Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe
Resource
win7-20240903-en
General
-
Target
a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe
-
Size
453KB
-
MD5
d3fd3cb51b35dac1e354db8e829d55d0
-
SHA1
4cb4afdd12ba70ee00549bc6600416b129abdcc7
-
SHA256
a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9
-
SHA512
e4afd6c9fc8eebef656aeb7eb8d493a16cc650c776cdd771e3c5eeee1b2d3d5ea6fc8ce042580a6149853ce8f088d9aec1d4c340c2f15dcdd95da3f04ebc767a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2892-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-56-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2864-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-141-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1696-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-649-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1240-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-717-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/444-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-885-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 btbbnn.exe 2712 jpjpp.exe 2636 3hnhhh.exe 2600 hhtthn.exe 2612 pjdjp.exe 2212 bbtbtt.exe 2864 vpdjj.exe 1848 rlflxlx.exe 888 ddjpp.exe 1472 1lfffrx.exe 1196 jvddj.exe 576 jdpvj.exe 1928 hbttbh.exe 2616 jdpvd.exe 532 xrffllx.exe 1696 htntbt.exe 2164 9jjpj.exe 2392 hbhhnh.exe 2172 jvpjv.exe 1752 rllxflr.exe 1460 nhhntt.exe 1972 dpjpv.exe 2800 fxrrlxf.exe 1648 pjppd.exe 1956 3lrrrxl.exe 2464 nhnttt.exe 1688 xrflrrf.exe 2068 hbhbnn.exe 1096 jvjjv.exe 1440 lfrxflr.exe 2140 1vjdj.exe 1532 pjvdd.exe 2668 thbhnt.exe 2816 pjvvd.exe 2784 jvddj.exe 2556 xlffrrl.exe 2596 nhbnbh.exe 2324 btnthn.exe 2612 jvvdd.exe 2964 xlxxflr.exe 2764 httthn.exe 2372 vpjpv.exe 2644 5vddd.exe 996 rfrlxxl.exe 888 hbtthh.exe 2268 3vpvp.exe 1196 1rxrlrr.exe 2032 htnnhh.exe 772 bthnbb.exe 1260 7vppv.exe 600 xrllllx.exe 2404 9tnntt.exe 2152 jdddp.exe 2248 jdddv.exe 2164 rfrrxxf.exe 2184 htttbb.exe 2284 pdppv.exe 2180 xfrrxfl.exe 1584 fxfflrf.exe 1868 btntbb.exe 2120 9vppp.exe 828 vpdvd.exe 288 lxxflll.exe 2908 nthbnb.exe -
resource yara_rule behavioral1/memory/2892-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-857-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2892 2792 a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe 30 PID 2792 wrote to memory of 2892 2792 a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe 30 PID 2792 wrote to memory of 2892 2792 a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe 30 PID 2792 wrote to memory of 2892 2792 a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe 30 PID 2892 wrote to memory of 2712 2892 btbbnn.exe 31 PID 2892 wrote to memory of 2712 2892 btbbnn.exe 31 PID 2892 wrote to memory of 2712 2892 btbbnn.exe 31 PID 2892 wrote to memory of 2712 2892 btbbnn.exe 31 PID 2712 wrote to memory of 2636 2712 jpjpp.exe 32 PID 2712 wrote to memory of 2636 2712 jpjpp.exe 32 PID 2712 wrote to memory of 2636 2712 jpjpp.exe 32 PID 2712 wrote to memory of 2636 2712 jpjpp.exe 32 PID 2636 wrote to memory of 2600 2636 3hnhhh.exe 33 PID 2636 wrote to memory of 2600 2636 3hnhhh.exe 33 PID 2636 wrote to memory of 2600 2636 3hnhhh.exe 33 PID 2636 wrote to memory of 2600 2636 3hnhhh.exe 33 PID 2600 wrote