Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe
Resource
win7-20241010-en
General
-
Target
a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe
-
Size
455KB
-
MD5
aa97f363fc325c4030361c94df2e9071
-
SHA1
22a53f17d292159cb08e22c8067c301378d362b5
-
SHA256
a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a
-
SHA512
a43715f274e65808b80eaa99bb91579120d550efe6ef8c7c30f731dfd1522e5d7717016d4b5d49db95074c3f5016ec80649ba35084e898ad503563c2914b2290
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2632-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-68-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-854-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1604-1332-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1196 vjvdd.exe 1472 5fxfxxr.exe 2404 826640.exe 2504 frlrxxl.exe 2976 jdvvj.exe 2832 202804.exe 2936 1bhnnh.exe 2712 xlffxff.exe 2860 frfrrrf.exe 2764 pjjpv.exe 2580 pvjjj.exe 1692 44488.exe 2192 nbhnnn.exe 444 208844.exe 1652 nbnntn.exe 2924 w86288.exe 1644 42844.exe 340 6488480.exe 1776 hnthbb.exe 2284 lfllfxr.exe 2784 rrflxxl.exe 2644 7jvvv.exe 2560 tnhnbt.exe 448 fxllxff.exe 2364 26888.exe 1344 w62262.exe 952 nhbhnt.exe 2552 4284008.exe 2288 lfrrrrx.exe 2216 4802442.exe 2624 400620.exe 2496 486688.exe 1616 pdvvv.exe 2368 pjpjj.exe 1196 rrlfffl.exe 2432 xxlxfrx.exe 2796 hbhbbh.exe 2948 lxllllr.exe 2984 7dpvd.exe 2360 w86248.exe 3044 tnhbhh.exe 2960 6488440.exe 2808 c626262.exe 2372 rrflrrf.exe 2892 04606.exe 2816 9xrlrfl.exe 2924 9jjdp.exe 780 640066.exe 3060 rflxxlf.exe 2720 vvpjv.exe 1664 jdppv.exe 3068 hthnbt.exe 1792 64680.exe 1852 264060.exe 3040 hthnbt.exe 2180 dvjjv.exe 2100 ppdjj.exe 1944 9rxflfl.exe 848 4826884.exe 1328 0802442.exe 344 c648424.exe 1360 1xrfllr.exe 2920 3lxrxrr.exe 1592 nbhhnn.exe -
resource yara_rule behavioral1/memory/1196-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/488-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-1200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-1310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-1332-0x0000000000260000-0x000000000028A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w24466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8262446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o640608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4200284.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2632 wrote to memory of 1196 2632 a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe 30 PID 2632 wrote to memory of 1196 2632 a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe 30 PID 2632 wrote to memory of 1196 2632 a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe 30 PID 2632 wrote to memory of 1196 2632 a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe 30 PID 1196 wrote to memory of 1472 1196 vjvdd.exe 31 PID 1196 wrote to memory of 1472 1196 vjvdd.exe 31 PID 1196 wrote to memory of 1472 1196 vjvdd.exe 31 PID 1196 wrote to memory of 1472 1196 vjvdd.exe 31 PID 1472 wrote to memory of 2404 1472 5fxfxxr.exe 32 PID 1472 wrote to memory of 2404 1472 5fxfxxr.exe 32 PID 1472 wrote to memory of 2404 1472 5fxfxxr.exe 32 PID 1472 wrote to memory of 2404 1472 5fxfxxr.exe 32 PID 2404 wrote to memory of 2504 2404 826640.exe 33 PID 2404 wrote to memory of 2504 2404 826640.exe 33 PID 2404 wrote to memory of 2504 