Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe
Resource
win7-20240903-en
General
-
Target
f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe
-
Size
454KB
-
MD5
f11d5654c326478a439c2b20c069dfb0
-
SHA1
4ed8727d0bd0188e6792c7ec0d2d2cb03b81f826
-
SHA256
f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39
-
SHA512
c23e1cb4a9ca8bb36f1838f6ea93434cca7bdda0a949a490c3307be8ef10d182a28a79a93a6c0b4ee357c50c5cdcbb6fde825c5e8d655c2ffe99fe1dc0f8ff47
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2172-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-233-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2504-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-737-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2660 ttnnbb.exe 2800 pdvpj.exe 2684 jpvvd.exe 2580 xrrxlrx.exe 2768 pvdvj.exe 2564 lfrxlrr.exe 2984 5dvvd.exe 1528 hbnntt.exe 1868 5fxrrxf.exe 2428 7xfrxff.exe 2608 fxlrxfr.exe 1564 frllxxf.exe 1288 rlflrxl.exe 2616 lrlrflf.exe 2860 jdvdj.exe 1928 fxlrflf.exe 112 vpdjv.exe 1568 ffrxlrl.exe 2016 dvppd.exe 2920 3xxfllx.exe 2164 3hnttb.exe 1820 vvvdp.exe 972 9tnttn.exe 2504 3xrxllr.exe 1720 hhbnbb.exe 2092 jjpjv.exe 2336 bttbnn.exe 1756 5pjjp.exe 2940 rlflllr.exe 2192 1vdjj.exe 776 rlffrxl.exe 2656 tnhtnt.exe 2700 fxrxrrf.exe 1592 hbnhhn.exe 2708 ttnthn.exe 2668 ddppv.exe 2736 1llrflx.exe 2688 nnhhtb.exe 2740 pjvdp.exe 2620 pdddj.exe 2564 xrlrxxl.exe 1808 nbhnnh.exe 2636 jvpjv.exe 3008 lllflxf.exe 1868 btnhnh.exe 2428 7nbbtt.exe 652 jvjdj.exe 896 frllllx.exe 2028 dvjjj.exe 2864 vvppv.exe 2648 rlxfrrr.exe 1992 btnthn.exe 1988 pjddj.exe 1928 pjvdv.exe 2140 9lrllfl.exe 2756 hbtbth.exe 2364 tnbbhh.exe 2764 5vpvd.exe 2216 lfxxffl.exe 1068 3xrlrrr.exe 2228 nhhhtb.exe 1100 pjpjj.exe 1296 vjjjj.exe 2496 rlrffxf.exe -
resource yara_rule behavioral1/memory/2172-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-737-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2084-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-981-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnht.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2660 2172 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 31 PID 2172 wrote to memory of 2660 2172 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 31 PID 2172 wrote to memory of 2660 2172 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 31 PID 2172 wrote to memory of 2660 2172 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 31 PID 2660 wrote to memory of 2800 2660 ttnnbb.exe 32 PID 2660 wrote to memory of 2800 2660 ttnnbb.exe 32 PID 2660 wrote to memory of 2800 2660 ttnnbb.exe 32 PID 2660 wrote to memory of 2800 2660 ttnnbb.exe 32 PID 2800 wrote to memory of 2684 2800 pdvpj.exe 33 PID 2800 wrote to memory of 2684 2800 pdvpj.exe 33 PID 2800 wrote to memory of 2684 2800 pdvpj.exe 33 PID 2800 wrote to memory of 2684 2800 pdvpj.exe 33 PID 2684 wrote to memory of 2580 2684 jpvvd.exe 34 PID 2684 wrote to memory of 2580 2684 jpvvd.exe 34 PID 2684 wrote to memory of 2580 2684 jpvvd.exe 34 PID 2684 wrote to memory of 2580 2684 jpvvd.exe 34 PID 2580 wrote to memory of 2768 2580 xrrxlrx.exe 35 PID 2580 wrote to memory of 2768 2580 xrrxlrx.exe 35 PID 2580 