Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe
Resource
win7-20240729-en
General
-
Target
b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe
-
Size
452KB
-
MD5
975c19201fb17237426cbcd542b42000
-
SHA1
3748f62e0333bf6f5bce48ca4c8c7371d7196dee
-
SHA256
b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cf
-
SHA512
a8072e820e1c893ee464931fc07af988d899e3ec6be0c2e0d147aa6852b34e43c757d0fbf9f9ae8c9609c8516096e4e2a596fe544601e3b49ec0d69c5976b9d8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2308-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-455-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2124-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-538-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2460-554-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1944-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-629-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-718-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1648 7rxxrrx.exe 1092 vdppd.exe 2876 3rrrxxx.exe 2836 ddjdd.exe 3060 lfffllr.exe 2792 btbhtn.exe 2736 rlfflff.exe 2756 llxxfxf.exe 2240 bnnhhh.exe 1344 lfrxlfr.exe 580 vvvdj.exe 2448 5rfffff.exe 3000 dddpp.exe 1408 xfllxxf.exe 2960 5pvpp.exe 2344 ddddj.exe 1812 7bbhth.exe 2124 flxfffl.exe 2180 bbhhhn.exe 1224 rrfxlrx.exe 2400 nthhnt.exe 1932 pjppd.exe 1076 btttnh.exe 1052 jjpvp.exe 1556 9lrrxrx.exe 2656 nnnhhn.exe 1328 ppvpv.exe 1680 hthhnn.exe 2640 jvddd.exe 3052 lrrllll.exe 1156 jdjjj.exe 900 7rxrfff.exe 1244 vvjjp.exe 2904 ppvvj.exe 1648 ffrrxfl.exe 2840 7xrrxxf.exe 2948 httnnh.exe 2824 9jvvp.exe 2808 1rfxxrr.exe 3060 hhntbh.exe 2860 1httnt.exe 2744 jpddj.exe 1736 rrxllrl.exe 2740 bbntth.exe 1348 3bhhhh.exe 1612 1ddvj.exe 1616 lxllxrf.exe 2444 xxffllr.exe 2012 tthbbh.exe 2988 1ddvp.exe 3000 lrxrllf.exe 2760 ffrrflr.exe 2532 3nbtnn.exe 1624 7vvdj.exe 1860 xxffllr.exe 2084 xxfllrx.exe 1780 nntttt.exe 2124 jjdjv.exe 2220 9xlfrrr.exe 2216 rfxrlfl.exe 2144 bbtbnn.exe 920 9vppj.exe 2040 3rflrlx.exe 1076 nnnnbh.exe -
resource yara_rule behavioral1/memory/2308-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-293-0x0000000077750000-0x000000007786F000-memory.dmp upx behavioral1/memory/1648-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-485-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1988-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-787-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1648 2308 b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe 30 PID 2308 wrote to memory of 1648 2308 b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe 30 PID 2308 wrote to memory of 1648 2308 b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe 30 PID 2308 wrote to memory of 1648 2308 b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe 30 PID 1648 wrote to memory of 1092 1648 7rxxrrx.exe 31 PID 1648 wrote to memory of 1092 1648 7rxxrrx.exe 31 PID 1648 wrote to memory of 1092 1648 7rxxrrx.exe 31 PID 1648 wrote to memory of 1092 1648 7rxxrrx.exe 31 PID 1092 wrote to memory of 2876 1092 vdppd.exe 32 PID 1092 wrote to memory of 2876 1092 vdppd.exe 32 PID 1092 wrote to memory of 2876 1092 vdppd.exe 32 PID 1092 wrote to memory of 2876 1092 vdppd.exe 32 PID 2876 wrote to memory of 2836 2876 3rrrxxx.exe 33 PID 2876 wrote to memory of 2836 2876 3rrrxxx.exe 33 PID 2876 wrote to memory of 2836 