Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe
Resource
win7-20240903-en
General
-
Target
acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe
-
Size
454KB
-
MD5
22d568622f39cb5627b662d060565a13
-
SHA1
34755aa1b7dac6b44272dd6c73270aa45bb8f0dd
-
SHA256
acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e
-
SHA512
e286ea9975bdf996c48da5cb59759ce63591146683840aaaf0f8d49ddf1b211f89b4cde2828c3b0873d75655a30e9a36eb3ebb8e0a86183619e61d7a4e71daa5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1728-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-74-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1552-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-195-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-375-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2444-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-468-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1944-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-730-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1984-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-849-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-875-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2684-906-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-920-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 5ppdd.exe 2700 tnbbtt.exe 2784 dvpjv.exe 2736 hbnntt.exe 2764 9ddjv.exe 2556 hbhnbb.exe 3016 5btbth.exe 1552 vvpjv.exe 348 hbtttt.exe 1020 dddjv.exe 2752 bbttnn.exe 2164 9jvdj.exe 2372 nbnthn.exe 2924 xlfxxfl.exe 2740 bhthbh.exe 2844 vvppd.exe 1716 rxrxlrl.exe 2316 rrfrflf.exe 2192 btthnn.exe 2496 lfxfflx.exe 1924 nbhhhb.exe 2500 pjvpv.exe 1168 xrrxflx.exe 968 nnntbn.exe 1788 3lfrxll.exe 2268 vpjdp.exe 2384 djdpp.exe 2024 3rllrrx.exe 2276 pvpdv.exe 2272 9hbhtb.exe 1884 3vvvj.exe 860 xrlrxfr.exe 2880 ttbtnb.exe 2876 ppdjd.exe 2656 xrrrfxf.exe 2768 5hbtbh.exe 2772 7bntbb.exe 2244 vpddd.exe 2592 fxrxxfl.exe 2720 1bnttt.exe 2556 hbtbnn.exe 2612 jpdvp.exe 3016 lllxxrf.exe 2444 hhbhnt.exe 1096 jjpdp.exe 664 jdvjp.exe 300 lfxfrrr.exe 2128 hhtbnt.exe 2156 ppddj.exe 2860 3pdpv.exe 2908 lllxllx.exe 1676 bbtnhn.exe 2084 jjvjv.exe 2220 9frrflx.exe 2340 lxllrlx.exe 1148 1thttb.exe 1772 7jdvp.exe 112 3xxxflr.exe 1944 9flrrrf.exe 1284 thbthh.exe 1876 pjjjv.exe 2516 llflxlx.exe 1040 tthhbh.exe 1368 ttnntt.exe -
resource yara_rule behavioral1/memory/1728-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2676 1728 acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe 30 PID 1728 wrote to memory of 2676 1728 acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe 30 PID 1728 wrote to memory of 2676 1728 acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe 30 PID 1728 wrote to memory of 2676 1728 acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe 30 PID 2676 wrote to memory of 2700 2676 5ppdd.exe 31 PID 2676 wrote to memory of 2700 2676 5ppdd.exe 31 PID 2676 wrote to memory of 2700 2676 5ppdd.exe 31 PID 2676 wrote to memory of 2700 2676 5ppdd.exe 31 PID 2700 wrote to memory of 2784 2700 tnbbtt.exe 32 PID 2700 wrote to memory of 2784 2700 tnbbtt.exe 32 PID 2700 wrote to memory of 2784 2700 tnbbtt.exe 32 PID 2700 wrote to memory of 2784 2700 tnbbtt.exe 32 PID 2784 wrote to memory of 2736 2784 dvpjv.exe 33 PID 2784 wrote to memory of 2736 2784 dvpjv.exe 33 PID 2784 