Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe
Resource
win7-20240704-en
General
-
Target
e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe
-
Size
93KB
-
MD5
954e07803cfaa102a921e55038b64877
-
SHA1
d8d7d8266afb45b4e3bab980c2e2faaeebe3215b
-
SHA256
e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f
-
SHA512
1a50e3a7e807252b074bf711ab6b731ce6584335953c96e89c85a4a651a001187b8509941f2f3f7f1188317d8937e75a2691b5c6b48ae05a7ee0605fabc1e0cf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIRwnohZkqwKYSpFxL:ymb3NkkiQ3mdBjFo7LAIRUohDwKY+xL
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1316-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 5rlfrlx.exe 3972 nhnhhb.exe 3204 jdjdv.exe 2428 vppjv.exe 2152 llfxfxr.exe 1004 hhhbnh.exe 4548 htnbnh.exe 1980 1jjvp.exe 2068 rlfrfrf.exe 4244 fxlfxfx.exe 4340 ththnh.exe 1268 dpvpp.exe 3764 xxffrlx.exe 2160 xlrlfrl.exe 4900 bnbtnn.exe 1196 pdvpp.exe 2312 lfxrfxl.exe 4556 frrlfrf.exe 3648 ttnhnn.exe 2484 jjjdv.exe 2280 9lfxllx.exe 1928 lxrfrlf.exe 3496 nbthbn.exe 1100 vjdvj.exe 1564 pdvjv.exe 4528 rfxlrlx.exe 4604 9pvpd.exe 944 vvpdp.exe 3152 rlxlllr.exe 3476 nttnbt.exe 668 hnnbnn.exe 3056 pvpjp.exe 2904 jdvpv.exe 2736 ffflxrf.exe 5048 htnhhb.exe 2140 nhnhnn.exe 4928 djjjv.exe 3380 jjpdp.exe 3472 rlrfrrr.exe 2560 bhtnhb.exe 3204 jjjpv.exe 1492 rxrfrrr.exe 2400 lrrfxrl.exe 1040 hbbbhb.exe 2664 jjdpj.exe 4624 jvvpd.exe 3584 7xlrfxx.exe 1424 rxrrffx.exe 2392 nhbbhn.exe 4244 jvpdp.exe 1576 3vvjj.exe 4192 pdpvd.exe 1932 3xfxlll.exe 3764 1tbtbt.exe 4064 9hhthb.exe 3356 jppdp.exe 4900 9ppdj.exe 440 xrxfflf.exe 2232 xrlfxrl.exe 1484 nnbttt.exe 2024 btbthb.exe 2552 bnhbnh.exe 4208 5vvpd.exe 976 fxlfrlf.exe -
resource yara_rule behavioral2/memory/1316-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 2276 1316 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 84 PID 1316 wrote to memory of 2276 1316 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 84 PID 1316 wrote to memory of 2276 1316 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 84 PID 2276 wrote to memory of 3972 2276 5rlfrlx.exe 85 PID 2276 wrote to memory of 3972 2276 5rlfrlx.exe 85 PID 2276 wrote to memory of 3972 2276 5rlfrlx.exe 85 PID 3972 wrote to memory of 3204 3972 nhnhhb.exe 86 PID 3972 wrote to memory of 3204 3972 nhnhhb.exe 86 PID 3972 wrote to memory of 3204 3972 nhnhhb.exe 86 PID 3204 wrote to memory of 2428 3204 jdjdv.exe 87 PID 3204 wrote to memory of 2428 3204 jdjdv.exe 87 PID 3204 wrote to memory of 2428 3204 jdjdv.exe 87 PID 2428 wrote to memory of 2152 2428 vppjv.exe 88 PID 2428 wrote to memory of 2152 2428 vppjv.exe 88 PID 2428 wrote to memory of 2152 2428 vppjv.exe 88 PID 2152 wrote to memory of 1004 2152 llfxfxr.exe 89 PID 2152 wrote to memory of 1004 2152 llfxfxr.exe 89 PID 2152 wrote to memory of 1004 2152 llfxfxr.exe 89 PID 1004 wrote to memory of 4548 1004 hhhbnh.exe 90 PID 1004 wrote to memory of 4548 1004 hhhbnh.exe 90 PID 1004 wrote to memory of 4548 1004 hhhbnh.exe 90 PID 4548 wrote to memory of 1980 4548 htnbnh.exe 91 PID 4548 wrote to memory of 1980 4548 htnbnh.exe 91 PID 4548 wrote to memory of 1980 4548 htnbnh.exe 91 PID 1980 wrote to memory of 2068 1980 1jjvp.exe 92 PID 1980 wrote to memory of 2068 1980 1jjvp.exe 92 PID 1980 wrote to memory of 2068 1980 1jjvp.exe 92 PID 2068 wrote to memory of 4244 2068 rlfrfrf.exe 93 PID 2068 wrote to memory of 4244 2068 rlfrfrf.exe 93 PID 2068 wrote to memory of 4244 2068 rlfrfrf.exe 93 PID 4244 wrote to memory of 4340 4244 fxlfxfx.exe 94 PID 4244 wrote to memory of 4340 4244 fxlfxfx.exe 94 PID 4244 wrote to memory of 4340 4244 fxlfxfx.exe 94 PID 4340 wrote to