Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe
Resource
win7-20240903-en
General
-
Target
37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe
-
Size
72KB
-
MD5
809e38221a4bb4e38ad053ebbe345500
-
SHA1
255e7190d3fe610373c7110c3b46dbe033112d37
-
SHA256
37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37
-
SHA512
ff1c0e1c5272596dbc4169646d632840307684f07ee127535c64a58feef90348cab1691c1d88cf1da47a1084e42334c7b0aa3298de6b5e8e8af247d692906cc0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjfg6:ymb3NkkiQ3mdBjFI4Vvg6
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/1320-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2320 7bnbtb.exe 3008 bbnttt.exe 2152 fxlrllr.exe 2688 hbtthb.exe 2704 ffflxfr.exe 2848 7fllxrx.exe 2712 jjvvd.exe 2564 dvjdd.exe 2596 bbbnnt.exe 2284 7bbnbn.exe 600 7dddv.exe 2044 rrlrxfr.exe 2604 1rxflrr.exe 2796 nhthhb.exe 1972 jdpvp.exe 824 lfllxxf.exe 2088 ffxlrll.exe 2296 9bnthh.exe 1912 7dpdj.exe 1664 vpdjp.exe 2932 lfrrxlx.exe 1264 3ttnbt.exe 1444 dvjdp.exe 1480 vppvj.exe 376 fxffrrx.exe 2436 1htntb.exe 1672 dvjvj.exe 904 pppvv.exe 2352 1rfflll.exe 3028 5bbnbh.exe 1700 vddpj.exe 2504 1vppd.exe 2192 9rrfrrf.exe 2964 tnhtbh.exe 2652 nntthb.exe 2960 pjdjv.exe 2868 9lrxxxx.exe 2568 bthhnn.exe 2660 7nthbn.exe 2840 vpdjd.exe 2540 ppjvj.exe 2576 xxlxlfr.exe 2780 lllffxf.exe 2788 9bthnb.exe 2440 nnbnnt.exe 2900 vpddj.exe 596 fxllxfr.exe 2532 ffrxllr.exe 1948 hbbbbb.exe 2024 hhbhtb.exe 2020 pjpvd.exe 2124 5pvvd.exe 2088 fffrrrr.exe 2072 fxrflrf.exe 1036 vjdjv.exe 1624 fxxrxfr.exe 1800 lfflflx.exe 2932 3hbnbn.exe 956 hbthtt.exe 644 dppdp.exe 1760 jdvjp.exe 1784 lfrlrlx.exe 2380 3frlxlr.exe 2308 5hnthn.exe -
resource yara_rule behavioral1/memory/1320-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2320 1320 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 31 PID 1320 wrote to memory of 2320 1320 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 31 PID 1320 wrote to memory of 2320 1320 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 31 PID 1320 wrote to memory of 2320 1320 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 31 PID 2320 wrote to memory of 3008 2320 7bnbtb.exe 32 PID 2320 wrote to memory of 3008 2320 7bnbtb.exe 32 PID 2320 wrote to memory of 3008 2320 7bnbtb.exe 32 PID 2320 wrote to memory of 3008 2320 7bnbtb.exe 32 PID 3008 wrote to memory of 2152 3008 bbnttt.exe 33 PID 3008 wrote to memory of 2152 3008 bbnttt.exe 33 PID 3008 wrote to memory of 2152 3008 bbnttt.exe 33 PID 3008 wrote to memory of 2152 3008 bbnttt.exe 33 PID 2152 wrote to memory of 2688 2152 fxlrllr.exe 34 PID 2152 wrote to memory of 2688 2152 fxlrllr.exe 34 PID 2152 wrote to memory of 2688 2152 fxlrllr.exe 34 PID 2152 wrote to memory of 2688 2152 fxlrllr.exe 34 PID 2688 wrote to memory of 2704 2688 hbtthb.exe 35 PID 2688 wrote to memory of 2704 2688 hbtthb.exe 35 PID 2688 wrote to memory of 2704 2688 hbtthb.exe 35 PID 2688 wrote to memory of 2704 2688 hbtthb.exe 35 PID 2704 wrote to memory of 2848 2704 ffflxfr.exe 36 PID 2704 wrote to memory of 2848 2704 ffflxfr.exe 36 PID 2704 wrote to memory of 2848 2704 ffflxfr.exe 36 PID 2704 wrote to memory of 2848 2704 ffflxfr.exe 36 PID 2848 wrote