Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe
Resource
win7-20240708-en
General
-
Target
cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe
-
Size
456KB
-
MD5
75ecf0f1e5b5e84fd0676e4a3ce49ae7
-
SHA1
adca04000e1f81a2cf9c2f3151749e272716ead3
-
SHA256
cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c
-
SHA512
16b1931a0aa94d411c637cd95b911b5ccb9c36269181fdfec325fec439a9590d97013d913dd33d3a443d0fc34ca8ecd8b0d95a19368ec05df376912bffe6302d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1892-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-70-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2256-74-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2600-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-251-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1716-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-370-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1448-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-456-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/944-549-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2260-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-607-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2208-699-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/656-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 1ddvd.exe 2768 fxrxlrf.exe 2812 frlxxlf.exe 2620 xlllrrx.exe 2544 pjvdj.exe 2560 64060.exe 2256 3fllrlr.exe 3004 4240262.exe 2600 4200606.exe 2128 5llrxlr.exe 1312 dvppv.exe 796 802888.exe 2708 864400.exe 1660 jdpvj.exe 2888 80200.exe 2416 2684440.exe 1948 64686.exe 1548 64482.exe 2932 420666.exe 1884 g6884.exe 656 7vvvv.exe 2948 802666.exe 2280 k08440.exe 1508 60228.exe 1300 604088.exe 1520 2028406.exe 1716 8082226.exe 2368 m8242.exe 2968 2088244.exe 552 pdjvd.exe 868 u068620.exe 1680 jvvpv.exe 1892 tnhhtt.exe 2644 424804.exe 2760 w26622.exe 2936 bbbnhn.exe 2792 hhhtth.exe 2540 jvppd.exe 2852 9pdjp.exe 2672 ffrxflx.exe 2536 a6044.exe 2560 86840.exe 1052 20848.exe 1448 46604.exe 2404 pjppj.exe 1796 80444.exe 1156 3rrxrlf.exe 2876 088408.exe 1152 8688680.exe 2336 648248.exe 1344 dvvpj.exe 828 048844.exe 2888 0424280.exe 2028 lxlfxfr.exe 1776 xllxxlf.exe 2300 0424068.exe 2176 6428046.exe 2396 w68284.exe 2408 rfxxlfr.exe 2044 64846.exe 1444 5vvdv.exe 444 646206.exe 1524 thtntn.exe 944 xxxrllr.exe -
resource yara_rule behavioral1/memory/1892-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-336-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2536-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-782-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2028840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8646884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8266228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 066288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8200662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxlrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 2024 1892 cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe 30 PID 1892 wrote to memory of 2024 1892 cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe 30 PID 1892 wrote to memory of 2024 1892 cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe 30 PID 1892 wrote to memory of 2024 1892 cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe 30 PID 2024 wrote to memory of 2768 2024 1ddvd.exe 31 PID 2024 wrote to memory of 2768 2024 1ddvd.exe 31 PID 2024 wrote