Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 14:27
Behavioral task
behavioral1
Sample
e0b20bad05735c8aecf6143cad631210N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
e0b20bad05735c8aecf6143cad631210N.exe
-
Size
189KB
-
MD5
e0b20bad05735c8aecf6143cad631210
-
SHA1
152430614d0fd9a7c09284b94645f2d3d3320c37
-
SHA256
ee3e49f5e31d3d823aebed06868596b79e5472014b7b5cce976a0533785842bd
-
SHA512
8df3d246aa53537e8eb07986e94e966c69717d9a70e702404e9154aa8007a59cc6c1062f1a0600d7518c26f2e63f423046c4e8b5936717621288dd6bd831bd0b
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t6NDWOH148BqCFPekj:kcm4FmowdHoSphraHcpOFltH4ttj8Bl
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2516-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-7-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2384-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-37-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2756-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1832-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/952-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/404-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-690-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-988-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 bbhbnn.exe 2384 vddpp.exe 2196 fxxrrxl.exe 2212 ntttth.exe 2756 jvjdd.exe 2104 1xrxlrl.exe 2688 ttnthn.exe 2768 dddjd.exe 2632 fxlxrrf.exe 3004 hbbbnb.exe 1276 vpdjp.exe 1504 frfflfx.exe 2420 3flxxfl.exe 584 bbbnbb.exe 1832 vvdpd.exe 2032 rlxfxff.exe 1608 rflrxfr.exe 2896 hbbnnt.exe 2288 9pjjv.exe 840 3lxxffl.exe 2208 rxxflxl.exe 1408 bnbtbh.exe 2560 vjpvj.exe 2940 fxffrxf.exe 1296 lfrrffr.exe 952 hhnhnb.exe 1536 jjvpd.exe 2988 rlflfrf.exe 2488 lfflrrf.exe 1960 nnbnbn.exe 2124 7ppdj.exe 2404 ffflxfr.exe 1732 btnthh.exe 2380 jjpvd.exe 2112 lxxfllf.exe 2316 fllllfl.exe 2816 tnhnbn.exe 2864 jdppv.exe 2756 jvdjp.exe 2804 ffrxffx.exe 2764 fxlrfxf.exe 2604 hbtbhn.exe 2576 hnbhht.exe 2868 pjjpv.exe 2652 pjddd.exe 556 rrxllfx.exe 1276 bthnbb.exe 2504 1tbbnn.exe 2344 jjddj.exe 1728 lxrrrrl.exe 600 xxrxrxl.exe 1900 btnttb.exe 1304 ttntnt.exe 1684 9dvdv.exe 2800 lfxfrrl.exe 2176 rffxxrr.exe 2080 ttnttt.exe 2304 7hnbhh.exe 1928 9jddd.exe 404 rrrxflx.exe 2436 lfxxflr.exe 660 hbtbhb.exe 1540 jdjdd.exe 972 vvdjp.exe -
resource yara_rule behavioral1/memory/2516-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120fe-8.dat upx behavioral1/memory/2384-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000190d2-18.dat upx behavioral1/memory/2368-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000191c6-27.dat upx behavioral1/memory/2384-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-35-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/files/0x000700000001921e-40.dat upx behavioral1/memory/2196-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019248-47.dat upx behavioral1/memory/2756-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001924b-54.dat upx behavioral1/memory/2104-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019255-65.dat upx behavioral1/files/0x0007000000019276-73.dat upx behavioral1/memory/2768-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001945d-85.dat upx behavioral1/memory/2768-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a419-97.dat upx behavioral1/memory/2632-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41b-105.dat upx behavioral1/memory/3004-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a423-112.dat upx behavioral1/files/0x000500000001a425-121.dat upx behavioral1/files/0x000500000001a426-128.dat upx behavioral1/memory/2420-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/584-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a452-140.dat upx behavioral1/memory/584-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a473-147.dat upx behavioral1/memory/2032-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1832-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a475-156.dat upx