Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 01:50
Static task
static1
Behavioral task
behavioral1
Sample
a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe
Resource
win7-20240708-en
General
-
Target
a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe
-
Size
371KB
-
MD5
a4c4de95a1866f36fc52d17e342a3348
-
SHA1
fc4764d039be85124990823c6bbe7a4a7453a867
-
SHA256
a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91
-
SHA512
11f658d90a44e1dbdb3389efbd0f06401a3f53f968680b2eab0671ad95a92f6d5670629987c56b57b145d83f420028adae44404eb75a35200d09dc6a4cd45e35
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVw8:n3C9uYA7okVqdKwaO5CV5
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1840-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3492 btnnhh.exe 2248 vjdvp.exe 1220 jjvpv.exe 1268 pjdjp.exe 1488 nhbtnh.exe 4156 jdpjj.exe 1520 nnbtth.exe 4984 pvpdv.exe 64 bnnhtn.exe 1312 dpjdj.exe 4512 tbnnth.exe 2512 tttnht.exe 2932 vddpd.exe 4712 htbtnh.exe 4532 vvjdv.exe 3032 flfrfxl.exe 2560 thhthh.exe 3372 vdpdv.exe 4628 xxxrfxl.exe 3116 bbbthn.exe 2612 dddvp.exe 3016 fxllrff.exe 3872 vpjjd.exe 5024 1rlfxxl.exe 3420 hnnbht.exe 1936 rrfffff.exe 388 lfllrlr.exe 2732 tbhbbb.exe 2096 djpjj.exe 4492 llxrllx.exe 1044 nhbbtt.exe 1368 rffxxrr.exe 1192 lrllrfr.exe 3704 hbnttn.exe 2436 bbhbbt.exe 4296 9vjdj.exe 336 rxfxllf.exe 3660 tnnbnn.exe 1280 htbtnt.exe 2468 vvjdj.exe 3248 dvvpj.exe 4116 rxlxfxr.exe 4456 5tbtth.exe 1268 dpvjd.exe 1632 vvvvv.exe 5060 frrlllf.exe 100 rflfrrf.exe 2936 hthhbb.exe 4616 jpdpj.exe 2596 tnhbbb.exe 3976 tttnbb.exe 4372 7pppj.exe 4432 xrrlllf.exe 4160 lxflffx.exe 3652 bthtbt.exe 1048 ppjvp.exe 2276 xrlfrll.exe 1524 frlfxxx.exe 220 bbtbnn.exe 2624 jdpdv.exe 4776 dvpdp.exe 3956 7lfxflx.exe 3448 bhnnhb.exe 392 httnhh.exe -
resource yara_rule behavioral2/memory/1840-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 3492 1840 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 84 PID 1840 wrote to memory of 3492 1840 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 84 PID 1840 wrote to memory of 3492 1840 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 84 PID 3492 wrote to memory of 2248 3492 btnnhh.exe 85 PID 3492 wrote to memory of 2248 3492 btnnhh.exe 85 PID 3492 wrote to memory of 2248 3492 btnnhh.exe 85 PID 2248 wrote to memory of 1220 2248 vjdvp.exe 86 PID 2248 wrote to memory of 1220 2248 vjdvp.exe 86 PID 2248 wrote to memory of 1220 2248 vjdvp.exe 86 PID 1220 wrote to memory of 1268 1220 jjvpv.exe 87 PID 1220 wrote to memory of 1268 1220 jjvpv.exe 87 PID 1220 wrote to memory of 1268 1220 jjvpv.exe 87 PID 1268 wrote to memory of 1488 1268 pjdjp.exe 88 PID 1268 wrote to memory of 1488 1268 pjdjp.exe 88 PID 1268 wrote to memory of 1488 1268 pjdjp.exe 88 PID 1488 wrote to memory of 4156 1488 nhbtnh.exe 89 PID 1488 wrote to memory of 4156 1488 nhbtnh.exe 89 PID 1488 wrote to memory of 4156 1488 nhbtnh.exe 89 PID 4156 wrote to memory of 1520 4156 jdpjj.exe 91 PID 4156 wrote to memory of 1520 4156 jdpjj.exe 91 PID 4156 wrote to memory of 1520 4156 jdpjj.exe 91 PID 1520 wrote to memory of 4984 1520 nnbtth.exe 92 PID 1520 wrote to memory of 4984 1520 nnbtth.exe 92 