Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe
Resource
win7-20240729-en
General
-
Target
e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe
-
Size
454KB
-
MD5
239124d408e5a805c3897886f2266c20
-
SHA1
90e7ec9080d3957f94256c388f89e4409511d02e
-
SHA256
e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732
-
SHA512
a77fa70ce2aa3e39c66198e36c2ff797efa9b242b3f64e7b8f8cdd6b3291263e5e431d5e9e9398c4cb2d839c57aa44a9339211a43c87eb1476510424b68161ca
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-42-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2740-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-58-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2752-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-157-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2128-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-409-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-462-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1688-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-474-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2204-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 hhttbt.exe 2772 7ntnnt.exe 2740 ffrrfxx.exe 2444 vvdjp.exe 2988 7lfxffl.exe 2056 7nbbhh.exe 2752 hbnnth.exe 1876 ttbnbh.exe 1844 ppdjd.exe 2080 3tbhnb.exe 1564 dpjvd.exe 1884 nnttbh.exe 2816 jjvdp.exe 2344 lllllrx.exe 1548 jjvvd.exe 1392 1rfflrx.exe 2128 1rxlfxl.exe 884 llrflxf.exe 1784 tnbbbh.exe 2008 1lfxlrx.exe 972 bbbhhn.exe 1148 fxllflr.exe 1624 bntbth.exe 1704 lrxxflr.exe 1584 hbthnt.exe 2104 nnbhbh.exe 264 3jddv.exe 2664 3thnbh.exe 664 ddjpv.exe 2428 7tbhth.exe 2388 vdvdp.exe 2120 djpdv.exe 2688 lrrfxfl.exe 3060 hbnnnt.exe 3044 9djpd.exe 2776 xrlllff.exe 1716 htnnhh.exe 2608 jdddv.exe 2756 ffxxlfr.exe 2580 nnbbnt.exe 2612 5jvjp.exe 2892 rflxlrx.exe 1228 bhntbn.exe 1876 bhntbh.exe 2560 vpvjj.exe 1240 3nbhnb.exe 1868 hnhnbb.exe 1728 pvjpj.exe 2620 flxxflx.exe 2844 bhtbnb.exe 2140 vpjjj.exe 2940 rfxrlfx.exe 1976 ffrffxr.exe 1688 5btthh.exe 2204 dpjjd.exe 1568 3rlrrxr.exe 1920 hbntht.exe 2332 7pjjv.exe 2008 lxrfrfx.exe 892 tbhhth.exe 1616 hththt.exe 828 vvpvp.exe 1424 fxxrflf.exe 1244 7nntbb.exe -
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-415-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-462-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1688-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-681-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btthh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2232 2188 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 30 PID 2188 wrote to memory of 2232 2188 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 30 PID 2188 wrote to memory of 2232 2188 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 30 PID 2188 wrote to memory of 2232 2188 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 30 PID 2232 wrote to memory of 2772 2232 hhttbt.exe 31 PID 2232 wrote to memory of 2772 2232 hhttbt.exe 31 PID 2232 wrote to memory of 2772 2232 hhttbt.exe 31 PID 2232 wrote to memory of 2772 2232 hhttbt.exe 31 PID 2772 wrote to memory of 2740 2772 7ntnnt.exe 32 PID 2772 wrote to memory of 2740 2772 7ntnnt.exe 32 PID 2772 wrote to memory of 2740 2772 7ntnnt.exe 32 PID 2772 wrote to memory of 2740 2772 7ntnnt.exe 32 PID 2740 wrote to memory of 2444 2740 