memory of 1268 4340 ththnh.exe 95 PID 4340 wrote to memory of 1268 4340 ththnh.exe 95 PID 4340 wrote to memory of 1268 4340 ththnh.exe 95 PID 1268 wrote to memory of 3764 1268 dpvpp.exe 96 PID 1268 wrote to memory of 3764 1268 dpvpp.exe 96 PID 1268 wrote to memory of 3764 1268 dpvpp.exe 96 PID 3764 wrote to memory of 2160 3764 xxffrlx.exe 97 PID 3764 wrote to memory of 2160 3764 xxffrlx.exe 97 PID 3764 wrote to memory of 2160 3764 xxffrlx.exe 97 PID 2160 wrote to memory of 4900 2160 xlrlfrl.exe 98 PID 2160 wrote to memory of 4900 2160 xlrlfrl.exe 98 PID 2160 wrote to memory of 4900 2160 xlrlfrl.exe 98 PID 4900 wrote to memory of 1196 4900 bnbtnn.exe 100 PID 4900 wrote to memory of 1196 4900 bnbtnn.exe 100 PID 4900 wrote to memory of 1196 4900 bnbtnn.exe 100 PID 1196 wrote to memory of 2312 1196 pdvpp.exe 101 PID 1196 wrote to memory of 2312 1196 pdvpp.exe 101 PID 1196 wrote to memory of 2312 1196 pdvpp.exe 101 PID 2312 wrote to memory of 4556 2312 lfxrfxl.exe 102 PID 2312 wrote to memory of 4556 2312 lfxrfxl.exe 102 PID 2312 wrote to memory of 4556 2312 lfxrfxl.exe 102 PID 4556 wrote to memory of 3648 4556 frrlfrf.exe 104 PID 4556 wrote to memory of 3648 4556 frrlfrf.exe 104 PID 4556 wrote to memory of 3648 4556 frrlfrf.exe 104 PID 3648 wrote to memory of 2484 3648 ttnhnn.exe 105 PID 3648 wrote to memory of 2484 3648 ttnhnn.exe 105 PID 3648 wrote to memory of 2484 3648 ttnhnn.exe 105 PID 2484 wrote to memory of 2280 2484 jjjdv.exe 106 PID 2484 wrote to memory of 2280 2484 jjjdv.exe 106 PID 2484 wrote to memory of 2280 2484 jjjdv.exe 106 PID 2280 wrote to memory of 1928 2280 9lfxllx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe"C:\Users\Admin\AppData\Local\Temp\e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\5rlfrlx.exec:\5rlfrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\nhnhhb.exec:\nhnhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jdjdv.exec:\jdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\vppjv.exec:\vppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\llfxfxr.exec:\llfxfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hhhbnh.exec:\hhhbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\htnbnh.exec:\htnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\1jjvp.exec:\1jjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\ththnh.exec:\ththnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\dpvpp.exec:\dpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\xxffrlx.exec:\xxffrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\xlrlfrl.exec:\xlrlfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\bnbtnn.exec:\bnbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\pdvpp.exec:\pdvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\frrlfrf.exec:\frrlfrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\ttnhnn.exec:\ttnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\jjjdv.exec:\jjjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9lfxllx.exec:\9lfxllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nbthbn.exec:\nbthbn.exe24⤵
- Executes dropped EXE
PID:3496 -
\??\c:\vjdvj.exec:\vjdvj.exe25⤵
- Executes dropped EXE
PID:1100 -
\??\c:\pdvjv.exec:\pdvjv.exe26⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rfxlrlx.exec:\rfxlrlx.exe27⤵
- Executes dropped EXE
PID:4528 -
\??\c:\9pvpd.exec:\9pvpd.exe28⤵
- Executes dropped EXE
PID:4604 -
\??\c:\vvpdp.exec:\vvpdp.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\rlxlllr.exec:\rlxlllr.exe30⤵
- Executes dropped EXE
PID:3152 -
\??\c:\nttnbt.exec:\nttnbt.exe31⤵
- Executes dropped EXE
PID:3476 -
\??\c:\hnnbnn.exec:\hnnbnn.exe32⤵
- Executes dropped EXE