PID 1520 wrote to memory of 4984 1520 nnbtth.exe 92 PID 4984 wrote to memory of 64 4984 pvpdv.exe 93 PID 4984 wrote to memory of 64 4984 pvpdv.exe 93 PID 4984 wrote to memory of 64 4984 pvpdv.exe 93 PID 64 wrote to memory of 1312 64 bnnhtn.exe 95 PID 64 wrote to memory of 1312 64 bnnhtn.exe 95 PID 64 wrote to memory of 1312 64 bnnhtn.exe 95 PID 1312 wrote to memory of 4512 1312 dpjdj.exe 96 PID 1312 wrote to memory of 4512 1312 dpjdj.exe 96 PID 1312 wrote to memory of 4512 1312 dpjdj.exe 96 PID 4512 wrote to memory of 2512 4512 tbnnth.exe 97 PID 4512 wrote to memory of 2512 4512 tbnnth.exe 97 PID 4512 wrote to memory of 2512 4512 tbnnth.exe 97 PID 2512 wrote to memory of 2932 2512 tttnht.exe 98 PID 2512 wrote to memory of 2932 2512 tttnht.exe 98 PID 2512 wrote to memory of 2932 2512 tttnht.exe 98 PID 2932 wrote to memory of 4712 2932 vddpd.exe 99 PID 2932 wrote to memory of 4712 2932 vddpd.exe 99 PID 2932 wrote to memory of 4712 2932 vddpd.exe 99 PID 4712 wrote to memory of 4532 4712 htbtnh.exe 100 PID 4712 wrote to memory of 4532 4712 htbtnh.exe 100 PID 4712 wrote to memory of 4532 4712 htbtnh.exe 100 PID 4532 wrote to memory of 3032 4532 vvjdv.exe 101 PID 4532 wrote to memory of 3032 4532 vvjdv.exe 101 PID 4532 wrote to memory of 3032 4532 vvjdv.exe 101 PID 3032 wrote to memory of 2560 3032 flfrfxl.exe 103 PID 3032 wrote to memory of 2560 3032 flfrfxl.exe 103 PID 3032 wrote to memory of 2560 3032 flfrfxl.exe 103 PID 2560 wrote to memory of 3372 2560 thhthh.exe 104 PID 2560 wrote to memory of 3372 2560 thhthh.exe 104 PID 2560 wrote to memory of 3372 2560 thhthh.exe 104 PID 3372 wrote to memory of 4628 3372 vdpdv.exe 105 PID 3372 wrote to memory of 4628 3372 vdpdv.exe 105 PID 3372 wrote to memory of 4628 3372 vdpdv.exe 105 PID 4628 wrote to memory of 3116 4628 xxxrfxl.exe 106 PID 4628 wrote to memory of 3116 4628 xxxrfxl.exe 106 PID 4628 wrote to memory of 3116 4628 xxxrfxl.exe 106 PID 3116 wrote to memory of 2612 3116 bbbthn.exe 107 PID 3116 wrote to memory of 2612 3116 bbbthn.exe 107 PID 3116 wrote to memory of 2612 3116 bbbthn.exe 107 PID 2612 wrote to memory of 3016 2612 dddvp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe"C:\Users\Admin\AppData\Local\Temp\a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\btnnhh.exec:\btnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\vjdvp.exec:\vjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\jjvpv.exec:\jjvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\pjdjp.exec:\pjdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nhbtnh.exec:\nhbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jdpjj.exec:\jdpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\nnbtth.exec:\nnbtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\pvpdv.exec:\pvpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\bnnhtn.exec:\bnnhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\dpjdj.exec:\dpjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\tbnnth.exec:\tbnnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\tttnht.exec:\tttnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vddpd.exec:\vddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\htbtnh.exec:\htbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\vvjdv.exec:\vvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\flfrfxl.exec:\flfrfxl.