wrote to memory of 2768 2580 xrrxlrx.exe 35 PID 2580 wrote to memory of 2768 2580 xrrxlrx.exe 35 PID 2768 wrote to memory of 2564 2768 pvdvj.exe 36 PID 2768 wrote to memory of 2564 2768 pvdvj.exe 36 PID 2768 wrote to memory of 2564 2768 pvdvj.exe 36 PID 2768 wrote to memory of 2564 2768 pvdvj.exe 36 PID 2564 wrote to memory of 2984 2564 lfrxlrr.exe 37 PID 2564 wrote to memory of 2984 2564 lfrxlrr.exe 37 PID 2564 wrote to memory of 2984 2564 lfrxlrr.exe 37 PID 2564 wrote to memory of 2984 2564 lfrxlrr.exe 37 PID 2984 wrote to memory of 1528 2984 5dvvd.exe 38 PID 2984 wrote to memory of 1528 2984 5dvvd.exe 38 PID 2984 wrote to memory of 1528 2984 5dvvd.exe 38 PID 2984 wrote to memory of 1528 2984 5dvvd.exe 38 PID 1528 wrote to memory of 1868 1528 hbnntt.exe 39 PID 1528 wrote to memory of 1868 1528 hbnntt.exe 39 PID 1528 wrote to memory of 1868 1528 hbnntt.exe 39 PID 1528 wrote to memory of 1868 1528 hbnntt.exe 39 PID 1868 wrote to memory of 2428 1868 5fxrrxf.exe 40 PID 1868 wrote to memory of 2428 1868 5fxrrxf.exe 40 PID 1868 wrote to memory of 2428 1868 5fxrrxf.exe 40 PID 1868 wrote to memory of 2428 1868 5fxrrxf.exe 40 PID 2428 wrote to memory of 2608 2428 7xfrxff.exe 41 PID 2428 wrote to memory of 2608 2428 7xfrxff.exe 41 PID 2428 wrote to memory of 2608 2428 7xfrxff.exe 41 PID 2428 wrote to memory of 2608 2428 7xfrxff.exe 41 PID 2608 wrote to memory of 1564 2608 fxlrxfr.exe 42 PID 2608 wrote to memory of 1564 2608 fxlrxfr.exe 42 PID 2608 wrote to memory of 1564 2608 fxlrxfr.exe 42 PID 2608 wrote to memory of 1564 2608 fxlrxfr.exe 42 PID 1564 wrote to memory of 1288 1564 frllxxf.exe 43 PID 1564 wrote to memory of 1288 1564 frllxxf.exe 43 PID 1564 wrote to memory of 1288 1564 frllxxf.exe 43 PID 1564 wrote to memory of 1288 1564 frllxxf.exe 43 PID 1288 wrote to memory of 2616 1288 rlflrxl.exe 44 PID 1288 wrote to memory of 2616 1288 rlflrxl.exe 44 PID 1288 wrote to memory of 2616 1288 rlflrxl.exe 44 PID 1288 wrote to memory of 2616 1288 rlflrxl.exe 44 PID 2616 wrote to memory of 2860 2616 lrlrflf.exe 45 PID 2616 wrote to memory of 2860 2616 lrlrflf.exe 45 PID 2616 wrote to memory of 2860 2616 lrlrflf.exe 45 PID 2616 wrote to memory of 2860 2616 lrlrflf.exe 45 PID 2860 wrote to memory of 1928 2860 jdvdj.exe 46 PID 2860 wrote to memory of 1928 2860 jdvdj.exe 46 PID 2860 wrote to memory of 1928 2860 jdvdj.exe 46 PID 2860 wrote to memory of 1928 2860 jdvdj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe"C:\Users\Admin\AppData\Local\Temp\f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\ttnnbb.exec:\ttnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pdvpj.exec:\pdvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jpvvd.exec:\jpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xrrxlrx.exec:\xrrxlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pvdvj.exec:\pvdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5dvvd.exec:\5dvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hbnntt.exec:\hbnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\5fxrrxf.exec:\5fxrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\7xfrxff.exec:\7xfrxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\frllxxf.exec:\frllxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\rlflrxl.exec:\rlflrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\lrlrflf.exec:\lrlrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jdvdj.exec:\jdvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fxlrflf.exec:\fxlrflf.exe17⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpdjv.exec:\vpdjv.exe18⤵