ffrrfxx.exe 33 PID 2740 wrote to memory of 2444 2740 ffrrfxx.exe 33 PID 2740 wrote to memory of 2444 2740 ffrrfxx.exe 33 PID 2740 wrote to memory of 2444 2740 ffrrfxx.exe 33 PID 2444 wrote to memory of 2988 2444 vvdjp.exe 34 PID 2444 wrote to memory of 2988 2444 vvdjp.exe 34 PID 2444 wrote to memory of 2988 2444 vvdjp.exe 34 PID 2444 wrote to memory of 2988 2444 vvdjp.exe 34 PID 2988 wrote to memory of 2056 2988 7lfxffl.exe 35 PID 2988 wrote to memory of 2056 2988 7lfxffl.exe 35 PID 2988 wrote to memory of 2056 2988 7lfxffl.exe 35 PID 2988 wrote to memory of 2056 2988 7lfxffl.exe 35 PID 2056 wrote to memory of 2752 2056 7nbbhh.exe 36 PID 2056 wrote to memory of 2752 2056 7nbbhh.exe 36 PID 2056 wrote to memory of 2752 2056 7nbbhh.exe 36 PID 2056 wrote to memory of 2752 2056 7nbbhh.exe 36 PID 2752 wrote to memory of 1876 2752 hbnnth.exe 37 PID 2752 wrote to memory of 1876 2752 hbnnth.exe 37 PID 2752 wrote to memory of 1876 2752 hbnnth.exe 37 PID 2752 wrote to memory of 1876 2752 hbnnth.exe 37 PID 1876 wrote to memory of 1844 1876 ttbnbh.exe 38 PID 1876 wrote to memory of 1844 1876 ttbnbh.exe 38 PID 1876 wrote to memory of 1844 1876 ttbnbh.exe 38 PID 1876 wrote to memory of 1844 1876 ttbnbh.exe 38 PID 1844 wrote to memory of 2080 1844 ppdjd.exe 39 PID 1844 wrote to memory of 2080 1844 ppdjd.exe 39 PID 1844 wrote to memory of 2080 1844 ppdjd.exe 39 PID 1844 wrote to memory of 2080 1844 ppdjd.exe 39 PID 2080 wrote to memory of 1564 2080 3tbhnb.exe 40 PID 2080 wrote to memory of 1564 2080 3tbhnb.exe 40 PID 2080 wrote to memory of 1564 2080 3tbhnb.exe 40 PID 2080 wrote to memory of 1564 2080 3tbhnb.exe 40 PID 1564 wrote to memory of 1884 1564 dpjvd.exe 41 PID 1564 wrote to memory of 1884 1564 dpjvd.exe 41 PID 1564 wrote to memory of 1884 1564 dpjvd.exe 41 PID 1564 wrote to memory of 1884 1564 dpjvd.exe 41 PID 1884 wrote to memory of 2816 1884 nnttbh.exe 42 PID 1884 wrote to memory of 2816 1884 nnttbh.exe 42 PID 1884 wrote to memory of 2816 1884 nnttbh.exe 42 PID 1884 wrote to memory of 2816 1884 nnttbh.exe 42 PID 2816 wrote to memory of 2344 2816 jjvdp.exe 43 PID 2816 wrote to memory of 2344 2816 jjvdp.exe 43 PID 2816 wrote to memory of 2344 2816 jjvdp.exe 43 PID 2816 wrote to memory of 2344 2816 jjvdp.exe 43 PID 2344 wrote to memory of 1548 2344 lllllrx.exe 44 PID 2344 wrote to memory of 1548 2344 lllllrx.exe 44 PID 2344 wrote to memory of 1548 2344 lllllrx.exe 44 PID 2344 wrote to memory of 1548 2344 lllllrx.exe 44 PID 1548 wrote to memory of 1392 1548 jjvvd.exe 45 PID 1548 wrote to memory of 1392 1548 jjvvd.exe 45 PID 1548 wrote to memory of 1392 1548 jjvvd.exe 45 PID 1548 wrote to memory of 1392 1548 jjvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe"C:\Users\Admin\AppData\Local\Temp\e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hhttbt.exec:\hhttbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\7ntnnt.exec:\7ntnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ffrrfxx.exec:\ffrrfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vvdjp.exec:\vvdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\7lfxffl.exec:\7lfxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7nbbhh.exec:\7nbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\hbnnth.exec:\hbnnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ttbnbh.exec:\ttbnