Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 14:59
Static task
static1
Behavioral task
behavioral1
Sample
7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe
Resource
win7-20240903-en
General
-
Target
7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe
-
Size
453KB
-
MD5
279c0bf89115446246b702f81ea47a0e
-
SHA1
780d7ee678fd21458d0f4332ef44e1454addb58d
-
SHA256
7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1
-
SHA512
4e673d96e24988c51ac851f7e8b5bc0ec21dbdde92d5e1dd92e56e2cb06b84b6fcd13d68ae6cc8c510f38dcb9a20af51f378a1449f2e6a5d0b1ed2744659c6ad
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-35-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2116-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-113-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1112-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/464-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-224-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/536-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-330-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-372-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1580-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-463-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/284-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-570-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2120-569-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-674-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2952-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2352 vdppp.exe 1044 llxxfxf.exe 2524 9ntttn.exe 2116 3rxrxxx.exe 2424 7tnthn.exe 2860 5dpjp.exe 3020 xffllff.exe 2704 hntthn.exe 2428 frxlrlr.exe 2588 bhhbbn.exe 2432 pjpjp.exe 2312 nnbhbb.exe 1112 vdjdd.exe 2936 nhttnh.exe 1320 ppvpp.exe 480 lrflrfx.exe 464 hntttt.exe 2948 xlflffx.exe 2984 9xfxxxr.exe 2096 vpdvj.exe 1072 frxxllr.exe 1204 ppdvj.exe 536 rlxfllr.exe 2080 ppdjd.exe 1552 jdppp.exe 580 9pjpv.exe 2452 jdddp.exe 1648 nnbbbt.exe 564 btnhtb.exe 1824 lflrxfl.exe 2460 ttnbnt.exe 2200 jjdjj.exe 1948 lfrxllx.exe 2536 hbnbhh.exe 2260 jdvvd.exe 3060 lfxrflx.exe 2044 9rlrflx.exe 2224 tbtbhn.exe 2692 dvdpp.exe 2712 frfffff.exe 2788 hhhhnn.exe 2884 9tbbhh.exe 2760 dvjjp.exe 2584 xrfxxrx.exe 2592 1bbbth.exe 2636 nhtbhb.exe 1640 vvpdj.exe 1372 xlrrllx.exe 676 1bhhhh.exe 1580 vpjjj.exe 576 djjdp.exe 764 9lffffl.exe 984 tntbbt.exe 544 ttbnbh.exe 1156 pvjjv.exe 284 lxlffxf.exe 2984 hbnthn.exe 1988 5jvdd.exe 1404 jpjpd.exe 1072 flllfxf.exe 652 bththh.exe 1968 hthhbb.exe 1216 lxrrxfr.exe 1576 thtnth.exe -
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/464-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-330-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2044-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-758-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2352 2672 7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe 30 PID 2672 wrote to memory of 2352 2672 7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe 30 PID 2672 wrote to memory of 2352 2672 7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe 30 PID 2672 wrote to memory of 2352 2672 7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe 30 PID 2352 wrote to memory of 1044 2352 vdppp.exe 31 PID 2352 wrote to memory of 1044 2352 vdppp.exe 31 PID 2352 wrote to memory of 1044 2352 vdppp.exe 31 PID 2352 wrote to memory of 1044 2352 vdppp.exe 31 PID 1044 wrote to