Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe
Resource
win7-20240903-en
General
-
Target
f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe
-
Size
54KB
-
MD5
d8490520b24f1e96ae3ca8df5ef552c0
-
SHA1
99acdb5d70ecdf283a8231459165e3a0c11f35b9
-
SHA256
f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1
-
SHA512
78d77f43d6079744c89dc1388eabf74d415f432e32827bc96d58ec231982d99c75dd1f44c607f3a70cf89dd9e13564693ae0ec2eb143a48d88309b07e806cf9b
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJL:0cdpeeBSHHMHLf9RyIE1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/1716-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-64-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/2612-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-121-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2844-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-138-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1252-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-179-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2096-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-277-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2960-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-320-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2816-333-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2528-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-540-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1592-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-553-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1592-560-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2816-622-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-635-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2988-666-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-729-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-739-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-742-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2104-769-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1400-795-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2452-840-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2904-873-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1708-953-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-984-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3008-987-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1808-1010-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2764-1030-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2480-1075-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2892-1264-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2092-1336-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 lfffxrr.exe 2648 hhnnhh.exe 2928 hhbbnn.exe 2808 jjvpp.exe 2896 7rxlxxl.exe 2612 3bnthh.exe 2520 hhttbb.exe 2128 5dvdj.exe 1708 9lfrxxf.exe 560 fxlfllr.exe 1496 bthntb.exe 2844 5vppv.exe 2900 3jjdd.exe 2540 xrffrrx.exe 2352 lfrxxxf.exe 1252 bnnbtb.exe 2784 vvpvp.exe 1736 vpjjd.exe 2600 rrlflxr.exe 852 htnnnb.exe 2096 jdjdv.exe 2088 9jdjp.exe 2196 fxlrffr.exe 2932 btnhnh.exe 2292 hhnhnn.exe 708 dvjdd.exe 1592 1vjvd.exe 1536 fflrffl.exe 1052 hbtnnt.exe 856 7tnnbt.exe 2960 jjjpp.exe 2212 jpdjp.exe 1072 7fllxrx.exe 2132 hbhntb.exe 2708 thbttn.exe 2140 jdppp.exe 2604 9dpdd.exe 2816 5xfxlll.exe 2232 1xrxlrr.exe 2528 7nbhnn.exe 2680 hbhtnt.exe 2800 ppvpj.exe 2576 1jppv.exe 2180 lfxlflr.exe 1064 xxfrfll.exe 604 bbhtbt.exe 992 httttn.exe 1108 jjppv.exe 1864 fflllfx.exe 2868 rllfllx.exe 2892 nnbbhb.exe 3040 bbbbnn.exe 3024 vjppp.exe 1740 3jvvj.exe 1640 rlrxllx.exe 2272 3lxlrrl.exe 2744 3rlllfl.exe 2684 9bnhbh.exe 1736 bthbbh.exe 2600 vpdvj.exe 1996 tttbnt.exe 