Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe
Resource
win7-20241010-en
General
-
Target
45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe
-
Size
457KB
-
MD5
1fa6d07912974090dc03334ebeeb538a
-
SHA1
55bcca7f286f1a8c4d2a774f89cffcb96f2b2d8d
-
SHA256
45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e
-
SHA512
96d831ed6e50d64cd87a65d67196ed43261774c591e467cad008eba58671e5aac0a0b93bf960c563c54d546414e43ed7e415d6d124246e87645b1eb883008b8d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRII:q7Tc2NYHUrAwfMp3CDRII
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5108-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4776 jdjjv.exe 3532 nhbhnn.exe 4700 pjppp.exe 3840 nhbbhh.exe 3388 jvvvv.exe 1084 9bnnnt.exe 3288 hntthh.exe 3020 3rflllx.exe 1396 lfxxlrx.exe 4524 ppvvv.exe 2756 lrlffxx.exe 3708 1ffffxx.exe 4672 pvvvj.exe 844 vvvvp.exe 4292 bbnttb.exe 4440 5pvvv.exe 4396 ppvpv.exe 1596 ddvvv.exe 3620 3llrrrr.exe 4916 vjvpj.exe 2540 tthhtb.exe 1844 pvpjj.exe 1660 bhhbhh.exe 2464 rrlllll.exe 1000 ttbbtb.exe 1804 httttb.exe 1748 hhhhnt.exe 1176 pjvvv.exe 4512 xrxffff.exe 4400 xrfffll.exe 816 jjddp.exe 4328 fflrrxf.exe 4660 rlxrrrr.exe 3640 ntbbbb.exe 3272 jjpjp.exe 3556 7rxxxff.exe 4336 nnbbbh.exe 1724 vvppp.exe 3860 tntttb.exe 4228 vpvvj.exe 3076 vpdvp.exe 2916 lfxrrxx.exe 5116 btbbbt.exe 2148 pvjjj.exe 3492 jdjjd.exe 1964 7rxrrrr.exe 2764 hbtnnh.exe 3204 nhtthh.exe 3168 vvvvd.exe 876 rfrrrrx.exe 4344 nntbbb.exe 4352 jjddv.exe 2912 7pjdv.exe 3744 lxxrllf.exe 1700 tthhnn.exe 3100 1vpdp.exe 3568 xxxfflr.exe 3920 nnbbhh.exe 4816 1bttht.exe 468 ddddv.exe 4920 xlrrxff.exe 4356 tnbbtb.exe 1408 vdpjj.exe 1384 flxrflf.exe -
resource yara_rule behavioral2/memory/5108-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-676-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 4776 5108 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 84 PID 5108 wrote to memory of 4776 5108 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 84 PID 5108 wrote to memory of 4776 5108 45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe 84 PID 4776 wrote to memory of 3532 4776 jdjjv.exe 86 PID 4776 wrote to memory of 3532 4776 jdjjv.exe 86 PID 4776 wrote to memory of 3532 4776 jdjjv.exe 86 PID 3532 wrote to memory of 4700 3532 nhbhnn.exe 88 PID 3532 wrote to memory of 4700 3532 nhbhnn.exe 88 PID 3532 wrote to memory of 4700 3532 nhbhnn.exe 88 PID 4700 wrote to memory of 3840 4700 pjppp.exe 89 PID 4700 wrote to memory of 3840 4700 pjppp.exe 89 PID 4700 wrote to memory of 3840 4700 pjppp.exe 89 PID 3840 wrote to memory of 3388 3840 nhbbhh.exe 90 PID 3840 wrote to memory of 3388 3840 nhbbhh.exe 90 PID 3840 wrote to memory of 3388 3840 nhbbhh.exe 90 PID 3388 wrote to memory of 1084 3388 jvvvv.exe 91 PID 3388 wrote to memory of 1084 3388 jvvvv.exe 91 PID 3388 wrote to memory of 1084 3388 jvvvv.exe 91 PID 1084 wrote to memory of 3288 1084 9bnnnt.exe 92 PID 1084 wrote to memory of 3288 1084 9bnnnt.exe 92 PID 1084 wrote to memory of 3288 1084 9bnnnt.exe 92 PID 3288 wrote to memory of 3020 3288 hntthh.exe 93 PID 3288 wrote to memory of 3020 3288 hntthh.exe 93 PID 3288 wrote to memory of 3020 3288 hntthh.exe 93 