Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe
Resource
win7-20240903-en
General
-
Target
600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe
-
Size
454KB
-
MD5
41f966c420346180ad88d02de6d5b55f
-
SHA1
e7d96552e987512d3e91abe962aff08bb52d9d26
-
SHA256
600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c
-
SHA512
005a2161854de170655b1130a52b2ccfaf7979f6511ba4f393d940e9af4e63624b3eb13272d41e2eb7911dbdf7fba3ea066ebda6054ea94aa03ebe81bacbd736
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2416-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-130-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2320-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1980-180-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2032-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-253-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/796-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-281-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1592-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-377-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2456-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1456-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-606-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 jvpvv.exe 2940 vpdvv.exe 2928 nhtbnn.exe 2380 pdjdv.exe 2704 xxrxllr.exe 2700 hbnbbn.exe 2708 llxflrf.exe 2588 xrfflfl.exe 2584 pjpdd.exe 2100 jdvvp.exe 2000 nhbbnn.exe 2320 vvjvv.exe 1672 ffxfrrf.exe 2364 vpvvv.exe 2316 httnbt.exe 1944 htbbhh.exe 1980 hnbhbh.exe 444 7pjvv.exe 2032 ddddd.exe 684 rfrxfff.exe 1640 jpvdj.exe 680 jdppd.exe 784 tbhntn.exe 1904 9pvdv.exe 796 5jvdd.exe 1548 1bnthn.exe 2972 xllfffx.exe 1396 bnhntt.exe 1888 dvjjj.exe 1500 lflfxrx.exe 2416 5bnttb.exe 1592 7vpvd.exe 1952 htttbt.exe 2988 bbnnhb.exe 2120 vpdjd.exe 2748 lfxrrrx.exe 2680 lfxxrxx.exe 2204 ntnbth.exe 2852 pppvp.exe 2544 jvvvd.exe 2456 flllrxf.exe 2932 1hnhhh.exe 2924 jdvvd.exe 540 lxrrllx.exe 1656 hbtbbh.exe 1788 jdvpv.exe 708 vjdjv.exe 2332 7xllrrx.exe 2308 7hbtnn.exe 2068 1djpj.exe 536 pjdjd.exe 1260 fxlllfl.exe 2164 bbthtb.exe 1980 3bbhhn.exe 712 dvddd.exe 328 flrllxr.exe 1304 tnnthn.exe 2020 ththbh.exe 1632 9pdjp.exe 1712 lxllfff.exe 1700 7btnnt.exe 1456 nbntbt.exe 2348 jppvp.exe 1124 dpjdd.exe -
resource yara_rule behavioral1/memory/2416-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-344-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2204-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-408-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/708-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-551-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1848-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-591-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2948-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-702-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2168 2416 600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe 31 PID 2416 wrote to memory of 2168 2416 600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe 31 PID 2416 wrote to memory of 2168 2416 600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe 31 PID 2416 wrote to memory of 2168 2416 600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe 31 PID 2168 wrote to memory of 2940 2168 jvpvv.exe 32 PID 2168 wrote to memory of 2940 2168 jvpvv.exe 32 PID 2168 wrote to memory of 2940 2168 