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\thhthh.exec:\thhthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\vdpdv.exec:\vdpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\xxxrfxl.exec:\xxxrfxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\bbbthn.exec:\bbbthn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\dddvp.exec:\dddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fxllrff.exec:\fxllrff.exe23⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vpjjd.exec:\vpjjd.exe24⤵
- Executes dropped EXE
PID:3872 -
\??\c:\1rlfxxl.exec:\1rlfxxl.exe25⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hnnbht.exec:\hnnbht.exe26⤵
- Executes dropped EXE
PID:3420 -
\??\c:\rrfffff.exec:\rrfffff.exe27⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lfllrlr.exec:\lfllrlr.exe28⤵
- Executes dropped EXE
PID:388 -
\??\c:\tbhbbb.exec:\tbhbbb.exe29⤵
- Executes dropped EXE
PID:2732 -
\??\c:\djpjj.exec:\djpjj.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\llxrllx.exec:\llxrllx.exe31⤵
- Executes dropped EXE
PID:4492 -
\??\c:\nhbbtt.exec:\nhbbtt.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rffxxrr.exec:\rffxxrr.exe33⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lrllrfr.exec:\lrllrfr.exe34⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hbnttn.exec:\hbnttn.exe35⤵
- Executes dropped EXE
PID:3704 -
\??\c:\bbhbbt.exec:\bbhbbt.exe36⤵
- Executes dropped EXE
PID:2436 -
\??\c:\9vjdj.exec:\9vjdj.exe37⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rxfxllf.exec:\rxfxllf.exe38⤵
- Executes dropped EXE
PID:336 -
\??\c:\tnnbnn.exec:\tnnbnn.exe39⤵
- Executes dropped EXE
PID:3660 -
\??\c:\htbtnt.exec:\htbtnt.exe40⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vvjdj.exec:\vvjdj.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dvvpj.exec:\dvvpj.exe42⤵
- Executes dropped EXE
PID:3248 -
\??\c:\rxlxfxr.exec:\rxlxfxr.exe43⤵
- Executes dropped EXE
PID:4116 -
\??\c:\5tbtth.exec:\5tbtth.exe44⤵
- Executes dropped EXE
PID:4456 -
\??\c:\dpvjd.exec:\dpvjd.exe45⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vvvvv.exec:\vvvvv.exe46⤵
- Executes dropped EXE
PID:1632 -
\??\c:\frrlllf.exec:\frrlllf.exe47⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rflfrrf.exec:\rflfrrf.exe48⤵
- Executes dropped EXE
PID:100 -
\??\c:\hthhbb.exec:\hthhbb.exe49⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jpdpj.exec:\jpdpj.exe50⤵
- Executes dropped EXE
PID:4616 -
\??\c:\tnhbbb.exec:\tnhbbb.exe51⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tttnbb.exec:\tttnbb.exe52⤵
- Executes dropped EXE
PID:3976 -
\??\c:\7pppj.exec:\7pppj.exe53⤵
- Executes dropped EXE
PID:4372 -
\??\c:\xrrlllf.exec:\xrrlllf.exe54⤵
- Executes dropped EXE
PID:4432 -
\??\c:\lxflffx.exec:\lxflffx.exe55⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bthtbt.exec:\bthtbt.exe56⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ppjvp.exec:\ppjvp.exe57⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xrlfrll.exec:\xrlfrll.exe58⤵