behavioral1/memory/2032-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a481-165.dat upx behavioral1/files/0x000500000001a486-174.dat upx behavioral1/files/0x000500000001a498-182.dat upx behavioral1/memory/2288-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a2-192.dat upx behavioral1/files/0x000500000001a4a4-199.dat upx behavioral1/files/0x000500000001a4a6-208.dat upx behavioral1/memory/1408-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a8-216.dat upx behavioral1/memory/2940-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a9-226.dat upx behavioral1/files/0x000500000001a4aa-236.dat upx behavioral1/memory/1296-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ac-244.dat upx behavioral1/memory/952-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1536-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-255.dat upx behavioral1/files/0x0008000000018f45-262.dat upx behavioral1/memory/2488-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-274.dat upx behavioral1/files/0x000500000001a4b9-282.dat upx behavioral1/memory/1960-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4be-293.dat upx behavioral1/memory/2404-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-307-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2368 2516 e0b20bad05735c8aecf6143cad631210N.exe 30 PID 2516 wrote to memory of 2368 2516 e0b20bad05735c8aecf6143cad631210N.exe 30 PID 2516 wrote to memory of 2368 2516 e0b20bad05735c8aecf6143cad631210N.exe 30 PID 2516 wrote to memory of 2368 2516 e0b20bad05735c8aecf6143cad631210N.exe 30 PID 2368 wrote to memory of 2384 2368 bbhbnn.exe 31 PID 2368 wrote to memory of 2384 2368 bbhbnn.exe 31 PID 2368 wrote to memory of 2384 2368 bbhbnn.exe 31 PID 2368 wrote to memory of 2384 2368 bbhbnn.exe 31 PID 2384 wrote to memory of 2196 2384 vddpp.exe 32 PID 2384 wrote to memory of 2196 2384 vddpp.exe 32 PID 2384 wrote to memory of 2196 2384 vddpp.exe 32 PID 2384 wrote to memory of 2196 2384 vddpp.exe 32 PID 2196 wrote to memory of 2212 2196 fxxrrxl.exe 33 PID 2196 wrote to memory of 2212 2196 fxxrrxl.exe 33 PID 2196 wrote to memory of 2212 2196 fxxrrxl.exe 33 PID 2196 wrote to memory of 2212 2196 fxxrrxl.exe 33 PID 2212 wrote to memory of 2756 2212 ntttth.exe 34 PID 2212 wrote to memory of 2756 2212 ntttth.exe 34 PID 2212 wrote to memory of 2756 2212 ntttth.exe 34 PID 2212 wrote to memory of 2756 2212 ntttth.exe 34 PID 2756 wrote to memory of 2104 2756 jvjdd.exe 35 PID 2756 wrote to memory of 2104 2756 jvjdd.exe 35 PID 2756 wrote to memory of 2104 2756 jvjdd.exe 35 PID 2756 wrote to memory of 2104 2756 jvjdd.exe 35 PID 2104 wrote to memory of 2688 2104 1xrxlrl.exe 36 PID 2104 wrote to memory of 2688 2104 1xrxlrl.exe 36 PID 2104 wrote to memory of 2688 2104 1xrxlrl.exe 36 PID 2104 wrote to memory of 2688 2104 1xrxlrl.exe 36 PID 2688 wrote to memory of 2768 2688 ttnthn.exe 37 PID 2688 wrote to memory of 2768 2688 ttnthn.exe 37 PID 2688 wrote to memory of 2768 2688 ttnthn.exe 37 PID 2688 wrote to memory of 2768 2688 ttnthn.exe 37 PID 2768 wrote to memory of 2632 2768 dddjd.exe 38 PID 2768 wrote to memory of 2632 2768 dddjd.exe 38 PID 2768 wrote to memory of 2632 2768 dddjd.exe 38 PID 2768 wrote to memory of 2632 2768 dddjd.exe 38 PID 2632 wrote to memory of 3004 2632 fxlxrrf.exe 39 PID 2632 wrote to memory of 3004 2632 fxlxrrf.exe 39 PID 2632 wrote to memory of 3004 2632 fxlxrrf.exe 39 PID 2632 wrote to memory of 3004 2632 fxlxrrf.exe 39 PID 3004 wrote to memory of 1276 3004 hbbbnb.exe 40 PID 3004 wrote to memory of 1276 3004 hbbbnb.exe 40 PID 3004 wrote to memory of 1276 3004 hbbbnb.exe 40 PID 3004 wrote to memory of 1276 3004 hbbbnb.exe 40 PID 1276 wrote to memory of 1504 1276 vpdjp.exe 41 PID 1276 wrote to memory of 1504 1276 vpdjp.exe 41 PID 1276 wrote to memory of 1504 1276 vpdjp.exe 41 PID 1276 wrote to memory of 1504 1276 vpdjp.exe 41 PID 1504 wrote to memory of 2420 1504 frfflfx.exe 42 PID 1504 wrote to memory of 2420 1504 frfflfx.exe 42 PID 1504 wrote to memory of 2420 1504 frfflfx.exe 42 PID 1504 wrote to memory