memory of 2524 1044 llxxfxf.exe 32 PID 1044 wrote to memory of 2524 1044 llxxfxf.exe 32 PID 1044 wrote to memory of 2524 1044 llxxfxf.exe 32 PID 1044 wrote to memory of 2524 1044 llxxfxf.exe 32 PID 2524 wrote to memory of 2116 2524 9ntttn.exe 33 PID 2524 wrote to memory of 2116 2524 9ntttn.exe 33 PID 2524 wrote to memory of 2116 2524 9ntttn.exe 33 PID 2524 wrote to memory of 2116 2524 9ntttn.exe 33 PID 2116 wrote to memory of 2424 2116 3rxrxxx.exe 34 PID 2116 wrote to memory of 2424 2116 3rxrxxx.exe 34 PID 2116 wrote to memory of 2424 2116 3rxrxxx.exe 34 PID 2116 wrote to memory of 2424 2116 3rxrxxx.exe 34 PID 2424 wrote to memory of 2860 2424 7tnthn.exe 35 PID 2424 wrote to memory of 2860 2424 7tnthn.exe 35 PID 2424 wrote to memory of 2860 2424 7tnthn.exe 35 PID 2424 wrote to memory of 2860 2424 7tnthn.exe 35 PID 2860 wrote to memory of 3020 2860 5dpjp.exe 36 PID 2860 wrote to memory of 3020 2860 5dpjp.exe 36 PID 2860 wrote to memory of 3020 2860 5dpjp.exe 36 PID 2860 wrote to memory of 3020 2860 5dpjp.exe 36 PID 3020 wrote to memory of 2704 3020 xffllff.exe 37 PID 3020 wrote to memory of 2704 3020 xffllff.exe 37 PID 3020 wrote to memory of 2704 3020 xffllff.exe 37 PID 3020 wrote to memory of 2704 3020 xffllff.exe 37 PID 2704 wrote to memory of 2428 2704 hntthn.exe 38 PID 2704 wrote to memory of 2428 2704 hntthn.exe 38 PID 2704 wrote to memory of 2428 2704 hntthn.exe 38 PID 2704 wrote to memory of 2428 2704 hntthn.exe 38 PID 2428 wrote to memory of 2588 2428 frxlrlr.exe 39 PID 2428 wrote to memory of 2588 2428 frxlrlr.exe 39 PID 2428 wrote to memory of 2588 2428 frxlrlr.exe 39 PID 2428 wrote to memory of 2588 2428 frxlrlr.exe 39 PID 2588 wrote to memory of 2432 2588 bhhbbn.exe 40 PID 2588 wrote to memory of 2432 2588 bhhbbn.exe 40 PID 2588 wrote to memory of 2432 2588 bhhbbn.exe 40 PID 2588 wrote to memory of 2432 2588 bhhbbn.exe 40 PID 2432 wrote to memory of 2312 2432 pjpjp.exe 41 PID 2432 wrote to memory of 2312 2432 pjpjp.exe 41 PID 2432 wrote to memory of 2312 2432 pjpjp.exe 41 PID 2432 wrote to memory of 2312 2432 pjpjp.exe 41 PID 2312 wrote to memory of 1112 2312 nnbhbb.exe 42 PID 2312 wrote to memory of 1112 2312 nnbhbb.exe 42 PID 2312 wrote to memory of 1112 2312 nnbhbb.exe 42 PID 2312 wrote to memory of 1112 2312 nnbhbb.exe 42 PID 1112 wrote to memory of 2936 1112 vdjdd.exe 43 PID 1112 wrote to memory of 2936 1112 vdjdd.exe 43 PID 1112 wrote to memory of 2936 1112 vdjdd.exe 43 PID 1112 wrote to memory of 2936 1112 vdjdd.exe 43 PID 2936 wrote to memory of 1320 2936 nhttnh.exe 44 PID 2936 wrote to memory of 1320 2936 nhttnh.exe 44 PID 2936 wrote to memory of 1320 2936 nhttnh.exe 44 PID 2936 wrote to memory of 1320 2936 nhttnh.exe 44 PID 1320 wrote to memory of 480 1320 ppvpp.exe 45 PID 1320 wrote to memory of 480 1320 ppvpp.exe 45 PID 1320 wrote to memory of 480 1320 ppvpp.exe 45 PID 1320 wrote to memory of 480 1320 ppvpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe"C:\Users\Admin\AppData\Local\Temp\7a86f38aa37093d191b2e99274b2966072628382adb63df3d554074ddafaebb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vdppp.exec:\vdppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\llxxfxf.exec:\llxxfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\9ntttn.exec:\9ntttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3rxrxxx.exec:\3rxrxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7tnthn.exec:\7tnthn.