PID 3020 wrote to memory of 1396 3020 3rflllx.exe 94 PID 3020 wrote to memory of 1396 3020 3rflllx.exe 94 PID 3020 wrote to memory of 1396 3020 3rflllx.exe 94 PID 1396 wrote to memory of 4524 1396 lfxxlrx.exe 95 PID 1396 wrote to memory of 4524 1396 lfxxlrx.exe 95 PID 1396 wrote to memory of 4524 1396 lfxxlrx.exe 95 PID 4524 wrote to memory of 2756 4524 ppvvv.exe 96 PID 4524 wrote to memory of 2756 4524 ppvvv.exe 96 PID 4524 wrote to memory of 2756 4524 ppvvv.exe 96 PID 2756 wrote to memory of 3708 2756 lrlffxx.exe 97 PID 2756 wrote to memory of 3708 2756 lrlffxx.exe 97 PID 2756 wrote to memory of 3708 2756 lrlffxx.exe 97 PID 3708 wrote to memory of 4672 3708 1ffffxx.exe 98 PID 3708 wrote to memory of 4672 3708 1ffffxx.exe 98 PID 3708 wrote to memory of 4672 3708 1ffffxx.exe 98 PID 4672 wrote to memory of 844 4672 pvvvj.exe 99 PID 4672 wrote to memory of 844 4672 pvvvj.exe 99 PID 4672 wrote to memory of 844 4672 pvvvj.exe 99 PID 844 wrote to memory of 4292 844 vvvvp.exe 100 PID 844 wrote to memory of 4292 844 vvvvp.exe 100 PID 844 wrote to memory of 4292 844 vvvvp.exe 100 PID 4292 wrote to memory of 4440 4292 bbnttb.exe 101 PID 4292 wrote to memory of 4440 4292 bbnttb.exe 101 PID 4292 wrote to memory of 4440 4292 bbnttb.exe 101 PID 4440 wrote to memory of 4396 4440 5pvvv.exe 102 PID 4440 wrote to memory of 4396 4440 5pvvv.exe 102 PID 4440 wrote to memory of 4396 4440 5pvvv.exe 102 PID 4396 wrote to memory of 1596 4396 ppvpv.exe 103 PID 4396 wrote to memory of 1596 4396 ppvpv.exe 103 PID 4396 wrote to memory of 1596 4396 ppvpv.exe 103 PID 1596 wrote to memory of 3620 1596 ddvvv.exe 104 PID 1596 wrote to memory of 3620 1596 ddvvv.exe 104 PID 1596 wrote to memory of 3620 1596 ddvvv.exe 104 PID 3620 wrote to memory of 4916 3620 3llrrrr.exe 105 PID 3620 wrote to memory of 4916 3620 3llrrrr.exe 105 PID 3620 wrote to memory of 4916 3620 3llrrrr.exe 105 PID 4916 wrote to memory of 2540 4916 vjvpj.exe 106 PID 4916 wrote to memory of 2540 4916 vjvpj.exe 106 PID 4916 wrote to memory of 2540 4916 vjvpj.exe 106 PID 2540 wrote to memory of 1844 2540 tthhtb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe"C:\Users\Admin\AppData\Local\Temp\45dc4adaeb252578100e93b538dd0b79e1517aae97b02cd638fb12053d89ee3e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\jdjjv.exec:\jdjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\nhbhnn.exec:\nhbhnn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\pjppp.exec:\pjppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\nhbbhh.exec:\nhbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\jvvvv.exec:\jvvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\9bnnnt.exec:\9bnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\hntthh.exec:\hntthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\3rflllx.exec:\3rflllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\ppvvv.exec:\ppvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\lrlffxx.exec:\lrlffxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1ffffxx.exec:\1ffffxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\pvvvj.exec:\pvvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\vvvvp.exec:\vvvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\bbnttb.exec:\bbnttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\5pvvv.exec:\5pvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\ppvpv.exec:\ppvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\ddvvv.exec:\ddvvv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3llrrrr.exec:\3llrrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\vjvpj.exec:\vjvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\tthhtb.exec:\tthhtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pvpjj.exec:\pvpjj.exe23⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bhhbhh.exec:\bhhbhh.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rrlllll.exec:\rrlllll.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ttbbtb.exec:\ttbbtb.exe26⤵
- Executes dropped EXE
PID:1000 -
\??\c:\httttb.exec:\httttb.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hhhhnt.exec:\hhhhnt.exe28⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjvvv.exec:\pjvvv.exe29⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xrxffff.exec:\xrxffff.exe30⤵
- Executes dropped EXE
PID:4512 -
\??\c:\xrfffll.exec:\xrfffll.exe31⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jjddp.exec:\jjddp.exe32⤵
- Executes dropped EXE
PID:816 -
\??\c:\fflrrxf.exec:\fflrrxf.exe33⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe34⤵
- Executes dropped EXE
PID:4660 -
\??\c:\ntbbbb.exec:\ntbbbb.exe35⤵
- Executes dropped EXE
PID:3640 -
\??\c:\jjpjp.exec:\jjpjp.exe36⤵
- Executes dropped EXE
PID:3272 -
\??\c:\7rxxxff.exec:\7rxxxff.exe37⤵
- Executes dropped EXE
PID:3556 -
\??\c:\nnbbbh.exec:\nnbbbh.exe38⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vvppp.exec:\vvppp.exe39⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tntttb.exec:\tntttb.exe40⤵
- Executes dropped EXE
PID:3860 -
\??\c:\vpvvj.exec:\vpvvj.exe41⤵
- Executes dropped EXE
PID:4228 -
\??\c:\vpdvp.exec:\vpdvp.exe42⤵
- Executes dropped EXE
PID:3076 -
\??\c:\lfxrrxx.exec:\lfxrrxx.exe43⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btbbbt.exec:\btbbbt.exe44⤵
- Executes dropped EXE
PID:5116 -
\??\c:\pvjjj.exec:\pvjjj.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jdjjd.exec:\jdjjd.exe46⤵
- Executes dropped EXE
PID:3492 -
\??\c:\7rxrrrr.exec:\7rxrrrr.exe47⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hbtnnh.exec:\hbtnnh.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nhtthh.exec:\nhtthh.exe49⤵
- Executes dropped EXE
PID:3204 -
\??\c:\vvvvd.exec:\vvvvd.exe50⤵
- Executes dropped EXE
PID:3168 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe51⤵
- Executes dropped EXE
PID:876 -
\??\c:\nntbbb.exec:\nntbbb.exe52⤵
- Executes dropped EXE
PID:4344 -
\??\c:\jjddv.exec:\jjddv.exe53⤵
- Executes dropped EXE
PID:4352 -
\??\c:\7pjdv.exec:\7pjdv.exe54⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxxrllf.exec:\lxxrllf.exe55⤵
- Executes dropped EXE
PID:3744 -
\??\c:\tthhnn.exec:\tthhnn.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1vpdp.exec:\1vpdp.exe57⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xxxfflr.exec:\xxxfflr.exe58⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nnbbhh.exec:\nnbbhh.exe59⤵
