Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe
Resource
win7-20240903-en
General
-
Target
bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe
-
Size
456KB
-
MD5
63c005bc062c54647df612c09595795e
-
SHA1
7f0920edca14fb167111d0c74164bf7f15a65d24
-
SHA256
bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e
-
SHA512
0f04ed064aaa49d0b69d618e600945928a679468b20256fc4b87ec65088cbd080fa01cdd1e224aad49eea3b3bdd197dccb1d05d90809cf1dfc1e33d099c6b74a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRx:q7Tc2NYHUrAwfMp3CDRx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2688-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-63-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2208-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-83-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2228-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-85-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2052-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-121-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2848-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-544-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-625-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2940-719-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1124-796-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2412-806-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2688 hhtbhb.exe 2880 pvjjj.exe 2712 fxllrrr.exe 2792 xxxlxxr.exe 2716 nnhnhh.exe 2588 lfrxfxl.exe 2208 7tntnn.exe 2796 xrrxllx.exe 2228 3lrxlxl.exe 2052 1xlrxfr.exe 2760 7flxxfl.exe 2848 thtbbh.exe 2916 lfrxffx.exe 2756 bnbhnt.exe 2100 lllxrlf.exe 760 hhnhtn.exe 1488 3xrlxfx.exe 2560 tthhnn.exe 580 ffrxlrf.exe 824 9vdjp.exe 1864 tntbhh.exe 948 pjdjp.exe 1852 lfrrfxf.exe 1376 ttnbht.exe 2364 1hbhbh.exe 596 pjvvd.exe 1728 hhbhnn.exe 284 1jjjp.exe 300 xrlrfrf.exe 1652 bbtbhh.exe 2508 1vdpj.exe 2300 hbthnn.exe 1604 llffrxl.exe 2720 tnnbnn.exe 3000 dvjjv.exe 2856 1rrrflf.exe 2680 btnnbb.exe 2792 tttbnn.exe 2864 pjvvj.exe 2656 llrrfll.exe 2420 tnbhnn.exe 640 pjddp.exe 2796 lfxlrxf.exe 2228 btbbht.exe 1264 djddp.exe 2960 dvpdp.exe 2784 9rlxffx.exe 2912 nhhttb.exe 1880 jjddv.exe 2916 frrxxrl.exe 1516 7rffllx.exe 3056 bbthth.exe 2120 3dppd.exe 1756 lfxlxlx.exe 2556 hhbhnt.exe 2432 dvpjv.exe 1344 llxlrxf.exe 840 5hbbhh.exe 292 vvjjp.exe 2520 flfxflf.exe 2060 nttbnt.exe 1772 nhtbth.exe 748 3dppv.exe 1900 rrfxflf.exe -
resource yara_rule behavioral1/memory/2688-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-65-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2228-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-508-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/748-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-718-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/3012-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-806-0x0000000000430000-0x000000000045A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2688 2128 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 30 PID 2128 wrote to memory of 2688 2128 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 30 PID 2128 wrote to memory of 2688 2128 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 30 PID 2128 wrote to memory of 2688 2128 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 30 PID 2688 wrote to memory of 2880 2688 hhtbhb.exe 31 PID 2688 wrote to memory of 