jvpvv.exe 32 PID 2168 wrote to memory of 2940 2168 jvpvv.exe 32 PID 2940 wrote to memory of 2928 2940 vpdvv.exe 33 PID 2940 wrote to memory of 2928 2940 vpdvv.exe 33 PID 2940 wrote to memory of 2928 2940 vpdvv.exe 33 PID 2940 wrote to memory of 2928 2940 vpdvv.exe 33 PID 2928 wrote to memory of 2380 2928 nhtbnn.exe 34 PID 2928 wrote to memory of 2380 2928 nhtbnn.exe 34 PID 2928 wrote to memory of 2380 2928 nhtbnn.exe 34 PID 2928 wrote to memory of 2380 2928 nhtbnn.exe 34 PID 2380 wrote to memory of 2704 2380 pdjdv.exe 35 PID 2380 wrote to memory of 2704 2380 pdjdv.exe 35 PID 2380 wrote to memory of 2704 2380 pdjdv.exe 35 PID 2380 wrote to memory of 2704 2380 pdjdv.exe 35 PID 2704 wrote to memory of 2700 2704 xxrxllr.exe 36 PID 2704 wrote to memory of 2700 2704 xxrxllr.exe 36 PID 2704 wrote to memory of 2700 2704 xxrxllr.exe 36 PID 2704 wrote to memory of 2700 2704 xxrxllr.exe 36 PID 2700 wrote to memory of 2708 2700 hbnbbn.exe 37 PID 2700 wrote to memory of 2708 2700 hbnbbn.exe 37 PID 2700 wrote to memory of 2708 2700 hbnbbn.exe 37 PID 2700 wrote to memory of 2708 2700 hbnbbn.exe 37 PID 2708 wrote to memory of 2588 2708 llxflrf.exe 38 PID 2708 wrote to memory of 2588 2708 llxflrf.exe 38 PID 2708 wrote to memory of 2588 2708 llxflrf.exe 38 PID 2708 wrote to memory of 2588 2708 llxflrf.exe 38 PID 2588 wrote to memory of 2584 2588 xrfflfl.exe 39 PID 2588 wrote to memory of 2584 2588 xrfflfl.exe 39 PID 2588 wrote to memory of 2584 2588 xrfflfl.exe 39 PID 2588 wrote to memory of 2584 2588 xrfflfl.exe 39 PID 2584 wrote to memory of 2100 2584 pjpdd.exe 40 PID 2584 wrote to memory of 2100 2584 pjpdd.exe 40 PID 2584 wrote to memory of 2100 2584 pjpdd.exe 40 PID 2584 wrote to memory of 2100 2584 pjpdd.exe 40 PID 2100 wrote to memory of 2000 2100 jdvvp.exe 41 PID 2100 wrote to memory of 2000 2100 jdvvp.exe 41 PID 2100 wrote to memory of 2000 2100 jdvvp.exe 41 PID 2100 wrote to memory of 2000 2100 jdvvp.exe 41 PID 2000 wrote to memory of 2320 2000 nhbbnn.exe 42 PID 2000 wrote to memory of 2320 2000 nhbbnn.exe 42 PID 2000 wrote to memory of 2320 2000 nhbbnn.exe 42 PID 2000 wrote to memory of 2320 2000 nhbbnn.exe 42 PID 2320 wrote to memory of 1672 2320 vvjvv.exe 43 PID 2320 wrote to memory of 1672 2320 vvjvv.exe 43 PID 2320 wrote to memory of 1672 2320 vvjvv.exe 43 PID 2320 wrote to memory of 1672 2320 vvjvv.exe 43 PID 1672 wrote to memory of 2364 1672 ffxfrrf.exe 44 PID 1672 wrote to memory of 2364 1672 ffxfrrf.exe 44 PID 1672 wrote to memory of 2364 1672 ffxfrrf.exe 44 PID 1672 wrote to memory of 2364 1672 ffxfrrf.exe 44 PID 2364 wrote to memory of 2316 2364 vpvvv.exe 45 PID 2364 wrote to memory of 2316 2364 vpvvv.exe 45 PID 2364 wrote to memory of 2316 2364 vpvvv.exe 45 PID 2364 wrote to memory of 2316 2364 vpvvv.exe 45 PID 2316 wrote to memory of 1944 2316 httnbt.exe 46 PID 2316 wrote to memory of 1944 2316 httnbt.exe 46 PID 2316 wrote to memory of 1944 2316 httnbt.exe 46 PID 2316 wrote to memory of 1944 2316 