Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe
Resource
win7-20240729-en
General
-
Target
8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe
-
Size
456KB
-
MD5
4f4711dc16fd510b8eb7c602d68a2069
-
SHA1
50d1e340a14439e58e98152a912a546250bdfb45
-
SHA256
8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd
-
SHA512
40b1053252f7d3e775693ac3fdae9aefc29ed8c76fab9f7219bb2775c2709061b8d3bb39428ff9428ef49951c420a0a16e13a3612562fc6e27c15f36d4262c9e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRh:q7Tc2NYHUrAwfMp3CDRh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-74-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2172-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-91-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1212-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/404-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2700 bbntnt.exe 2704 jppvp.exe 2732 ffxffrf.exe 2844 nnbhtb.exe 2600 pvjjv.exe 2584 5rlrlrl.exe 2604 bnbbnt.exe 1128 pjjjv.exe 2524 vvddj.exe 2172 rxllrrx.exe 1212 jpdjv.exe 2148 1vvjv.exe 1488 pdvdj.exe 492 7rxlrxf.exe 404 vjvdj.exe 2516 1rlrxxx.exe 588 7jdjp.exe 2028 rrxlxxf.exe 636 ppjjp.exe 2180 bbhhnt.exe 2232 pvjvj.exe 2348 bnhnbh.exe 1828 vjvjv.exe 920 hhnnbb.exe 2020 ffrfrxl.exe 2480 1tntbb.exe 1160 pdvdp.exe 2160 1ttbbn.exe 1156 dpdjp.exe 880 xflxllx.exe 2324 bhntbh.exe 2696 1lxlxfr.exe 1620 lrflxfl.exe 2144 bntbnt.exe 2724 1rfxfxf.exe 2844 bbnbnn.exe 1716 nnnnbb.exe 2572 vdjpv.exe 3068 1frrxfr.exe 2152 bbhhhb.exe 2352 ntbbnn.exe 2344 djvdj.exe 3004 ffllrrx.exe 1892 5ntnnn.exe 2076 jjppd.exe 644 dvdvd.exe 1500 fffrfff.exe 2100 3ntbhn.exe 2824 vvppp.exe 2128 dvdvp.exe 1952 xxxxffl.exe 2132 9btbhn.exe 1660 vjpvv.exe 1776 xxrxlxr.exe 2112 hhnhhh.exe 2336 dpdjv.exe 2200 vdpvd.exe 2208 lrlfllx.exe 1948 7thhhh.exe 2348 ddddd.exe 2508 7dvvd.exe 348 xxrrxrr.exe 960 bbbbbb.exe 1192 ppvdj.exe -
resource yara_rule behavioral1/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-858-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2700 1072 8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe 30 PID 1072 wrote to memory of 2700 1072 8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe 30 PID 1072 wrote to memory of 2700 1072 8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe 30 PID 1072 wrote to memory of 2700 1072 8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe 30 PID 2700 wrote to memory of 2704 2700 bbntnt.exe 31 PID 2700 wrote to memory of 2704 2700 bbntnt.exe 31 PID 2700 wrote to memory of 2704 2700 bbntnt.exe 31 PID 2700 wrote to memory of 2704 2700 bbntnt.exe 31 PID 2704 wrote to memory of 2732 2704 jppvp.exe 32 PID 2704 wrote to memory of 2732 2704 jppvp.exe 32 PID 2704 wrote to memory of 2732 2704 jppvp.exe 32 PID 2704 wrote to memory of 2732 2704 jppvp.exe 32 PID 2732 wrote to memory of 2844 2732 ffxffrf.exe 33 PID 2732 wrote to memory of 2844 2732 ffxffrf.exe 33 PID 2732 wrote to memory of 2844 2732 ffxffrf.exe 33 PID 2732 wrote to memory of 2844 2732 ffxffrf.exe 33 PID 2844 wrote to memory of 2600 2844 nnbhtb.exe 34 PID 2844 wrote to memory of 2600 2844 nnbhtb.exe 34 PID 2844 wrote to memory of 2600 2844 nnbhtb.exe 34 PID 2844 wrote to memory of 2600 2844 nnbhtb.exe 34 PID 2600 wrote