2404 826640.exe 33 PID 2404 wrote to memory of 2504 2404 826640.exe 33 PID 2504 wrote to memory of 2976 2504 frlrxxl.exe 34 PID 2504 wrote to memory of 2976 2504 frlrxxl.exe 34 PID 2504 wrote to memory of 2976 2504 frlrxxl.exe 34 PID 2504 wrote to memory of 2976 2504 frlrxxl.exe 34 PID 2976 wrote to memory of 2832 2976 jdvvj.exe 35 PID 2976 wrote to memory of 2832 2976 jdvvj.exe 35 PID 2976 wrote to memory of 2832 2976 jdvvj.exe 35 PID 2976 wrote to memory of 2832 2976 jdvvj.exe 35 PID 2832 wrote to memory of 2936 2832 202804.exe 36 PID 2832 wrote to memory of 2936 2832 202804.exe 36 PID 2832 wrote to memory of 2936 2832 202804.exe 36 PID 2832 wrote to memory of 2936 2832 202804.exe 36 PID 2936 wrote to memory of 2712 2936 1bhnnh.exe 37 PID 2936 wrote to memory of 2712 2936 1bhnnh.exe 37 PID 2936 wrote to memory of 2712 2936 1bhnnh.exe 37 PID 2936 wrote to memory of 2712 2936 1bhnnh.exe 37 PID 2712 wrote to memory of 2860 2712 xlffxff.exe 38 PID 2712 wrote to memory of 2860 2712 xlffxff.exe 38 PID 2712 wrote to memory of 2860 2712 xlffxff.exe 38 PID 2712 wrote to memory of 2860 2712 xlffxff.exe 38 PID 2860 wrote to memory of 2764 2860 frfrrrf.exe 39 PID 2860 wrote to memory of 2764 2860 frfrrrf.exe 39 PID 2860 wrote to memory of 2764 2860 frfrrrf.exe 39 PID 2860 wrote to memory of 2764 2860 frfrrrf.exe 39 PID 2764 wrote to memory of 2580 2764 pjjpv.exe 40 PID 2764 wrote to memory of 2580 2764 pjjpv.exe 40 PID 2764 wrote to memory of 2580 2764 pjjpv.exe 40 PID 2764 wrote to memory of 2580 2764 pjjpv.exe 40 PID 2580 wrote to memory of 1692 2580 pvjjj.exe 41 PID 2580 wrote to memory of 1692 2580 pvjjj.exe 41 PID 2580 wrote to memory of 1692 2580 pvjjj.exe 41 PID 2580 wrote to memory of 1692 2580 pvjjj.exe 41 PID 1692 wrote to memory of 2192 1692 44488.exe 42 PID 1692 wrote to memory of 2192 1692 44488.exe 42 PID 1692 wrote to memory of 2192 1692 44488.exe 42 PID 1692 wrote to memory of 2192 1692 44488.exe 42 PID 2192 wrote to memory of 444 2192 nbhnnn.exe 43 PID 2192 wrote to memory of 444 2192 nbhnnn.exe 43 PID 2192 wrote to memory of 444 2192 nbhnnn.exe 43 PID 2192 wrote to memory of 444 2192 nbhnnn.exe 43 PID 444 wrote to memory of 1652 444 208844.exe 44 PID 444 wrote to memory of 1652 444 208844.exe 44 PID 444 wrote to memory of 1652 444 208844.exe 44 PID 444 wrote to memory of 1652 444 208844.exe 44 PID 1652 wrote to memory of 2924 1652 nbnntn.exe 45 PID 1652 wrote to memory of 2924 1652 nbnntn.exe 45 PID 1652 wrote to memory of 2924 1652 nbnntn.exe 45 PID 1652 wrote to memory of 2924 1652 nbnntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe"C:\Users\Admin\AppData\Local\Temp\a6d62540f96ee7968e596946f696fd956a2d1932ffb71e745fccf3c26be5435a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vjvdd.exec:\vjvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\5fxfxxr.exec:\5fxfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\826640.exec:\826640.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\frlrxxl.exec:\frlrxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdvvj.exec:\jdvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\202804.exec:\202804.