httnbt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe"C:\Users\Admin\AppData\Local\Temp\600af36d58b2feb3abc1ac8b60cbda21656ad16180688c4bc29e371d3038b57c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\jvpvv.exec:\jvpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vpdvv.exec:\vpdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhtbnn.exec:\nhtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pdjdv.exec:\pdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\xxrxllr.exec:\xxrxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hbnbbn.exec:\hbnbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\llxflrf.exec:\llxflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xrfflfl.exec:\xrfflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjpdd.exec:\pjpdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jdvvp.exec:\jdvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\nhbbnn.exec:\nhbbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vvjvv.exec:\vvjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\vpvvv.exec:\vpvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\httnbt.exec:\httnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\htbbhh.exec:\htbbhh.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnbhbh.exec:\hnbhbh.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7pjvv.exec:\7pjvv.exe19⤵
- Executes dropped EXE
PID:444 -
\??\c:\ddddd.exec:\ddddd.exe20⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rfrxfff.exec:\rfrxfff.exe21⤵
- Executes dropped EXE
PID:684 -
\??\c:\jpvdj.exec:\jpvdj.exe22⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jdppd.exec:\jdppd.exe23⤵
- Executes dropped EXE
PID:680 -
\??\c:\tbhntn.exec:\tbhntn.exe24⤵
- Executes dropped EXE
PID:784 -
\??\c:\9pvdv.exec:\9pvdv.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5jvdd.exec:\5jvdd.exe26⤵
- Executes dropped EXE
PID:796 -
\??\c:\1bnthn.exec:\1bnthn.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xllfffx.exec:\xllfffx.exe28⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bnhntt.exec:\bnhntt.exe29⤵
- Executes dropped EXE
PID:1396 -
\??\c:\dvjjj.exec:\dvjjj.exe30⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lflfxrx.exec:\lflfxrx.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5bnttb.exec:\5bnttb.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7vpvd.exec:\7vpvd.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\htttbt.exec:\htttbt.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bbnnhb.exec:\bbnnhb.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpdjd.exec:\vpdjd.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ntnbth.exec:\ntnbth.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pppvp.exec:\pppvp.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jvvvd.exec:\jvvvd.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\flllrxf.exec:\flllrxf.exe42⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1hnhhh.exec:\1hnhhh.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jdvvd.exec:\jdvvd.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lxrrllx.exec:\lxrrllx.exe45⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbtbbh.exec:\hbtbbh.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jdvpv.exec:\jdvpv.exe47⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vjdjv.exec:\vjdjv.exe48⤵
- Executes dropped EXE
PID:708 -
\??\c:\7xllrrx.exec:\7xllrrx.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7hbtnn.exec:\7hbtnn.exe50⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1djpj.exec:\1djpj.exe51⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pjdjd.exec:\pjdjd.exe52⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxlllfl.exec:\fxlllfl.exe53⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bbthtb.exec:\bbthtb.exe54⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3bbhhn.exec:\3bbhhn.exe55⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dvddd.exec:\dvddd.exe56⤵