to memory of 2612 2600 hhtthn.exe 34 PID 2600 wrote to memory of 2612 2600 hhtthn.exe 34 PID 2600 wrote to memory of 2612 2600 hhtthn.exe 34 PID 2600 wrote to memory of 2612 2600 hhtthn.exe 34 PID 2612 wrote to memory of 2212 2612 pjdjp.exe 35 PID 2612 wrote to memory of 2212 2612 pjdjp.exe 35 PID 2612 wrote to memory of 2212 2612 pjdjp.exe 35 PID 2612 wrote to memory of 2212 2612 pjdjp.exe 35 PID 2212 wrote to memory of 2864 2212 bbtbtt.exe 36 PID 2212 wrote to memory of 2864 2212 bbtbtt.exe 36 PID 2212 wrote to memory of 2864 2212 bbtbtt.exe 36 PID 2212 wrote to memory of 2864 2212 bbtbtt.exe 36 PID 2864 wrote to memory of 1848 2864 vpdjj.exe 37 PID 2864 wrote to memory of 1848 2864 vpdjj.exe 37 PID 2864 wrote to memory of 1848 2864 vpdjj.exe 37 PID 2864 wrote to memory of 1848 2864 vpdjj.exe 37 PID 1848 wrote to memory of 888 1848 rlflxlx.exe 38 PID 1848 wrote to memory of 888 1848 rlflxlx.exe 38 PID 1848 wrote to memory of 888 1848 rlflxlx.exe 38 PID 1848 wrote to memory of 888 1848 rlflxlx.exe 38 PID 888 wrote to memory of 1472 888 ddjpp.exe 39 PID 888 wrote to memory of 1472 888 ddjpp.exe 39 PID 888 wrote to memory of 1472 888 ddjpp.exe 39 PID 888 wrote to memory of 1472 888 ddjpp.exe 39 PID 1472 wrote to memory of 1196 1472 1lfffrx.exe 40 PID 1472 wrote to memory of 1196 1472 1lfffrx.exe 40 PID 1472 wrote to memory of 1196 1472 1lfffrx.exe 40 PID 1472 wrote to memory of 1196 1472 1lfffrx.exe 40 PID 1196 wrote to memory of 576 1196 jvddj.exe 41 PID 1196 wrote to memory of 576 1196 jvddj.exe 41 PID 1196 wrote to memory of 576 1196 jvddj.exe 41 PID 1196 wrote to memory of 576 1196 jvddj.exe 41 PID 576 wrote to memory of 1928 576 jdpvj.exe 42 PID 576 wrote to memory of 1928 576 jdpvj.exe 42 PID 576 wrote to memory of 1928 576 jdpvj.exe 42 PID 576 wrote to memory of 1928 576 jdpvj.exe 42 PID 1928 wrote to memory of 2616 1928 hbttbh.exe 43 PID 1928 wrote to memory of 2616 1928 hbttbh.exe 43 PID 1928 wrote to memory of 2616 1928 hbttbh.exe 43 PID 1928 wrote to memory of 2616 1928 hbttbh.exe 43 PID 2616 wrote to memory of 532 2616 jdpvd.exe 44 PID 2616 wrote to memory of 532 2616 jdpvd.exe 44 PID 2616 wrote to memory of 532 2616 jdpvd.exe 44 PID 2616 wrote to memory of 532 2616 jdpvd.exe 44 PID 532 wrote to memory of 1696 532 xrffllx.exe 45 PID 532 wrote to memory of 1696 532 xrffllx.exe 45 PID 532 wrote to memory of 1696 532 xrffllx.exe 45 PID 532 wrote to memory of 1696 532 xrffllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe"C:\Users\Admin\AppData\Local\Temp\a381f3f79600fb6b691eaa0b8b6899c2bf4b251f3f31f6d323c8b76438334bc9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\btbbnn.exec:\btbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\jpjpp.exec:\jpjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3hnhhh.exec:\3hnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hhtthn.exec:\hhtthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pjdjp.exec:\pjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\bbtbtt.exec:\bbtbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vpdjj.exec:\vpdjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rlflxlx.exec:\rlflxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\ddjpp.exec:\ddjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\1lfffrx.exec:\1lfffrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jvddj.exec:\jvddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jdpvj.exec:\jdpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\hbttbh.exec:\hbttbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\jdpvd.exec:\jdpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrffllx.exec:\xrffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\htntbt.exec:\htntbt.