Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe
Resource
win7-20240903-en
General
-
Target
b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe
-
Size
72KB
-
MD5
366778de520f3ba12fe89324217a5d77
-
SHA1
5ac6cfafe568e64b92e4a9ce734b7babcdef0030
-
SHA256
b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a
-
SHA512
6614a436a29a1a1872a218a5a99e794dc26ae017cc7a8ebfe32da17b10ce4f8cb43643ed0a619889047c4ae7f5d76ee49d0c60dbf35d2705af5584cb1dba2b40
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIdiW65OA:ymb3NkkiQ3mdBjFIFdJ8bViW6r
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/1940-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2132 9tnbbb.exe 2996 1djjj.exe 2116 dvjjd.exe 2800 1lrrlfx.exe 2852 bnttbb.exe 2568 1vddj.exe 2656 xxxxffl.exe 2664 bhnhhh.exe 2940 pjppp.exe 916 1vpjj.exe 1556 fxlxxxl.exe 2060 lfrrflx.exe 1920 nnnbnb.exe 1524 jjpjj.exe 2456 5dpvv.exe 2004 1lflxxl.exe 2416 7rlrxfl.exe 2348 tnhntt.exe 2408 dpvpv.exe 2120 9pvvd.exe 2872 9ffffxf.exe 816 rlrxffl.exe 932 bbnnnh.exe 2980 bhnnnb.exe 1160 vjvdp.exe 1660 pdppv.exe 1700 rfllxxf.exe 2300 hbtbnn.exe 868 9httbt.exe 2500 1vdjv.exe 2516 7djvv.exe 2824 9rllxfl.exe 2692 xrflxrx.exe 2452 1ntbtt.exe 2776 jvjpd.exe 2548 jvdpp.exe 2764 dvjpp.exe 2968 lfrxxlf.exe 2632 tbhnnb.exe 2552 tbhttt.exe 2924 dpvvj.exe 1648 vpjpj.exe 580 9vpvj.exe 1372 frlrrxr.exe 1620 9xrxllr.exe 2368 nhnntt.exe 1868 hbnbnn.exe 492 5pvpd.exe 1992 3ddjv.exe 1524 fxxfrlf.exe 1988 lfrfxfr.exe 2400 tbnnbh.exe 2192 9nbhnh.exe 1896 nhbbbh.exe 1808 5jddd.exe 2380 rxrxrfr.exe 1668 9xlxffr.exe 800 fxxflrx.exe 1340 bththh.exe 872 htnntb.exe 932 9jdjv.exe 1672 9vppp.exe 2296 frxflrr.exe 2376 3xflxxr.exe -
resource yara_rule behavioral1/memory/1940-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2132 1940 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 31 PID 1940 wrote to memory of 2132 1940 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 31 PID 1940 wrote to memory of 2132 1940 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 31 PID 1940 wrote to memory of 2132 1940 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 31 PID 2132 wrote to memory of 2996 2132 9tnbbb.exe 32 PID 2132 wrote to memory of 2996 2132 9tnbbb.exe 32 PID 2132 wrote to memory of 2996 2132 9tnbbb.exe 32 PID 2132 wrote to memory of 2996 2132 9tnbbb.exe 32 PID 2996 wrote to memory of 2116 2996 1djjj.exe 33 PID 2996 wrote to memory of 2116 2996 1djjj.exe 33 PID 2996 wrote to memory of 2116 2996 1djjj.exe 33 PID 2996 wrote to memory of 2116 2996 1djjj.exe 33 PID 2116 wrote to memory of 2800 2116 dvjjd.exe 34 PID 2116 wrote to memory of 2800 2116 dvjjd.exe 34 PID 2116 wrote to memory of 2800 2116 dvjjd.exe 34 PID 2116 wrote to memory of 2800 2116 dvjjd.exe 34 PID 2800 wrote to memory of 2852 2800 1lrrlfx.exe 35 PID 2800 wrote to memory of 2852 2800 1lrrlfx.exe 35 PID 2800 wrote to memory of 2852 2800 1lrrlfx.exe 35 PID 2800 wrote to memory of 2852 2800 1lrrlfx.exe 35 PID 2852 wrote to memory of 2568 2852 bnttbb.exe 36 PID 2852 wrote to memory of 2568 2852 bnttbb.exe 36 PID 2852 wrote to memory of 2568 2852 bnttbb.exe 36 PID 2852 wrote to memory of 2568 2852 bnttbb.exe 36 