2876 3rrrxxx.exe 33 PID 2876 wrote to memory of 2836 2876 3rrrxxx.exe 33 PID 2836 wrote to memory of 3060 2836 ddjdd.exe 34 PID 2836 wrote to memory of 3060 2836 ddjdd.exe 34 PID 2836 wrote to memory of 3060 2836 ddjdd.exe 34 PID 2836 wrote to memory of 3060 2836 ddjdd.exe 34 PID 3060 wrote to memory of 2792 3060 lfffllr.exe 35 PID 3060 wrote to memory of 2792 3060 lfffllr.exe 35 PID 3060 wrote to memory of 2792 3060 lfffllr.exe 35 PID 3060 wrote to memory of 2792 3060 lfffllr.exe 35 PID 2792 wrote to memory of 2736 2792 btbhtn.exe 36 PID 2792 wrote to memory of 2736 2792 btbhtn.exe 36 PID 2792 wrote to memory of 2736 2792 btbhtn.exe 36 PID 2792 wrote to memory of 2736 2792 btbhtn.exe 36 PID 2736 wrote to memory of 2756 2736 rlfflff.exe 37 PID 2736 wrote to memory of 2756 2736 rlfflff.exe 37 PID 2736 wrote to memory of 2756 2736 rlfflff.exe 37 PID 2736 wrote to memory of 2756 2736 rlfflff.exe 37 PID 2756 wrote to memory of 2240 2756 llxxfxf.exe 38 PID 2756 wrote to memory of 2240 2756 llxxfxf.exe 38 PID 2756 wrote to memory of 2240 2756 llxxfxf.exe 38 PID 2756 wrote to memory of 2240 2756 llxxfxf.exe 38 PID 2240 wrote to memory of 1344 2240 bnnhhh.exe 39 PID 2240 wrote to memory of 1344 2240 bnnhhh.exe 39 PID 2240 wrote to memory of 1344 2240 bnnhhh.exe 39 PID 2240 wrote to memory of 1344 2240 bnnhhh.exe 39 PID 1344 wrote to memory of 580 1344 lfrxlfr.exe 40 PID 1344 wrote to memory of 580 1344 lfrxlfr.exe 40 PID 1344 wrote to memory of 580 1344 lfrxlfr.exe 40 PID 1344 wrote to memory of 580 1344 lfrxlfr.exe 40 PID 580 wrote to memory of 2448 580 vvvdj.exe 41 PID 580 wrote to memory of 2448 580 vvvdj.exe 41 PID 580 wrote to memory of 2448 580 vvvdj.exe 41 PID 580 wrote to memory of 2448 580 vvvdj.exe 41 PID 2448 wrote to memory of 3000 2448 5rfffff.exe 42 PID 2448 wrote to memory of 3000 2448 5rfffff.exe 42 PID 2448 wrote to memory of 3000 2448 5rfffff.exe 42 PID 2448 wrote to memory of 3000 2448 5rfffff.exe 42 PID 3000 wrote to memory of 1408 3000 dddpp.exe 43 PID 3000 wrote to memory of 1408 3000 dddpp.exe 43 PID 3000 wrote to memory of 1408 3000 dddpp.exe 43 PID 3000 wrote to memory of 1408 3000 dddpp.exe 43 PID 1408 wrote to memory of 2960 1408 xfllxxf.exe 44 PID 1408 wrote to memory of 2960 1408 xfllxxf.exe 44 PID 1408 wrote to memory of 2960 1408 xfllxxf.exe 44 PID 1408 wrote to memory of 2960 1408 xfllxxf.exe 44 PID 2960 wrote to memory of 2344 2960 5pvpp.exe 45 PID 2960 wrote to memory of 2344 2960 5pvpp.exe 45 PID 2960 wrote to memory of 2344 2960 5pvpp.exe 45 PID 2960 wrote to memory of 2344 2960 5pvpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe"C:\Users\Admin\AppData\Local\Temp\b3c949ec785b5189fe376fcb915d5f1c923f9de3eb19b3b0891f909b619e10cfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\7rxxrrx.exec:\7rxxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vdppd.exec:\vdppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\3rrrxxx.exec:\3rrrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ddjdd.exec:\ddjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lfffllr.exec:\lfffllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\btbhtn.exec:\btbhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rlfflff.exec:\rlfflff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\llxxfxf.exec:\llxxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