- Executes dropped EXE
PID:2276 -
\??\c:\frlfxxx.exec:\frlfxxx.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bbtbnn.exec:\bbtbnn.exe60⤵
- Executes dropped EXE
PID:220 -
\??\c:\jdpdv.exec:\jdpdv.exe61⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dvpdp.exec:\dvpdp.exe62⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7lfxflx.exec:\7lfxflx.exe63⤵
- Executes dropped EXE
PID:3956 -
\??\c:\bhnnhb.exec:\bhnnhb.exe64⤵
- Executes dropped EXE
PID:3448 -
\??\c:\httnhh.exec:\httnhh.exe65⤵
- Executes dropped EXE
PID:392 -
\??\c:\3jjvj.exec:\3jjvj.exe66⤵PID:2088
-
\??\c:\fflxrrf.exec:\fflxrrf.exe67⤵PID:2224
-
\??\c:\rfffxrl.exec:\rfffxrl.exe68⤵PID:3376
-
\??\c:\btnhtn.exec:\btnhtn.exe69⤵PID:4180
-
\??\c:\jdvjd.exec:\jdvjd.exe70⤵PID:3800
-
\??\c:\pjjvv.exec:\pjjvv.exe71⤵PID:4908
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe72⤵PID:1440
-
\??\c:\3bbtbb.exec:\3bbtbb.exe73⤵PID:1652
-
\??\c:\nhbthb.exec:\nhbthb.exe74⤵PID:996
-
\??\c:\jjvjv.exec:\jjvjv.exe75⤵PID:2172
-
\??\c:\xffrlfx.exec:\xffrlfx.exe76⤵PID:4472
-
\??\c:\lrrffxx.exec:\lrrffxx.exe77⤵PID:3876
-
\??\c:\bnhtnb.exec:\bnhtnb.exe78⤵PID:3400
-
\??\c:\1jpdv.exec:\1jpdv.exe79⤵PID:768
-
\??\c:\vvpjj.exec:\vvpjj.exe80⤵PID:3556
-
\??\c:\5xrlrrr.exec:\5xrlrrr.exe81⤵PID:4720
-
\??\c:\nhbtbb.exec:\nhbtbb.exe82⤵PID:3228
-
\??\c:\btbbtt.exec:\btbbtt.exe83⤵PID:2728
-
\??\c:\pjdpv.exec:\pjdpv.exe84⤵PID:524
-
\??\c:\xlxfxxr.exec:\xlxfxxr.exe85⤵PID:2436
-
\??\c:\1llxrrl.exec:\1llxrrl.exe86⤵PID:4332
-
\??\c:\tbhtnh.exec:\tbhtnh.exe87⤵PID:936
-
\??\c:\vdvpj.exec:\vdvpj.exe88⤵PID:3492
-
\??\c:\7xflfxr.exec:\7xflfxr.exe89⤵PID:2068
-
\??\c:\hbtnbb.exec:\hbtnbb.exe90⤵PID:2576
-
\??\c:\hhnthb.exec:\hhnthb.exe91⤵PID:4232
-
\??\c:\fffxlfx.exec:\fffxlfx.exe92⤵PID:3832
-
\??\c:\bnnttt.exec:\bnnttt.exe93⤵PID:3292
-
\??\c:\ppdvp.exec:\ppdvp.exe94⤵PID:4156
-
\??\c:\xrrlfff.exec:\xrrlfff.exe95⤵PID:4924
-
\??\c:\hhbtbn.exec:\hhbtbn.exe96⤵PID:4888
-
\??\c:\3bnbtn.exec:\3bnbtn.exe97⤵PID:536
-
\??\c:\pdpjd.exec:\pdpjd.exe98⤵PID:3544
-
\??\c:\lflrlff.exec:\lflrlff.exe99⤵PID:4020
-
\??\c:\7lrlffx.exec:\7lrlffx.exe100⤵PID:1796
-
\??\c:\tbbtnh.exec:\tbbtnh.exe101⤵PID:3656
-
\??\c:\vvpdj.exec:\vvpdj.exe102⤵PID:2932
-
\??\c:\vpdvp.exec:\vpdvp.exe103⤵PID:1036
-
\??\c:\lflffff.exec:\lflffff.exe104⤵PID:2276
-
\??\c:\hbtnbb.exec:\hbtnbb.exe105⤵PID:4948
-
\??\c:\ttthbt.exec:\ttthbt.exe106⤵PID:1928
-
\??\c:\vjvpj.exec:\vjvpj.exe107⤵PID:1284
-
\??\c:\rrfxffx.exec:\rrfxffx.exe108⤵PID:4776
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe109⤵PID:3340
-
\??\c:\hbtnhh.exec:\hbtnhh.exe110⤵PID:1836
-
\??\c:\bthbtt.exec:\bthbtt.exe111⤵PID:4540
-
\??\c:\ddddv.exec:\ddddv.exe112⤵PID:4328
-
\??\c:\9rfxrrl.exec:\9rfxrrl.exe113⤵PID:4404
-
\??\c:\thhtnh.exec:\thhtnh.exe114⤵PID:3144
-
\??\c:\1nbtnh.exec:\1nbtnh.exe115⤵PID:1556
-
\??\c:\jdpjp.exec:\jdpjp.exe116⤵PID:3040
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe117⤵PID:4704
-
\??\c:\xxlrrxl.exec:\xxlrrxl.exe118⤵PID:3740
-
\??\c:\nnhbbt.exec:\nnhbbt.exe119⤵PID:2836
-
\??\c:\pjpdj.exec:\pjpdj.exe120⤵PID:2312
-
\??\c:\pjddv.exec:\pjddv.exe121⤵PID:5012
-
\??\c:\rllrflf.exec:\rllrflf.exe122⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-