to memory of 2768 2024 1ddvd.exe 31 PID 2024 wrote to memory of 2768 2024 1ddvd.exe 31 PID 2768 wrote to memory of 2812 2768 fxrxlrf.exe 32 PID 2768 wrote to memory of 2812 2768 fxrxlrf.exe 32 PID 2768 wrote to memory of 2812 2768 fxrxlrf.exe 32 PID 2768 wrote to memory of 2812 2768 fxrxlrf.exe 32 PID 2812 wrote to memory of 2620 2812 frlxxlf.exe 33 PID 2812 wrote to memory of 2620 2812 frlxxlf.exe 33 PID 2812 wrote to memory of 2620 2812 frlxxlf.exe 33 PID 2812 wrote to memory of 2620 2812 frlxxlf.exe 33 PID 2620 wrote to memory of 2544 2620 xlllrrx.exe 34 PID 2620 wrote to memory of 2544 2620 xlllrrx.exe 34 PID 2620 wrote to memory of 2544 2620 xlllrrx.exe 34 PID 2620 wrote to memory of 2544 2620 xlllrrx.exe 34 PID 2544 wrote to memory of 2560 2544 pjvdj.exe 35 PID 2544 wrote to memory of 2560 2544 pjvdj.exe 35 PID 2544 wrote to memory of 2560 2544 pjvdj.exe 35 PID 2544 wrote to memory of 2560 2544 pjvdj.exe 35 PID 2560 wrote to memory of 2256 2560 64060.exe 36 PID 2560 wrote to memory of 2256 2560 64060.exe 36 PID 2560 wrote to memory of 2256 2560 64060.exe 36 PID 2560 wrote to memory of 2256 2560 64060.exe 36 PID 2256 wrote to memory of 3004 2256 3fllrlr.exe 37 PID 2256 wrote to memory of 3004 2256 3fllrlr.exe 37 PID 2256 wrote to memory of 3004 2256 3fllrlr.exe 37 PID 2256 wrote to memory of 3004 2256 3fllrlr.exe 37 PID 3004 wrote to memory of 2600 3004 4240262.exe 38 PID 3004 wrote to memory of 2600 3004 4240262.exe 38 PID 3004 wrote to memory of 2600 3004 4240262.exe 38 PID 3004 wrote to memory of 2600 3004 4240262.exe 38 PID 2600 wrote to memory of 2128 2600 4200606.exe 39 PID 2600 wrote to memory of 2128 2600 4200606.exe 39 PID 2600 wrote to memory of 2128 2600 4200606.exe 39 PID 2600 wrote to memory of 2128 2600 4200606.exe 39 PID 2128 wrote to memory of 1312 2128 5llrxlr.exe 40 PID 2128 wrote to memory of 1312 2128 5llrxlr.exe 40 PID 2128 wrote to memory of 1312 2128 5llrxlr.exe 40 PID 2128 wrote to memory of 1312 2128 5llrxlr.exe 40 PID 1312 wrote to memory of 796 1312 dvppv.exe 41 PID 1312 wrote to memory of 796 1312 dvppv.exe 41 PID 1312 wrote to memory of 796 1312 dvppv.exe 41 PID 1312 wrote to memory of 796 1312 dvppv.exe 41 PID 796 wrote to memory of 2708 796 802888.exe 42 PID 796 wrote to memory of 2708 796 802888.exe 42 PID 796 wrote to memory of 2708 796 802888.exe 42 PID 796 wrote to memory of 2708 796 802888.exe 42 PID 2708 wrote to memory of 1660 2708 864400.exe 43 PID 2708 wrote to memory of 1660 2708 864400.exe 43 PID 2708 wrote to memory of 1660 2708 864400.exe 43 PID 2708 wrote to memory of 1660 2708 864400.exe 43 PID 1660 wrote to memory of 2888 1660 jdpvj.exe 44 PID 1660 wrote to memory of 2888 1660 jdpvj.exe 44 PID 1660 wrote to memory of 2888 1660 jdpvj.exe 44 PID 1660 wrote to memory of 2888 1660 jdpvj.exe 44 PID 2888 wrote to memory of 2416 2888 80200.exe 45 PID 2888 wrote to memory of 2416 2888 80200.exe 45 PID 2888 wrote to memory of 2416 2888 80200.exe 45 PID 2888 wrote to memory of 2416 2888 80200.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe"C:\Users\Admin\AppData\Local\Temp\cf4e40fa9c7f045f3e2116a721dd34a461ffd52b290a15350c29f552d179390c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\1ddvd.exec:\1ddvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\frlxxlf.exec:\frlxxlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xlllrrx.exec:\xlllrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\pjvdj.exec:\pjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\64060.exec:\64060.