Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe
Resource
win7-20240903-en
General
-
Target
811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe
-
Size
454KB
-
MD5
a0d8d7f0ce5d38544f0acca74aea2755
-
SHA1
9a0f1c3da93420f85459a1c8e2ba3ee2fb8873d3
-
SHA256
811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3
-
SHA512
bfef5f7e815d8e97881fecb05e99d99219ed15a722185eb67f1724b52b397a67ebb39a02253fa65608286872d410d6e386499625eb862dd5d7f3c83097ccd350
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/3036-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-23-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/860-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-80-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2624-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-85-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1864-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-183-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/832-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-237-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1688-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-290-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1968-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-320-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2280-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-441-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1780-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-610-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 860 xlxlrlr.exe 2280 nnhhhn.exe 2796 lrlxlrx.exe 2568 1xlxrff.exe 2792 tbbbnt.exe 2608 hbtnth.exe 2624 dddvj.exe 2604 ddvjd.exe 1864 flrlrrx.exe 2968 lrlflfl.exe 2460 rxfxfrx.exe 756 vvjjd.exe 1248 rrrrrrr.exe 2844 1rrffrl.exe 1440 htbnhn.exe 532 1hbnnn.exe 264 9vjpp.exe 2916 jjddv.exe 1504 dppjj.exe 832 nbbtbh.exe 1324 1jjdp.exe 2224 ttthnt.exe 1352 bhnhtn.exe 1044 1pdpd.exe 1688 xffxlrl.exe 1964 ddvdv.exe 1880 5xxfxfx.exe 2072 jdjdd.exe 1488 lxfrlfx.exe 1968 flrlrxx.exe 2096 7xfflxx.exe 2240 3nbnhb.exe 3032 bbbbnh.exe 2708 flfrlfx.exe 2280 hnntnn.exe 2900 dddvp.exe 2596 fllxxlf.exe 2832 hhbhnn.exe 2696 vddvp.exe 2592 xrrxrxl.exe 2972 5rrxxfx.exe 2228 bbhbth.exe 3008 pjvjv.exe 1832 rflrlrf.exe 1864 5hnnbb.exe 2416 3ddvj.exe 2168 fxrflfr.exe 2196 9hhthb.exe 2320 ttbnbn.exe 2784 5jjvj.exe 1276 rxxxxxf.exe 1600 thhbnh.exe 1152 9vvpv.exe 1772 jdjpj.exe 2544 lflrfxf.exe 2456 nbhhtt.exe 580 jdpjv.exe 1680 rxxrlfr.exe 832 rxrffrl.exe 2408 ntnbtb.exe 2880 pvdvv.exe 1632 lxxrrrx.exe 1396 hnnnhb.exe 1780 jpdvp.exe -
resource yara_rule behavioral1/memory/3036-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-85-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1864-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-340-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2592-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-610-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2600-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-656-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 860 3036 811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe 30 PID 3036 wrote to memory of 860 3036 811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe 30 PID 3036 wrote to memory of 860 3036 811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe 30 PID 3036 wrote to memory of 860 3036 811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe 30 PID 860 wrote to memory of 2280 860 xlxlrlr.exe 31 