of 2420 1504 frfflfx.exe 42 PID 2420 wrote to memory of 584 2420 3flxxfl.exe 43 PID 2420 wrote to memory of 584 2420 3flxxfl.exe 43 PID 2420 wrote to memory of 584 2420 3flxxfl.exe 43 PID 2420 wrote to memory of 584 2420 3flxxfl.exe 43 PID 584 wrote to memory of 1832 584 bbbnbb.exe 44 PID 584 wrote to memory of 1832 584 bbbnbb.exe 44 PID 584 wrote to memory of 1832 584 bbbnbb.exe 44 PID 584 wrote to memory of 1832 584 bbbnbb.exe 44 PID 1832 wrote to memory of 2032 1832 vvdpd.exe 45 PID 1832 wrote to memory of 2032 1832 vvdpd.exe 45 PID 1832 wrote to memory of 2032 1832 vvdpd.exe 45 PID 1832 wrote to memory of 2032 1832 vvdpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b20bad05735c8aecf6143cad631210N.exe"C:\Users\Admin\AppData\Local\Temp\e0b20bad05735c8aecf6143cad631210N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bbhbnn.exec:\bbhbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vddpp.exec:\vddpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\fxxrrxl.exec:\fxxrrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ntttth.exec:\ntttth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\jvjdd.exec:\jvjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1xrxlrl.exec:\1xrxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ttnthn.exec:\ttnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dddjd.exec:\dddjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\fxlxrrf.exec:\fxlxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hbbbnb.exec:\hbbbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vpdjp.exec:\vpdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\frfflfx.exec:\frfflfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\3flxxfl.exec:\3flxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\bbbnbb.exec:\bbbnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\vvdpd.exec:\vvdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\rlxfxff.exec:\rlxfxff.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rflrxfr.exec:\rflrxfr.exe18⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbbnnt.exec:\hbbnnt.exe19⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9pjjv.exec:\9pjjv.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3lxxffl.exec:\3lxxffl.exe21⤵
- Executes dropped EXE
PID:840 -
\??\c:\rxxflxl.exec:\rxxflxl.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bnbtbh.exec:\bnbtbh.exe23⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vjpvj.exec:\vjpvj.exe24⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxffrxf.exec:\fxffrxf.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lfrrffr.exec:\lfrrffr.exe26⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hhnhnb.exec:\hhnhnb.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\jjvpd.exec:\jjvpd.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rlflfrf.exec:\rlflfrf.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfflrrf.exec:\lfflrrf.exe30⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nnbnbn.exec:\nnbnbn.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7ppdj.exec:\7ppdj.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ffflxfr.exec:\ffflxfr.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\btnthh.exec:\btnthh.exe34⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jjpvd.exec:\jjpvd.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxxfllf.exec:\lxxfllf.exe36⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fllllfl.exec:\fllllfl.exe37⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tnhnbn.exec:\tnhnbn.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jdppv.exec:\jdppv.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvdjp.exec:\jvdjp.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ffrxffx.exec:\ffrxffx.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\hbtbhn.exec:\hbtbhn.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hnbhht.exec:\hnbhht.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pjjpv.exec:\pjjpv.exe45⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pjddd.exec:\pjddd.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rrxllfx.exec:\rrxllfx.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\bthnbb.exec:\bthnbb.exe48⤵