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3fllrlr.exec:\3fllrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\4240262.exec:\4240262.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\4200606.exec:\4200606.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5llrxlr.exec:\5llrxlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\dvppv.exec:\dvppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\802888.exec:\802888.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\864400.exec:\864400.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jdpvj.exec:\jdpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\80200.exec:\80200.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\2684440.exec:\2684440.exe17⤵
- Executes dropped EXE
PID:2416 -
\??\c:\64686.exec:\64686.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\64482.exec:\64482.exe19⤵
- Executes dropped EXE
PID:1548 -
\??\c:\420666.exec:\420666.exe20⤵
- Executes dropped EXE
PID:2932 -
\??\c:\g6884.exec:\g6884.exe21⤵
- Executes dropped EXE
PID:1884 -
\??\c:\7vvvv.exec:\7vvvv.exe22⤵
- Executes dropped EXE
PID:656 -
\??\c:\802666.exec:\802666.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\k08440.exec:\k08440.exe24⤵
- Executes dropped EXE
PID:2280 -
\??\c:\60228.exec:\60228.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\604088.exec:\604088.exe26⤵
- Executes dropped EXE
PID:1300 -
\??\c:\2028406.exec:\2028406.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\8082226.exec:\8082226.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\m8242.exec:\m8242.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\2088244.exec:\2088244.exe30⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pdjvd.exec:\pdjvd.exe31⤵
- Executes dropped EXE
PID:552 -
\??\c:\u068620.exec:\u068620.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\jvvpv.exec:\jvvpv.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tnhhtt.exec:\tnhhtt.exe34⤵
- Executes dropped EXE
PID:1892 -
\??\c:\424804.exec:\424804.exe35⤵
- Executes dropped EXE
PID:2644 -
\??\c:\w26622.exec:\w26622.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbbnhn.exec:\bbbnhn.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhhtth.exec:\hhhtth.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jvppd.exec:\jvppd.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9pdjp.exec:\9pdjp.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ffrxflx.exec:\ffrxflx.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\a6044.exec:\a6044.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\86840.exec:\86840.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\20848.exec:\20848.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\46604.exec:\46604.exe45⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pjppj.exec:\pjppj.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\80444.exec:\80444.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\3rrxrlf.exec:\3rrxrlf.exe48⤵
- Executes dropped EXE
PID:1156 -
\??\c:\088408.exec:\088408.exe49⤵
- Executes dropped EXE
PID:2876 -
\??\c:\8688680.exec:\8688680.exe50⤵
- Executes dropped EXE
PID:1152 -
\??\c:\648248.exec:\648248.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dvvpj.exec:\dvvpj.exe52⤵
- Executes dropped EXE
PID:1344 -
\??\c:\048844.exec:\048844.exe53⤵
- Executes dropped EXE
PID:828 -
