Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe
Resource
win7-20240903-en
General
-
Target
9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe
-
Size
453KB
-
MD5
25270dba82b4387dce3ee39afb168b5e
-
SHA1
53e312f75105cbb6c9f9a24e25916a48648f3f55
-
SHA256
9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028
-
SHA512
01955c33abdd340645e44caf784420c6042b5d2df06dca6214c781adcfc0278f0ecc832856b42b1f6d60b2462940c3f2813403b6d9b30436ee713f3497af6afc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2892-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-373-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2188-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-388-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-496-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2060-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-664-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/484-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-970-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-982-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-1068-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1228-1106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 lfrxffr.exe 2820 vpjpd.exe 2148 1tnhhh.exe 2740 7jdvd.exe 2600 5btttb.exe 2692 pjpjd.exe 2652 ttntnt.exe 2188 9pjpp.exe 1844 7bhnnn.exe 2184 bnhttt.exe 1412 5lxlrff.exe 2968 nbtbhn.exe 2896 llflffx.exe 1560 bhtthh.exe 2948 5xrflfl.exe 3068 7rfxrrx.exe 2396 3pjpd.exe 1156 rlfrxfr.exe 1160 ddpvd.exe 1984 lxrrlrx.exe 824 jppdp.exe 2276 nhbbnt.exe 2404 dvvjd.exe 1636 7xlrxlr.exe 2136 9bnthn.exe 2476 dddjp.exe 596 3thhnn.exe 1728 fxllrxf.exe 2000 hbbnbh.exe 972 7vpjp.exe 2056 7lffllx.exe 1408 hbthnh.exe 2128 9ffrflr.exe 2724 nnhhnn.exe 1572 ppvjp.exe 2064 dvdvd.exe 2684 9xffxxl.exe 3000 bthhhn.exe 2872 jjjvj.exe 2740 lxfxfxx.exe 2572 1frfflr.exe 2656 5nhnbh.exe 2692 dvjpj.exe 1528 rxlfllx.exe 2188 nnhnbh.exe 2540 bbnthh.exe 2488 dpddj.exe 1264 3lffxxf.exe 2960 tnhbbb.exe 2940 pjppp.exe 468 ppddp.exe 1516 lfxllrx.exe 2948 1nnnhh.exe 2100 pjddj.exe 680 rffflff.exe 1296 lfxxlfl.exe 1496 ntnthh.exe 1356 1jjdp.exe 1608 1xxflfr.exe 1484 btttnn.exe 1128 7nbbnt.exe 2164 3pjpd.exe 948 lfrfrxf.exe 2060 thbthb.exe -
resource yara_rule behavioral1/memory/2892-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-529-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2724-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-742-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2064 2892 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 30 PID 2892 wrote to memory of 2064 2892 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 30 PID 2892 wrote to memory of 2064 2892 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 30 PID 2892 wrote to memory of 2064 2892 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 30 PID 2064 wrote to memory of 2820 2064 lfrxffr.exe 31 PID 2064 wrote to memory of 2820 2064 lfrxffr.exe 31 PID 2064 wrote to memory of 2820 2064 lfrxffr.exe 31 PID 2064 wrote to memory of 2820 2064 lfrxffr.exe 31 PID 2820 wrote to memory of 2148 2820 vpjpd.exe 32 PID 2820 wrote to memory of 2148 2820 vpjpd.exe 32 PID 2820 wrote to memory of 2148 2820 vpjpd.exe 32 PID 2820 wrote to memory of 2148 2820 vpjpd.exe 32 PID 2148 wrote to memory of 2740 2148 1tnhhh.exe 33 PID 2148 wrote to memory of 2740 2148 1tnhhh.exe 