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9jjpj.exec:\9jjpj.exe18⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbhhnh.exec:\hbhhnh.exe19⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jvpjv.exec:\jvpjv.exe20⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rllxflr.exec:\rllxflr.exe21⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nhhntt.exec:\nhhntt.exe22⤵
- Executes dropped EXE
PID:1460 -
\??\c:\dpjpv.exec:\dpjpv.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxrrlxf.exec:\fxrrlxf.exe24⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjppd.exec:\pjppd.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3lrrrxl.exec:\3lrrrxl.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhnttt.exec:\nhnttt.exe27⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xrflrrf.exec:\xrflrrf.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hbhbnn.exec:\hbhbnn.exe29⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jvjjv.exec:\jvjjv.exe30⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lfrxflr.exec:\lfrxflr.exe31⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1vjdj.exec:\1vjdj.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pjvdd.exec:\pjvdd.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\thbhnt.exec:\thbhnt.exe34⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjvvd.exec:\pjvvd.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jvddj.exec:\jvddj.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xlffrrl.exec:\xlffrrl.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhbnbh.exec:\nhbnbh.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\btnthn.exec:\btnthn.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jvvdd.exec:\jvvdd.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xlxxflr.exec:\xlxxflr.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\httthn.exec:\httthn.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vpjpv.exec:\vpjpv.exe43⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5vddd.exec:\5vddd.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rfrlxxl.exec:\rfrlxxl.exe45⤵
- Executes dropped EXE
PID:996 -
\??\c:\hbtthh.exec:\hbtthh.exe46⤵
- Executes dropped EXE
PID:888 -
\??\c:\3vpvp.exec:\3vpvp.exe47⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1rxrlrr.exec:\1rxrlrr.exe48⤵
- Executes dropped EXE
PID:1196 -
\??\c:\htnnhh.exec:\htnnhh.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bthnbb.exec:\bthnbb.exe50⤵
- Executes dropped EXE
PID:772 -
\??\c:\7vppv.exec:\7vppv.exe51⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xrllllx.exec:\xrllllx.exe52⤵
- Executes dropped EXE
PID:600 -
