe26⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ddvdp.exec:\ddvdp.exe27⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rlfrxff.exec:\rlfrxff.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nbtbnn.exec:\nbtbnn.exe29⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdvdp.exec:\jdvdp.exe30⤵
- Executes dropped EXE
PID:756 -
\??\c:\rffllll.exec:\rffllll.exe31⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbnthh.exec:\hbnthh.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jjvjj.exec:\jjvjj.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\nhnnbb.exec:\nhnnbb.exe34⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lfxxflx.exec:\lfxxflx.exe35⤵
- Executes dropped EXE
PID:952 -
\??\c:\lffflxf.exec:\lffflxf.exe36⤵PID:2788
-
\??\c:\pjddj.exec:\pjddj.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1xrxrrr.exec:\1xrxrrr.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hbtnhn.exec:\hbtnhn.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vddjd.exec:\vddjd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\1dvvv.exec:\1dvvv.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3hnntt.exec:\3hnntt.exe43⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dvjjj.exec:\dvjjj.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fffflrx.exec:\fffflrx.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe46⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hthhnn.exec:\hthhnn.exe47⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ddvjv.exec:\ddvjv.exe48⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9xrrllr.exec:\9xrrllr.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fffrrlx.exec:\fffrrlx.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nhtnbb.exec:\nhtnbb.exe51⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dvjdj.exec:\dvjdj.exe52⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvvvd.exec:\dvvvd.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xlffffr.exec:\xlffffr.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhbbbn.exec:\hhbbbn.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3pddj.exec:\3pddj.exe56⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xllrxfl.exec:\xllrxfl.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7frlrll.exec:\7frlrll.exe58⤵
- Executes dropped EXE
PID:768 -
\??\c:\nbhhhh.exec:\nbhhhh.exe59⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dpdvd.exec:\dpdvd.exe60⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dvjjv.exec:\dvjjv.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lfxlxrx.exec:\lfxlxrx.exe62⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9nhhtt.exec:\9nhhtt.exe63⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jdvdv.exec:\jdvdv.exe64⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjpvj.exec:\pjpvj.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rrflxxf.exec:\rrflxxf.exe66⤵
- Executes dropped EXE
PID:896 -
\??\c:\xfflrrx.exec:\xfflrrx.exe67⤵PID:3024
-
\??\c:\htnhnn.exec:\htnhnn.exe68⤵PID:1648
-
\??\c:\1pjjj.exec:\1pjjj.exe69⤵PID:1456
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe70⤵PID:1728
-
\??\c:\lfxfllr.exec:\lfxfllr.exe71⤵PID:1708
-
\??\c:\nbttnh.exec:\nbttnh.exe72⤵PID:1096
-
\??\c:\pjdpv.exec:\pjdpv.exe73⤵PID:2200
-
\??\c:\dvjvj.exec:\dvjvj.exe74⤵PID:2296
-
\??\c:\rxrfrxl.exec:\rxrfrxl.exe75⤵PID:2404
-
\??\c:\nbnttb.exec:\nbnttb.exe76⤵PID:2276
-
\??\c:\pjjvp.exec:\pjjvp.exe77⤵PID:1500
-
\??\c:\dvdpj.exec:\dvdpj.exe78⤵PID:2464
-
\??\c:\hbthnt.exec:\hbthnt.exe79⤵PID:2632
-
\??\c:\bthtnn.exec:\bthtnn.exe80⤵PID:2844
-
\??\c:\ddjvv.exec:\ddjvv.exe81⤵PID:2652
-
\??\c:\ffxrffr.exec:\ffxrffr.exe82⤵PID:2840
-
\??\c:\1hbnbt.exec:\1hbnbt.exe83⤵PID:2684
-
\??\c:\9nnbnt.exec:\9nnbnt.exe84⤵PID:2568
-
\??\c:\pjdjp.exec:\pjdjp.exe85⤵PID:2544
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe86⤵PID:2532
-
\??\c:\rfllrlr.exec:\rfllrlr.exe87⤵PID:2600
-
\??\c:\3tnnbh.exec:\3tnnbh.exe88⤵PID:1152
-
\??\c:\vpjvj.exec:\vpjvj.exe89⤵PID:1404
-
\??\c:\5rrxflx.exec:\5rrxflx.exe90⤵PID:2760
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe91⤵PID:1900
-
\??\c:\hbbhnt.exec:\hbbhnt.exe92⤵PID:2508
-
\??\c:\vvjjp.exec:\vvjjp.exe93⤵PID:1176
-
\??\c:\llxfffr.exec:\llxfffr.exe94⤵PID:2512
-
\??\c:\5xrxffl.exec:\5xrxffl.exe95⤵PID:2972
-
\??\c:\3tbhtb.exec:\3tbhtb.exe96⤵PID:2764
-
\??\c:\vjvpp.exec:\vjvpp.exe97⤵PID:2896
-
\??\c:\pjvvj.exec:\pjvvj.exe98⤵PID:2888
-
\??\c:\lxlfrxl.exec:\lxlfrxl.exe99⤵PID:2900
-
\??\c:\ttbttt.exec:\ttbttt.exe100⤵PID:1044
-
\??\c:\pjvvj.exec:\pjvvj.exe101⤵PID:1768
-
\??\c:\pvjjv.exec:\pvjjv.exe102⤵PID:2072
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe103⤵PID:2172
-
\??\c:\hhbnth.exec:\hhbnth.exe104⤵PID:3000
-
\??\c:\pjpjj.exec:\pjpjj.exe105⤵PID:2092
-
\??\c:\dvvjd.exec:\dvvjd.exe106⤵PID:1636
-
\??\c:\7rlrffl.exec:\7rlrffl.exe107⤵PID:2040
-
\??\c:\9tnbhn.exec:\9tnbhn.exe108⤵PID:1612
-
\??\c:\7ddjj.exec:\7ddjj.exe109⤵PID:392
-
\??\c:\9lffffr.exec:\9lffffr.exe110⤵PID:1716
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe111⤵PID:1468
-
\??\c:\tnnnhn.exec:\tnnnhn.exe112⤵PID:1648
-
\??\c:\7jpvv.exec:\7jpvv.exe113⤵PID:1972
-
\??\c:\3ppvd.exec:\3ppvd.exe114⤵PID:2260
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe115⤵PID:2996
-
\??\c:\hhhhhh.exec:\hhhhhh.exe116⤵PID:2272
-
\??\c:\pvjvj.exec:\pvjvj.exe117⤵PID:696
-
\??\c:\vppdj.exec:\vppdj.exe118⤵PID:2268
-
\??\c:\frffllf.exec:\frffllf.exe119⤵PID:2440
-
\??\c:\bttbnt.exec:\bttbnt.exe120⤵PID:2316
-
\??\c:\9pppv.exec:\9pppv.exe121⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-