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5dpjp.exec:\5dpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xffllff.exec:\xffllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\hntthn.exec:\hntthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\frxlrlr.exec:\frxlrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bhhbbn.exec:\bhhbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjpjp.exec:\pjpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\nnbhbb.exec:\nnbhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vdjdd.exec:\vdjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\nhttnh.exec:\nhttnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ppvpp.exec:\ppvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\lrflrfx.exec:\lrflrfx.exe17⤵
- Executes dropped EXE
PID:480 -
\??\c:\hntttt.exec:\hntttt.exe18⤵
- Executes dropped EXE
PID:464 -
\??\c:\xlflffx.exec:\xlflffx.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9xfxxxr.exec:\9xfxxxr.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\vpdvj.exec:\vpdvj.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\frxxllr.exec:\frxxllr.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ppdvj.exec:\ppdvj.exe23⤵
- Executes dropped EXE
PID:1204 -
\??\c:\rlxfllr.exec:\rlxfllr.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\ppdjd.exec:\ppdjd.exe25⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jdppp.exec:\jdppp.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9pjpv.exec:\9pjpv.exe27⤵
- Executes dropped EXE
PID:580 -
\??\c:\jdddp.exec:\jdddp.exe28⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnbbbt.exec:\nnbbbt.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\btnhtb.exec:\btnhtb.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\lflrxfl.exec:\lflrxfl.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ttnbnt.exec:\ttnbnt.exe32⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjdjj.exec:\jjdjj.exe33⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lfrxllx.exec:\lfrxllx.exe34⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hbnbhh.exec:\hbnbhh.exe35⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdvvd.exec:\jdvvd.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lfxrflx.exec:\lfxrflx.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9rlrflx.exec:\9rlrflx.exe38⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tbtbhn.exec:\tbtbhn.exe39⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvdpp.exec:\dvdpp.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\frfffff.exec:\frfffff.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hhhhnn.exec:\hhhhnn.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9tbbhh.exec:\9tbbhh.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dvjjp.exec:\dvjjp.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1bbbth.exec:\1bbbth.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nhtbhb.exec:\nhtbhb.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vvpdj.exec:\vvpdj.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xlrrllx.exec:\xlrrllx.exe49⤵
- Executes dropped EXE
PID:1372 -
\??\c:\1bhhhh.exec:\1bhhhh.exe50⤵
- Executes dropped EXE
PID:676 -
\??\c:\vpjjj.exec:\vpjjj.exe51⤵
- Executes dropped EXE
PID:1580 -
\??\c:\djjdp.exec:\djjdp.exe52⤵
- Executes dropped EXE
PID:576 -
\??\c:\9lffffl.exec:\9lffffl.exe53⤵
- Executes dropped EXE
PID:764 -
\??\c:\tntbbt.exec:\tntbbt.exe54⤵
- Executes dropped EXE
PID:984 -
\??\c:\ttbnbh.exec:\ttbnbh.exe55⤵
- Executes dropped EXE