to memory of 2584 2600 pvjjv.exe 35 PID 2600 wrote to memory of 2584 2600 pvjjv.exe 35 PID 2600 wrote to memory of 2584 2600 pvjjv.exe 35 PID 2600 wrote to memory of 2584 2600 pvjjv.exe 35 PID 2584 wrote to memory of 2604 2584 5rlrlrl.exe 36 PID 2584 wrote to memory of 2604 2584 5rlrlrl.exe 36 PID 2584 wrote to memory of 2604 2584 5rlrlrl.exe 36 PID 2584 wrote to memory of 2604 2584 5rlrlrl.exe 36 PID 2604 wrote to memory of 1128 2604 bnbbnt.exe 37 PID 2604 wrote to memory of 1128 2604 bnbbnt.exe 37 PID 2604 wrote to memory of 1128 2604 bnbbnt.exe 37 PID 2604 wrote to memory of 1128 2604 bnbbnt.exe 37 PID 1128 wrote to memory of 2524 1128 pjjjv.exe 38 PID 1128 wrote to memory of 2524 1128 pjjjv.exe 38 PID 1128 wrote to memory of 2524 1128 pjjjv.exe 38 PID 1128 wrote to memory of 2524 1128 pjjjv.exe 38 PID 2524 wrote to memory of 2172 2524 vvddj.exe 39 PID 2524 wrote to memory of 2172 2524 vvddj.exe 39 PID 2524 wrote to memory of 2172 2524 vvddj.exe 39 PID 2524 wrote to memory of 2172 2524 vvddj.exe 39 PID 2172 wrote to memory of 1212 2172 rxllrrx.exe 40 PID 2172 wrote to memory of 1212 2172 rxllrrx.exe 40 PID 2172 wrote to memory of 1212 2172 rxllrrx.exe 40 PID 2172 wrote to memory of 1212 2172 rxllrrx.exe 40 PID 1212 wrote to memory of 2148 1212 jpdjv.exe 41 PID 1212 wrote to memory of 2148 1212 jpdjv.exe 41 PID 1212 wrote to memory of 2148 1212 jpdjv.exe 41 PID 1212 wrote to memory of 2148 1212 jpdjv.exe 41 PID 2148 wrote to memory of 1488 2148 1vvjv.exe 42 PID 2148 wrote to memory of 1488 2148 1vvjv.exe 42 PID 2148 wrote to memory of 1488 2148 1vvjv.exe 42 PID 2148 wrote to memory of 1488 2148 1vvjv.exe 42 PID 1488 wrote to memory of 492 1488 pdvdj.exe 43 PID 1488 wrote to memory of 492 1488 pdvdj.exe 43 PID 1488 wrote to memory of 492 1488 pdvdj.exe 43 PID 1488 wrote to memory of 492 1488 pdvdj.exe 43 PID 492 wrote to memory of 404 492 7rxlrxf.exe 44 PID 492 wrote to memory of 404 492 7rxlrxf.exe 44 PID 492 wrote to memory of 404 492 7rxlrxf.exe 44 PID 492 wrote to memory of 404 492 7rxlrxf.exe 44 PID 404 wrote to memory of 2516 404 vjvdj.exe 45 PID 404 wrote to memory of 2516 404 vjvdj.exe 45 PID 404 wrote to memory of 2516 404 vjvdj.exe 45 PID 404 wrote to memory of 2516 404 vjvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe"C:\Users\Admin\AppData\Local\Temp\8a39b2b17a431219043790a609486d59fc0ff541d9ff24155858d99f88e206fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\bbntnt.exec:\bbntnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jppvp.exec:\jppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ffxffrf.exec:\ffxffrf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnbhtb.exec:\nnbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pvjjv.exec:\pvjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5rlrlrl.exec:\5rlrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\bnbbnt.exec:\bnbbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pjjjv.exec:\pjjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vvddj.exec:\vvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rxllrrx.exec:\rxllrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jpdjv.exec:\jpdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\1vvjv.exec:\1vvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pdvdj.exec:\pdvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\7rxlrxf.exec:\7rxlrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\vjvdj.exec:\vjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\1rlrxxx.exec:\1rlrxxx.exe17⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7jdjp.exec:\7jdjp.