wrote to memory of 2736 2784 dvpjv.exe 33 PID 2784 wrote to memory of 2736 2784 dvpjv.exe 33 PID 2736 wrote to memory of 2764 2736 hbnntt.exe 34 PID 2736 wrote to memory of 2764 2736 hbnntt.exe 34 PID 2736 wrote to memory of 2764 2736 hbnntt.exe 34 PID 2736 wrote to memory of 2764 2736 hbnntt.exe 34 PID 2764 wrote to memory of 2556 2764 9ddjv.exe 35 PID 2764 wrote to memory of 2556 2764 9ddjv.exe 35 PID 2764 wrote to memory of 2556 2764 9ddjv.exe 35 PID 2764 wrote to memory of 2556 2764 9ddjv.exe 35 PID 2556 wrote to memory of 3016 2556 hbhnbb.exe 36 PID 2556 wrote to memory of 3016 2556 hbhnbb.exe 36 PID 2556 wrote to memory of 3016 2556 hbhnbb.exe 36 PID 2556 wrote to memory of 3016 2556 hbhnbb.exe 36 PID 3016 wrote to memory of 1552 3016 5btbth.exe 37 PID 3016 wrote to memory of 1552 3016 5btbth.exe 37 PID 3016 wrote to memory of 1552 3016 5btbth.exe 37 PID 3016 wrote to memory of 1552 3016 5btbth.exe 37 PID 1552 wrote to memory of 348 1552 vvpjv.exe 38 PID 1552 wrote to memory of 348 1552 vvpjv.exe 38 PID 1552 wrote to memory of 348 1552 vvpjv.exe 38 PID 1552 wrote to memory of 348 1552 vvpjv.exe 38 PID 348 wrote to memory of 1020 348 hbtttt.exe 39 PID 348 wrote to memory of 1020 348 hbtttt.exe 39 PID 348 wrote to memory of 1020 348 hbtttt.exe 39 PID 348 wrote to memory of 1020 348 hbtttt.exe 39 PID 1020 wrote to memory of 2752 1020 dddjv.exe 40 PID 1020 wrote to memory of 2752 1020 dddjv.exe 40 PID 1020 wrote to memory of 2752 1020 dddjv.exe 40 PID 1020 wrote to memory of 2752 1020 dddjv.exe 40 PID 2752 wrote to memory of 2164 2752 bbttnn.exe 41 PID 2752 wrote to memory of 2164 2752 bbttnn.exe 41 PID 2752 wrote to memory of 2164 2752 bbttnn.exe 41 PID 2752 wrote to memory of 2164 2752 bbttnn.exe 41 PID 2164 wrote to memory of 2372 2164 9jvdj.exe 42 PID 2164 wrote to memory of 2372 2164 9jvdj.exe 42 PID 2164 wrote to memory of 2372 2164 9jvdj.exe 42 PID 2164 wrote to memory of 2372 2164 9jvdj.exe 42 PID 2372 wrote to memory of 2924 2372 nbnthn.exe 43 PID 2372 wrote to memory of 2924 2372 nbnthn.exe 43 PID 2372 wrote to memory of 2924 2372 nbnthn.exe 43 PID 2372 wrote to memory of 2924 2372 nbnthn.exe 43 PID 2924 wrote to memory of 2740 2924 xlfxxfl.exe 44 PID 2924 wrote to memory of 2740 2924 xlfxxfl.exe 44 PID 2924 wrote to memory of 2740 2924 xlfxxfl.exe 44 PID 2924 wrote to memory of 2740 2924 xlfxxfl.exe 44 PID 2740 wrote to memory of 2844 2740 bhthbh.exe 45 PID 2740 wrote to memory of 2844 2740 bhthbh.exe 45 PID 2740 wrote to memory of 2844 2740 bhthbh.exe 45 PID 2740 wrote to memory of 2844 2740 bhthbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe"C:\Users\Admin\AppData\Local\Temp\acd8c66f14fe324ec9eed4fd145d4dd44403b44fdb0f3f0af2e8897dce82fc1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\5ppdd.exec:\5ppdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnbbtt.exec:\tnbbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dvpjv.exec:\dvpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hbnntt.exec:\hbnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9ddjv.exec:\9ddjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hbhnbb.exec:\hbhnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5btbth.exec:\5btbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vvpjv.exec:\vvpjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\hbtttt.exec:\hbtttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\dddjv.exec:\dddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\bbttnn.exec:\bbttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9jvdj.exec:\9jvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nbnthn.exec:\nbnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xlfxxfl.exec:\xlfxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\bhthbh.exec:\bhthbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vvppd.exec:\vvppd.exe17⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rxrxlrl.exec:\rxrxlrl.exe18⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rrfrflf.exec:\rrfrflf.exe19⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btthnn.exec:\btthnn.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lfxfflx.exec:\lfxfflx.exe21⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nbhhhb.exec:\nbhhhb.exe22⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjvpv.exec:\pjvpv.exe23⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrrxflx.exec:\xrrxflx.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nnntbn.exec:\nnntbn.exe25⤵
- Executes dropped EXE
PID:968 -
\??\c:\3lfrxll.exec:\3lfrxll.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vpjdp.exec:\vpjdp.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\djdpp.exec:\djdpp.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3rllrrx.exec:\3rllrrx.exe29⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pvpdv.exec:\pvpdv.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9hbhtb.exec:\9hbhtb.exe31⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3vvvj.exec:\3vvvj.exe32⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe33⤵
- Executes dropped EXE
PID:860 -
\??\c:\ttbtnb.exec:\ttbtnb.exe34⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ppdjd.exec:\ppdjd.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrrrfxf.exec:\xrrrfxf.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5hbtbh.exec:\5hbtbh.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7bntbb.exec:\7bntbb.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpddd.exec:\vpddd.exe39⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1bnttt.exec:\1bnttt.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hbtbnn.exec:\hbtbnn.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jpdvp.exec:\jpdvp.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lllxxrf.exec:\lllxxrf.exe44⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhbhnt.exec:\hhbhnt.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jjpdp.exec:\jjpdp.exe46⤵
- Executes dropped EXE
PID:1096 -
\??\c:\jdvjp.exec:\jdvjp.exe47⤵
- Executes dropped EXE
PID:664 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe48⤵
- Executes dropped EXE
PID:300 -
\??\c:\hhtbnt.exec:\hhtbnt.exe49⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ppddj.exec:\ppddj.exe50⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3pdpv.exec:\3pdpv.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lllxllx.exec:\lllxllx.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bbtnhn.exec:\bbtnhn.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jjvjv.exec:\jjvjv.exe54⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9frrflx.exec:\9frrflx.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lxllrlx.exec:\lxllrlx.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1thttb.exec:\1thttb.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7jdvp.exec:\7jdvp.exe58⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3xxxflr.exec:\3xxxflr.exe59⤵