\??\c:\9tnntt.exec:\9tnntt.exe53⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdddp.exec:\jdddp.exe54⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jdddv.exec:\jdddv.exe55⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\htttbb.exec:\htttbb.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pdppv.exec:\pdppv.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxfflrf.exec:\fxfflrf.exe60⤵
- Executes dropped EXE
PID:1584 -
\??\c:\btntbb.exec:\btntbb.exe61⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9vppp.exec:\9vppp.exe62⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vpdvd.exec:\vpdvd.exe63⤵
- Executes dropped EXE
PID:828 -
\??\c:\lxxflll.exec:\lxxflll.exe64⤵
- Executes dropped EXE
PID:288 -
\??\c:\nthbnb.exec:\nthbnb.exe65⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jvjjv.exec:\jvjjv.exe66⤵PID:2512
-
\??\c:\vjddj.exec:\vjddj.exe67⤵PID:1872
-
\??\c:\lfflxxl.exec:\lfflxxl.exe68⤵PID:1592
-
\??\c:\thbbhh.exec:\thbbhh.exe69⤵PID:1720
-
\??\c:\nbnnnt.exec:\nbnnnt.exe70⤵PID:2508
-
\??\c:\dpddj.exec:\dpddj.exe71⤵PID:904
-
\??\c:\xlflllr.exec:\xlflllr.exe72⤵PID:2272
-
\??\c:\thbbbh.exec:\thbbbh.exe73⤵PID:1444
-
\??\c:\nbnhbb.exec:\nbnhbb.exe74⤵PID:3020
-
\??\c:\vjppd.exec:\vjppd.exe75⤵PID:2736
-
\??\c:\7flllrx.exec:\7flllrx.exe76⤵PID:2652
-
\??\c:\xlxxxfr.exec:\xlxxxfr.exe77⤵PID:2812
-
\??\c:\hthntt.exec:\hthntt.exe78⤵PID:2804
-
\??\c:\jdppv.exec:\jdppv.exe79⤵PID:2636
-
\??\c:\fxlfffl.exec:\fxlfffl.exe80⤵PID:2720
-
\??\c:\1rflrxr.exec:\1rflrxr.exe81⤵PID:1920
-
\??\c:\bntbhn.exec:\bntbhn.exe82⤵PID:2324
-
\??\c:\vpdjp.exec:\vpdjp.exe83⤵PID:2956
-
\??\c:\vpdpp.exec:\vpdpp.exe84⤵PID:2648
-
\??\c:\xlxxfff.exec:\xlxxfff.exe85⤵PID:2360
-
\??\c:\3bttnn.exec:\3bttnn.exe86⤵PID:2384
-
\??\c:\thttbb.exec:\thttbb.exe87⤵PID:1464
-
\??\c:\3vdvp.exec:\3vdvp.exe88⤵PID:2016
-
\??\c:\5rlrxxl.exec:\5rlrxxl.exe89⤵PID:2044
-
\??\c:\nbtthb.exec:\nbtthb.exe90⤵PID:2276
-
\??\c:\btnntn.exec:\btnntn.exe91⤵PID:1428
-
\??\c:\ddpvv.exec:\ddpvv.exe92⤵PID:1240
-
\??\c:\9rlrrxf.exec:\9rlrrxf.exe93⤵PID:2900
-
\??\c:\fflxffr.exec:\fflxffr.exe94⤵PID:680
-
\??\c:\thttbn.exec:\thttbn.exe95⤵PID:600
-
\??\c:\vjvvv.exec:\vjvvv.exe96⤵PID:1684
-
\??\c:\xrxrxff.exec:\xrxrxff.exe97⤵PID:2168
-
\??\c:\lxrrrlx.exec:\lxrrrlx.exe98⤵PID:1456
-
\??\c:\hbhntt.exec:\hbhntt.exe99⤵PID:3064
-
\??\c:\vpdjp.exec:\vpdjp.exe100⤵PID:2184
-
\??\c:\9jddj.exec:\9jddj.exe101⤵PID:444
-
\??\c:\rflxxxr.exec:\rflxxxr.exe102⤵PID:2412
-
\??\c:\nbbnbt.exec:\nbbnbt.exe103⤵PID:1192
-
\??\c:\1jvjp.exec:\1jvjp.exe104⤵PID:1556
-
\??\c:\5jjjj.exec:\5jjjj.exe105⤵PID:2440
-
\??\c:\flrrfxx.exec:\flrrfxx.exe106⤵PID:1916
-
\??\c:\1nbbhn.exec:\1nbbhn.exe107⤵PID:2260
-
\??\c:\jvppj.exec:\jvppj.exe108⤵PID:1728
-
\??\c:\pvpvv.exec:\pvpvv.exe109⤵PID:2480
-
\??\c:\rfrrrll.exec:\rfrrrll.exe110⤵PID:2100
-
\??\c:\tttbnn.exec:\tttbnn.exe111⤵PID:2996
-
\??\c:\5thntt.exec:\5thntt.exe112⤵PID:1628
-
\??\c:\3pddp.exec:\3pddp.exe113⤵PID:896
-
\??\c:\xrxxllr.exec:\xrxxllr.exe114⤵PID:2884
-
\??\c:\rfrxflx.exec:\rfrxflx.exe115⤵PID:2148
-
\??\c:\hthhnt.exec:\hthhnt.exe116⤵PID:1532
-
\??\c:\pdvvj.exec:\pdvvj.exe117⤵PID:2828
-
\??\c:\djjpv.exec:\djjpv.exe118⤵PID:2716
-
\??\c:\lfrrffl.exec:\lfrrffl.exe119⤵PID:2784
-
\??\c:\ttntbn.exec:\ttntbn.exe120⤵PID:2548
-
\??\c:\9hhnbn.exec:\9hhnbn.exe121⤵PID:2468
-
\??\c:\pjjjj.exec:\pjjjj.exe122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-