PID 2568 wrote to memory of 2656 2568 1vddj.exe 37 PID 2568 wrote to memory of 2656 2568 1vddj.exe 37 PID 2568 wrote to memory of 2656 2568 1vddj.exe 37 PID 2568 wrote to memory of 2656 2568 1vddj.exe 37 PID 2656 wrote to memory of 2664 2656 xxxxffl.exe 38 PID 2656 wrote to memory of 2664 2656 xxxxffl.exe 38 PID 2656 wrote to memory of 2664 2656 xxxxffl.exe 38 PID 2656 wrote to memory of 2664 2656 xxxxffl.exe 38 PID 2664 wrote to memory of 2940 2664 bhnhhh.exe 39 PID 2664 wrote to memory of 2940 2664 bhnhhh.exe 39 PID 2664 wrote to memory of 2940 2664 bhnhhh.exe 39 PID 2664 wrote to memory of 2940 2664 bhnhhh.exe 39 PID 2940 wrote to memory of 916 2940 pjppp.exe 40 PID 2940 wrote to memory of 916 2940 pjppp.exe 40 PID 2940 wrote to memory of 916 2940 pjppp.exe 40 PID 2940 wrote to memory of 916 2940 pjppp.exe 40 PID 916 wrote to memory of 1556 916 1vpjj.exe 41 PID 916 wrote to memory of 1556 916 1vpjj.exe 41 PID 916 wrote to memory of 1556 916 1vpjj.exe 41 PID 916 wrote to memory of 1556 916 1vpjj.exe 41 PID 1556 wrote to memory of 2060 1556 fxlxxxl.exe 42 PID 1556 wrote to memory of 2060 1556 fxlxxxl.exe 42 PID 1556 wrote to memory of 2060 1556 fxlxxxl.exe 42 PID 1556 wrote to memory of 2060 1556 fxlxxxl.exe 42 PID 2060 wrote to memory of 1920 2060 lfrrflx.exe 43 PID 2060 wrote to memory of 1920 2060 lfrrflx.exe 43 PID 2060 wrote to memory of 1920 2060 lfrrflx.exe 43 PID 2060 wrote to memory of 1920 2060 lfrrflx.exe 43 PID 1920 wrote to memory of 1524 1920 nnnbnb.exe 44 PID 1920 wrote to memory of 1524 1920 nnnbnb.exe 44 PID 1920 wrote to memory of 1524 1920 nnnbnb.exe 44 PID 1920 wrote to memory of 1524 1920 nnnbnb.exe 44 PID 1524 wrote to memory of 2456 1524 jjpjj.exe 45 PID 1524 wrote to memory of 2456 1524 jjpjj.exe 45 PID 1524 wrote to memory of 2456 1524 jjpjj.exe 45 PID 1524 wrote to memory of 2456 1524 jjpjj.exe 45 PID 2456 wrote to memory of 2004 2456 5dpvv.exe 46 PID 2456 wrote to memory of 2004 2456 5dpvv.exe 46 PID 2456 wrote to memory of 2004 2456 5dpvv.exe 46 PID 2456 wrote to memory of 2004 2456 5dpvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe"C:\Users\Admin\AppData\Local\Temp\b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\9tnbbb.exec:\9tnbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\1djjj.exec:\1djjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\dvjjd.exec:\dvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\1lrrlfx.exec:\1lrrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bnttbb.exec:\bnttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1vddj.exec:\1vddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xxxxffl.exec:\xxxxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bhnhhh.exec:\bhnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pjppp.exec:\pjppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\1vpjj.exec:\1vpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\fxlxxxl.exec:\fxlxxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\lfrrflx.exec:\lfrrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nnnbnb.exec:\nnnbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jjpjj.exec:\jjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\5dpvv.exec:\5dpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1lflxxl.exec:\1lflxxl.exe17⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7rlrxfl.exec:\7rlrxfl.exe18⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnhntt.exec:\tnhntt.exe19⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dpvpv.exec:\dpvpv.exe20⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9pvvd.exec:\9pvvd.