PID:544 -
\??\c:\pvjjv.exec:\pvjjv.exe56⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lxlffxf.exec:\lxlffxf.exe57⤵
- Executes dropped EXE
PID:284 -
\??\c:\hbnthn.exec:\hbnthn.exe58⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5jvdd.exec:\5jvdd.exe59⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jpjpd.exec:\jpjpd.exe60⤵
- Executes dropped EXE
PID:1404 -
\??\c:\flllfxf.exec:\flllfxf.exe61⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bththh.exec:\bththh.exe62⤵
- Executes dropped EXE
PID:652 -
\??\c:\hthhbb.exec:\hthhbb.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lxrrxfr.exec:\lxrrxfr.exe64⤵
- Executes dropped EXE
PID:1216 -
\??\c:\thtnth.exec:\thtnth.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1hbnth.exec:\1hbnth.exe66⤵PID:1108
-
\??\c:\dpvdd.exec:\dpvdd.exe67⤵PID:2488
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe68⤵PID:2120
-
\??\c:\5frlllx.exec:\5frlllx.exe69⤵PID:2468
-
\??\c:\nnbnhn.exec:\nnbnhn.exe70⤵PID:872
-
\??\c:\9vddd.exec:\9vddd.exe71⤵PID:564
-
\??\c:\dpdjp.exec:\dpdjp.exe72⤵PID:2280
-
\??\c:\rrflrrl.exec:\rrflrrl.exe73⤵PID:1944
-
\??\c:\lfrxffr.exec:\lfrxffr.exe74⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\9hnbbb.exec:\9hnbbb.exe75⤵PID:1596
-
\??\c:\3dpjp.exec:\3dpjp.exe76⤵PID:2372
-
\??\c:\vpjvp.exec:\vpjvp.exe77⤵PID:2136
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe78⤵PID:2532
-
\??\c:\9nbbhb.exec:\9nbbhb.exe79⤵PID:2116
-
\??\c:\btthhn.exec:\btthhn.exe80⤵PID:2864
-
\??\c:\9jppp.exec:\9jppp.exe81⤵PID:2744
-
\??\c:\xrllrrx.exec:\xrllrrx.exe82⤵PID:2848
-
\??\c:\xlxrxff.exec:\xlxrxff.exe83⤵PID:3020
-
\??\c:\1hnhnn.exec:\1hnhnn.exe84⤵PID:3016
-
\??\c:\7vppv.exec:\7vppv.exe85⤵PID:2752
-
\??\c:\dpjpp.exec:\dpjpp.exe86⤵PID:2612
-
\??\c:\xfxrxrr.exec:\xfxrxrr.exe87⤵PID:2724
-
\??\c:\rrxfllr.exec:\rrxfllr.exe88⤵PID:2652
-
\??\c:\7nhhhh.exec:\7nhhhh.exe89⤵PID:2660
-
\??\c:\pjvvd.exec:\pjvvd.exe90⤵PID:1640
-
\??\c:\vpjdj.exec:\vpjdj.exe91⤵PID:1804
-
\??\c:\xrrrxff.exec:\xrrrxff.exe92⤵PID:756
-
\??\c:\tnhhht.exec:\tnhhht.exe93⤵PID:2824
-
\??\c:\5tntbh.exec:\5tntbh.exe94⤵PID:2808
-
\??\c:\vpjvd.exec:\vpjvd.exe95⤵PID:316
-
\??\c:\lrlxrfx.exec:\lrlxrfx.exe96⤵PID:2344
-
\??\c:\fffrflf.exec:\fffrflf.exe97⤵PID:1200
-
\??\c:\hthnnn.exec:\hthnnn.exe98⤵PID:1408
-
\??\c:\bbnnbh.exec:\bbnnbh.exe99⤵PID:2952
-
\??\c:\vjvvp.exec:\vjvvp.exe100⤵PID:2780
-
\??\c:\5lrflll.exec:\5lrflll.exe101⤵PID:2320
-
\??\c:\hbthnt.exec:\hbthnt.exe102⤵PID:2132
-
\??\c:\thnttn.exec:\thnttn.exe103⤵PID:444
-
\??\c:\vvddd.exec:\vvddd.exe104⤵PID:944
-
\??\c:\rflffff.exec:\rflffff.exe105⤵PID:2004
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe106⤵PID:1364
-
\??\c:\9tttbt.exec:\9tttbt.exe107⤵PID:1552
-
\??\c:\3pddp.exec:\3pddp.exe108⤵PID:1192
-
\??\c:\vpdpp.exec:\vpdpp.exe109⤵PID:2464
-
\??\c:\lxxxlrr.exec:\lxxxlrr.exe110⤵PID:1788
-
\??\c:\7rlxlfx.exec:\7rlxlfx.exe111⤵PID:2236
-
\??\c:\nhbntt.exec:\nhbntt.exe112⤵PID:2520
-
\??\c:\vjpjj.exec:\vjpjj.exe113⤵PID:1824
-
\??\c:\dpddj.exec:\dpddj.exe114⤵PID:1696
-
\??\c:\9rlffff.exec:\9rlffff.exe115⤵PID:2396
-
\??\c:\7bnnnn.exec:\7bnnnn.exe116⤵PID:2352
-
\??\c:\bbtntb.exec:\bbtntb.exe117⤵PID:1444
-
\??\c:\7vppp.exec:\7vppp.exe118⤵PID:2304
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe119⤵PID:2332
-
\??\c:\rlxxlrl.exec:\rlxxlrl.exe120⤵PID:3060
-
\??\c:\9nttbn.exec:\9nttbn.exe121⤵PID:2316
-
\??\c:\vpjpd.exec:\vpjpd.exe122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-