to memory of 2712 2848 7fllxrx.exe 37 PID 2848 wrote to memory of 2712 2848 7fllxrx.exe 37 PID 2848 wrote to memory of 2712 2848 7fllxrx.exe 37 PID 2848 wrote to memory of 2712 2848 7fllxrx.exe 37 PID 2712 wrote to memory of 2564 2712 jjvvd.exe 38 PID 2712 wrote to memory of 2564 2712 jjvvd.exe 38 PID 2712 wrote to memory of 2564 2712 jjvvd.exe 38 PID 2712 wrote to memory of 2564 2712 jjvvd.exe 38 PID 2564 wrote to memory of 2596 2564 dvjdd.exe 39 PID 2564 wrote to memory of 2596 2564 dvjdd.exe 39 PID 2564 wrote to memory of 2596 2564 dvjdd.exe 39 PID 2564 wrote to memory of 2596 2564 dvjdd.exe 39 PID 2596 wrote to memory of 2284 2596 bbbnnt.exe 40 PID 2596 wrote to memory of 2284 2596 bbbnnt.exe 40 PID 2596 wrote to memory of 2284 2596 bbbnnt.exe 40 PID 2596 wrote to memory of 2284 2596 bbbnnt.exe 40 PID 2284 wrote to memory of 600 2284 7bbnbn.exe 41 PID 2284 wrote to memory of 600 2284 7bbnbn.exe 41 PID 2284 wrote to memory of 600 2284 7bbnbn.exe 41 PID 2284 wrote to memory of 600 2284 7bbnbn.exe 41 PID 600 wrote to memory of 2044 600 7dddv.exe 42 PID 600 wrote to memory of 2044 600 7dddv.exe 42 PID 600 wrote to memory of 2044 600 7dddv.exe 42 PID 600 wrote to memory of 2044 600 7dddv.exe 42 PID 2044 wrote to memory of 2604 2044 rrlrxfr.exe 43 PID 2044 wrote to memory of 2604 2044 rrlrxfr.exe 43 PID 2044 wrote to memory of 2604 2044 rrlrxfr.exe 43 PID 2044 wrote to memory of 2604 2044 rrlrxfr.exe 43 PID 2604 wrote to memory of 2796 2604 1rxflrr.exe 44 PID 2604 wrote to memory of 2796 2604 1rxflrr.exe 44 PID 2604 wrote to memory of 2796 2604 1rxflrr.exe 44 PID 2604 wrote to memory of 2796 2604 1rxflrr.exe 44 PID 2796 wrote to memory of 1972 2796 nhthhb.exe 45 PID 2796 wrote to memory of 1972 2796 nhthhb.exe 45 PID 2796 wrote to memory of 1972 2796 nhthhb.exe 45 PID 2796 wrote to memory of 1972 2796 nhthhb.exe 45 PID 1972 wrote to memory of 824 1972 jdpvp.exe 46 PID 1972 wrote to memory of 824 1972 jdpvp.exe 46 PID 1972 wrote to memory of 824 1972 jdpvp.exe 46 PID 1972 wrote to memory of 824 1972 jdpvp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe"C:\Users\Admin\AppData\Local\Temp\37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\7bnbtb.exec:\7bnbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\bbnttt.exec:\bbnttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\fxlrllr.exec:\fxlrllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hbtthb.exec:\hbtthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ffflxfr.exec:\ffflxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7fllxrx.exec:\7fllxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jjvvd.exec:\jjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\dvjdd.exec:\dvjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bbbnnt.exec:\bbbnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7bbnbn.exec:\7bbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\7dddv.exec:\7dddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\1rxflrr.exec:\1rxflrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhthhb.exec:\nhthhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jdpvp.exec:\jdpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\lfllxxf.exec:\lfllxxf.exe17⤵