2484 bthhhh.exe 2476 bbhnnh.exe 2088 pjppd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2184 1716 f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe 28 PID 1716 wrote to memory of 2184 1716 f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe 28 PID 1716 wrote to memory of 2184 1716 f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe 28 PID 1716 wrote to memory of 2184 1716 f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe 28 PID 2184 wrote to memory of 2648 2184 lfffxrr.exe 29 PID 2184 wrote to memory of 2648 2184 lfffxrr.exe 29 PID 2184 wrote to memory of 2648 2184 lfffxrr.exe 29 PID 2184 wrote to memory of 2648 2184 lfffxrr.exe 29 PID 2648 wrote to memory of 2928 2648 hhnnhh.exe 30 PID 2648 wrote to memory of 2928 2648 hhnnhh.exe 30 PID 2648 wrote to memory of 2928 2648 hhnnhh.exe 30 PID 2648 wrote to memory of 2928 2648 hhnnhh.exe 30 PID 2928 wrote to memory of 2808 2928 hhbbnn.exe 31 PID 2928 wrote to memory of 2808 2928 hhbbnn.exe 31 PID 2928 wrote to memory of 2808 2928 hhbbnn.exe 31 PID 2928 wrote to memory of 2808 2928 hhbbnn.exe 31 PID 2808 wrote to memory of 2896 2808 jjvpp.exe 32 PID 2808 wrote to memory of 2896 2808 jjvpp.exe 32 PID 2808 wrote to memory of 2896 2808 jjvpp.exe 32 PID 2808 wrote to memory of 2896 2808 jjvpp.exe 32 PID 2896 wrote to memory of 2612 2896 7rxlxxl.exe 33 PID 2896 wrote to memory of 2612 2896 7rxlxxl.exe 33 PID 2896 wrote to memory of 2612 2896 7rxlxxl.exe 33 PID 2896 wrote to memory of 2612 2896 7rxlxxl.exe 33 PID 2612 wrote to memory of 2520 2612 3bnthh.exe 34 PID 2612 wrote to memory of 2520 2612 3bnthh.exe 34 PID 2612 wrote to memory of 2520 2612 3bnthh.exe 34 PID 2612 wrote to memory of 2520 2612 3bnthh.exe 34 PID 2520 wrote to memory of 2128 2520 hhttbb.exe 35 PID 2520 wrote to memory of 2128 2520 hhttbb.exe 35 PID 2520 wrote to memory of 2128 2520 hhttbb.exe 35 PID 2520 wrote to memory of 2128 2520 hhttbb.exe 35 PID 2128 wrote to memory of 1708 2128 5dvdj.exe 36 PID 2128 wrote to memory of 1708 2128 5dvdj.exe 36 PID 2128 wrote to memory of 1708 2128 5dvdj.exe 36 PID 2128 wrote to memory of 1708 2128 5dvdj.exe 36 PID 1708 wrote to memory of 560 1708 9lfrxxf.exe 37 PID 1708 wrote to memory of 560 1708 9lfrxxf.exe 37 PID 1708 wrote to memory of 560 1708 9lfrxxf.exe 37 PID 1708 wrote to memory of 560 1708 9lfrxxf.exe 37 PID 560 wrote to memory of 1496 560 fxlfllr.exe 38 PID 560 wrote to memory of 1496 560 fxlfllr.exe 38 PID 560 wrote to memory of 1496 560 fxlfllr.exe 38 PID 560 wrote to memory of 1496 560 fxlfllr.exe 38 PID 1496 wrote to memory of 2844 1496 bthntb.exe 39 PID 1496 wrote to memory of 2844 1496 bthntb.exe 39 PID 1496 wrote to memory of 2844 1496 bthntb.exe 39 PID 1496 wrote to memory of 2844 1496 bthntb.exe 39 PID 2844 wrote to memory of 2900 2844 5vppv.exe 40 PID 2844 wrote to memory of 2900 2844 5vppv.exe 40 PID 2844 wrote to memory of 2900 2844 5vppv.exe 40 PID 2844 wrote to memory of 2900 2844 5vppv.exe 40 PID 2900 wrote to memory of 2540 2900 3jjdd.exe 41 PID 2900 wrote to memory of 2540 2900 3jjdd.exe 41 PID 2900 wrote to memory of 2540 2900 3jjdd.exe 41 PID 2900 wrote to memory of 2540 2900 3jjdd.exe 41 PID 2540 wrote to memory of 2352 2540 xrffrrx.exe 42 PID 2540 wrote to memory of 2352 2540 xrffrrx.exe 42 PID 2540 wrote to memory of 2352 2540 xrffrrx.exe 42 PID 2540 wrote to memory of 2352 2540 xrffrrx.exe 42 PID 2352 wrote to memory of 1252 2352 lfrxxxf.exe 43 PID 2352 wrote to memory of 1252 2352 lfrxxxf.exe 43 PID 2352 wrote to memory of 1252 2352 lfrxxxf.exe 43 PID 2352 wrote to memory of 1252 2352 lfrxxxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe"C:\Users\Admin\AppData\Local\Temp\f1386cfbfaec37b76233324d09a5413120b930a5d36379291d1240aec4fbf1b1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lfffxrr.exec:\lfffxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hhnnhh.exec:\hhnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hhbbnn.exec:\hhbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jjvpp.exec:\jjvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7rxlxxl.exec:\7rxlxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3bnthh.exec:\3bnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\hhttbb.exec:\hhttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5dvdj.exec:\5dvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\9lfrxxf.exec:\9lfrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\fxlfllr.exec:\fxlfllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\bthntb.exec:\bthntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\5vppv.exec:\5vppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3jjdd.exec:\3jjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xrffrrx.exec:\xrffrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bnnbtb.exec:\bnnbtb.exe17⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vvpvp.exec:\vvpvp.exe18⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vpjjd.exec:\vpjjd.exe19⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rrlflxr.exec:\rrlflxr.exe20⤵
- Executes dropped EXE
PID:2600 -
\??\c:\htnnnb.exec:\htnnnb.exe21⤵
- Executes dropped EXE
PID:852 -
\??\c:\jdjdv.exec:\jdjdv.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9jdjp.exec:\9jdjp.exe23⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fxlrffr.exec:\fxlrffr.exe24⤵
- Executes dropped EXE
PID:2196 -
\??\c:\btnhnh.exec:\btnhnh.exe25⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhnhnn.exec:\hhnhnn.exe26⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvjdd.exec:\dvjdd.exe27⤵
- Executes dropped EXE
PID:708 -
\??\c:\1vjvd.exec:\1vjvd.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fflrffl.exec:\fflrffl.exe29⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbtnnt.exec:\hbtnnt.exe30⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7tnnbt.exec:\7tnnbt.exe31⤵
- Executes dropped EXE
PID:856 -
\??\c:\jjjpp.exec:\jjjpp.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jpdjp.exec:\jpdjp.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7fllxrx.exec:\7fllxrx.exe34⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hbhntb.exec:\hbhntb.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\thbttn.exec:\thbttn.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jdppp.exec:\jdppp.exe37⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9dpdd.exec:\9dpdd.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5xfxlll.exec:\5xfxlll.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1xrxlrr.exec:\1xrxlrr.exe40⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7nbhnn.exec:\7nbhnn.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbhtnt.exec:\hbhtnt.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ppvpj.exec:\ppvpj.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1jppv.exec:\1jppv.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lfxlflr.exec:\lfxlflr.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxfrfll.exec:\xxfrfll.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bbhtbt.exec:\bbhtbt.exe47⤵
- Executes dropped EXE
PID:604 -
\??\c:\httttn.exec:\httttn.exe48⤵
- Executes dropped EXE
PID:992 -
