Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe
Resource
win7-20241010-en
General
-
Target
821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe
-
Size
454KB
-
MD5
5523b2433e4431919418f543a1ffe491
-
SHA1
96c62ba2753c7a4b5e37834b5c780b68fb1d4da2
-
SHA256
821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e
-
SHA512
fdc7832f6b505b76e8b922c6e42fe619d656ddecdea707616a416ccf72ce5256b9183e1dff44a950ff71f6fd367efd2caa57e767674b5b4973aab07d859557b3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2252-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-40-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2596-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-77-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-406-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1924-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2908-582-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-740-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2556-766-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/628-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2872 4008206.exe 2904 nnbthb.exe 2300 i044628.exe 2348 260240.exe 2596 tbbnnt.exe 2044 ttthth.exe 1644 828844.exe 2820 e04688.exe 2404 8808088.exe 1516 0824286.exe 3040 m0862.exe 2808 bhhbnn.exe 2992 1vvpv.exe 2788 5flllfl.exe 1928 w86866.exe 2328 8800600.exe 2196 864028.exe 2324 1xllrxl.exe 2372 fffrfrf.exe 1120 o800662.exe 352 c822480.exe 1628 260244.exe 880 llxlxfr.exe 1780 426806.exe 1300 nhhttt.exe 1496 g0442.exe 1728 k00202.exe 2224 rxfxrlr.exe 3060 htthtb.exe 884 3xlrrxr.exe 2708 3pjvp.exe 1264 q42840.exe 1556 u884286.exe 2388 48686.exe 2836 6666464.exe 2772 9rffxrr.exe 2620 xflrrfx.exe 2600 28228.exe 2044 s8024.exe 1060 04284.exe 1672 080026.exe 2820 bthhnn.exe 2452 hhbhtt.exe 2536 rllrffx.exe 3004 lfxfrfr.exe 2912 fffxllr.exe 2808 s8668.exe 2968 hhbnbb.exe 3020 jjdpj.exe 1924 ppdpv.exe 2924 lffrlrl.exe 2144 7xrfllx.exe 2196 7rllrrf.exe 2364 444008.exe 1832 600240.exe 2372 hnthht.exe 828 6602060.exe 1868 0420840.exe 680 86028.exe 2040 nhbhth.exe 776 xfrflrr.exe 872 rlffxxl.exe 1964 hbnntt.exe 1744 0866264.exe -
resource yara_rule behavioral1/memory/2252-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-164-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2372-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-603-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2032-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-766-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1524-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-801-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s8668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k00202.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2022662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 464044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2872 2252 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 31 PID 2252 wrote to memory of 2872 2252 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 31 PID 2252 wrote to memory of 2872 2252 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 31 PID 2252 wrote to memory of 2872 2252 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 31 PID 2872 wrote to memory of 2904 2872 4008206.exe 32 PID 2872 wrote to memory of 2904 2872 4008206.exe 32 PID 2872 wrote to memory of 2904 2872 4008206.exe 32 PID 2872 wrote to memory of 2904 2872 4008206.exe 32 