33 PID 2148 wrote to memory of 2740 2148 1tnhhh.exe 33 PID 2148 wrote to memory of 2740 2148 1tnhhh.exe 33 PID 2740 wrote to memory of 2600 2740 7jdvd.exe 34 PID 2740 wrote to memory of 2600 2740 7jdvd.exe 34 PID 2740 wrote to memory of 2600 2740 7jdvd.exe 34 PID 2740 wrote to memory of 2600 2740 7jdvd.exe 34 PID 2600 wrote to memory of 2692 2600 5btttb.exe 35 PID 2600 wrote to memory of 2692 2600 5btttb.exe 35 PID 2600 wrote to memory of 2692 2600 5btttb.exe 35 PID 2600 wrote to memory of 2692 2600 5btttb.exe 35 PID 2692 wrote to memory of 2652 2692 pjpjd.exe 36 PID 2692 wrote to memory of 2652 2692 pjpjd.exe 36 PID 2692 wrote to memory of 2652 2692 pjpjd.exe 36 PID 2692 wrote to memory of 2652 2692 pjpjd.exe 36 PID 2652 wrote to memory of 2188 2652 ttntnt.exe 37 PID 2652 wrote to memory of 2188 2652 ttntnt.exe 37 PID 2652 wrote to memory of 2188 2652 ttntnt.exe 37 PID 2652 wrote to memory of 2188 2652 ttntnt.exe 37 PID 2188 wrote to memory of 1844 2188 9pjpp.exe 38 PID 2188 wrote to memory of 1844 2188 9pjpp.exe 38 PID 2188 wrote to memory of 1844 2188 9pjpp.exe 38 PID 2188 wrote to memory of 1844 2188 9pjpp.exe 38 PID 1844 wrote to memory of 2184 1844 7bhnnn.exe 39 PID 1844 wrote to memory of 2184 1844 7bhnnn.exe 39 PID 1844 wrote to memory of 2184 1844 7bhnnn.exe 39 PID 1844 wrote to memory of 2184 1844 7bhnnn.exe 39 PID 2184 wrote to memory of 1412 2184 bnhttt.exe 40 PID 2184 wrote to memory of 1412 2184 bnhttt.exe 40 PID 2184 wrote to memory of 1412 2184 bnhttt.exe 40 PID 2184 wrote to memory of 1412 2184 bnhttt.exe 40 PID 1412 wrote to memory of 2968 1412 5lxlrff.exe 41 PID 1412 wrote to memory of 2968 1412 5lxlrff.exe 41 PID 1412 wrote to memory of 2968 1412 5lxlrff.exe 41 PID 1412 wrote to memory of 2968 1412 5lxlrff.exe 41 PID 2968 wrote to memory of 2896 2968 nbtbhn.exe 42 PID 2968 wrote to memory of 2896 2968 nbtbhn.exe 42 PID 2968 wrote to memory of 2896 2968 nbtbhn.exe 42 PID 2968 wrote to memory of 2896 2968 nbtbhn.exe 42 PID 2896 wrote to memory of 1560 2896 llflffx.exe 43 PID 2896 wrote to memory of 1560 2896 llflffx.exe 43 PID 2896 wrote to memory of 1560 2896 llflffx.exe 43 PID 2896 wrote to memory of 1560 2896 llflffx.exe 43 PID 1560 wrote to memory of 2948 1560 bhtthh.exe 44 PID 1560 wrote to memory of 2948 1560 bhtthh.exe 44 PID 1560 wrote to memory of 2948 1560 bhtthh.exe 44 PID 1560 wrote to memory of 2948 1560 bhtthh.exe 44 PID 2948 wrote to memory of 3068 2948 5xrflfl.exe 45 PID 2948 wrote to memory of 3068 2948 5xrflfl.exe 45 PID 2948 wrote to memory of 3068 2948 5xrflfl.exe 45 PID 2948 wrote to memory of 3068 2948 5xrflfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe"C:\Users\Admin\AppData\Local\Temp\9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lfrxffr.exec:\lfrxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vpjpd.exec:\vpjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1tnhhh.exec:\1tnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\7jdvd.exec:\7jdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5btttb.exec:\5btttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pjpjd.exec:\pjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ttntnt.exec:\ttntnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\9pjpp.exec:\9pjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\7bhnnn.exec:\7bhnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