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9ffffxf.exec:\9ffffxf.exe22⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlrxffl.exec:\rlrxffl.exe23⤵
- Executes dropped EXE
PID:816 -
\??\c:\bbnnnh.exec:\bbnnnh.exe24⤵
- Executes dropped EXE
PID:932 -
\??\c:\bhnnnb.exec:\bhnnnb.exe25⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vjvdp.exec:\vjvdp.exe26⤵
- Executes dropped EXE
PID:1160 -
\??\c:\pdppv.exec:\pdppv.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rfllxxf.exec:\rfllxxf.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbtbnn.exec:\hbtbnn.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9httbt.exec:\9httbt.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\1vdjv.exec:\1vdjv.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7djvv.exec:\7djvv.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9rllxfl.exec:\9rllxfl.exe33⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xrflxrx.exec:\xrflxrx.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1ntbtt.exec:\1ntbtt.exe35⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jvjpd.exec:\jvjpd.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jvdpp.exec:\jvdpp.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvjpp.exec:\dvjpp.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lfrxxlf.exec:\lfrxxlf.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tbhnnb.exec:\tbhnnb.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tbhttt.exec:\tbhttt.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dpvvj.exec:\dpvvj.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpjpj.exec:\vpjpj.exe43⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9vpvj.exec:\9vpvj.exe44⤵
- Executes dropped EXE
PID:580 -
\??\c:\frlrrxr.exec:\frlrrxr.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\9xrxllr.exec:\9xrxllr.exe46⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nhnntt.exec:\nhnntt.exe47⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hbnbnn.exec:\hbnbnn.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5pvpd.exec:\5pvpd.exe49⤵
- Executes dropped EXE
PID:492 -
\??\c:\3ddjv.exec:\3ddjv.exe50⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fxxfrlf.exec:\fxxfrlf.exe51⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lfrfxfr.exec:\lfrfxfr.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tbnnbh.exec:\tbnnbh.exe53⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9nbhnh.exec:\9nbhnh.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhbbbh.exec:\nhbbbh.exe55⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5jddd.exec:\5jddd.exe56⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rxrxrfr.exec:\rxrxrfr.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9xlxffr.exec:\9xlxffr.exe58⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fxxflrx.exec:\fxxflrx.exe59⤵