PID 2904 wrote to memory of 2300 2904 nnbthb.exe 33 PID 2904 wrote to memory of 2300 2904 nnbthb.exe 33 PID 2904 wrote to memory of 2300 2904 nnbthb.exe 33 PID 2904 wrote to memory of 2300 2904 nnbthb.exe 33 PID 2300 wrote to memory of 2348 2300 i044628.exe 34 PID 2300 wrote to memory of 2348 2300 i044628.exe 34 PID 2300 wrote to memory of 2348 2300 i044628.exe 34 PID 2300 wrote to memory of 2348 2300 i044628.exe 34 PID 2348 wrote to memory of 2596 2348 260240.exe 35 PID 2348 wrote to memory of 2596 2348 260240.exe 35 PID 2348 wrote to memory of 2596 2348 260240.exe 35 PID 2348 wrote to memory of 2596 2348 260240.exe 35 PID 2596 wrote to memory of 2044 2596 tbbnnt.exe 36 PID 2596 wrote to memory of 2044 2596 tbbnnt.exe 36 PID 2596 wrote to memory of 2044 2596 tbbnnt.exe 36 PID 2596 wrote to memory of 2044 2596 tbbnnt.exe 36 PID 2044 wrote to memory of 1644 2044 ttthth.exe 37 PID 2044 wrote to memory of 1644 2044 ttthth.exe 37 PID 2044 wrote to memory of 1644 2044 ttthth.exe 37 PID 2044 wrote to memory of 1644 2044 ttthth.exe 37 PID 1644 wrote to memory of 2820 1644 828844.exe 38 PID 1644 wrote to memory of 2820 1644 828844.exe 38 PID 1644 wrote to memory of 2820 1644 828844.exe 38 PID 1644 wrote to memory of 2820 1644 828844.exe 38 PID 2820 wrote to memory of 2404 2820 e04688.exe 39 PID 2820 wrote to memory of 2404 2820 e04688.exe 39 PID 2820 wrote to memory of 2404 2820 e04688.exe 39 PID 2820 wrote to memory of 2404 2820 e04688.exe 39 PID 2404 wrote to memory of 1516 2404 8808088.exe 40 PID 2404 wrote to memory of 1516 2404 8808088.exe 40 PID 2404 wrote to memory of 1516 2404 8808088.exe 40 PID 2404 wrote to memory of 1516 2404 8808088.exe 40 PID 1516 wrote to memory of 3040 1516 0824286.exe 41 PID 1516 wrote to memory of 3040 1516 0824286.exe 41 PID 1516 wrote to memory of 3040 1516 0824286.exe 41 PID 1516 wrote to memory of 3040 1516 0824286.exe 41 PID 3040 wrote to memory of 2808 3040 m0862.exe 42 PID 3040 wrote to memory of 2808 3040 m0862.exe 42 PID 3040 wrote to memory of 2808 3040 m0862.exe 42 PID 3040 wrote to memory of 2808 3040 m0862.exe 42 PID 2808 wrote to memory of 2992 2808 bhhbnn.exe 43 PID 2808 wrote to memory of 2992 2808 bhhbnn.exe 43 PID 2808 wrote to memory of 2992 2808 bhhbnn.exe 43 PID 2808 wrote to memory of 2992 2808 bhhbnn.exe 43 PID 2992 wrote to memory of 2788 2992 1vvpv.exe 44 PID 2992 wrote to memory of 2788 2992 1vvpv.exe 44 PID 2992 wrote to memory of 2788 2992 1vvpv.exe 44 PID 2992 wrote to memory of 2788 2992 1vvpv.exe 44 PID 2788 wrote to memory of 1928 2788 5flllfl.exe 45 PID 2788 wrote to memory of 1928 2788 5flllfl.exe 45 PID 2788 wrote to memory of 1928 2788 5flllfl.exe 45 PID 2788 wrote to memory of 1928 2788 5flllfl.exe 45 PID 1928 wrote to memory of 2328 1928 w86866.exe 46 PID 1928 wrote to memory of 2328 1928 w86866.exe 46 PID 1928 wrote to memory of 2328 1928 w86866.exe 46 PID 1928 wrote to memory of 2328 1928 w86866.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe"C:\Users\Admin\AppData\Local\Temp\821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\4008206.exec:\4008206.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nnbthb.exec:\nnbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\i044628.exec:\i044628.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\260240.exec:\260240.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\tbbnnt.exec:\tbbnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ttthth.exec:\ttthth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\828844.exec:\828844.