bnnhhh.exec:\bnnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\lfrxlfr.exec:\lfrxlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\vvvdj.exec:\vvvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\5rfffff.exec:\5rfffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dddpp.exec:\dddpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xfllxxf.exec:\xfllxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\5pvpp.exec:\5pvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ddddj.exec:\ddddj.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7bbhth.exec:\7bbhth.exe18⤵
- Executes dropped EXE
PID:1812 -
\??\c:\flxfffl.exec:\flxfffl.exe19⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bbhhhn.exec:\bbhhhn.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrfxlrx.exec:\rrfxlrx.exe21⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nthhnt.exec:\nthhnt.exe22⤵
- Executes dropped EXE
PID:2400 -
\??\c:\pjppd.exec:\pjppd.exe23⤵
- Executes dropped EXE
PID:1932 -
\??\c:\btttnh.exec:\btttnh.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jjpvp.exec:\jjpvp.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9lrrxrx.exec:\9lrrxrx.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nnnhhn.exec:\nnnhhn.exe27⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppvpv.exec:\ppvpv.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hthhnn.exec:\hthhnn.exe29⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jvddd.exec:\jvddd.exe30⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lrrllll.exec:\lrrllll.exe31⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jdjjj.exec:\jdjjj.exe32⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7rxrfff.exec:\7rxrfff.exe33⤵
- Executes dropped EXE
PID:900 -
\??\c:\vvjjp.exec:\vvjjp.exe34⤵
- Executes dropped EXE
PID:1244 -
\??\c:\flrxffl.exec:\flrxffl.exe35⤵PID:1600
-
\??\c:\ppvvj.exec:\ppvvj.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7xrrxxf.exec:\7xrrxxf.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\httnnh.exec:\httnnh.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9jvvp.exec:\9jvvp.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1rfxxrr.exec:\1rfxxrr.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hhntbh.exec:\hhntbh.exe42⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1httnt.exec:\1httnt.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jpddj.exec:\jpddj.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rrxllrl.exec:\rrxllrl.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bbntth.exec:\bbntth.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3bhhhh.exec:\3bhhhh.exe47⤵
- Executes dropped EXE
PID:1348 -
\??\c:\1ddvj.exec:\1ddvj.exe48⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxllxrf.exec:\lxllxrf.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxffllr.exec:\xxffllr.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tthbbh.exec:\tthbbh.exe51⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1ddvp.exec:\1ddvp.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrxrllf.exec:\lrxrllf.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ffrrflr.exec:\ffrrflr.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3nbtnn.exec:\3nbtnn.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7vvdj.exec:\7vvdj.exe56⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxffllr.exec:\xxffllr.