- Executes dropped EXE
PID:112 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe19⤵
- Executes dropped EXE
PID:1568 -
\??\c:\dvppd.exec:\dvppd.exe20⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3xxfllx.exec:\3xxfllx.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3hnttb.exec:\3hnttb.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vvvdp.exec:\vvvdp.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9tnttn.exec:\9tnttn.exe24⤵
- Executes dropped EXE
PID:972 -
\??\c:\3xrxllr.exec:\3xrxllr.exe25⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hhbnbb.exec:\hhbnbb.exe26⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjpjv.exec:\jjpjv.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bttbnn.exec:\bttbnn.exe28⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5pjjp.exec:\5pjjp.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlflllr.exec:\rlflllr.exe30⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1vdjj.exec:\1vdjj.exe31⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rlffrxl.exec:\rlffrxl.exe32⤵
- Executes dropped EXE
PID:776 -
\??\c:\tnhtnt.exec:\tnhtnt.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbnhhn.exec:\hbnhhn.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ttnthn.exec:\ttnthn.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ddppv.exec:\ddppv.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1llrflx.exec:\1llrflx.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nnhhtb.exec:\nnhhtb.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjvdp.exec:\pjvdp.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pdddj.exec:\pdddj.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nbhnnh.exec:\nbhnnh.exe43⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jvpjv.exec:\jvpjv.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lllflxf.exec:\lllflxf.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\btnhnh.exec:\btnhnh.exe46⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7nbbtt.exec:\7nbbtt.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jvjdj.exec:\jvjdj.exe48⤵
- Executes dropped EXE
PID:652 -
\??\c:\frllllx.exec:\frllllx.exe49⤵
- Executes dropped EXE
PID:896 -
\??\c:\dvjjj.exec:\dvjjj.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vvppv.exec:\vvppv.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe52⤵
- Executes dropped EXE
PID:2648 -