2880 2688 hhtbhb.exe 31 PID 2688 wrote to memory of 2880 2688 hhtbhb.exe 31 PID 2688 wrote to memory of 2880 2688 hhtbhb.exe 31 PID 2880 wrote to memory of 2712 2880 pvjjj.exe 32 PID 2880 wrote to memory of 2712 2880 pvjjj.exe 32 PID 2880 wrote to memory of 2712 2880 pvjjj.exe 32 PID 2880 wrote to memory of 2712 2880 pvjjj.exe 32 PID 2712 wrote to memory of 2792 2712 fxllrrr.exe 33 PID 2712 wrote to memory of 2792 2712 fxllrrr.exe 33 PID 2712 wrote to memory of 2792 2712 fxllrrr.exe 33 PID 2712 wrote to memory of 2792 2712 fxllrrr.exe 33 PID 2792 wrote to memory of 2716 2792 xxxlxxr.exe 34 PID 2792 wrote to memory of 2716 2792 xxxlxxr.exe 34 PID 2792 wrote to memory of 2716 2792 xxxlxxr.exe 34 PID 2792 wrote to memory of 2716 2792 xxxlxxr.exe 34 PID 2716 wrote to memory of 2588 2716 nnhnhh.exe 35 PID 2716 wrote to memory of 2588 2716 nnhnhh.exe 35 PID 2716 wrote to memory of 2588 2716 nnhnhh.exe 35 PID 2716 wrote to memory of 2588 2716 nnhnhh.exe 35 PID 2588 wrote to memory of 2208 2588 lfrxfxl.exe 36 PID 2588 wrote to memory of 2208 2588 lfrxfxl.exe 36 PID 2588 wrote to memory of 2208 2588 lfrxfxl.exe 36 PID 2588 wrote to memory of 2208 2588 lfrxfxl.exe 36 PID 2208 wrote to memory of 2796 2208 7tntnn.exe 37 PID 2208 wrote to memory of 2796 2208 7tntnn.exe 37 PID 2208 wrote to memory of 2796 2208 7tntnn.exe 37 PID 2208 wrote to memory of 2796 2208 7tntnn.exe 37 PID 2796 wrote to memory of 2228 2796 xrrxllx.exe 38 PID 2796 wrote to memory of 2228 2796 xrrxllx.exe 38 PID 2796 wrote to memory of 2228 2796 xrrxllx.exe 38 PID 2796 wrote to memory of 2228 2796 xrrxllx.exe 38 PID 2228 wrote to memory of 2052 2228 3lrxlxl.exe 39 PID 2228 wrote to memory of 2052 2228 3lrxlxl.exe 39 PID 2228 wrote to memory of 2052 2228 3lrxlxl.exe 39 PID 2228 wrote to memory of 2052 2228 3lrxlxl.exe 39 PID 2052 wrote to memory of 2760 2052 1xlrxfr.exe 40 PID 2052 wrote to memory of 2760 2052 1xlrxfr.exe 40 PID 2052 wrote to memory of 2760 2052 1xlrxfr.exe 40 PID 2052 wrote to memory of 2760 2052 1xlrxfr.exe 40 PID 2760 wrote to memory of 2848 2760 7flxxfl.exe 41 PID 2760 wrote to memory of 2848 2760 7flxxfl.exe 41 PID 2760 wrote to memory of 2848 2760 7flxxfl.exe 41 PID 2760 wrote to memory of 2848 2760 7flxxfl.exe 41 PID 2848 wrote to memory of 2916 2848 thtbbh.exe 42 PID 2848 wrote to memory of 2916 2848 thtbbh.exe 42 PID 2848 wrote to memory of 2916 2848 thtbbh.exe 42 PID 2848 wrote to memory of 2916 2848 thtbbh.exe 42 PID 2916 wrote to memory of 2756 2916 lfrxffx.exe 43 PID 2916 wrote to memory of 2756 2916 lfrxffx.exe 43 PID 2916 wrote to memory of 2756 2916 lfrxffx.exe 43 PID 2916 wrote to memory of 2756 2916 lfrxffx.exe 43 PID 2756 wrote to memory of 2100 2756 bnbhnt.exe 44 PID 2756 wrote to memory of 2100 2756 bnbhnt.exe 44 PID 2756 wrote to memory of 2100 2756 bnbhnt.exe 44 PID 2756 wrote to memory of 2100 2756 bnbhnt.exe 44 PID 2100 wrote to memory of 760 2100 lllxrlf.exe 45 PID 2100 wrote to memory of 760 2100 lllxrlf.exe 45 PID 2100 wrote to memory of 760 2100 lllxrlf.exe 45 PID 2100 wrote to memory of 760 2100 lllxrlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe"C:\Users\Admin\AppData\Local\Temp\bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hhtbhb.exec:\hhtbhb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pvjjj.exec:\pvjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxllrrr.exec:\fxllrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nnhnhh.exec:\nnhnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lfrxfxl.exec:\lfrxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7tntnn.exec:\7tntnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xrrxllx.exec:\xrrxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3lrxlxl.exec:\3lrxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\1xlrxfr.exec:\1xlrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\7flxxfl.exec:\7flxxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\thtbbh.exec:\thtbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lfrxffx.exec:\lfrxffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\bnbhnt.exec:\bnbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lllxrlf.exec:\lllxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hhnhtn.exec:\hhnhtn.exe17⤵
- Executes dropped EXE
PID:760 -
\??\c:\3xrlxfx.exec:\3xrlxfx.exe18⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tthhnn.exec:\tthhnn.exe19⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\9vdjp.exec:\9vdjp.exe21⤵
- Executes dropped EXE
PID:824 -
\??\c:\tntbhh.exec:\tntbhh.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:948 -
\??\c:\lfrrfxf.exec:\lfrrfxf.exe24⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ttnbht.exec:\ttnbht.exe25⤵
- Executes dropped EXE
PID:1376 -
\??\c:\1hbhbh.exec:\1hbhbh.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjvvd.exec:\pjvvd.exe27⤵
- Executes dropped EXE
PID:596 -
\??\c:\hhbhnn.exec:\hhbhnn.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1jjjp.exec:\1jjjp.exe29⤵
- Executes dropped EXE
PID:284 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe30⤵
- Executes dropped EXE
PID:300 -
\??\c:\bbtbhh.exec:\bbtbhh.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1vdpj.exec:\1vdpj.exe32⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbthnn.exec:\hbthnn.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\llffrxl.exec:\llffrxl.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tnnbnn.exec:\tnnbnn.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dvjjv.exec:\dvjjv.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1rrrflf.exec:\1rrrflf.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btnnbb.exec:\btnnbb.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tttbnn.exec:\tttbnn.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjvvj.exec:\pjvvj.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\llrrfll.exec:\llrrfll.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnbhnn.exec:\tnbhnn.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjddp.exec:\pjddp.exe43⤵
- Executes dropped EXE
PID:640 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\btbbht.exec:\btbbht.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\djddp.exec:\djddp.exe46⤵
- Executes dropped EXE
PID:1264 -
\??\c:\dvpdp.exec:\dvpdp.exe47⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9rlxffx.exec:\9rlxffx.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nhhttb.exec:\nhhttb.exe49⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jjddv.exec:\jjddv.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\frrxxrl.exec:\frrxxrl.exe51⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7rffllx.exec:\7rffllx.exe52⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bbthth.exec:\bbthth.exe53⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3dppd.exec:\3dppd.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hhbhnt.exec:\hhbhnt.exe56⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvpjv.exec:\dvpjv.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llxlrxf.exec:\llxlrxf.exe58⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5hbbhh.exec:\5hbbhh.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\vvjjp.exec:\vvjjp.exe60⤵