- Executes dropped EXE
PID:112 -
\??\c:\9flrrrf.exec:\9flrrrf.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\thbthh.exec:\thbthh.exe61⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pjjjv.exec:\pjjjv.exe62⤵
- Executes dropped EXE
PID:1876 -
\??\c:\llflxlx.exec:\llflxlx.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tthhbh.exec:\tthhbh.exe64⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ttnntt.exec:\ttnntt.exe65⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7dpvj.exec:\7dpvj.exe66⤵PID:1248
-
\??\c:\rlxlrlf.exec:\rlxlrlf.exe67⤵PID:2412
-
\??\c:\hhbbnn.exec:\hhbbnn.exe68⤵PID:1872
-
\??\c:\1vppv.exec:\1vppv.exe69⤵PID:868
-
\??\c:\ppjpv.exec:\ppjpv.exe70⤵PID:2408
-
\??\c:\3xrrrlx.exec:\3xrrrlx.exe71⤵PID:2384
-
\??\c:\tthhbh.exec:\tthhbh.exe72⤵PID:1760
-
\??\c:\1jvdd.exec:\1jvdd.exe73⤵PID:3008
-
\??\c:\7pppd.exec:\7pppd.exe74⤵PID:3004
-
\??\c:\7xlrxxf.exec:\7xlrxxf.exe75⤵PID:2728
-
\??\c:\7tthnh.exec:\7tthnh.exe76⤵PID:2788
-
\??\c:\hntthb.exec:\hntthb.exe77⤵PID:2892
-
\??\c:\ppdjv.exec:\ppdjv.exe78⤵PID:2880
-
\??\c:\rlxflrl.exec:\rlxflrl.exe79⤵PID:2652
-
\??\c:\hhtbbh.exec:\hhtbbh.exe80⤵PID:2140
-
\??\c:\bbnthh.exec:\bbnthh.exe81⤵PID:2768
-
\??\c:\pjvdp.exec:\pjvdp.exe82⤵PID:2296
-
\??\c:\lxrxffr.exec:\lxrxffr.exe83⤵PID:3032
-
\??\c:\5rlrxll.exec:\5rlrxll.exe84⤵PID:2548
-
\??\c:\7ntttb.exec:\7ntttb.exe85⤵PID:2764
-
\??\c:\vvjvj.exec:\vvjvj.exe86⤵PID:324
-
\??\c:\3dppv.exec:\3dppv.exe87⤵PID:3036
-
\??\c:\frllflr.exec:\frllflr.exe88⤵PID:1392
-
\??\c:\ttnbnb.exec:\ttnbnb.exe89⤵PID:440
-
\??\c:\5hbhnn.exec:\5hbhnn.exe90⤵PID:872
-
\??\c:\dvjpj.exec:\dvjpj.exe91⤵PID:2968
-
\??\c:\xrfrlrf.exec:\xrfrlrf.exe92⤵PID:2972
-
\??\c:\nnhhhh.exec:\nnhhhh.exe93⤵PID:2964
-
\??\c:\tnhhtt.exec:\tnhhtt.exe94⤵PID:2164
-
\??\c:\ddjjp.exec:\ddjjp.exe95⤵PID:2352
-
\??\c:\rrllxfl.exec:\rrllxfl.exe96⤵PID:3000
-
\??\c:\9thntb.exec:\9thntb.exe97⤵PID:1676
-
\??\c:\9ttthh.exec:\9ttthh.exe98⤵PID:2084
-
\??\c:\vdpvj.exec:\vdpvj.exe99⤵PID:596
-
\??\c:\lrrflxf.exec:\lrrflxf.exe100⤵
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\3tntbb.exec:\3tntbb.exe101⤵PID:2184
-
\??\c:\htbbtt.exec:\htbbtt.exe102⤵PID:2168
-
\??\c:\pjjjd.exec:\pjjjd.exe103⤵PID:112
-
\??\c:\xrffllr.exec:\xrffllr.exe104⤵PID:1992
-
\??\c:\3htbhn.exec:\3htbhn.exe105⤵PID:1312
-
\??\c:\bbttbb.exec:\bbttbb.exe106⤵PID:2000
-
\??\c:\3vjjj.exec:\3vjjj.exe107⤵PID:2440
-
\??\c:\rrfflrl.exec:\rrfflrl.exe108⤵PID:708
-
\??\c:\hbnnnn.exec:\hbnnnn.exe109⤵PID:264
-
\??\c:\nbnnth.exec:\nbnnth.exe110⤵PID:1984
-
\??\c:\jdpjp.exec:\jdpjp.exe111⤵PID:856
-
\??\c:\xxxxrxl.exec:\xxxxrxl.exe112⤵PID:2308
-
\??\c:\hbnnhh.exec:\hbnnhh.exe113⤵PID:372
-
\??\c:\hnbbnt.exec:\hnbbnt.exe114⤵PID:1868
-
\??\c:\jjdjv.exec:\jjdjv.exe115⤵PID:2384
-
\??\c:\llflxfl.exec:\llflxfl.exe116⤵PID:1760
-
\??\c:\tntntn.exec:\tntntn.exe117⤵PID:1820
-
\??\c:\9bhbbh.exec:\9bhbbh.exe118⤵PID:2996
-
\??\c:\dpjjv.exec:\dpjjv.exe119⤵PID:3068
-
\??\c:\lllfxfx.exec:\lllfxfx.exe120⤵PID:2804
-
\??\c:\nbbtnn.exec:\nbbtnn.exe121⤵PID:2696
-
\??\c:\vppvp.exec:\vppvp.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-