- Executes dropped EXE
PID:800 -
\??\c:\bththh.exec:\bththh.exe60⤵
- Executes dropped EXE
PID:1340 -
\??\c:\htnntb.exec:\htnntb.exe61⤵
- Executes dropped EXE
PID:872 -
\??\c:\9jdjv.exec:\9jdjv.exe62⤵
- Executes dropped EXE
PID:932 -
\??\c:\9vppp.exec:\9vppp.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\frxflrr.exec:\frxflrr.exe64⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3xflxxr.exec:\3xflxxr.exe65⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tnbhtn.exec:\tnbhtn.exe66⤵PID:652
-
\??\c:\3hbhnh.exec:\3hbhnh.exe67⤵PID:1700
-
\??\c:\jjvvv.exec:\jjvvv.exe68⤵PID:2300
-
\??\c:\vjvjv.exec:\vjvjv.exe69⤵PID:1880
-
\??\c:\rrxlllr.exec:\rrxlllr.exe70⤵PID:1980
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe71⤵PID:2992
-
\??\c:\tbtttb.exec:\tbtttb.exe72⤵PID:2648
-
\??\c:\hbhnbb.exec:\hbhnbb.exe73⤵PID:2944
-
\??\c:\pdjjv.exec:\pdjjv.exe74⤵PID:2744
-
\??\c:\pjddp.exec:\pjddp.exe75⤵PID:1652
-
\??\c:\lfxfffl.exec:\lfxfffl.exe76⤵PID:2796
-
\??\c:\fxflxxf.exec:\fxflxxf.exe77⤵PID:2704
-
\??\c:\fxlxrlx.exec:\fxlxrlx.exe78⤵PID:2852
-
\??\c:\7bbnth.exec:\7bbnth.exe79⤵PID:2660
-
\??\c:\9ttbbb.exec:\9ttbbb.exe80⤵PID:2560
-
\??\c:\dpdjd.exec:\dpdjd.exe81⤵PID:2556
-
\??\c:\pjppd.exec:\pjppd.exe82⤵PID:2664
-
\??\c:\dpdjj.exec:\dpdjj.exe83⤵PID:1216
-
\??\c:\frxxllr.exec:\frxxllr.exe84⤵PID:1900
-
\??\c:\xrfrffl.exec:\xrfrffl.exe85⤵PID:1372
-
\??\c:\1nhthb.exec:\1nhthb.exe86⤵PID:1656
-
\??\c:\3nbhtb.exec:\3nbhtb.exe87⤵PID:1624
-
\??\c:\ddjdj.exec:\ddjdj.exe88⤵PID:1612
-
\??\c:\vpjvp.exec:\vpjvp.exe89⤵PID:2528
-
\??\c:\vppjd.exec:\vppjd.exe90⤵PID:976
-
\??\c:\ffrlrxx.exec:\ffrlrxx.exe91⤵PID:332
-
\??\c:\lxrxlrl.exec:\lxrxlrl.exe92⤵PID:2196
-
\??\c:\bnbhnh.exec:\bnbhnh.exe93⤵PID:2580
-
\??\c:\tnhntt.exec:\tnhntt.exe94⤵PID:664
-
\??\c:\djdjv.exec:\djdjv.exe95⤵PID:1520
-
\??\c:\jvjvv.exec:\jvjvv.exe96⤵PID:2156
-
\??\c:\5xxfffl.exec:\5xxfffl.exe97⤵PID:2408
-
\??\c:\xlflxxl.exec:\xlflxxl.exe98⤵PID:760
-
\??\c:\5frrxxl.exec:\5frrxxl.exe99⤵PID:1932
-
\??\c:\nhhnbb.exec:\nhhnbb.exe100⤵PID:1360
-
\??\c:\nbnnhh.exec:\nbnnhh.exe101⤵PID:1688
-
\??\c:\jdpdd.exec:\jdpdd.exe102⤵PID:2220
-
\??\c:\dvjvp.exec:\dvjvp.exe103⤵PID:2080
-
\??\c:\lxrrfxl.exec:\lxrrfxl.exe104⤵PID:2104
-
\??\c:\xrfflll.exec:\xrfflll.exe105⤵PID:2168
-
\??\c:\3frxlfl.exec:\3frxlfl.exe106⤵PID:784
-
\??\c:\nhnntn.exec:\nhnntn.exe107⤵PID:1700
-
\??\c:\hbnttt.exec:\hbnttt.exe108⤵PID:2124
-
\??\c:\3dpvj.exec:\3dpvj.exe109⤵PID:1576
-
\??\c:\pjvdj.exec:\pjvdj.exe110⤵PID:1760
-
\??\c:\9rflrrf.exec:\9rflrrf.exe111⤵PID:3056
-
\??\c:\5xrxllr.exec:\5xrxllr.exe112⤵PID:3036
-
\??\c:\7hbbbb.exec:\7hbbbb.exe113⤵PID:1604
-
\??\c:\7bbhth.exec:\7bbhth.exe114⤵PID:2668
-
\??\c:\nbhhtt.exec:\nbhhtt.exe115⤵PID:2452
-
\??\c:\dvjjp.exec:\dvjjp.exe116⤵PID:2784
-
\??\c:\dpddj.exec:\dpddj.exe117⤵PID:2548
-
\??\c:\7frfflr.exec:\7frfflr.exe118⤵PID:2588
-
\??\c:\fxflrfx.exec:\fxflrfx.exe119⤵PID:2968
-
\??\c:\nhtbtt.exec:\nhtbtt.exe120⤵PID:2928
-
\??\c:\nnhntt.exec:\nnhntt.exe121⤵PID:2552
-
\??\c:\hbnttt.exec:\hbnttt.exe122⤵PID:268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-