\bnhttt.exec:\bnhttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\5lxlrff.exec:\5lxlrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\nbtbhn.exec:\nbtbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\llflffx.exec:\llflffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bhtthh.exec:\bhtthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\5xrflfl.exec:\5xrflfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\7rfxrrx.exec:\7rfxrrx.exe17⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3pjpd.exec:\3pjpd.exe18⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe19⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ddpvd.exec:\ddpvd.exe20⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lxrrlrx.exec:\lxrrlrx.exe21⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jppdp.exec:\jppdp.exe22⤵
- Executes dropped EXE
PID:824 -
\??\c:\nhbbnt.exec:\nhbbnt.exe23⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvvjd.exec:\dvvjd.exe24⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7xlrxlr.exec:\7xlrxlr.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9bnthn.exec:\9bnthn.exe26⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dddjp.exec:\dddjp.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3thhnn.exec:\3thhnn.exe28⤵
- Executes dropped EXE
PID:596 -
\??\c:\fxllrxf.exec:\fxllrxf.exe29⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbbnbh.exec:\hbbnbh.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7vpjp.exec:\7vpjp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:972 -
\??\c:\7lffllx.exec:\7lffllx.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hbthnh.exec:\hbthnh.exe33⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9ffrflr.exec:\9ffrflr.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnhhnn.exec:\nnhhnn.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ppvjp.exec:\ppvjp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\dvdvd.exec:\dvdvd.exe37⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9xffxxl.exec:\9xffxxl.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bthhhn.exec:\bthhhn.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jjjvj.exec:\jjjvj.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lxfxfxx.exec:\lxfxfxx.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1frfflr.exec:\1frfflr.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5nhnbh.exec:\5nhnbh.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvjpj.exec:\dvjpj.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rxlfllx.exec:\rxlfllx.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nnhnbh.exec:\nnhnbh.exe46⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bbnthh.exec:\bbnthh.exe47⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dpddj.exec:\dpddj.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3lffxxf.exec:\3lffxxf.exe49⤵
- Executes dropped EXE
PID:1264 -
\??\c:\tnhbbb.exec:\tnhbbb.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pjppp.exec:\pjppp.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ppddp.exec:\ppddp.exe52⤵
- Executes dropped EXE
PID:468 -
\??\c:\lfxllrx.exec:\lfxllrx.exe53⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1nnnhh.exec:\1nnnhh.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjddj.exec:\pjddj.exe55⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rffflff.exec:\rffflff.exe56⤵