PID 860 wrote to memory of 2280 860 xlxlrlr.exe 31 PID 860 wrote to memory of 2280 860 xlxlrlr.exe 31 PID 860 wrote to memory of 2280 860 xlxlrlr.exe 31 PID 2280 wrote to memory of 2796 2280 nnhhhn.exe 32 PID 2280 wrote to memory of 2796 2280 nnhhhn.exe 32 PID 2280 wrote to memory of 2796 2280 nnhhhn.exe 32 PID 2280 wrote to memory of 2796 2280 nnhhhn.exe 32 PID 2796 wrote to memory of 2568 2796 lrlxlrx.exe 33 PID 2796 wrote to memory of 2568 2796 lrlxlrx.exe 33 PID 2796 wrote to memory of 2568 2796 lrlxlrx.exe 33 PID 2796 wrote to memory of 2568 2796 lrlxlrx.exe 33 PID 2568 wrote to memory of 2792 2568 1xlxrff.exe 34 PID 2568 wrote to memory of 2792 2568 1xlxrff.exe 34 PID 2568 wrote to memory of 2792 2568 1xlxrff.exe 34 PID 2568 wrote to memory of 2792 2568 1xlxrff.exe 34 PID 2792 wrote to memory of 2608 2792 tbbbnt.exe 35 PID 2792 wrote to memory of 2608 2792 tbbbnt.exe 35 PID 2792 wrote to memory of 2608 2792 tbbbnt.exe 35 PID 2792 wrote to memory of 2608 2792 tbbbnt.exe 35 PID 2608 wrote to memory of 2624 2608 hbtnth.exe 36 PID 2608 wrote to memory of 2624 2608 hbtnth.exe 36 PID 2608 wrote to memory of 2624 2608 hbtnth.exe 36 PID 2608 wrote to memory of 2624 2608 hbtnth.exe 36 PID 2624 wrote to memory of 2604 2624 dddvj.exe 37 PID 2624 wrote to memory of 2604 2624 dddvj.exe 37 PID 2624 wrote to memory of 2604 2624 dddvj.exe 37 PID 2624 wrote to memory of 2604 2624 dddvj.exe 37 PID 2604 wrote to memory of 1864 2604 ddvjd.exe 38 PID 2604 wrote to memory of 1864 2604 ddvjd.exe 38 PID 2604 wrote to memory of 1864 2604 ddvjd.exe 38 PID 2604 wrote to memory of 1864 2604 ddvjd.exe 38 PID 1864 wrote to memory of 2968 1864 flrlrrx.exe 39 PID 1864 wrote to memory of 2968 1864 flrlrrx.exe 39 PID 1864 wrote to memory of 2968 1864 flrlrrx.exe 39 PID 1864 wrote to memory of 2968 1864 flrlrrx.exe 39 PID 2968 wrote to memory of 2460 2968 lrlflfl.exe 40 PID 2968 wrote to memory of 2460 2968 lrlflfl.exe 40 PID 2968 wrote to memory of 2460 2968 lrlflfl.exe 40 PID 2968 wrote to memory of 2460 2968 lrlflfl.exe 40 PID 2460 wrote to memory of 756 2460 rxfxfrx.exe 41 PID 2460 wrote to memory of 756 2460 rxfxfrx.exe 41 PID 2460 wrote to memory of 756 2460 rxfxfrx.exe 41 PID 2460 wrote to memory of 756 2460 rxfxfrx.exe 41 PID 756 wrote to memory of 1248 756 vvjjd.exe 42 PID 756 wrote to memory of 1248 756 vvjjd.exe 42 PID 756 wrote to memory of 1248 756 vvjjd.exe 42 PID 756 wrote to memory of 1248 756 vvjjd.exe 42 PID 1248 wrote to memory of 2844 1248 rrrrrrr.exe 43 PID 1248 wrote to memory of 2844 1248 rrrrrrr.exe 43 PID 1248 wrote to memory of 2844 1248 rrrrrrr.exe 43 PID 1248 wrote to memory of 2844 1248 rrrrrrr.exe 43 PID 2844 wrote to memory of 1440 2844 1rrffrl.exe 44 PID 2844 wrote to memory of 1440 2844 1rrffrl.exe 44 PID 2844 wrote to memory of 1440 2844 1rrffrl.exe 44 PID 2844 wrote to memory of 1440 2844 1rrffrl.exe 44 PID 1440 wrote to memory of 532 1440 htbnhn.exe 45 PID 1440 wrote to memory of 532 1440 htbnhn.exe 45 PID 1440 wrote to memory of 532 1440 htbnhn.exe 45 PID 1440 wrote to memory of 532 1440 htbnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe"C:\Users\Admin\AppData\Local\Temp\811972e64e629fa120c01a7ffceea6ba264308daefe4ab0c0e05c430ff0d20e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xlxlrlr.exec:\xlxlrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\nnhhhn.exec:\nnhhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\lrlxlrx.exec:\lrlxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1xlxrff.exec:\1xlxrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tbbbnt.exec:\tbbbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hbtnth.exec:\hbtnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dddvj.exec:\dddvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ddvjd.exec:\ddvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\flrlrrx.exec:\flrlrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\lrlflfl.exec:\lrlflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rxfxfrx.exec:\rxfxfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vvjjd.exec:\vvjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\1rrffrl.exec:\1rrffrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\htbnhn.exec:\htbnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\1hbnnn.exec:\1hbnnn.exe17⤵
- Executes dropped EXE
PID:532 -
\??\c:\9vjpp.exec:\9vjpp.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\jjddv.exec:\jjddv.exe19⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dppjj.exec:\dppjj.exe20⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nbbtbh.exec:\nbbtbh.exe21⤵
- Executes dropped EXE
PID:832 -
\??\c:\1jjdp.exec:\1jjdp.exe22⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ttthnt.exec:\ttthnt.exe23⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bhnhtn.exec:\bhnhtn.exe24⤵
- Executes dropped EXE
PID:1352 -
\??\c:\1pdpd.exec:\1pdpd.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xffxlrl.exec:\xffxlrl.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ddvdv.exec:\ddvdv.exe27⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5xxfxfx.exec:\5xxfxfx.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jdjdd.exec:\jdjdd.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lxfrlfx.exec:\lxfrlfx.exe30⤵
- Executes dropped EXE
PID:1488 -
\??\c:\flrlrxx.exec:\flrlrxx.exe31⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7xfflxx.exec:\7xfflxx.exe32⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3nbnhb.exec:\3nbnhb.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bbbbnh.exec:\bbbbnh.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\flfrlfx.exec:\flfrlfx.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hnntnn.exec:\hnntnn.exe36⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dddvp.exec:\dddvp.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fllxxlf.exec:\fllxxlf.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hhbhnn.exec:\hhbhnn.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vddvp.exec:\vddvp.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5rrxxfx.exec:\5rrxxfx.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bbhbth.exec:\bbhbth.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjvjv.exec:\pjvjv.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rflrlrf.exec:\rflrlrf.exe45⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5hnnbb.exec:\5hnnbb.exe46⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3ddvj.exec:\3ddvj.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\fxrflfr.exec:\fxrflfr.exe48⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9hhthb.exec:\9hhthb.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ttbnbn.exec:\ttbnbn.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5jjvj.exec:\5jjvj.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rxxxxxf.exec:\rxxxxxf.exe52⤵
- Executes dropped EXE
PID:1276 -