- Executes dropped EXE
PID:292 -
\??\c:\flfxflf.exec:\flfxflf.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nttbnt.exec:\nttbnt.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\nhtbth.exec:\nhtbth.exe63⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3dppv.exec:\3dppv.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\rrfxflf.exec:\rrfxflf.exe65⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9nhtnt.exec:\9nhtnt.exe66⤵PID:1180
-
\??\c:\djvdp.exec:\djvdp.exe67⤵PID:2344
-
\??\c:\1xlxlrx.exec:\1xlxlrx.exe68⤵PID:2500
-
\??\c:\ttntbh.exec:\ttntbh.exe69⤵PID:1228
-
\??\c:\hhbttt.exec:\hhbttt.exe70⤵PID:1960
-
\??\c:\lrxllxf.exec:\lrxllxf.exe71⤵PID:868
-
\??\c:\fxxxflr.exec:\fxxxflr.exe72⤵PID:1700
-
\??\c:\9bthtb.exec:\9bthtb.exe73⤵PID:2024
-
\??\c:\vdvjd.exec:\vdvjd.exe74⤵PID:2844
-
\??\c:\xxrrffr.exec:\xxrrffr.exe75⤵PID:2688
-
\??\c:\rfxfxfx.exec:\rfxfxfx.exe76⤵PID:2808
-
\??\c:\3hbhbt.exec:\3hbhbt.exe77⤵PID:2176
-
\??\c:\jdvvj.exec:\jdvvj.exe78⤵PID:2816
-
\??\c:\vvpvp.exec:\vvpvp.exe79⤵PID:2856
-
\??\c:\rlfrffl.exec:\rlfrffl.exe80⤵PID:1992
-
\??\c:\tnhhnb.exec:\tnhhnb.exe81⤵PID:2596
-
\??\c:\jjdjd.exec:\jjdjd.exe82⤵PID:2692
-
\??\c:\xxxlflx.exec:\xxxlflx.exe83⤵PID:1976
-
\??\c:\lllxlrf.exec:\lllxlrf.exe84⤵PID:1896
-
\??\c:\3tnhbh.exec:\3tnhbh.exe85⤵PID:1528
-
\??\c:\jdppp.exec:\jdppp.exe86⤵PID:2236
-
\??\c:\xrlrfxr.exec:\xrlrfxr.exe87⤵PID:1412
-
\??\c:\rlxfllx.exec:\rlxfllx.exe88⤵PID:332
-
\??\c:\hhbhbb.exec:\hhbhbb.exe89⤵PID:1336
-
\??\c:\dpdjp.exec:\dpdjp.exe90⤵PID:2900
-
\??\c:\7vpvd.exec:\7vpvd.exe91⤵PID:468
-
\??\c:\7fflfrl.exec:\7fflfrl.exe92⤵PID:2940
-
\??\c:\tththn.exec:\tththn.exe93⤵PID:2920
-
\??\c:\ppdjv.exec:\ppdjv.exe94⤵PID:3068
-
\??\c:\frlxxfl.exec:\frlxxfl.exe95⤵PID:1612
-
\??\c:\3btbtt.exec:\3btbtt.exe96⤵PID:1820
-
\??\c:\jdvjd.exec:\jdvjd.exe97⤵PID:1488
-
\??\c:\ppddp.exec:\ppddp.exe98⤵PID:3012
-
\??\c:\3rflfrx.exec:\3rflfrx.exe99⤵PID:348
-
\??\c:\bttbhn.exec:\bttbhn.exe100⤵PID:708
-
\??\c:\1ddvj.exec:\1ddvj.exe101⤵PID:2296
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe102⤵PID:2164
-
\??\c:\1rlrflx.exec:\1rlrflx.exe103⤵PID:352
-
\??\c:\ppjpd.exec:\ppjpd.exe104⤵PID:1584
-
\??\c:\ppjjd.exec:\ppjjd.exe105⤵
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\rrlrflx.exec:\rrlrflx.exe106⤵PID:1912
-
\??\c:\hbbhtt.exec:\hbbhtt.exe107⤵PID:1124
-
\??\c:\9dvdp.exec:\9dvdp.exe108⤵PID:2412
-
\??\c:\7rlrxfx.exec:\7rlrxfx.exe109⤵PID:2376
-
\??\c:\jvdvp.exec:\jvdvp.exe110⤵PID:576
-
\??\c:\7flrxfl.exec:\7flrxfl.exe111⤵PID:284
-
\??\c:\bbthnn.exec:\bbthnn.exe112⤵PID:300
-
\??\c:\tnbtbt.exec:\tnbtbt.exe113⤵PID:548
-
\??\c:\flfxffl.exec:\flfxffl.exe114⤵PID:1512
-
\??\c:\ffxfflx.exec:\ffxfflx.exe115⤵PID:2508
-
\??\c:\3hnntb.exec:\3hnntb.exe116⤵PID:2064
-
\??\c:\jdpvd.exec:\jdpvd.exe117⤵PID:2732
-
\??\c:\pjddd.exec:\pjddd.exe118⤵PID:2876
-
\??\c:\9frrrrx.exec:\9frrrrx.exe119⤵PID:2880
-
\??\c:\nnnbtt.exec:\nnnbtt.exe120⤵PID:2872
-
\??\c:\ppjpd.exec:\ppjpd.exe121⤵PID:2616
-
\??\c:\3rrxflx.exec:\3rrxflx.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-