\??\c:\jjppv.exec:\jjppv.exe49⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fflllfx.exec:\fflllfx.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rllfllx.exec:\rllfllx.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nnbbhb.exec:\nnbbhb.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bbbbnn.exec:\bbbbnn.exe53⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vjppp.exec:\vjppp.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3jvvj.exec:\3jvvj.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rlrxllx.exec:\rlrxllx.exe56⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3lxlrrl.exec:\3lxlrrl.exe57⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3rlllfl.exec:\3rlllfl.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9bnhbh.exec:\9bnhbh.exe59⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bthbbh.exec:\bthbbh.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vpdvj.exec:\vpdvj.exe61⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tttbnt.exec:\tttbnt.exe62⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bthhhh.exec:\bthhhh.exe63⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bbhnnh.exec:\bbhnnh.exe64⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjppd.exec:\pjppd.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rlrxfll.exec:\rlrxfll.exe66⤵PID:2480
-
\??\c:\3xlrffl.exec:\3xlrffl.exe67⤵PID:2936
-
\??\c:\nnbbhb.exec:\nnbbhb.exe68⤵PID:448
-
\??\c:\nbbbtn.exec:\nbbbtn.exe69⤵PID:1568
-
\??\c:\dvjvd.exec:\dvjvd.exe70⤵PID:2100
-
\??\c:\pvvvj.exec:\pvvvj.exe71⤵PID:1592
-
\??\c:\rlrrflf.exec:\rlrrflf.exe72⤵PID:1628
-
\??\c:\lrrxrff.exec:\lrrxrff.exe73⤵PID:2300
-
\??\c:\9bthnh.exec:\9bthnh.exe74⤵PID:1768
-
\??\c:\7ntnbb.exec:\7ntnbb.exe75⤵PID:2320
-
\??\c:\vpdvd.exec:\vpdvd.exe76⤵PID:2296
-
\??\c:\ppjvp.exec:\ppjvp.exe77⤵PID:1956
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe78⤵PID:2904
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe79⤵PID:2592
-
\??\c:\3tbnnb.exec:\3tbnnb.exe80⤵PID:2656
-
\??\c:\btbthb.exec:\btbthb.exe81⤵PID:1616
-
\??\c:\vvdpd.exec:\vvdpd.exe82⤵PID:2140
-
\??\c:\vpvvd.exec:\vpvvd.exe83⤵PID:1576
-
\??\c:\rflrffr.exec:\rflrffr.exe84⤵PID:2816
-
\??\c:\5lxxffl.exec:\5lxxffl.exe85⤵PID:2736
-
\??\c:\tbhhbh.exec:\tbhhbh.exe86⤵PID:2528
-
\??\c:\7htnnh.exec:\7htnnh.exe87⤵PID:2688
-
\??\c:\7vdjp.exec:\7vdjp.exe88⤵PID:2636
-
\??\c:\vjppv.exec:\vjppv.exe89⤵PID:2564
-
\??\c:\ppvjd.exec:\ppvjd.exe90⤵PID:2412
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe91⤵PID:2988
-
\??\c:\llxlffr.exec:\llxlffr.exe92⤵PID:1168
-
\??\c:\btntbt.exec:\btntbt.exe93⤵PID:1788
-
\??\c:\hhntbb.exec:\hhntbb.exe94⤵PID:2756
-
\??\c:\pjvdd.exec:\pjvdd.exe95⤵PID:2876
-
\??\c:\vpdvd.exec:\vpdvd.exe96⤵PID:2864
-
\??\c:\5rlxllr.exec:\5rlxllr.exe97⤵PID:3036
-
\??\c:\7xrrffr.exec:\7xrrffr.exe98⤵PID:3016
-
\??\c:\rrxllll.exec:\rrxllll.exe99⤵PID:3032
-
\??\c:\tntbbb.exec:\tntbbb.exe100⤵PID:1808
-
\??\c:\tthbnn.exec:\tthbnn.exe101⤵
- System Location Discovery: System Language Discovery
PID:1868 -
\??\c:\7pddj.exec:\7pddj.exe102⤵PID:1252
-
\??\c:\ddpvp.exec:\ddpvp.exe103⤵PID:1720
-
\??\c:\xxfflfl.exec:\xxfflfl.exe104⤵PID:1728
-
\??\c:\1flrxxx.exec:\1flrxxx.exe105⤵PID:1964
-
\??\c:\9nbbtt.exec:\9nbbtt.exe106⤵PID:1396
-
\??\c:\nhthtt.exec:\nhthtt.exe107⤵PID:2104
-
\??\c:\9vvdd.exec:\9vvdd.exe108⤵PID:2484
-
\??\c:\ppddj.exec:\ppddj.exe109⤵PID:2476
-
\??\c:\fxffflf.exec:\fxffflf.exe110⤵PID:2088
-
\??\c:\5lffrxx.exec:\5lffrxx.exe111⤵PID:1400
-
\??\c:\bthttt.exec:\bthttt.exe112⤵PID:2260
-
\??\c:\bthtbh.exec:\bthtbh.exe113⤵PID:448
-
\??\c:\1jjjp.exec:\1jjjp.exe114⤵PID:1568
-
\??\c:\7jvdd.exec:\7jvdd.exe115⤵PID:2248
-
\??\c:\5vddj.exec:\5vddj.exe116⤵PID:1592
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe117⤵PID:1628
-
\??\c:\xxlrfrx.exec:\xxlrfrx.exe118⤵PID:2452
-
\??\c:\tbhbtb.exec:\tbhbtb.exe119⤵PID:2976
-
\??\c:\1dpdv.exec:\1dpdv.exe120⤵PID:892
-
\??\c:\vjjdp.exec:\vjjdp.exe121⤵PID:1032
-
\??\c:\9lffxrr.exec:\9lffxrr.exe122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-