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1bhnnh.exec:\1bhnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xlffxff.exec:\xlffxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\frfrrrf.exec:\frfrrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pjjpv.exec:\pjjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pvjjj.exec:\pvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\44488.exec:\44488.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\nbhnnn.exec:\nbhnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\208844.exec:\208844.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\nbnntn.exec:\nbnntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\w86288.exec:\w86288.exe17⤵
- Executes dropped EXE
PID:2924 -
\??\c:\42844.exec:\42844.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\6488480.exec:\6488480.exe19⤵
- Executes dropped EXE
PID:340 -
\??\c:\hnthbb.exec:\hnthbb.exe20⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lfllfxr.exec:\lfllfxr.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rrflxxl.exec:\rrflxxl.exe22⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7jvvv.exec:\7jvvv.exe23⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnhnbt.exec:\tnhnbt.exe24⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxllxff.exec:\fxllxff.exe25⤵
- Executes dropped EXE
PID:448 -
\??\c:\26888.exec:\26888.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\w62262.exec:\w62262.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\nhbhnt.exec:\nhbhnt.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\4284008.exec:\4284008.exe29⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe30⤵
- Executes dropped EXE
PID:2288 -
\??\c:\4802442.exec:\4802442.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\400620.exec:\400620.exe32⤵
- Executes dropped EXE
PID:2624 -
\??\c:\486688.exec:\486688.exe33⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pdvvv.exec:\pdvvv.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pjpjj.exec:\pjpjj.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rrlfffl.exec:\rrlfffl.exe36⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xxlxfrx.exec:\xxlxfrx.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbhbbh.exec:\hbhbbh.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxllllr.exec:\lxllllr.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7dpvd.exec:\7dpvd.exe40⤵
- Executes dropped EXE
PID:2984 -
\??\c:\w86248.exec:\w86248.exe41⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tnhbhh.exec:\tnhbhh.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\6488440.exec:\6488440.exe43⤵
- Executes dropped EXE
PID:2960 -
\??\c:\c626262.exec:\c626262.exe44⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrflrrf.exec:\rrflrrf.exe45⤵
- Executes dropped EXE
PID:2372 -
\??\c:\04606.exec:\04606.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9xrlrfl.exec:\9xrlrfl.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9jjdp.exec:\9jjdp.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\640066.exec:\640066.exe49⤵
- Executes dropped EXE
PID:780 -
\??\c:\rflxxlf.exec:\rflxxlf.exe50⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vvpjv.exec:\vvpjv.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jdppv.exec:\jdppv.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hthnbt.exec:\hthnbt.exe53⤵
- Executes dropped EXE
PID:3068 -
\??\c:\64680.exec:\64680.exe54⤵
- Executes dropped EXE
PID:1792 -