- Executes dropped EXE
PID:712 -
\??\c:\flrllxr.exec:\flrllxr.exe57⤵
- Executes dropped EXE
PID:328 -
\??\c:\tnnthn.exec:\tnnthn.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ththbh.exec:\ththbh.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9pdjp.exec:\9pdjp.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lxllfff.exec:\lxllfff.exe61⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7btnnt.exec:\7btnnt.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nbntbt.exec:\nbntbt.exe63⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jppvp.exec:\jppvp.exe64⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dpjdd.exec:\dpjdd.exe65⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xxrxflx.exec:\xxrxflx.exe66⤵PID:2084
-
\??\c:\1tntbh.exec:\1tntbh.exe67⤵PID:1736
-
\??\c:\dvpjp.exec:\dvpjp.exe68⤵PID:696
-
\??\c:\7ddjv.exec:\7ddjv.exe69⤵PID:1848
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe70⤵PID:1852
-
\??\c:\5nbhnh.exec:\5nbhnh.exe71⤵PID:2144
-
\??\c:\5jjjp.exec:\5jjjp.exe72⤵PID:2088
-
\??\c:\1djdd.exec:\1djdd.exe73⤵PID:2900
-
\??\c:\1xlrrfl.exec:\1xlrrfl.exe74⤵PID:2424
-
\??\c:\ntbhnt.exec:\ntbhnt.exe75⤵PID:2948
-
\??\c:\jvjjp.exec:\jvjjp.exe76⤵PID:2688
-
\??\c:\dvdjp.exec:\dvdjp.exe77⤵PID:3056
-
\??\c:\3ffllxl.exec:\3ffllxl.exe78⤵PID:2672
-
\??\c:\1bhttb.exec:\1bhttb.exe79⤵PID:2696
-
\??\c:\dvvvd.exec:\dvvvd.exe80⤵PID:2992
-
\??\c:\lffrflx.exec:\lffrflx.exe81⤵PID:2772
-
\??\c:\nhhbnt.exec:\nhhbnt.exe82⤵PID:2668
-
\??\c:\hthhnn.exec:\hthhnn.exe83⤵PID:2684
-
\??\c:\5jdjj.exec:\5jdjj.exe84⤵PID:1724
-
\??\c:\jvjdj.exec:\jvjdj.exe85⤵PID:2932
-
\??\c:\1xrrlrl.exec:\1xrrlrl.exe86⤵PID:2924
-
\??\c:\hnbbhb.exec:\hnbbhb.exe87⤵PID:648
-
\??\c:\vdppv.exec:\vdppv.exe88⤵PID:1624
-
\??\c:\3fxfxfr.exec:\3fxfxfr.exe89⤵PID:1604
-
\??\c:\xxlxrrx.exec:\xxlxrrx.exe90⤵PID:1748
-
\??\c:\bnbttn.exec:\bnbttn.exe91⤵PID:2304
-
\??\c:\3jpvv.exec:\3jpvv.exe92⤵PID:2364
-
\??\c:\fxrffxf.exec:\fxrffxf.exe93⤵PID:1236
-
\??\c:\3htbtt.exec:\3htbtt.exe94⤵PID:2276
-
\??\c:\nbhnnt.exec:\nbhnnt.exe95⤵PID:1972
-
\??\c:\pdvdj.exec:\pdvdj.exe96⤵PID:1960
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe97⤵PID:2904
-
\??\c:\3tbnhn.exec:\3tbnhn.exe98⤵PID:1556
-
\??\c:\bbbhtb.exec:\bbbhtb.exe99⤵PID:964
-
\??\c:\ddddp.exec:\ddddp.exe100⤵PID:684
-
\??\c:\ffrllff.exec:\ffrllff.exe101⤵PID:2864
-
\??\c:\nnbnnn.exec:\nnbnnn.exe102⤵PID:1264
-
\??\c:\hhntbt.exec:\hhntbt.exe103⤵PID:3028
-
\??\c:\9pjdp.exec:\9pjdp.exe104⤵PID:1464
-
\??\c:\3lxxflx.exec:\3lxxflx.exe105⤵PID:1456
-
\??\c:\fxxxllr.exec:\fxxxllr.exe106⤵PID:568
-
\??\c:\1thntt.exec:\1thntt.exe107⤵PID:2224
-
\??\c:\9vppp.exec:\9vppp.exe108⤵PID:912
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe109⤵PID:2172
-
\??\c:\frlflff.exec:\frlflff.exe110⤵PID:2056
-
\??\c:\7bhbnh.exec:\7bhbnh.exe111⤵PID:1864
-
\??\c:\dpvdd.exec:\dpvdd.exe112⤵PID:1500
-
\??\c:\vpddp.exec:\vpddp.exe113⤵PID:2072
-
\??\c:\xrxrfxx.exec:\xrxrfxx.exe114⤵PID:1840
-
\??\c:\bthntt.exec:\bthntt.exe115⤵PID:2984
-
\??\c:\ddpjj.exec:\ddpjj.exe116⤵PID:2804
-
\??\c:\3lrfffr.exec:\3lrfffr.exe117⤵PID:2676
-
\??\c:\5nttnn.exec:\5nttnn.exe118⤵PID:2736
-
\??\c:\jdvvv.exec:\jdvvv.exe119⤵PID:2716
-
\??\c:\jdppp.exec:\jdppp.exe120⤵PID:2844
-
\??\c:\9frllrr.exec:\9frllrr.exe121⤵PID:2812
-
\??\c:\thtntt.exec:\thtntt.exe122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-