Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe
Resource
win7-20241010-en
General
-
Target
611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe
-
Size
454KB
-
MD5
142781dfefbfce562adc6c69705cfe40
-
SHA1
2497072efe163965a01fc7791068a3f80983f1e3
-
SHA256
611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdeb
-
SHA512
437c3f73231032bde19be472a5eef3577689225849d1980254d715fdf55b1a44e5142b2074fb48d16dbe28f1844200a9e7c624e2dcfd63ca499d96782b01d0d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2916-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-67-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/684-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-156-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1676-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-372-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2360-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-760-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2832 1flxxxr.exe 2956 642206.exe 2704 826802.exe 2472 48680.exe 2740 dpppd.exe 2388 60868.exe 684 8206880.exe 2900 9jvdp.exe 2080 nhtbbh.exe 2564 5bhnnn.exe 2776 ddvdv.exe 3032 lfxlxfx.exe 2560 rrfrlrf.exe 2304 20848.exe 1424 48620.exe 1676 04802.exe 2060 c824002.exe 2184 260622.exe 2276 q06206.exe 1472 e84080.exe 592 5thtbn.exe 1984 0424284.exe 692 llrfrxl.exe 1680 btttbh.exe 1764 o028006.exe 2288 nnhtbh.exe 1544 vdvdj.exe 1856 868284.exe 2112 rlrlffx.exe 1368 e64808.exe 1776 4828064.exe 2924 jvppv.exe 1568 264080.exe 2260 7bhbhb.exe 2596 vvjdd.exe 2912 240688.exe 2792 m6406.exe 2696 1thhnh.exe 2528 9tttnn.exe 536 g6446.exe 688 lxllrxl.exe 264 8800006.exe 380 ppvpv.exe 2360 08440.exe 2072 1jppp.exe 3028 g4268.exe 3012 064026.exe 2968 rfffflr.exe 2592 024406.exe 2524 hbbhbn.exe 2644 rlffllr.exe 1156 bbnbnn.exe 2448 vpdjd.exe 1956 pjvvd.exe 2632 1hnnth.exe 2228 tbbttn.exe 2204 s6222.exe 468 1bhnnh.exe 1300 hthnbh.exe 592 4262880.exe 1140 42442.exe 868 nbbbhn.exe 2188 1xfflff.exe 1540 thtbhn.exe -
resource yara_rule behavioral1/memory/2832-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-156-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1676-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4880846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i206284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08440.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2832 2916 611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe 30 PID 2916 wrote to memory of 2832 2916 611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe 30 PID 2916 wrote to memory of 2832 2916 611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe 30 PID 2916 wrote to memory of 2832 2916 611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe 30 PID 2832 wrote to memory of 2956 2832 1flxxxr.exe 31 PID 2832 wrote to memory of 2956 2832 1flxxxr.exe 31 PID 2832 wrote to memory of 2956 2832 1flxxxr.exe 31 PID 2832 wrote to memory of 2956 2832 1flxxxr.exe 31 PID 2956 wrote to memory of 2704 2956 642206.exe 32 PID 2956 wrote to memory of 2704 2956 642206.exe 32 PID 2956 wrote to memory of 2704 2956 642206.exe 32 PID 2956 wrote to memory of 2704 2956 642206.exe 32 PID 2704 wrote to memory of 2472 2704 826802.exe 33 PID 2704 wrote to memory of 2472 2704 826802.exe 33 PID 2704 wrote to memory of 2472 2704 826802.exe 33 PID 2704 wrote to memory of 2472 2704 826802.exe 33 PID 2472 wrote to memory of 2740 2472 48680.exe 34 PID 2472 wrote to memory of 2740 2472 48680.exe 34 PID 2472 wrote to memory of 2740 2472 48680.exe 34 PID 2472 wrote to memory of 2740 2472 48680.exe 34 PID 2740 wrote to memory of 2388 2740 dpppd.exe 35 PID 2740 wrote to memory of 2388 2740 dpppd.exe 35 PID 2740 wrote to memory of 2388 2740 dpppd.exe 35 PID 2740 wrote to memory of 2388 2740 dpppd.exe 35 PID 2388 wrote to memory of 684 2388 60868.exe 36 PID 2388 wrote to memory of 684 2388 60868.exe 36 PID 2388 wrote to memory of 684 2388 60868.exe 36 PID 2388 wrote to memory of 684 2388 60868.exe 36 PID 684 wrote to memory of 2900 684 8206880.exe 37 PID 684 wrote to memory of 2900 684 8206880.exe 37 PID 684 wrote to memory of 2900 684 8206880.exe 37 PID 684 wrote to memory of 2900 684 8206880.exe 37 PID 2900 wrote to memory of 2080 2900 9jvdp.exe 38 PID 2900 wrote to memory of 2080 2900 9jvdp.exe 38 PID 2900 wrote to memory of 2080 2900 9jvdp.exe 38 PID 2900 wrote to memory of 2080 2900 9jvdp.exe 