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\e04688.exec:\e04688.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\8808088.exec:\8808088.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\0824286.exec:\0824286.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\m0862.exec:\m0862.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bhhbnn.exec:\bhhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\1vvpv.exec:\1vvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5flllfl.exec:\5flllfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\w86866.exec:\w86866.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\8800600.exec:\8800600.exe17⤵
- Executes dropped EXE
PID:2328 -
\??\c:\864028.exec:\864028.exe18⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1xllrxl.exec:\1xllrxl.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fffrfrf.exec:\fffrfrf.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\o800662.exec:\o800662.exe21⤵
- Executes dropped EXE
PID:1120 -
\??\c:\c822480.exec:\c822480.exe22⤵
- Executes dropped EXE
PID:352 -
\??\c:\260244.exec:\260244.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\llxlxfr.exec:\llxlxfr.exe24⤵
- Executes dropped EXE
PID:880 -
\??\c:\426806.exec:\426806.exe25⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nhhttt.exec:\nhhttt.exe26⤵
- Executes dropped EXE
PID:1300 -
\??\c:\g0442.exec:\g0442.exe27⤵
- Executes dropped EXE
PID:1496 -
\??\c:\k00202.exec:\k00202.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\rxfxrlr.exec:\rxfxrlr.exe29⤵
- Executes dropped EXE
PID:2224 -
\??\c:\htthtb.exec:\htthtb.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3xlrrxr.exec:\3xlrrxr.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\3pjvp.exec:\3pjvp.exe32⤵
- Executes dropped EXE
PID:2708 -
\??\c:\q42840.exec:\q42840.exe33⤵
- Executes dropped EXE
PID:1264 -
\??\c:\u884286.exec:\u884286.exe34⤵
- Executes dropped EXE
PID:1556 -
\??\c:\48686.exec:\48686.exe35⤵
- Executes dropped EXE
PID:2388 -
\??\c:\6666464.exec:\6666464.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\9rffxrr.exec:\9rffxrr.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xflrrfx.exec:\xflrrfx.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\28228.exec:\28228.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\s8024.exec:\s8024.exe40⤵
- Executes dropped EXE
PID:2044 -
\??\c:\04284.exec:\04284.exe41⤵
- Executes dropped EXE
PID:1060 -
\??\c:\080026.exec:\080026.exe42⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bthhnn.exec:\bthhnn.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hhbhtt.exec:\hhbhtt.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rllrffx.exec:\rllrffx.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe46⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fffxllr.exec:\fffxllr.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\s8668.exec:\s8668.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\hhbnbb.exec:\hhbnbb.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjdpj.exec:\jjdpj.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ppdpv.exec:\ppdpv.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lffrlrl.exec:\lffrlrl.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7xrfllx.exec:\7xrfllx.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\7rllrrf.exec:\7rllrrf.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\444008.exec:\444008.exe55⤵