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ppdjd.exec:\ppdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\3tbhnb.exec:\3tbhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dpjvd.exec:\dpjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\nnttbh.exec:\nnttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\jjvdp.exec:\jjvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lllllrx.exec:\lllllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jjvvd.exec:\jjvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\1rfflrx.exec:\1rfflrx.exe17⤵
- Executes dropped EXE
PID:1392 -
\??\c:\1rxlfxl.exec:\1rxlfxl.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\llrflxf.exec:\llrflxf.exe19⤵
- Executes dropped EXE
PID:884 -
\??\c:\tnbbbh.exec:\tnbbbh.exe20⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1lfxlrx.exec:\1lfxlrx.exe21⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bbbhhn.exec:\bbbhhn.exe22⤵
- Executes dropped EXE
PID:972 -
\??\c:\fxllflr.exec:\fxllflr.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bntbth.exec:\bntbth.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lrxxflr.exec:\lrxxflr.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbthnt.exec:\hbthnt.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nnbhbh.exec:\nnbhbh.exe27⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3jddv.exec:\3jddv.exe28⤵
- Executes dropped EXE
PID:264 -
\??\c:\3thnbh.exec:\3thnbh.exe29⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ddjpv.exec:\ddjpv.exe30⤵
- Executes dropped EXE
PID:664 -
\??\c:\7tbhth.exec:\7tbhth.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vdvdp.exec:\vdvdp.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\djpdv.exec:\djpdv.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lrrfxfl.exec:\lrrfxfl.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbnnnt.exec:\hbnnnt.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9djpd.exec:\9djpd.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrlllff.exec:\xrlllff.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\htnnhh.exec:\htnnhh.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jdddv.exec:\jdddv.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ffxxlfr.exec:\ffxxlfr.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nnbbnt.exec:\nnbbnt.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5jvjp.exec:\5jvjp.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rflxlrx.exec:\rflxlrx.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhntbn.exec:\bhntbn.exe44⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bhntbh.exec:\bhntbh.exe45⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vpvjj.exec:\vpvjj.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3nbhnb.exec:\3nbhnb.exe47⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hnhnbb.exec:\hnhnbb.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pvjpj.exec:\pvjpj.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\flxxflx.exec:\flxxflx.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bhtbnb.exec:\bhtbnb.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpjjj.exec:\vpjjj.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ffrffxr.exec:\ffrffxr.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5btthh.exec:\5btthh.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\dpjjd.exec:\dpjjd.