38 PID 2080 wrote to memory of 2564 2080 nhtbbh.exe 39 PID 2080 wrote to memory of 2564 2080 nhtbbh.exe 39 PID 2080 wrote to memory of 2564 2080 nhtbbh.exe 39 PID 2080 wrote to memory of 2564 2080 nhtbbh.exe 39 PID 2564 wrote to memory of 2776 2564 5bhnnn.exe 40 PID 2564 wrote to memory of 2776 2564 5bhnnn.exe 40 PID 2564 wrote to memory of 2776 2564 5bhnnn.exe 40 PID 2564 wrote to memory of 2776 2564 5bhnnn.exe 40 PID 2776 wrote to memory of 3032 2776 ddvdv.exe 41 PID 2776 wrote to memory of 3032 2776 ddvdv.exe 41 PID 2776 wrote to memory of 3032 2776 ddvdv.exe 41 PID 2776 wrote to memory of 3032 2776 ddvdv.exe 41 PID 3032 wrote to memory of 2560 3032 lfxlxfx.exe 42 PID 3032 wrote to memory of 2560 3032 lfxlxfx.exe 42 PID 3032 wrote to memory of 2560 3032 lfxlxfx.exe 42 PID 3032 wrote to memory of 2560 3032 lfxlxfx.exe 42 PID 2560 wrote to memory of 2304 2560 rrfrlrf.exe 43 PID 2560 wrote to memory of 2304 2560 rrfrlrf.exe 43 PID 2560 wrote to memory of 2304 2560 rrfrlrf.exe 43 PID 2560 wrote to memory of 2304 2560 rrfrlrf.exe 43 PID 2304 wrote to memory of 1424 2304 20848.exe 44 PID 2304 wrote to memory of 1424 2304 20848.exe 44 PID 2304 wrote to memory of 1424 2304 20848.exe 44 PID 2304 wrote to memory of 1424 2304 20848.exe 44 PID 1424 wrote to memory of 1676 1424 48620.exe 45 PID 1424 wrote to memory of 1676 1424 48620.exe 45 PID 1424 wrote to memory of 1676 1424 48620.exe 45 PID 1424 wrote to memory of 1676 1424 48620.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe"C:\Users\Admin\AppData\Local\Temp\611fdbbf9fe6dcc79b5dd38517d8a4a216ab76bf282d03073fa62333e5f2cdebN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\1flxxxr.exec:\1flxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\642206.exec:\642206.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\826802.exec:\826802.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\48680.exec:\48680.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\dpppd.exec:\dpppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\60868.exec:\60868.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\8206880.exec:\8206880.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\9jvdp.exec:\9jvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nhtbbh.exec:\nhtbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\5bhnnn.exec:\5bhnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ddvdv.exec:\ddvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\20848.exec:\20848.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\48620.exec:\48620.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\04802.exec:\04802.exe17⤵
- Executes dropped EXE
PID:1676 -
\??\c:\c824002.exec:\c824002.exe18⤵
- Executes dropped EXE
PID:2060 -
\??\c:\260622.exec:\260622.exe19⤵
- Executes dropped EXE
PID:2184 -
\??\c:\q06206.exec:\q06206.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\e84080.exec:\e84080.exe21⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5thtbn.exec:\5thtbn.exe22⤵
- Executes dropped EXE
PID:592 -
\??\c:\0424284.exec:\0424284.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\llrfrxl.exec:\llrfrxl.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\btttbh.exec:\btttbh.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\o028006.exec:\o028006.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nnhtbh.exec:\nnhtbh.exe27⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vdvdj.exec:\vdvdj.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\868284.exec:\868284.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rlrlffx.exec:\rlrlffx.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\e64808.exec:\e64808.exe31⤵
- Executes dropped EXE
PID:1368 -
\??\c:\4828064.exec:\4828064.exe32⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jvppv.exec:\jvppv.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\264080.exec:\264080.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7bhbhb.exec:\7bhbhb.exe35⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vvjdd.exec:\vvjdd.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\240688.exec:\240688.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\m6406.exec:\m6406.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1thhnh.exec:\1thhnh.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9tttnn.exec:\9tttnn.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\g6446.exec:\g6446.exe41⤵
- Executes dropped EXE