\??\c:\btnthn.exec:\btnthn.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjddj.exec:\pjddj.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pjvdv.exec:\pjvdv.exe55⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9lrllfl.exec:\9lrllfl.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbtbth.exec:\hbtbth.exe57⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tnbbhh.exec:\tnbbhh.exe58⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5vpvd.exec:\5vpvd.exe59⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lfxxffl.exec:\lfxxffl.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3xrlrrr.exec:\3xrlrrr.exe61⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nhhhtb.exec:\nhhhtb.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjpjj.exec:\pjpjj.exe63⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vjjjj.exec:\vjjjj.exe64⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rlrffxf.exec:\rlrffxf.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tntbhh.exec:\tntbhh.exe66⤵PID:2464
-
\??\c:\vjpjp.exec:\vjpjp.exe67⤵PID:716
-
\??\c:\vpppv.exec:\vpppv.exe68⤵PID:1672
-
\??\c:\lfrfllr.exec:\lfrfllr.exe69⤵PID:3036
-
\??\c:\nbtbhn.exec:\nbtbhn.exe70⤵PID:556
-
\??\c:\vjdvv.exec:\vjdvv.exe71⤵PID:2516
-
\??\c:\pjjjp.exec:\pjjjp.exe72⤵PID:2248
-
\??\c:\7fxflll.exec:\7fxflll.exe73⤵PID:2388
-
\??\c:\5hhntb.exec:\5hhntb.exe74⤵PID:1860
-
\??\c:\jvjjp.exec:\jvjjp.exe75⤵PID:2416
-
\??\c:\vvvvd.exec:\vvvvd.exe76⤵PID:2660
-
\??\c:\7fxfffl.exec:\7fxfffl.exe77⤵PID:2700
-
\??\c:\7hbtbh.exec:\7hbtbh.exe78⤵PID:2680
-
\??\c:\pdvvd.exec:\pdvvd.exe79⤵PID:2708
-
\??\c:\5lxfflr.exec:\5lxfflr.exe80⤵PID:2744
-
\??\c:\lxfrrrx.exec:\lxfrrrx.exe81⤵PID:2884
-
\??\c:\nhtbnn.exec:\nhtbnn.exe82⤵PID:2724
-
\??\c:\pjjvd.exec:\pjjvd.exe83⤵PID:2544
-
\??\c:\rxlffxl.exec:\rxlffxl.exe84⤵PID:2988
-
\??\c:\ffflrlr.exec:\ffflrlr.exe85⤵PID:2360
-
\??\c:\9thhhh.exec:\9thhhh.exe86⤵PID:1716
-
\??\c:\pjpvv.exec:\pjpvv.exe87⤵PID:1528
-
\??\c:\vpjpv.exec:\vpjpv.exe88⤵PID:2188
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe89⤵PID:2288
-
\??\c:\7ttthh.exec:\7ttthh.exe90⤵PID:1172
-
\??\c:\3pddj.exec:\3pddj.exe91⤵PID:708
-
\??\c:\jvpvv.exec:\jvpvv.exe92⤵PID:912
-
\??\c:\xxlfllx.exec:\xxlfllx.exe93⤵PID:1500
-
\??\c:\1bnntt.exec:\1bnntt.exe94⤵PID:1680
-
\??\c:\bhbnbb.exec:\bhbnbb.exe95⤵PID:1664
-
\??\c:\5vjpv.exec:\5vjpv.exe96⤵PID:2836
-
\??\c:\5lrxfrr.exec:\5lrxfrr.exe97⤵PID:1212
-
\??\c:\hbnthn.exec:\hbnthn.exe98⤵PID:1372
-
\??\c:\btttbb.exec:\btttbb.exe99⤵PID:1928
-
\??\c:\1djjv.exec:\1djjv.exe100⤵PID:2044
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe101⤵PID:1040
-
\??\c:\hbnntt.exec:\hbnntt.exe102⤵PID:1656
-
\??\c:\bthhnh.exec:\bthhnh.exe103⤵PID:2968
-
\??\c:\ddddp.exec:\ddddp.exe104⤵PID:1152
-
\??\c:\xfxxxrf.exec:\xfxxxrf.exe105⤵PID:1636
-
\??\c:\nnbtbh.exec:\nnbtbh.exe106⤵PID:944
-
\??\c:\pjvpp.exec:\pjvpp.exe107⤵PID:960
-
\??\c:\vvppv.exec:\vvppv.exe108⤵PID:1976
-
\??\c:\7frxfff.exec:\7frxfff.exe109⤵PID:1452
-
\??\c:\bthhtt.exec:\bthhtt.exe110⤵PID:376
-
\??\c:\hbtntn.exec:\hbtntn.exe111⤵PID:1940
-
\??\c:\jdpvv.exec:\jdpvv.exe112⤵PID:2336
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe113⤵PID:2116
-
\??\c:\9lxxllx.exec:\9lxxllx.exe114⤵PID:556
-
\??\c:\3tttnb.exec:\3tttnb.exe115⤵PID:2084
-
\??\c:\ppdjj.exec:\ppdjj.exe116⤵PID:316
-
\??\c:\nbntbb.exec:\nbntbb.exe117⤵PID:2640
-
\??\c:\ttttbt.exec:\ttttbt.exe118⤵PID:2348
-
\??\c:\frxflrr.exec:\frxflrr.exe119⤵PID:1584
-
\??\c:\9rfflrx.exec:\9rfflrx.exe120⤵PID:1688
-
\??\c:\thnhhh.exec:\thnhhh.exe121⤵PID:2804
-
\??\c:\jjdvd.exec:\jjdvd.exe122⤵PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-