- Executes dropped EXE
PID:2364 -
\??\c:\600240.exec:\600240.exe56⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hnthht.exec:\hnthht.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\6602060.exec:\6602060.exe58⤵
- Executes dropped EXE
PID:828 -
\??\c:\0420840.exec:\0420840.exe59⤵
- Executes dropped EXE
PID:1868 -
\??\c:\86028.exec:\86028.exe60⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhbhth.exec:\nhbhth.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xfrflrr.exec:\xfrflrr.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\rlffxxl.exec:\rlffxxl.exe63⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbnntt.exec:\hbnntt.exe64⤵
- Executes dropped EXE
PID:1964 -
\??\c:\0866264.exec:\0866264.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\080622.exec:\080622.exe66⤵PID:1720
-
\??\c:\420000.exec:\420000.exe67⤵
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\q46628.exec:\q46628.exe68⤵PID:2240
-
\??\c:\u826280.exec:\u826280.exe69⤵PID:2000
-
\??\c:\thtbhh.exec:\thtbhh.exe70⤵PID:2280
-
\??\c:\2068884.exec:\2068884.exe71⤵PID:2856
-
\??\c:\864060.exec:\864060.exe72⤵PID:2860
-
\??\c:\jvjpd.exec:\jvjpd.exe73⤵PID:1584
-
\??\c:\60840.exec:\60840.exe74⤵PID:2908
-
\??\c:\60808.exec:\60808.exe75⤵PID:1556
-
\??\c:\nnbhtt.exec:\nnbhtt.exe76⤵PID:2624
-
\??\c:\nbnntt.exec:\nbnntt.exe77⤵PID:2656
-
\??\c:\vpjdj.exec:\vpjdj.exe78⤵PID:2256
-
\??\c:\hnhthh.exec:\hnhthh.exe79⤵PID:2332
-
\??\c:\nhtttb.exec:\nhtttb.exe80⤵PID:600
-
\??\c:\6660664.exec:\6660664.exe81⤵PID:2784
-
\??\c:\hhhhbh.exec:\hhhhbh.exe82⤵PID:2004
-
\??\c:\448680.exec:\448680.exe83⤵PID:2460
-
\??\c:\8262446.exec:\8262446.exe84⤵PID:2080
-
\??\c:\1hhhnb.exec:\1hhhnb.exe85⤵PID:2452
-
\??\c:\06644.exec:\06644.exe86⤵PID:840
-
\??\c:\rxfrrlf.exec:\rxfrrlf.exe87⤵PID:2828
-
\??\c:\nnntnt.exec:\nnntnt.exe88⤵PID:2816
-
\??\c:\440868.exec:\440868.exe89⤵PID:2984
-
\??\c:\pppvp.exec:\pppvp.exe90⤵PID:700
-
\??\c:\00424.exec:\00424.exe91⤵PID:2692
-
\??\c:\26420.exec:\26420.exe92⤵PID:2120
-
\??\c:\s0464.exec:\s0464.exe93⤵PID:2584
-
\??\c:\8240208.exec:\8240208.exe94⤵PID:2380
-
\??\c:\486806.exec:\486806.exe95⤵PID:2144
-
\??\c:\dppjd.exec:\dppjd.exe96⤵PID:1768
-
\??\c:\7ddpv.exec:\7ddpv.exe97⤵PID:448
-
\??\c:\48680.exec:\48680.exe98⤵PID:1048
-
\??\c:\264024.exec:\264024.exe99⤵PID:1340
-
\??\c:\6080202.exec:\6080202.exe100⤵PID:2264
-
\??\c:\u266280.exec:\u266280.exe101⤵PID:2032
-
\??\c:\lxrrllf.exec:\lxrrllf.exe102⤵PID:2556
-
\??\c:\rrfrlrr.exec:\rrfrlrr.exe103⤵PID:900
-
\??\c:\nnbhtt.exec:\nnbhtt.exe104⤵PID:1668
-
\??\c:\86884.exec:\86884.exe105⤵PID:1524
-
\??\c:\vpjjv.exec:\vpjjv.exe106⤵PID:1964
-
\??\c:\vpdvv.exec:\vpdvv.exe107⤵PID:628
-
\??\c:\a0840.exec:\a0840.exe108⤵PID:2516
-
\??\c:\m6060.exec:\m6060.exe109⤵PID:1740
-
\??\c:\pdjpv.exec:\pdjpv.exe110⤵
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\ddjdd.exec:\ddjdd.exe111⤵PID:876
-
\??\c:\s4842.exec:\s4842.exe112⤵PID:1388
-
\??\c:\66842.exec:\66842.exe113⤵PID:2252
-
\??\c:\0006068.exec:\0006068.exe114⤵PID:2860
-
\??\c:\260640.exec:\260640.exe115⤵PID:1584
-
\??\c:\2644288.exec:\2644288.exe116⤵PID:2132
-
\??\c:\dvpvp.exec:\dvpvp.exe117⤵PID:3012
-
\??\c:\u268620.exec:\u268620.exe118⤵PID:1296
-
\??\c:\640662.exec:\640662.exe119⤵PID:2668
-
\??\c:\rrllflf.exec:\rrllflf.exe120⤵PID:2620
-
\??\c:\u080402.exec:\u080402.exe121⤵PID:2444
-
\??\c:\xxxxrxl.exec:\xxxxrxl.exe122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-