\??\c:\264060.exec:\264060.exe55⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hthnbt.exec:\hthnbt.exe56⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dvjjv.exec:\dvjjv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\ppdjj.exec:\ppdjj.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9rxflfl.exec:\9rxflfl.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\4826884.exec:\4826884.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\0802442.exec:\0802442.exe61⤵
- Executes dropped EXE
PID:1328 -
\??\c:\c648424.exec:\c648424.exe62⤵
- Executes dropped EXE
PID:344 -
\??\c:\1xrfllr.exec:\1xrfllr.exe63⤵
- Executes dropped EXE
PID:1360 -
\??\c:\3lxrxrr.exec:\3lxrxrr.exe64⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbhhnn.exec:\nbhhnn.exe65⤵
- Executes dropped EXE
PID:1592 -
\??\c:\604682.exec:\604682.exe66⤵PID:2216
-
\??\c:\20806.exec:\20806.exe67⤵PID:2144
-
\??\c:\1fxxflr.exec:\1fxxflr.exe68⤵PID:1252
-
\??\c:\g2406.exec:\g2406.exe69⤵PID:2160
-
\??\c:\bnbbbb.exec:\bnbbbb.exe70⤵PID:1920
-
\??\c:\5pdjd.exec:\5pdjd.exe71⤵PID:2248
-
\??\c:\pdppd.exec:\pdppd.exe72⤵PID:3024
-
\??\c:\5jvjd.exec:\5jvjd.exe73⤵PID:2992
-
\??\c:\flxrlfx.exec:\flxrlfx.exe74⤵PID:1248
-
\??\c:\66680.exec:\66680.exe75⤵PID:2168
-
\??\c:\7vjpj.exec:\7vjpj.exe76⤵PID:2960
-
\??\c:\jdvjp.exec:\jdvjp.exe77⤵PID:2316
-
\??\c:\824688.exec:\824688.exe78⤵PID:2952
-
\??\c:\pddjp.exec:\pddjp.exe79⤵PID:2192
-
\??\c:\dpddd.exec:\dpddd.exe80⤵PID:2696
-
\??\c:\xfflxrf.exec:\xfflxrf.exe81⤵PID:2816
-
\??\c:\9nnnbb.exec:\9nnnbb.exe82⤵PID:2476
-
\??\c:\djppp.exec:\djppp.exe83⤵PID:1136
-
\??\c:\g4066.exec:\g4066.exe84⤵PID:1424
-
\??\c:\3jjjd.exec:\3jjjd.exe85⤵PID:2512
-
\??\c:\tthtbh.exec:\tthtbh.exe86⤵PID:592
-
\??\c:\1vjvj.exec:\1vjvj.exe87⤵PID:2928
-
\??\c:\6062228.exec:\6062228.exe88⤵PID:2932
-
\??\c:\060640.exec:\060640.exe89⤵PID:1940
-
\??\c:\4822846.exec:\4822846.exe90⤵PID:264
-
\??\c:\a6402.exec:\a6402.exe91⤵PID:2312
-
\??\c:\ttbbnh.exec:\ttbbnh.exe92⤵PID:1728
-
\??\c:\26884.exec:\26884.exe93⤵PID:2880
-
\??\c:\pjvvv.exec:\pjvvv.exe94⤵PID:2284
-
\??\c:\60880.exec:\60880.exe95⤵PID:288
-
\??\c:\2224282.exec:\2224282.exe96⤵PID:828
-
\??\c:\fflfffr.exec:\fflfffr.exe97⤵PID:1992
-
\??\c:\jpppj.exec:\jpppj.exe98⤵PID:2364
-
\??\c:\26884.exec:\26884.exe99⤵PID:1292
-
\??\c:\pjdpd.exec:\pjdpd.exe100⤵PID:2792
-
\??\c:\1hnnnt.exec:\1hnnnt.exe101⤵PID:612
-
\??\c:\8802888.exec:\8802888.exe102⤵PID:1072
-
\??\c:\tnhbhn.exec:\tnhbhn.exe103⤵PID:2356
-
\??\c:\lfxrfll.exec:\lfxrfll.exe104⤵PID:2732
-
\??\c:\g4228.exec:\g4228.exe105⤵PID:2740
-
\??\c:\60846.exec:\60846.exe106⤵PID:2416
-
\??\c:\208422.exec:\208422.exe107⤵PID:2288
-
\??\c:\864026.exec:\864026.exe108⤵PID:2496
-
\??\c:\pdpvd.exec:\pdpvd.exe109⤵PID:2072
-
\??\c:\bhhthn.exec:\bhhthn.exe110⤵PID:1804
-
\??\c:\dpvvv.exec:\dpvvv.exe111⤵PID:1936
-
\??\c:\6044062.exec:\6044062.exe112⤵PID:2568
-
\??\c:\dpvpp.exec:\dpvpp.exe113⤵PID:632
-
\??\c:\bhnbnb.exec:\bhnbnb.exe114⤵PID:272
-
\??\c:\xlflxfl.exec:\xlflxfl.exe115⤵PID:1920
-
\??\c:\5ttthn.exec:\5ttthn.exe116⤵PID:2436
-
\??\c:\9dvvv.exec:\9dvvv.exe117⤵PID:3024
-
\??\c:\htbhtt.exec:\htbhtt.exe118⤵PID:2848
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe119⤵PID:2028
-
\??\c:\jvjpp.exec:\jvjpp.exe120⤵PID:1496
-
\??\c:\c462802.exec:\c462802.exe121⤵PID:2388
-
\??\c:\5vpvd.exec:\5vpvd.exe122⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-