- Executes dropped EXE
PID:3920 -
\??\c:\1bttht.exec:\1bttht.exe60⤵
- Executes dropped EXE
PID:4816 -
\??\c:\ddddv.exec:\ddddv.exe61⤵
- Executes dropped EXE
PID:468 -
\??\c:\xlrrxff.exec:\xlrrxff.exe62⤵
- Executes dropped EXE
PID:4920 -
\??\c:\tnbbtb.exec:\tnbbtb.exe63⤵
- Executes dropped EXE
PID:4356 -
\??\c:\vdpjj.exec:\vdpjj.exe64⤵
- Executes dropped EXE
PID:1408 -
\??\c:\flxrflf.exec:\flxrflf.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe66⤵
- System Location Discovery: System Language Discovery
PID:4120 -
\??\c:\tnhhhn.exec:\tnhhhn.exe67⤵PID:1540
-
\??\c:\djpdd.exec:\djpdd.exe68⤵PID:4784
-
\??\c:\jvddv.exec:\jvddv.exe69⤵PID:1072
-
\??\c:\frxlfxr.exec:\frxlfxr.exe70⤵PID:2964
-
\??\c:\hhnnnn.exec:\hhnnnn.exe71⤵PID:1824
-
\??\c:\jdppj.exec:\jdppj.exe72⤵PID:3628
-
\??\c:\pddvj.exec:\pddvj.exe73⤵PID:1660
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe74⤵PID:3176
-
\??\c:\nttnhh.exec:\nttnhh.exe75⤵PID:1580
-
\??\c:\vvdvp.exec:\vvdvp.exe76⤵PID:1848
-
\??\c:\ppvpj.exec:\ppvpj.exe77⤵PID:3092
-
\??\c:\fxxxlxx.exec:\fxxxlxx.exe78⤵PID:1672
-
\??\c:\nhnhbb.exec:\nhnhbb.exe79⤵PID:1364
-
\??\c:\bthbnt.exec:\bthbnt.exe80⤵PID:4584
-
\??\c:\dvppd.exec:\dvppd.exe81⤵PID:4724
-
\??\c:\5rrfxxr.exec:\5rrfxxr.exe82⤵PID:1632
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe83⤵PID:2376
-
\??\c:\bthbtn.exec:\bthbtn.exe84⤵PID:2300
-
\??\c:\djpdp.exec:\djpdp.exe85⤵PID:4328
-
\??\c:\1dvpj.exec:\1dvpj.exe86⤵PID:768
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe87⤵PID:3392
-
\??\c:\1btnnh.exec:\1btnnh.exe88⤵PID:4284
-
\??\c:\djvvp.exec:\djvvp.exe89⤵PID:872
-
\??\c:\1xfffll.exec:\1xfffll.exe90⤵PID:1368
-
\??\c:\nhbtnn.exec:\nhbtnn.exe91⤵PID:3632
-
\??\c:\btbtbh.exec:\btbtbh.exe92⤵PID:1820
-
\??\c:\dvdjp.exec:\dvdjp.exe93⤵PID:3980
-
\??\c:\rflxrrf.exec:\rflxrrf.exe94⤵PID:3532
-
\??\c:\1thbnn.exec:\1thbnn.exe95⤵PID:1492
-
\??\c:\bnnhbb.exec:\bnnhbb.exe96⤵PID:4700
-
\??\c:\pjpjv.exec:\pjpjv.exe97⤵PID:4956
-
\??\c:\9lxrlll.exec:\9lxrlll.exe98⤵PID:1116
-
\??\c:\hbtnhh.exec:\hbtnhh.exe99⤵PID:4116
-
\??\c:\vvvpv.exec:\vvvpv.exe100⤵PID:2084
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe101⤵PID:2036
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe102⤵PID:2724
-
\??\c:\hhnnhh.exec:\hhnnhh.exe103⤵PID:4880
-
\??\c:\jjpjd.exec:\jjpjd.exe104⤵PID:1092
-
\??\c:\llfxrfx.exec:\llfxrfx.exe105⤵PID:3168
-
\??\c:\hbtnhh.exec:\hbtnhh.exe106⤵PID:876
-
\??\c:\hhnbbb.exec:\hhnbbb.exe107⤵PID:1396
-
\??\c:\rrxrffl.exec:\rrxrffl.exe108⤵PID:1100
-
\??\c:\btbtnn.exec:\btbtnn.exe109⤵PID:4236
-
\??\c:\nnhnhh.exec:\nnhnhh.exe110⤵PID:2756
-
\??\c:\pdjdd.exec:\pdjdd.exe111⤵PID:4444
-
\??\c:\rfllffx.exec:\rfllffx.exe112⤵PID:4488
-
\??\c:\7htntt.exec:\7htntt.exe113⤵PID:3480
-
\??\c:\pjvvp.exec:\pjvvp.exe114⤵PID:1980
-
\??\c:\rfllrrl.exec:\rfllrrl.exe115⤵PID:4412
-
\??\c:\lflrrrr.exec:\lflrrrr.exe116⤵PID:2648
-
\??\c:\ttttbh.exec:\ttttbh.exe117⤵PID:4972
-
\??\c:\5dpjp.exec:\5dpjp.exe118⤵PID:3764
-
\??\c:\rrffffr.exec:\rrffffr.exe119⤵PID:4920
-
\??\c:\xfffxxx.exec:\xfffxxx.exe120⤵PID:2628
-
\??\c:\hhnnnn.exec:\hhnnnn.exe121⤵PID:3488
-
\??\c:\dvdvp.exec:\dvdvp.exe122⤵PID:3884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-