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3rlrrxr.exec:\3rlrrxr.exe57⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbntht.exec:\hbntht.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7pjjv.exec:\7pjjv.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lxrfrfx.exec:\lxrfrfx.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tbhhth.exec:\tbhhth.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\hththt.exec:\hththt.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vvpvp.exec:\vvpvp.exe63⤵
- Executes dropped EXE
PID:828 -
\??\c:\fxxrflf.exec:\fxxrflf.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7nntbb.exec:\7nntbb.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ddpvj.exec:\ddpvj.exe66⤵PID:1888
-
\??\c:\ffrfrxr.exec:\ffrfrxr.exe67⤵PID:2272
-
\??\c:\lrllxlx.exec:\lrllxlx.exe68⤵PID:2288
-
\??\c:\3btbtb.exec:\3btbtb.exe69⤵PID:1992
-
\??\c:\7dpvv.exec:\7dpvv.exe70⤵PID:2664
-
\??\c:\llxrfxf.exec:\llxrfxf.exe71⤵PID:1220
-
\??\c:\7tnnbt.exec:\7tnnbt.exe72⤵PID:748
-
\??\c:\1nhhtb.exec:\1nhhtb.exe73⤵PID:2428
-
\??\c:\3dpdp.exec:\3dpdp.exe74⤵PID:876
-
\??\c:\9lrxlrl.exec:\9lrxlrl.exe75⤵PID:2232
-
\??\c:\hhtbhn.exec:\hhtbhn.exe76⤵PID:2880
-
\??\c:\ddpvj.exec:\ddpvj.exe77⤵PID:1364
-
\??\c:\djvvj.exec:\djvvj.exe78⤵PID:2380
-
\??\c:\hhnnth.exec:\hhnnth.exe79⤵PID:2808
-
\??\c:\hnbhth.exec:\hnbhth.exe80⤵PID:3004
-
\??\c:\jvdjv.exec:\jvdjv.exe81⤵PID:2720
-
\??\c:\xrflxxl.exec:\xrflxxl.exe82⤵PID:2988
-
\??\c:\tthtnb.exec:\tthtnb.exe83⤵PID:2704
-
\??\c:\ddpvj.exec:\ddpvj.exe84⤵PID:2260
-
\??\c:\pvppj.exec:\pvppj.exe85⤵PID:1004
-
\??\c:\3ffxlrl.exec:\3ffxlrl.exe86⤵PID:2440
-
\??\c:\tbthtt.exec:\tbthtt.exe87⤵PID:1356
-
\??\c:\dpjpj.exec:\dpjpj.exe88⤵PID:2208
-
\??\c:\lflrllf.exec:\lflrllf.exe89⤵PID:2064
-
\??\c:\tnhtnt.exec:\tnhtnt.exe90⤵PID:2460
-
\??\c:\hhhnbh.exec:\hhhnbh.exe91⤵PID:2640
-
\??\c:\djdpd.exec:\djdpd.exe92⤵PID:1020
-
\??\c:\lfrrffr.exec:\lfrrffr.exe93⤵PID:2344
-
\??\c:\xxrffrx.exec:\xxrffrx.exe94⤵PID:2824
-
\??\c:\nthhnt.exec:\nthhnt.exe95⤵PID:2140
-
\??\c:\vvpdv.exec:\vvpdv.exe96⤵PID:804
-
\??\c:\3fxfrfr.exec:\3fxfrfr.exe97⤵PID:2340
-
\??\c:\7xrxrfr.exec:\7xrxrfr.exe98⤵PID:2420
-
\??\c:\hhnntt.exec:\hhnntt.exe99⤵PID:2328
-
\??\c:\9rflrxl.exec:\9rflrxl.exe100⤵PID:2372
-
\??\c:\hhthnt.exec:\hhthnt.exe101⤵PID:1752
-
\??\c:\ttnntb.exec:\ttnntb.exe102⤵PID:1756
-
\??\c:\pvppd.exec:\pvppd.exe103⤵PID:1168
-
\??\c:\7fxrflr.exec:\7fxrflr.exe104⤵PID:972
-
\??\c:\xfrxfrx.exec:\xfrxfrx.exe105⤵PID:1732
-
\??\c:\3thntb.exec:\3thntb.exe106⤵PID:1624
-
\??\c:\9vppv.exec:\9vppv.exe107⤵PID:2540
-
\??\c:\vjvdv.exec:\vjvdv.exe108⤵PID:1684
-
\??\c:\rxrrxfx.exec:\rxrrxfx.exe109⤵PID:1244
-
\??\c:\bbntht.exec:\bbntht.exe110⤵PID:1584
-
\??\c:\jpvdp.exec:\jpvdp.exe111⤵PID:2272
-
\??\c:\1pdpj.exec:\1pdpj.exe112⤵PID:2288
-
\??\c:\ffflrxl.exec:\ffflrxl.exe113⤵PID:1992
-
\??\c:\ttnbnb.exec:\ttnbnb.exe114⤵PID:2664
-
\??\c:\9hnbnb.exec:\9hnbnb.exe115⤵PID:1336
-
\??\c:\jvvpp.exec:\jvvpp.exe116⤵PID:2188
-
\??\c:\rxrxlrl.exec:\rxrxlrl.exe117⤵PID:2692
-
\??\c:\hnnttb.exec:\hnnttb.exe118⤵PID:2856
-
\??\c:\hbbhtn.exec:\hbbhtn.exe119⤵PID:2772
-
\??\c:\pdpvd.exec:\pdpvd.exe120⤵PID:2880
-
\??\c:\1flrxxf.exec:\1flrxxf.exe121⤵PID:2804
-
\??\c:\nttbnb.exec:\nttbnb.exe122⤵PID:2380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-