Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe
Resource
win7-20240903-en
General
-
Target
0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe
-
Size
453KB
-
MD5
1d1c89d5e127d67dc6e08adb501458c2
-
SHA1
af44aa3e2a1c92df412b62c50bc19e1376da09a7
-
SHA256
0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b
-
SHA512
dfb2a81bdb67fbc496c7591f9483845c2f3c42b57abdb3165d96c4a6f8f891a9090db13871be095ad8c333574298426fd043a1dbd8a312e41bcbd213a2e03462
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/3040-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-362-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-551-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-710-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2760-757-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2444-765-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/696-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-851-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3040 dvpjd.exe 2680 nhhthn.exe 2616 vvddd.exe 2700 1rllxfr.exe 2664 3nbhnt.exe 2572 fxxflrf.exe 2500 vvvdj.exe 2508 1vdpd.exe 264 btnntt.exe 1296 djpjj.exe 2772 xxlfffr.exe 2964 1nbnbh.exe 2976 pjvdj.exe 2004 xrlrxrx.exe 1728 jjjjv.exe 1856 xxxfrxl.exe 1724 3thbnn.exe 540 jddjv.exe 1588 ttnbnn.exe 2056 tnnbnn.exe 844 7xrxrrl.exe 1468 3nbbnt.exe 2884 5jvdj.exe 2300 llffxxr.exe 1368 vpvpd.exe 1700 xlxfrrf.exe 1600 jdvjv.exe 964 lrlxrfx.exe 1512 thtbhh.exe 2392 9jjvp.exe 356 htbttt.exe 1428 1vvjv.exe 2260 lfxfxfl.exe 284 hbtbht.exe 3064 dvddv.exe 2684 5vjjv.exe 2608 5xlrrxf.exe 2584 9hnthn.exe 2620 3vpdp.exe 2480 7fxfflx.exe 2820 htnntb.exe 2452 ttbthn.exe 2532 vppdj.exe 1612 fxlflfl.exe 2016 3ntnnb.exe 536 1dvpj.exe 1400 rlxllll.exe 668 1hbhtt.exe 2948 9bbhhh.exe 2736 ddvdp.exe 1968 7fllllr.exe 1556 5tnbnt.exe 2024 tnbbbt.exe 1864 jdpvp.exe 1676 fxrlfxf.exe 1856 3xxffrx.exe 1924 1bhbbb.exe 2548 5dpdp.exe 380 rrxxrrf.exe 2348 hbnnbh.exe 1744 vpvvd.exe 3028 ddvjd.exe 1004 xxrxlrl.exe 444 1bthhh.exe -
resource yara_rule behavioral1/memory/3040-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-785-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2280-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-872-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3040 2132 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 28 PID 2132 wrote to memory of 3040 2132 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 28 PID 2132 wrote to memory of 3040 2132 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 28 PID 2132 wrote to memory of 3040 2132 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 28 PID 3040 wrote to memory of 2680 3040 dvpjd.exe 29 PID 3040 wrote to memory of 2680 3040 dvpjd.exe 29 PID 3040 wrote to memory of 2680 3040 dvpjd.exe 29 PID 3040 wrote to memory of 2680 3040 dvpjd.exe 29 PID 2680 wrote to memory of 2616 2680 nhhthn.exe 30 PID 2680 wrote to memory of 2616 2680 nhhthn.exe 30 PID 2680 wrote to memory of 2616 2680 nhhthn.exe 30 PID 2680 wrote to memory of 2616 2680 nhhthn.exe 30 PID 2616 wrote to memory of 2700 2616 vvddd.exe 31 PID 2616 wrote to memory of 2700 2616 vvddd.exe 31 PID 2616 wrote to memory of 2700 2616 vvddd.exe 31 PID 2616 wrote to memory of 2700 2616 vvddd.exe 31 PID 2700 wrote to memory