- Executes dropped EXE
PID:1276 -
\??\c:\1tbbnn.exec:\1tbbnn.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jjddj.exec:\jjddj.exe50⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxrrrrl.exec:\lxrrrrl.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe52⤵
- Executes dropped EXE
PID:600 -
\??\c:\btnttb.exec:\btnttb.exe53⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ttntnt.exec:\ttntnt.exe54⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9dvdv.exec:\9dvdv.exe55⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe56⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rffxxrr.exec:\rffxxrr.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ttnttt.exec:\ttnttt.exe58⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7hnbhh.exec:\7hnbhh.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9jddd.exec:\9jddd.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rrrxflx.exec:\rrrxflx.exe61⤵
- Executes dropped EXE
PID:404 -
\??\c:\lfxxflr.exec:\lfxxflr.exe62⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbtbhb.exec:\hbtbhb.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\jdjdd.exec:\jdjdd.exe64⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vvdjp.exec:\vvdjp.exe65⤵
- Executes dropped EXE
PID:972 -
\??\c:\3rxfllx.exec:\3rxfllx.exe66⤵PID:936
-
\??\c:\3xxffxr.exec:\3xxffxr.exe67⤵PID:3028
-
\??\c:\btntbb.exec:\btntbb.exe68⤵PID:1668
-
\??\c:\tnbtbt.exec:\tnbtbt.exe69⤵PID:1328
-
\??\c:\vpjpv.exec:\vpjpv.exe70⤵PID:2976
-
\??\c:\7pppv.exec:\7pppv.exe71⤵PID:1888
-
\??\c:\fxllfff.exec:\fxllfff.exe72⤵PID:2052
-
\??\c:\5lxxxxx.exec:\5lxxxxx.exe73⤵PID:2544
-
\??\c:\7hbhhn.exec:\7hbhhn.exe74⤵PID:2388
-
\??\c:\3vpjj.exec:\3vpjj.exe75⤵PID:1524
-
\??\c:\vvpdv.exec:\vvpdv.exe76⤵PID:1500
-
\??\c:\lffxrxf.exec:\lffxrxf.exe77⤵PID:2284
-
\??\c:\rrllxfr.exec:\rrllxfr.exe78⤵PID:2744
-
\??\c:\bnbthh.exec:\bnbthh.exe79⤵PID:2840
-
\??\c:\pjdjp.exec:\pjdjp.exe80⤵PID:2928
-
\??\c:\vjvdd.exec:\vjvdd.exe81⤵PID:2480
-
\??\c:\xfxxlxl.exec:\xfxxlxl.exe82⤵PID:2636
-
\??\c:\7rffxxl.exec:\7rffxxl.exe83⤵PID:3020
-
\??\c:\nnhbtn.exec:\nnhbtn.exe84⤵PID:2712
-
\??\c:\9vvdj.exec:\9vvdj.exe85⤵PID:2620
-
\??\c:\dvpvv.exec:\dvpvv.exe86⤵PID:3008
-
\??\c:\frlflll.exec:\frlflll.exe87⤵PID:2632
-
\??\c:\tnhnhh.exec:\tnhnhh.exe88⤵PID:788
-
\??\c:\7bbtbb.exec:\7bbtbb.exe89⤵PID:480
-
\??\c:\dvddj.exec:\dvddj.exe90⤵PID:1236
-
\??\c:\jdvjj.exec:\jdvjj.exe91⤵PID:1628
-
\??\c:\xxlrlrx.exec:\xxlrlrx.exe92⤵PID:1612
-
\??\c:\xfxfrrf.exec:\xfxfrrf.exe93⤵PID:352
-
\??\c:\hbntbh.exec:\hbntbh.exe94⤵PID:1060
-
\??\c:\dvjjd.exec:\dvjjd.exe95⤵PID:1952
-
\??\c:\5vppv.exec:\5vppv.exe96⤵PID:1860
-
\??\c:\lfxlffr.exec:\lfxlffr.exe97⤵PID:2660
-
\??\c:\lfxlrlf.exec:\lfxlrlf.exe98⤵PID:568
-
\??\c:\hthtbb.exec:\hthtbb.exe99⤵PID:2128
-
\??\c:\bbbhtb.exec:\bbbhtb.exe100⤵PID:1772
-
\??\c:\dpvvv.exec:\dpvvv.exe101⤵PID:2944
-
\??\c:\dvjpd.exec:\dvjpd.exe102⤵PID:2208
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe103⤵PID:1408
-
\??\c:\ffrxxrr.exec:\ffrxxrr.exe104⤵PID:2948
-
\??\c:\nntnnn.exec:\nntnnn.exe105⤵PID:2472
-
\??\c:\7tbbtb.exec:\7tbbtb.exe106⤵PID:1660
-
\??\c:\jdjpd.exec:\jdjpd.exe107⤵PID:112
-
\??\c:\vpjvp.exec:\vpjvp.exe108⤵PID:972
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe109⤵PID:3036
-
\??\c:\rxxllxf.exec:\rxxllxf.exe110⤵PID:3028
-
\??\c:\bbtbnn.exec:\bbtbnn.exe111⤵PID:3052
-
\??\c:\vjjpp.exec:\vjjpp.exe112⤵PID:1924
-
\??\c:\jpjpd.exec:\jpjpd.exe113⤵PID:644
-
\??\c:\9frxxfl.exec:\9frxxfl.exe114⤵PID:1380
-
\??\c:\nnhnhh.exec:\nnhnhh.exe115⤵PID:2512
-
\??\c:\bnnbnt.exec:\bnnbnt.exe116⤵PID:2516
-
\??\c:\vpdvj.exec:\vpdvj.exe117⤵PID:2064
-
\??\c:\9jdvp.exec:\9jdvp.exe118⤵PID:2384
-
\??\c:\xlxfffr.exec:\xlxfffr.exe119⤵PID:2692
-
\??\c:\nhnthn.exec:\nhnthn.exe120⤵PID:2780
-
\??\c:\thbhhb.exec:\thbhhb.exe121⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-