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\rrxlxxf.exec:\rrxlxxf.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppjjp.exec:\ppjjp.exe20⤵
- Executes dropped EXE
PID:636 -
\??\c:\bbhhnt.exec:\bbhhnt.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pvjvj.exec:\pvjvj.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bnhnbh.exec:\bnhnbh.exe23⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vjvjv.exec:\vjvjv.exe24⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hhnnbb.exec:\hhnnbb.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe26⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1tntbb.exec:\1tntbb.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pdvdp.exec:\pdvdp.exe28⤵
- Executes dropped EXE
PID:1160 -
\??\c:\1ttbbn.exec:\1ttbbn.exe29⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpdjp.exec:\dpdjp.exe30⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xflxllx.exec:\xflxllx.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\bhntbh.exec:\bhntbh.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1lxlxfr.exec:\1lxlxfr.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lrflxfl.exec:\lrflxfl.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bntbnt.exec:\bntbnt.exe35⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1rfxfxf.exec:\1rfxfxf.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bbnbnn.exec:\bbnbnn.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nnnnbb.exec:\nnnnbb.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vdjpv.exec:\vdjpv.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1frrxfr.exec:\1frrxfr.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bbhhhb.exec:\bbhhhb.exe41⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ntbbnn.exec:\ntbbnn.exe42⤵
- Executes dropped EXE
PID:2352 -
\??\c:\djvdj.exec:\djvdj.exe43⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ffllrrx.exec:\ffllrrx.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5ntnnn.exec:\5ntnnn.exe45⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jjppd.exec:\jjppd.exe46⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dvdvd.exec:\dvdvd.exe47⤵
- Executes dropped EXE
PID:644 -
\??\c:\fffrfff.exec:\fffrfff.exe48⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3ntbhn.exec:\3ntbhn.exe49⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vvppp.exec:\vvppp.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvdvp.exec:\dvdvp.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xxxxffl.exec:\xxxxffl.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9btbhn.exec:\9btbhn.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vjpvv.exec:\vjpvv.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xxrxlxr.exec:\xxrxlxr.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hhnhhh.exec:\hhnhhh.exe56⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dpdjv.exec:\dpdjv.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vdpvd.exec:\vdpvd.exe58⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lrlfllx.exec:\lrlfllx.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7thhhh.exec:\7thhhh.exe60⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ddddd.exec:\ddddd.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7dvvd.exec:\7dvvd.exe62⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xxrrxrr.exec:\xxrrxrr.exe63⤵