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xxfllrx.exec:\xxfllrx.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nntttt.exec:\nntttt.exe59⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jjdjv.exec:\jjdjv.exe60⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9xlfrrr.exec:\9xlfrrr.exe61⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rfxrlfl.exec:\rfxrlfl.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\bbtbnn.exec:\bbtbnn.exe63⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9vppj.exec:\9vppj.exe64⤵
- Executes dropped EXE
PID:920 -
\??\c:\3rflrlx.exec:\3rflrlx.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nnnnbh.exec:\nnnnbh.exe66⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bbhhnn.exec:\bbhhnn.exe67⤵PID:1988
-
\??\c:\vddvj.exec:\vddvj.exe68⤵PID:1556
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe69⤵PID:3056
-
\??\c:\hbhbnt.exec:\hbhbnt.exe70⤵PID:1032
-
\??\c:\tntntn.exec:\tntntn.exe71⤵PID:1804
-
\??\c:\jjpvv.exec:\jjpvv.exe72⤵PID:1680
-
\??\c:\xflrrxf.exec:\xflrrxf.exe73⤵PID:2460
-
\??\c:\hhnhnt.exec:\hhnhnt.exe74⤵PID:3052
-
\??\c:\5pjpv.exec:\5pjpv.exe75⤵PID:884
-
\??\c:\ffllrxf.exec:\ffllrxf.exe76⤵PID:1500
-
\??\c:\5rlllll.exec:\5rlllll.exe77⤵PID:1244
-
\??\c:\3bhhnt.exec:\3bhhnt.exe78⤵PID:1704
-
\??\c:\bhnntn.exec:\bhnntn.exe79⤵PID:2168
-
\??\c:\djvdv.exec:\djvdv.exe80⤵PID:1648
-
\??\c:\3rfflll.exec:\3rfflll.exe81⤵PID:2952
-
\??\c:\bhnbbh.exec:\bhnbbh.exe82⤵PID:2948
-
\??\c:\hntnnn.exec:\hntnnn.exe83⤵PID:2852
-
\??\c:\vpvjp.exec:\vpvjp.exe84⤵PID:1944
-
\??\c:\llrrlll.exec:\llrrlll.exe85⤵PID:2692
-
\??\c:\hhnhnh.exec:\hhnhnh.exe86⤵PID:1700
-
\??\c:\pddjj.exec:\pddjj.exe87⤵PID:1276
-
\??\c:\vvdjj.exec:\vvdjj.exe88⤵PID:2256
-
\??\c:\flxrfrr.exec:\flxrfrr.exe89⤵PID:1488
-
\??\c:\9bnnnn.exec:\9bnnnn.exe90⤵PID:2056
-
\??\c:\7tbbbb.exec:\7tbbbb.exe91⤵PID:1344
-
\??\c:\5jpvd.exec:\5jpvd.exe92⤵PID:320
-
\??\c:\flxxffl.exec:\flxxffl.exe93⤵PID:2980
-
\??\c:\flrxllr.exec:\flrxllr.exe94⤵PID:1504
-
\??\c:\9htbtt.exec:\9htbtt.exe95⤵PID:3000
-
\??\c:\jpdvv.exec:\jpdvv.exe96⤵PID:2760
-
\??\c:\3vvvv.exec:\3vvvv.exe97⤵PID:3032
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe98⤵PID:1740
-
\??\c:\tnnttb.exec:\tnnttb.exe99⤵PID:2348
-
\??\c:\hbnttb.exec:\hbnttb.exe100⤵PID:2224
-
\??\c:\dvddd.exec:\dvddd.exe101⤵PID:2024
-
\??\c:\xxflxlf.exec:\xxflxlf.exe102⤵PID:808
-
\??\c:\hhbnhh.exec:\hhbnhh.exe103⤵PID:1628
-
\??\c:\tbhnnn.exec:\tbhnnn.exe104⤵PID:2484
-
\??\c:\3ddjp.exec:\3ddjp.exe105⤵PID:1696
-
\??\c:\3frlffl.exec:\3frlffl.exe106⤵PID:1956
-
\??\c:\xrxxflx.exec:\xrxxflx.exe107⤵PID:2016
-
\??\c:\hbttbh.exec:\hbttbh.exe108⤵PID:1760
-
\??\c:\jdjpv.exec:\jdjpv.exe109⤵PID:552
-
\??\c:\ffllrrx.exec:\ffllrrx.exe110⤵PID:2064
-
\??\c:\5xlrflr.exec:\5xlrflr.exe111⤵PID:2304
-
\??\c:\7nhnnn.exec:\7nhnnn.exe112⤵PID:1000
-
\??\c:\hbtnbt.exec:\hbtnbt.exe113⤵PID:2580
-
\??\c:\pjppp.exec:\pjppp.exe114⤵PID:1152
-
\??\c:\rlxflll.exec:\rlxflll.exe115⤵PID:344
-
\??\c:\lflllrf.exec:\lflllrf.exe116⤵PID:2596
-
\??\c:\hbhnnt.exec:\hbhnnt.exe117⤵PID:900
-
\??\c:\3vpvd.exec:\3vpvd.exe118⤵PID:2604
-
\??\c:\vdpdp.exec:\vdpdp.exe119⤵PID:2044
-
\??\c:\btbhht.exec:\btbhht.exe120⤵PID:2832
-
\??\c:\7dpjp.exec:\7dpjp.exe121⤵PID:2800
-
\??\c:\llxxfff.exec:\llxxfff.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-