- Executes dropped EXE
PID:824 -
\??\c:\ffxlrll.exec:\ffxlrll.exe18⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9bnthh.exec:\9bnthh.exe19⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7dpdj.exec:\7dpdj.exe20⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vpdjp.exec:\vpdjp.exe21⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfrrxlx.exec:\lfrrxlx.exe22⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3ttnbt.exec:\3ttnbt.exe23⤵
- Executes dropped EXE
PID:1264 -
\??\c:\dvjdp.exec:\dvjdp.exe24⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vppvj.exec:\vppvj.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\fxffrrx.exec:\fxffrrx.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\1htntb.exec:\1htntb.exe27⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dvjvj.exec:\dvjvj.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pppvv.exec:\pppvv.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\1rfflll.exec:\1rfflll.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5bbnbh.exec:\5bbnbh.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vddpj.exec:\vddpj.exe32⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1vppd.exec:\1vppd.exe33⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9rrfrrf.exec:\9rrfrrf.exe34⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tnhtbh.exec:\tnhtbh.exe35⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nntthb.exec:\nntthb.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pjdjv.exec:\pjdjv.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9lrxxxx.exec:\9lrxxxx.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bthhnn.exec:\bthhnn.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7nthbn.exec:\7nthbn.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vpdjd.exec:\vpdjd.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ppjvj.exec:\ppjvj.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxlxlfr.exec:\xxlxlfr.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lllffxf.exec:\lllffxf.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9bthnb.exec:\9bthnb.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nnbnnt.exec:\nnbnnt.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vpddj.exec:\vpddj.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fxllxfr.exec:\fxllxfr.exe48⤵
- Executes dropped EXE
PID:596 -
\??\c:\ffrxllr.exec:\ffrxllr.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbbbbb.exec:\hbbbbb.exe50⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhbhtb.exec:\hhbhtb.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pjpvd.exec:\pjpvd.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5pvvd.exec:\5pvvd.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fffrrrr.exec:\fffrrrr.exe54⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fxrflrf.exec:\fxrflrf.exe55⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vjdjv.exec:\vjdjv.exe56⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fxxrxfr.exec:\fxxrxfr.exe57⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lfflflx.exec:\lfflflx.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3hbnbn.exec:\3hbnbn.exe59⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbthtt.exec:\hbthtt.exe60⤵