\??\c:\0424280.exec:\0424280.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lxlfxfr.exec:\lxlfxfr.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xllxxlf.exec:\xllxxlf.exe56⤵
- Executes dropped EXE
PID:1776 -
\??\c:\0424068.exec:\0424068.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\6428046.exec:\6428046.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\w68284.exec:\w68284.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rfxxlfr.exec:\rfxxlfr.exe60⤵
- Executes dropped EXE
PID:2408 -
\??\c:\64846.exec:\64846.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5vvdv.exec:\5vvdv.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\646206.exec:\646206.exe63⤵
- Executes dropped EXE
PID:444 -
\??\c:\thtntn.exec:\thtntn.exe64⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xxxrllr.exec:\xxxrllr.exe65⤵
- Executes dropped EXE
PID:944 -
\??\c:\9httnn.exec:\9httnn.exe66⤵PID:1816
-
\??\c:\vvpdj.exec:\vvpdj.exe67⤵PID:924
-
\??\c:\hhnbhn.exec:\hhnbhn.exe68⤵PID:1552
-
\??\c:\5vpdj.exec:\5vpdj.exe69⤵PID:1728
-
\??\c:\jdvvd.exec:\jdvvd.exe70⤵PID:2260
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe71⤵PID:1988
-
\??\c:\7hthnt.exec:\7hthnt.exe72⤵PID:1148
-
\??\c:\hhhnbb.exec:\hhhnbb.exe73⤵
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\e22866.exec:\e22866.exe74⤵PID:2276
-
\??\c:\vvjvv.exec:\vvjvv.exe75⤵PID:1560
-
\??\c:\w26806.exec:\w26806.exe76⤵PID:1540
-
\??\c:\1bnnnn.exec:\1bnnnn.exe77⤵PID:2836
-
\??\c:\486684.exec:\486684.exe78⤵PID:2796
-
\??\c:\jjdjv.exec:\jjdjv.exe79⤵PID:1072
-
\??\c:\824288.exec:\824288.exe80⤵PID:2636
-
\??\c:\jdddp.exec:\jdddp.exe81⤵PID:2892
-
\??\c:\hnhbhb.exec:\hnhbhb.exe82⤵PID:2676
-
\??\c:\8684480.exec:\8684480.exe83⤵PID:2616
-
\??\c:\048448.exec:\048448.exe84⤵PID:2992
-
\??\c:\0866224.exec:\0866224.exe85⤵PID:2580
-
\??\c:\vjdjp.exec:\vjdjp.exe86⤵PID:560
-
\??\c:\2602406.exec:\2602406.exe87⤵PID:1088
-
\??\c:\20840.exec:\20840.exe88⤵PID:2208
-
\??\c:\i006880.exec:\i006880.exe89⤵PID:2224
-
\??\c:\rrrrflx.exec:\rrrrflx.exe90⤵PID:2128
-
\??\c:\s0400.exec:\s0400.exe91⤵PID:1156
-
\??\c:\20240.exec:\20240.exe92⤵PID:108
-
\??\c:\3lrrlff.exec:\3lrrlff.exe93⤵PID:1968
-
\??\c:\jdvjp.exec:\jdvjp.exe94⤵
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\tnnbhn.exec:\tnnbhn.exe95⤵PID:1848
-
\??\c:\26402.exec:\26402.exe96⤵PID:2860
-
\??\c:\04280.exec:\04280.exe97⤵PID:1952
-
\??\c:\a4842.exec:\a4842.exe98⤵PID:2020
-
\??\c:\jdjjp.exec:\jdjjp.exe99⤵PID:1948
-
\??\c:\68426.exec:\68426.exe100⤵PID:2392
-
\??\c:\s2000.exec:\s2000.exe101⤵PID:2120
-
\??\c:\9llrrxl.exec:\9llrrxl.exe102⤵PID:2148
-
\??\c:\q08028.exec:\q08028.exe103⤵PID:600
-
\??\c:\s6688.exec:\s6688.exe104⤵PID:656
-
\??\c:\dpdvd.exec:\dpdvd.exe105⤵PID:2044
-
\??\c:\64662.exec:\64662.exe106⤵PID:880
-
\??\c:\g8808.exec:\g8808.exe107⤵PID:444
-
\??\c:\q22802.exec:\q22802.exe108⤵PID:984
-
\??\c:\o428002.exec:\o428002.exe109⤵PID:1616
-
\??\c:\pjvdj.exec:\pjvdj.exe110⤵PID:1608
-
\??\c:\ttnbbh.exec:\ttnbbh.exe111⤵PID:924
-
\??\c:\7jdjj.exec:\7jdjj.exe112⤵PID:1232
-
\??\c:\lfffxfr.exec:\lfffxfr.exe113⤵PID:1812
-
\??\c:\1jpdv.exec:\1jpdv.exe114⤵PID:1544
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe115⤵PID:2108
-
\??\c:\0866224.exec:\0866224.exe116⤵PID:1696
-
\??\c:\ffrfrxl.exec:\ffrfrxl.exe117⤵PID:2296
-
\??\c:\86844.exec:\86844.exe118⤵PID:2164
-
\??\c:\602622.exec:\602622.exe119⤵PID:1568
-
\??\c:\046288.exec:\046288.exe120⤵PID:3068
-
\??\c:\66200.exec:\66200.exe121⤵PID:2632
-
\??\c:\pvjjv.exec:\pvjjv.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-