of 2664 2700 1rllxfr.exe 32 PID 2700 wrote to memory of 2664 2700 1rllxfr.exe 32 PID 2700 wrote to memory of 2664 2700 1rllxfr.exe 32 PID 2700 wrote to memory of 2664 2700 1rllxfr.exe 32 PID 2664 wrote to memory of 2572 2664 3nbhnt.exe 33 PID 2664 wrote to memory of 2572 2664 3nbhnt.exe 33 PID 2664 wrote to memory of 2572 2664 3nbhnt.exe 33 PID 2664 wrote to memory of 2572 2664 3nbhnt.exe 33 PID 2572 wrote to memory of 2500 2572 fxxflrf.exe 34 PID 2572 wrote to memory of 2500 2572 fxxflrf.exe 34 PID 2572 wrote to memory of 2500 2572 fxxflrf.exe 34 PID 2572 wrote to memory of 2500 2572 fxxflrf.exe 34 PID 2500 wrote to memory of 2508 2500 vvvdj.exe 35 PID 2500 wrote to memory of 2508 2500 vvvdj.exe 35 PID 2500 wrote to memory of 2508 2500 vvvdj.exe 35 PID 2500 wrote to memory of 2508 2500 vvvdj.exe 35 PID 2508 wrote to memory of 264 2508 1vdpd.exe 36 PID 2508 wrote to memory of 264 2508 1vdpd.exe 36 PID 2508 wrote to memory of 264 2508 1vdpd.exe 36 PID 2508 wrote to memory of 264 2508 1vdpd.exe 36 PID 264 wrote to memory of 1296 264 btnntt.exe 37 PID 264 wrote to memory of 1296 264 btnntt.exe 37 PID 264 wrote to memory of 1296 264 btnntt.exe 37 PID 264 wrote to memory of 1296 264 btnntt.exe 37 PID 1296 wrote to memory of 2772 1296 djpjj.exe 38 PID 1296 wrote to memory of 2772 1296 djpjj.exe 38 PID 1296 wrote to memory of 2772 1296 djpjj.exe 38 PID 1296 wrote to memory of 2772 1296 djpjj.exe 38 PID 2772 wrote to memory of 2964 2772 xxlfffr.exe 39 PID 2772 wrote to memory of 2964 2772 xxlfffr.exe 39 PID 2772 wrote to memory of 2964 2772 xxlfffr.exe 39 PID 2772 wrote to memory of 2964 2772 xxlfffr.exe 39 PID 2964 wrote to memory of 2976 2964 1nbnbh.exe 40 PID 2964 wrote to memory of 2976 2964 1nbnbh.exe 40 PID 2964 wrote to memory of 2976 2964 1nbnbh.exe 40 PID 2964 wrote to memory of 2976 2964 1nbnbh.exe 40 PID 2976 wrote to memory of 2004 2976 pjvdj.exe 41 PID 2976 wrote to memory of 2004 2976 pjvdj.exe 41 PID 2976 wrote to memory of 2004 2976 pjvdj.exe 41 PID 2976 wrote to memory of 2004 2976 pjvdj.exe 41 PID 2004 wrote to memory of 1728 2004 xrlrxrx.exe 42 PID 2004 wrote to memory of 1728 2004 xrlrxrx.exe 42 PID 2004 wrote to memory of 1728 2004 xrlrxrx.exe 42 PID 2004 wrote to memory of 1728 2004 xrlrxrx.exe 42 PID 1728 wrote to memory of 1856 1728 jjjjv.exe 43 PID 1728 wrote to memory of 1856 1728 jjjjv.exe 43 PID 1728 wrote to memory of 1856 1728 jjjjv.exe 43 PID 1728 wrote to memory of 1856 1728 jjjjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe"C:\Users\Admin\AppData\Local\Temp\0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvpjd.exec:\dvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nhhthn.exec:\nhhthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vvddd.exec:\vvddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1rllxfr.exec:\1rllxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\3nbhnt.exec:\3nbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fxxflrf.exec:\fxxflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vvvdj.exec:\vvvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\1vdpd.exec:\1vdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\btnntt.exec:\btnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\djpjj.exec:\djpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\xxlfffr.exec:\xxlfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1nbnbh.exec:\1nbnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\pjvdj.exec:\pjvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xrlrxrx.exec:\xrlrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jjjjv.exec:\jjjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe17⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3thbnn.exec:\3thbnn.exe18⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jddjv.exec:\jddjv.exe19⤵
- Executes dropped EXE
PID:540 -
\??\c:\ttnbnn.exec:\ttnbnn.exe20⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnnbnn.exec:\tnnbnn.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7xrxrrl.exec:\7xrxrrl.exe22⤵
- Executes dropped EXE
PID:844 -
\??\c:\3nbbnt.exec:\3nbbnt.exe23⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5jvdj.exec:\5jvdj.exe24⤵
- Executes dropped EXE
PID:2884 -
\??\c:\llffxxr.exec:\llffxxr.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vpvpd.exec:\vpvpd.exe26⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xlxfrrf.exec:\xlxfrrf.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jdvjv.exec:\jdvjv.exe28⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lrlxrfx.exec:\lrlxrfx.exe29⤵
- Executes dropped EXE
PID:964 -
\??\c:\thtbhh.exec:\thtbhh.exe30⤵
- Executes dropped EXE
PID:1512 -
\??\c:\9jjvp.exec:\9jjvp.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\htbttt.exec:\htbttt.exe32⤵
- Executes dropped EXE
PID:356 -
\??\c:\1vvjv.exec:\1vvjv.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lfxfxfl.exec:\lfxfxfl.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hbtbht.exec:\hbtbht.exe35⤵
- Executes dropped EXE
PID:284 -
\??\c:\dvddv.exec:\dvddv.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5vjjv.exec:\5vjjv.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5xlrrxf.exec:\5xlrrxf.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9hnthn.exec:\9hnthn.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3vpdp.exec:\3vpdp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\7fxfflx.exec:\7fxfflx.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\htnntb.exec:\htnntb.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ttbthn.exec:\ttbthn.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vppdj.exec:\vppdj.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fxlflfl.exec:\fxlflfl.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3ntnnb.exec:\3ntnnb.exe46⤵
- Executes dropped EXE
PID:2016 -
\??\c:\1dvpj.exec:\1dvpj.exe47⤵
- Executes dropped EXE
PID:536 -
\??\c:\rlxllll.exec:\rlxllll.exe48⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1hbhtt.exec:\1hbhtt.exe49⤵
- Executes dropped EXE
PID:668 -
\??\c:\9bbhhh.exec:\9bbhhh.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ddvdp.exec:\ddvdp.exe51⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7fllllr.exec:\7fllllr.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5tnbnt.exec:\5tnbnt.exe53⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tnbbbt.exec:\tnbbbt.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdpvp.exec:\jdpvp.exe55⤵
- Executes dropped EXE
PID:1864 -