- Executes dropped EXE
PID:956 -
\??\c:\dppdp.exec:\dppdp.exe61⤵
- Executes dropped EXE
PID:644 -
\??\c:\jdvjp.exec:\jdvjp.exe62⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfrlrlx.exec:\lfrlrlx.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3frlxlr.exec:\3frlxlr.exe64⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5hnthn.exec:\5hnthn.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bbthbn.exec:\bbthbn.exe66⤵PID:544
-
\??\c:\pjdjd.exec:\pjdjd.exe67⤵PID:396
-
\??\c:\7vjdp.exec:\7vjdp.exe68⤵PID:2480
-
\??\c:\7vvvp.exec:\7vvvp.exe69⤵PID:1080
-
\??\c:\rlxfllr.exec:\rlxfllr.exe70⤵PID:3028
-
\??\c:\nhbbtt.exec:\nhbbtt.exe71⤵PID:536
-
\??\c:\nhhntt.exec:\nhhntt.exe72⤵PID:3008
-
\??\c:\jdpvj.exec:\jdpvj.exe73⤵PID:2640
-
\??\c:\1jjdj.exec:\1jjdj.exe74⤵PID:2812
-
\??\c:\pjdjj.exec:\pjdjj.exe75⤵PID:2552
-
\??\c:\frfxxxf.exec:\frfxxxf.exe76⤵PID:2836
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe77⤵PID:2680
-
\??\c:\thntbh.exec:\thntbh.exe78⤵PID:2868
-
\??\c:\5bttbt.exec:\5bttbt.exe79⤵PID:2720
-
\??\c:\vpvdp.exec:\vpvdp.exe80⤵PID:2612
-
\??\c:\vjddd.exec:\vjddd.exe81⤵PID:1312
-
\??\c:\xrlrrxl.exec:\xrlrrxl.exe82⤵PID:1492
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe83⤵PID:1572
-
\??\c:\btnhth.exec:\btnhth.exe84⤵PID:2392
-
\??\c:\3jpjj.exec:\3jpjj.exe85⤵PID:1056
-
\??\c:\3vddv.exec:\3vddv.exe86⤵PID:532
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe87⤵PID:2768
-
\??\c:\7fxlfff.exec:\7fxlfff.exe88⤵PID:2044
-
\??\c:\1bhtbn.exec:\1bhtbn.exe89⤵PID:2000
-
\??\c:\ttnnht.exec:\ttnnht.exe90⤵PID:1300
-
\??\c:\pdvvd.exec:\pdvvd.exe91⤵PID:760
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe92⤵PID:1944
-
\??\c:\3rlxfll.exec:\3rlxfll.exe93⤵PID:2216
-
\??\c:\hbnnbb.exec:\hbnnbb.exe94⤵PID:2068
-
\??\c:\5bhhhh.exec:\5bhhhh.exe95⤵PID:2948
-
\??\c:\vpdvj.exec:\vpdvj.exe96⤵PID:964
-
\??\c:\jdpvv.exec:\jdpvv.exe97⤵PID:1352
-
\??\c:\xfllxrx.exec:\xfllxrx.exe98⤵PID:1916
-
\??\c:\xxlrxff.exec:\xxlrxff.exe99⤵PID:2160
-
\??\c:\1bhnhn.exec:\1bhnhn.exe100⤵PID:956
-
\??\c:\pdppv.exec:\pdppv.exe101⤵PID:888
-
\??\c:\jdddp.exec:\jdddp.exe102⤵PID:1660
-
\??\c:\llfrfrl.exec:\llfrfrl.exe103⤵PID:996
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe104⤵PID:2436
-
\??\c:\btbhhn.exec:\btbhhn.exe105⤵PID:1672
-
\??\c:\7pvvj.exec:\7pvvj.exe106⤵PID:2408
-
\??\c:\7dpjp.exec:\7dpjp.exe107⤵
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe108⤵PID:1320
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe109⤵PID:1768
-
\??\c:\tbhhtn.exec:\tbhhtn.exe110⤵PID:1696
-
\??\c:\jdpvv.exec:\jdpvv.exe111⤵PID:1700
-
\??\c:\vvpvp.exec:\vvpvp.exe112⤵PID:560
-
\??\c:\fflxlrx.exec:\fflxlrx.exe113⤵PID:3016
-
\??\c:\rrfrflx.exec:\rrfrflx.exe114⤵PID:2700
-
\??\c:\nhnthh.exec:\nhnthh.exe115⤵PID:2212
-
\??\c:\nbhbnh.exec:\nbhbnh.exe116⤵PID:2880
-
\??\c:\pppdp.exec:\pppdp.exe117⤵PID:2704
-
\??\c:\dddjd.exec:\dddjd.exe118⤵PID:2868
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe119⤵PID:2544
-
\??\c:\9btbbb.exec:\9btbbb.exe120⤵PID:2612
-
\??\c:\bbbbbt.exec:\bbbbbt.exe121⤵PID:2668
-
\??\c:\vpppd.exec:\vpppd.exe122⤵PID:1492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-