- Executes dropped EXE
PID:680 -
\??\c:\lfxxlfl.exec:\lfxxlfl.exe57⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ntnthh.exec:\ntnthh.exe58⤵
- Executes dropped EXE
PID:1496 -
\??\c:\1jjdp.exec:\1jjdp.exe59⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1xxflfr.exec:\1xxflfr.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\btttnn.exec:\btttnn.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484 -
\??\c:\7nbbnt.exec:\7nbbnt.exe62⤵
- Executes dropped EXE
PID:1128 -
\??\c:\3pjpd.exec:\3pjpd.exe63⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe64⤵
- Executes dropped EXE
PID:948 -
\??\c:\thbthb.exec:\thbthb.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9bhhhh.exec:\9bhhhh.exe66⤵PID:2160
-
\??\c:\vvvjp.exec:\vvvjp.exe67⤵PID:1180
-
\??\c:\rlxflrx.exec:\rlxflrx.exe68⤵PID:1260
-
\??\c:\hbtbbb.exec:\hbtbbb.exe69⤵PID:2364
-
\??\c:\tnhnbb.exec:\tnhnbb.exe70⤵PID:2344
-
\??\c:\dddjv.exec:\dddjv.exe71⤵PID:284
-
\??\c:\fxrxlfr.exec:\fxrxlfr.exe72⤵PID:1736
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe73⤵PID:688
-
\??\c:\bthhtt.exec:\bthhtt.exe74⤵PID:272
-
\??\c:\dvvdj.exec:\dvvdj.exe75⤵PID:1972
-
\??\c:\7lfrxff.exec:\7lfrxff.exe76⤵PID:868
-
\??\c:\ffxflrf.exec:\ffxflrf.exe77⤵PID:1596
-
\??\c:\bbbbht.exec:\bbbbht.exe78⤵PID:2724
-
\??\c:\vpdpj.exec:\vpdpj.exe79⤵PID:3008
-
\??\c:\dpjjj.exec:\dpjjj.exe80⤵PID:2064
-
\??\c:\5frllll.exec:\5frllll.exe81⤵PID:2148
-
\??\c:\3nttbb.exec:\3nttbb.exe82⤵PID:3000
-
\??\c:\vvvdv.exec:\vvvdv.exe83⤵PID:2748
-
\??\c:\pdpvv.exec:\pdpvv.exe84⤵PID:2616
-
\??\c:\lxrrrlx.exec:\lxrrrlx.exe85⤵PID:2572
-
\??\c:\nbhhhh.exec:\nbhhhh.exe86⤵PID:2656
-
\??\c:\3vpvj.exec:\3vpvj.exe87⤵PID:2668
-
\??\c:\dpdvp.exec:\dpdvp.exe88⤵PID:1528
-
\??\c:\xrlllrr.exec:\xrlllrr.exe89⤵PID:2220
-
\??\c:\3tbbbh.exec:\3tbbbh.exe90⤵PID:2676
-
\??\c:\hbthnt.exec:\hbthnt.exe91⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\pjvvj.exec:\pjvvj.exe92⤵PID:1336
-
\??\c:\rlflrxl.exec:\rlflrxl.exe93⤵PID:484
-
\??\c:\3lfxflr.exec:\3lfxflr.exe94⤵PID:1656
-
\??\c:\nhbbhh.exec:\nhbbhh.exe95⤵PID:1532
-
\??\c:\dvvvj.exec:\dvvvj.exe96⤵PID:2936
-
\??\c:\pdpvd.exec:\pdpvd.exe97⤵PID:2972
-
\??\c:\5rlrxff.exec:\5rlrxff.exe98⤵PID:492
-
\??\c:\hbntth.exec:\hbntth.exe99⤵PID:1524
-
\??\c:\jjvvd.exec:\jjvvd.exe100⤵PID:944
-
\??\c:\7pjjj.exec:\7pjjj.exe101⤵PID:1776
-
\??\c:\rfllrrx.exec:\rfllrrx.exe102⤵PID:1160
-
\??\c:\tnbbhh.exec:\tnbbhh.exe103⤵
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\5jddp.exec:\5jddp.exe104⤵PID:444
-
\??\c:\dppjv.exec:\dppjv.exe105⤵PID:2004
-
\??\c:\1lflllr.exec:\1lflllr.exe106⤵PID:1340
-
\??\c:\bthnbb.exec:\bthnbb.exe107⤵PID:1092
-
\??\c:\pjvvv.exec:\pjvvv.exe108⤵PID:1680
-
\??\c:\jdvdj.exec:\jdvdj.exe109⤵PID:1204
-
\??\c:\fffflrf.exec:\fffflrf.exe110⤵PID:1080
-
\??\c:\9btnhn.exec:\9btnhn.exe111⤵PID:2360
-
\??\c:\bbttbb.exec:\bbttbb.exe112⤵PID:2364
-
\??\c:\dddpd.exec:\dddpd.exe113⤵PID:1876
-
\??\c:\1xxrxxf.exec:\1xxrxxf.exe114⤵PID:1228
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe115⤵PID:1960
-
\??\c:\tthhth.exec:\tthhth.exe116⤵PID:972
-
\??\c:\vjppp.exec:\vjppp.exe117⤵PID:872
-
\??\c:\9rlllll.exec:\9rlllll.exe118⤵PID:2380
-
\??\c:\tnbbhh.exec:\tnbbhh.exe119⤵PID:2308
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:1712
-
\??\c:\9xxxlrf.exec:\9xxxlrf.exe121⤵PID:2836
-
\??\c:\1nttbb.exec:\1nttbb.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-