\??\c:\thhbnh.exec:\thhbnh.exe53⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9vvpv.exec:\9vvpv.exe54⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jdjpj.exec:\jdjpj.exe55⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lflrfxf.exec:\lflrfxf.exe56⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nbhhtt.exec:\nbhhtt.exe57⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdpjv.exec:\jdpjv.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe59⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rxrffrl.exec:\rxrffrl.exe60⤵
- Executes dropped EXE
PID:832 -
\??\c:\ntnbtb.exec:\ntnbtb.exe61⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pvdvv.exec:\pvdvv.exe62⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lxxrrrx.exec:\lxxrrrx.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hnnnhb.exec:\hnnnhb.exe64⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jpdvp.exec:\jpdvp.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rfflrfr.exec:\rfflrfr.exe66⤵PID:656
-
\??\c:\bhhbbt.exec:\bhhbbt.exe67⤵PID:688
-
\??\c:\pppjv.exec:\pppjv.exe68⤵PID:1664
-
\??\c:\9dppv.exec:\9dppv.exe69⤵PID:2892
-
\??\c:\frxxrff.exec:\frxxrff.exe70⤵PID:820
-
\??\c:\ntbhbn.exec:\ntbhbn.exe71⤵PID:2052
-
\??\c:\jppjd.exec:\jppjd.exe72⤵PID:1512
-
\??\c:\xxxllrr.exec:\xxxllrr.exe73⤵PID:2876
-
\??\c:\ttthhb.exec:\ttthhb.exe74⤵PID:2372
-
\??\c:\ddjdd.exec:\ddjdd.exe75⤵PID:2096
-
\??\c:\jjjpj.exec:\jjjpj.exe76⤵PID:2020
-
\??\c:\lrxlrxr.exec:\lrxlrxr.exe77⤵PID:2688
-
\??\c:\bhnhnb.exec:\bhnhnb.exe78⤵PID:3056
-
\??\c:\vdvjp.exec:\vdvjp.exe79⤵PID:2700
-
\??\c:\lfllrff.exec:\lfllrff.exe80⤵PID:2692
-
\??\c:\tbhbbn.exec:\tbhbbn.exe81⤵PID:2600
-
\??\c:\tnttbh.exec:\tnttbh.exe82⤵PID:2792
-
\??\c:\vvjvd.exec:\vvjvd.exe83⤵PID:2536
-
\??\c:\rrrllrf.exec:\rrrllrf.exe84⤵PID:2592
-
\??\c:\bnhhhn.exec:\bnhhhn.exe85⤵PID:2732
-
\??\c:\jvvvj.exec:\jvvvj.exe86⤵PID:2036
-
\??\c:\rxxxlrx.exec:\rxxxlrx.exe87⤵PID:2736
-
\??\c:\1nhbth.exec:\1nhbth.exe88⤵PID:2188
-
\??\c:\dpvpp.exec:\dpvpp.exe89⤵PID:2144
-
\??\c:\frrxrrx.exec:\frrxrrx.exe90⤵PID:1972
-
\??\c:\1frlrfl.exec:\1frlrfl.exe91⤵PID:1228
-
\??\c:\3bhbnb.exec:\3bhbnb.exe92⤵PID:664
-
\??\c:\jpjdd.exec:\jpjdd.exe93⤵PID:2748
-
\??\c:\fxflrlr.exec:\fxflrlr.exe94⤵PID:2328
-
\??\c:\nnnhbn.exec:\nnnhbn.exe95⤵PID:1276
-
\??\c:\jddjd.exec:\jddjd.exe96⤵PID:1484
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe97⤵PID:1152
-
\??\c:\nnthth.exec:\nnthth.exe98⤵PID:1772
-
\??\c:\vddvv.exec:\vddvv.exe99⤵PID:2140
-
\??\c:\7lxrxff.exec:\7lxrxff.exe100⤵PID:1288
-
\??\c:\nnntht.exec:\nnntht.exe101⤵PID:1640
-
\??\c:\bthbtt.exec:\bthbtt.exe102⤵PID:2156
-
\??\c:\ppvdv.exec:\ppvdv.exe103⤵PID:1264
-
\??\c:\rfffrlr.exec:\rfffrlr.exe104⤵PID:2424
-
\??\c:\hhtbtb.exec:\hhtbtb.exe105⤵PID:1284
-
\??\c:\pvppj.exec:\pvppj.exe106⤵PID:1044
-
\??\c:\7vvjv.exec:\7vvjv.exe107⤵PID:1356
-
\??\c:\xfllllr.exec:\xfllllr.exe108⤵PID:1540
-
\??\c:\bhhtht.exec:\bhhtht.exe109⤵
- System Location Discovery: System Language Discovery
PID:1172 -
\??\c:\vvjpv.exec:\vvjpv.exe110⤵PID:1560
-
\??\c:\ddddp.exec:\ddddp.exe111⤵
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\xlflrxl.exec:\xlflrxl.exe112⤵PID:2384
-
\??\c:\bhhtbt.exec:\bhhtbt.exe113⤵PID:2044
-
\??\c:\jvdjd.exec:\jvdjd.exe114⤵PID:2308
-
\??\c:\pvjvj.exec:\pvjvj.exe115⤵PID:3020
-
\??\c:\xrfxlfr.exec:\xrfxlfr.exe116⤵PID:2888
-
\??\c:\tttnbh.exec:\tttnbh.exe117⤵PID:1192
-
\??\c:\vppjd.exec:\vppjd.exe118⤵PID:2704
-
\??\c:\7xxrfxr.exec:\7xxrfxr.exe119⤵PID:2020
-
\??\c:\9rrxllr.exec:\9rrxllr.exe120⤵PID:2688
-
\??\c:\nnnbth.exec:\nnnbth.exe121⤵PID:3056
-
\??\c:\jvvvd.exec:\jvvvd.exe122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-