- Executes dropped EXE
PID:348 -
\??\c:\bbbbbb.exec:\bbbbbb.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\ppvdj.exec:\ppvdj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192 -
\??\c:\ddpvv.exec:\ddpvv.exe66⤵PID:2464
-
\??\c:\xxlffff.exec:\xxlffff.exe67⤵PID:2168
-
\??\c:\tntntt.exec:\tntntt.exe68⤵PID:1160
-
\??\c:\vdpdj.exec:\vdpdj.exe69⤵PID:2288
-
\??\c:\xxllrxl.exec:\xxllrxl.exe70⤵PID:892
-
\??\c:\xxxxfxf.exec:\xxxxfxf.exe71⤵PID:1512
-
\??\c:\hhnnbn.exec:\hhnnbn.exe72⤵PID:2472
-
\??\c:\ddppd.exec:\ddppd.exe73⤵PID:2976
-
\??\c:\rxlxxlx.exec:\rxlxxlx.exe74⤵PID:2988
-
\??\c:\llxxxxl.exec:\llxxxxl.exe75⤵PID:2972
-
\??\c:\1nntnb.exec:\1nntnb.exe76⤵PID:2684
-
\??\c:\1jjpd.exec:\1jjpd.exe77⤵PID:2144
-
\??\c:\1fxfrxl.exec:\1fxfrxl.exe78⤵PID:2816
-
\??\c:\1hhntb.exec:\1hhntb.exe79⤵PID:2716
-
\??\c:\htnthn.exec:\htnthn.exe80⤵PID:1716
-
\??\c:\lrllxxl.exec:\lrllxxl.exe81⤵PID:2060
-
\??\c:\bhthnt.exec:\bhthnt.exe82⤵PID:1420
-
\??\c:\1vjdj.exec:\1vjdj.exe83⤵PID:2564
-
\??\c:\dpdjp.exec:\dpdjp.exe84⤵PID:2352
-
\??\c:\5rrxlrx.exec:\5rrxlrx.exe85⤵PID:2344
-
\??\c:\bnbbht.exec:\bnbbht.exe86⤵PID:336
-
\??\c:\9vppd.exec:\9vppd.exe87⤵PID:1764
-
\??\c:\vvpdj.exec:\vvpdj.exe88⤵PID:2076
-
\??\c:\xxlrrxl.exec:\xxlrrxl.exe89⤵PID:2148
-
\??\c:\hnhhtb.exec:\hnhhtb.exe90⤵PID:1960
-
\??\c:\1jvdp.exec:\1jvdp.exe91⤵PID:1220
-
\??\c:\fflxlxf.exec:\fflxlxf.exe92⤵PID:1172
-
\??\c:\ffrxfrf.exec:\ffrxfrf.exe93⤵PID:444
-
\??\c:\hthbnb.exec:\hthbnb.exe94⤵PID:2356
-
\??\c:\jjvdp.exec:\jjvdp.exe95⤵PID:1164
-
\??\c:\lxfflrr.exec:\lxfflrr.exe96⤵PID:696
-
\??\c:\bbhntb.exec:\bbhntb.exe97⤵PID:2016
-
\??\c:\vvdjv.exec:\vvdjv.exe98⤵PID:1888
-
\??\c:\djvdd.exec:\djvdd.exe99⤵PID:2196
-
\??\c:\3lffrxl.exec:\3lffrxl.exe100⤵PID:2276
-
\??\c:\btnbhh.exec:\btnbhh.exe101⤵PID:952
-
\??\c:\nnbtbh.exec:\nnbtbh.exe102⤵PID:1700
-
\??\c:\djvvj.exec:\djvvj.exe103⤵PID:780
-
\??\c:\xxxxlll.exec:\xxxxlll.exe104⤵PID:1828
-
\??\c:\hntbhh.exec:\hntbhh.exe105⤵PID:2912
-
\??\c:\nbbbbn.exec:\nbbbbn.exe106⤵PID:1564
-
\??\c:\pjpjp.exec:\pjpjp.exe107⤵PID:1940
-
\??\c:\xlffrfl.exec:\xlffrfl.exe108⤵PID:2512
-
\??\c:\bhbhnt.exec:\bhbhnt.exe109⤵PID:2216
-
\??\c:\9btbbt.exec:\9btbbt.exe110⤵PID:1004
-
\??\c:\jpjjp.exec:\jpjjp.exe111⤵PID:1676
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe112⤵PID:2256
-
\??\c:\tnbhhn.exec:\tnbhhn.exe113⤵PID:880
-
\??\c:\5btthn.exec:\5btthn.exe114⤵PID:2680
-
\??\c:\rxlrxlr.exec:\rxlrxlr.exe115⤵PID:2792
-
\??\c:\tthhnn.exec:\tthhnn.exe116⤵PID:2704
-
\??\c:\jpdpv.exec:\jpdpv.exe117⤵PID:2712
-
\??\c:\ffffrrf.exec:\ffffrrf.exe118⤵PID:2808
-
\??\c:\rrxxffl.exec:\rrxxffl.exe119⤵PID:2576
-
\??\c:\hbhbhn.exec:\hbhbhn.exe120⤵PID:2768
-
\??\c:\9pddj.exec:\9pddj.exe121⤵PID:2596
-
\??\c:\djvvd.exec:\djvvd.exe122⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-