PID:536 -
\??\c:\lxllrxl.exec:\lxllrxl.exe42⤵
- Executes dropped EXE
PID:688 -
\??\c:\8800006.exec:\8800006.exe43⤵
- Executes dropped EXE
PID:264 -
\??\c:\ppvpv.exec:\ppvpv.exe44⤵
- Executes dropped EXE
PID:380 -
\??\c:\08440.exec:\08440.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\1jppp.exec:\1jppp.exe46⤵
- Executes dropped EXE
PID:2072 -
\??\c:\g4268.exec:\g4268.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\064026.exec:\064026.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rfffflr.exec:\rfffflr.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\024406.exec:\024406.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbbhbn.exec:\hbbhbn.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rlffllr.exec:\rlffllr.exe52⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bbnbnn.exec:\bbnbnn.exe53⤵
- Executes dropped EXE
PID:1156 -
\??\c:\vpdjd.exec:\vpdjd.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjvvd.exec:\pjvvd.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1hnnth.exec:\1hnnth.exe56⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tbbttn.exec:\tbbttn.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\s6222.exec:\s6222.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1bhnnh.exec:\1bhnnh.exe59⤵
- Executes dropped EXE
PID:468 -
\??\c:\hthnbh.exec:\hthnbh.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\4262880.exec:\4262880.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\42442.exec:\42442.exe62⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nbbbhn.exec:\nbbbhn.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\1xfflff.exec:\1xfflff.exe64⤵
- Executes dropped EXE
PID:2188 -
\??\c:\thtbhn.exec:\thtbhn.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\0840068.exec:\0840068.exe66⤵PID:300
-
\??\c:\lfffxfr.exec:\lfffxfr.exe67⤵PID:1820
-
\??\c:\60246.exec:\60246.exe68⤵PID:2164
-
\??\c:\xrfrrxr.exec:\xrfrrxr.exe69⤵PID:1432
-
\??\c:\nnttnn.exec:\nnttnn.exe70⤵PID:2572
-
\??\c:\826240.exec:\826240.exe71⤵PID:992
-
\??\c:\860246.exec:\860246.exe72⤵PID:1928
-
\??\c:\864684.exec:\864684.exe73⤵PID:1816
-
\??\c:\60402.exec:\60402.exe74⤵PID:1716
-
\??\c:\vddpd.exec:\vddpd.exe75⤵PID:2296
-
\??\c:\6040846.exec:\6040846.exe76⤵PID:2924
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe77⤵PID:2808
-
\??\c:\20006.exec:\20006.exe78⤵PID:2712
-
\??\c:\420244.exec:\420244.exe79⤵PID:3040
-
\??\c:\264028.exec:\264028.exe80⤵PID:3036
-
\??\c:\4862442.exec:\4862442.exe81⤵PID:2688
-
\??\c:\fxlfxlx.exec:\fxlfxlx.exe82⤵PID:2748
-
\??\c:\260028.exec:\260028.exe83⤵PID:2728
-
\??\c:\c020088.exec:\c020088.exe84⤵PID:2568
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe85⤵PID:536
-
\??\c:\08666.exec:\08666.exe86⤵PID:1248
-
\??\c:\3jjvd.exec:\3jjvd.exe87⤵PID:684
-
\??\c:\ntntnn.exec:\ntntnn.exe88⤵PID:2052
-
\??\c:\s8686.exec:\s8686.exe89⤵PID:2364
-
\??\c:\86068.exec:\86068.exe90⤵PID:2616
-
\??\c:\dpjpj.exec:\dpjpj.exe91⤵PID:2108
-
\??\c:\86840.exec:\86840.exe92⤵PID:2552
-
\??\c:\vppjv.exec:\vppjv.exe93⤵PID:2424
-
\??\c:\vvjvp.exec:\vvjvp.exe94⤵PID:1968
-
\??\c:\fxxflrl.exec:\fxxflrl.exe95⤵PID:2144
-
\??\c:\k88028.exec:\k88028.exe96⤵PID:1032
-
\??\c:\2640264.exec:\2640264.exe97⤵PID:2340
-
\??\c:\42680.exec:\42680.exe98⤵PID:1192
-
\??\c:\tnhhhn.exec:\tnhhhn.exe99⤵PID:2172
-
\??\c:\dvpjv.exec:\dvpjv.exe100⤵PID:2860
-
\??\c:\4840006.exec:\4840006.exe101⤵PID:1316
-
\??\c:\4806284.exec:\4806284.exe102⤵PID:1920
-
\??\c:\rllxxfr.exec:\rllxxfr.exe103⤵PID:1784
-
\??\c:\m4844.exec:\m4844.exe104⤵PID:432
-
\??\c:\046206.exec:\046206.exe105⤵PID:1964
-
\??\c:\3lrxxxf.exec:\3lrxxxf.exe106⤵PID:2620
-
\??\c:\nhthtb.exec:\nhthtb.exe107⤵PID:1612
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe108⤵PID:2380
-
\??\c:\5hbnnt.exec:\5hbnnt.exe109⤵PID:1364
-
\??\c:\240466.exec:\240466.exe110⤵PID:1548
-
\??\c:\646064.exec:\646064.exe111⤵PID:884
-
\??\c:\hbbnnt.exec:\hbbnnt.exe112⤵PID:2908
-
\??\c:\608406.exec:\608406.exe113⤵PID:1740
-
\??\c:\3jvvd.exec:\3jvvd.exe114⤵PID:2760
-
\??\c:\868822.exec:\868822.exe115⤵PID:1520
-
\??\c:\08668.exec:\08668.exe116⤵PID:2112
-
\??\c:\rlrfxfr.exec:\rlrfxfr.exe117⤵PID:1772
-
\??\c:\864248.exec:\864248.exe118⤵PID:2356
-
\??\c:\pvvpj.exec:\pvvpj.exe119⤵PID:328
-
\??\c:\6080624.exec:\6080624.exe120⤵PID:2804
-
\??\c:\486688.exec:\486688.exe121⤵PID:2796
-
\??\c:\hnhthh.exec:\hnhthh.exe122⤵PID:856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-