\??\c:\fxrlfxf.exec:\fxrlfxf.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3xxffrx.exec:\3xxffrx.exe57⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1bhbbb.exec:\1bhbbb.exe58⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5dpdp.exec:\5dpdp.exe59⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rrxxrrf.exec:\rrxxrrf.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbnnbh.exec:\hbnnbh.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpvvd.exec:\vpvvd.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ddvjd.exec:\ddvjd.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe64⤵
- Executes dropped EXE
PID:1004 -
\??\c:\1bthhh.exec:\1bthhh.exe65⤵
- Executes dropped EXE
PID:444 -
\??\c:\9vvvv.exec:\9vvvv.exe66⤵PID:828
-
\??\c:\7jjjp.exec:\7jjjp.exe67⤵PID:1128
-
\??\c:\9rrlfff.exec:\9rrlfff.exe68⤵PID:700
-
\??\c:\3tnbnb.exec:\3tnbnb.exe69⤵PID:1788
-
\??\c:\3jvvp.exec:\3jvvp.exe70⤵PID:1732
-
\??\c:\lrffllr.exec:\lrffllr.exe71⤵PID:784
-
\??\c:\bnbhnn.exec:\bnbhnn.exe72⤵PID:920
-
\??\c:\3htthh.exec:\3htthh.exe73⤵PID:2396
-
\??\c:\pvpvp.exec:\pvpvp.exe74⤵PID:2380
-
\??\c:\xfxxlrx.exec:\xfxxlrx.exe75⤵PID:1464
-
\??\c:\nhthtn.exec:\nhthtn.exe76⤵PID:644
-
\??\c:\vpjvj.exec:\vpjvj.exe77⤵
- System Location Discovery: System Language Discovery
PID:1432 -
\??\c:\rlflllr.exec:\rlflllr.exe78⤵PID:1880
-
\??\c:\nnhnhh.exec:\nnhnhh.exe79⤵PID:2136
-
\??\c:\pdppp.exec:\pdppp.exe80⤵PID:2604
-
\??\c:\pddvp.exec:\pddvp.exe81⤵PID:2600
-
\??\c:\1xxrxrx.exec:\1xxrxrx.exe82⤵PID:3036
-
\??\c:\7thtbh.exec:\7thtbh.exe83⤵PID:2592
-
\??\c:\vdddp.exec:\vdddp.exe84⤵PID:2636
-
\??\c:\5frxffx.exec:\5frxffx.exe85⤵PID:2512
-
\??\c:\rrlflfl.exec:\rrlflfl.exe86⤵PID:2596
-
\??\c:\bthnbh.exec:\bthnbh.exe87⤵PID:2572
-
\??\c:\3vddv.exec:\3vddv.exe88⤵PID:2516
-
\??\c:\rrlrlrl.exec:\rrlrlrl.exe89⤵PID:2996
-
\??\c:\tbbntb.exec:\tbbntb.exe90⤵PID:576
-
\??\c:\hbntbt.exec:\hbntbt.exe91⤵PID:484
-
\??\c:\7jdpv.exec:\7jdpv.exe92⤵PID:1416
-
\??\c:\xlfllrf.exec:\xlfllrf.exe93⤵PID:2796
-
\??\c:\fxxlrll.exec:\fxxlrll.exe94⤵PID:2916
-
\??\c:\hbttbh.exec:\hbttbh.exe95⤵PID:2924
-
\??\c:\pjvjv.exec:\pjvjv.exe96⤵PID:2960
-
\??\c:\rfxrflf.exec:\rfxrflf.exe97⤵PID:1872
-
\??\c:\5nbtnn.exec:\5nbtnn.exe98⤵PID:1540
-
\??\c:\hbbhht.exec:\hbbhht.exe99⤵PID:1840
-
\??\c:\jvjjp.exec:\jvjjp.exe100⤵PID:2444
-
\??\c:\rfrxxfr.exec:\rfrxxfr.exe101⤵PID:2640
-
\??\c:\xxrxffr.exec:\xxrxffr.exe102⤵PID:2760
-
\??\c:\hbttnn.exec:\hbttnn.exe103⤵PID:928
-
\??\c:\ppddd.exec:\ppddd.exe104⤵PID:396
-
\??\c:\llflrxl.exec:\llflrxl.exe105⤵PID:2352
-
\??\c:\xlrllrr.exec:\xlrllrr.exe106⤵PID:696
-
\??\c:\9ntnht.exec:\9ntnht.exe107⤵PID:1720
-
\??\c:\ddpvd.exec:\ddpvd.exe108⤵PID:2120
-
\??\c:\rrffxxl.exec:\rrffxxl.exe109⤵PID:2220
-
\??\c:\xrflfrr.exec:\xrflfrr.exe110⤵PID:3052
-
\??\c:\nnhnbh.exec:\nnhnbh.exe111⤵PID:1480
-
\??\c:\vdvdd.exec:\vdvdd.exe112⤵PID:2280
-
\??\c:\1flffxf.exec:\1flffxf.exe113⤵PID:976
-
\??\c:\tnbbbt.exec:\tnbbbt.exe114⤵PID:1484
-
\??\c:\hthbtn.exec:\hthbtn.exe115⤵PID:1852
-
\??\c:\dvddj.exec:\dvddj.exe116⤵PID:2824
-
\??\c:\3llrrlr.exec:\3llrrlr.exe117⤵PID:1596
-
\??\c:\nhbnht.exec:\nhbnht.exe118⤵PID:1948
-
\??\c:\9ddpv.exec:\9ddpv.exe119⤵PID:1964
-
\??\c:\rfrrrlf.exec:\rfrrrlf.exe120⤵PID:2008
-
\??\c:\1nthtb.exec:\1nthtb.exe121⤵PID:1920
-
\??\c:\9jdjv.exec:\9jdjv.exe122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-