PID:668 -
\??\c:\pvpjp.exec:\pvpjp.exe33⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jdvpv.exec:\jdvpv.exe34⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ffflxrf.exec:\ffflxrf.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\htnhhb.exec:\htnhhb.exe36⤵
- Executes dropped EXE
PID:5048 -
\??\c:\nhnhnn.exec:\nhnhnn.exe37⤵
- Executes dropped EXE
PID:2140 -
\??\c:\djjjv.exec:\djjjv.exe38⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jjpdp.exec:\jjpdp.exe39⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rlrfrrr.exec:\rlrfrrr.exe40⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bhtnhb.exec:\bhtnhb.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jjjpv.exec:\jjjpv.exe42⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rxrfrrr.exec:\rxrfrrr.exe43⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\hbbbhb.exec:\hbbbhb.exe45⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jjdpj.exec:\jjdpj.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jvvpd.exec:\jvvpd.exe47⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7xlrfxx.exec:\7xlrfxx.exe48⤵
- Executes dropped EXE
PID:3584 -
\??\c:\rxrrffx.exec:\rxrrffx.exe49⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nhbbhn.exec:\nhbbhn.exe50⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jvpdp.exec:\jvpdp.exe51⤵
- Executes dropped EXE
PID:4244 -
\??\c:\3vvjj.exec:\3vvjj.exe52⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pdpvd.exec:\pdpvd.exe53⤵
- Executes dropped EXE
PID:4192 -
\??\c:\3xfxlll.exec:\3xfxlll.exe54⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1tbtbt.exec:\1tbtbt.exe55⤵
- Executes dropped EXE
PID:3764 -
\??\c:\9hhthb.exec:\9hhthb.exe56⤵
- Executes dropped EXE
PID:4064 -
\??\c:\jppdp.exec:\jppdp.exe57⤵
- Executes dropped EXE
PID:3356 -
\??\c:\9ppdj.exec:\9ppdj.exe58⤵
- Executes dropped EXE
PID:4900 -
\??\c:\xrxfflf.exec:\xrxfflf.exe59⤵
- Executes dropped EXE
PID:440 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe60⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nnbttt.exec:\nnbttt.exe61⤵
- Executes dropped EXE
PID:1484 -
\??\c:\btbthb.exec:\btbthb.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bnhbnh.exec:\bnhbnh.exe63⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5vvpd.exec:\5vvpd.exe64⤵
- Executes dropped EXE
PID:4208 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:976 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe66⤵PID:4912
-
\??\c:\btnbtn.exec:\btnbtn.exe67⤵PID:3644
-
\??\c:\5tntnt.exec:\5tntnt.exe68⤵PID:1908
-
\??\c:\jdpdp.exec:\jdpdp.exe69⤵
- System Location Discovery: System Language Discovery
PID:3752 -
\??\c:\dpjvd.exec:\dpjvd.exe70⤵PID:3960
-
\??\c:\xffrfxr.exec:\xffrfxr.exe71⤵PID:3212
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe72⤵PID:4360
-
\??\c:\btbthb.exec:\btbthb.exe73⤵PID:2884
-
\??\c:\tntthh.exec:\tntthh.exe74⤵PID:3504
-
\??\c:\3pjdp.exec:\3pjdp.exe75⤵PID:4920
-
\??\c:\pdjvd.exec:\pdjvd.exe76⤵PID:1108
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe77⤵PID:3012
-
\??\c:\htnhtn.exec:\htnhtn.exe78⤵PID:3736
-
\??\c:\tththb.exec:\tththb.exe79⤵PID:3876
-
\??\c:\ddvvv.exec:\ddvvv.exe80⤵PID:2564
-
\??\c:\vjdpv.exec:\vjdpv.exe81⤵PID:1372
-
\??\c:\llllxxx.exec:\llllxxx.exe82⤵PID:4348
-
\??\c:\tttnnn.exec:\tttnnn.exe83⤵PID:3396
-
\??\c:\tnthhh.exec:\tnthhh.exe84⤵PID:4384
-
\??\c:\jdvvp.exec:\jdvvp.exe85⤵PID:2140
-
\??\c:\ffxxlfr.exec:\ffxxlfr.exe86⤵PID:2276
-
\??\c:\fxrrlll.exec:\fxrrlll.exe87⤵PID:3972
-
\??\c:\jpdpd.exec:\jpdpd.exe88⤵PID:764
-
\??\c:\jvvpj.exec:\jvvpj.exe89⤵PID:4708
-
\??\c:\vjvdp.exec:\vjvdp.exe90⤵PID:3204
-
\??\c:\fllflfx.exec:\fllflfx.exe91⤵PID:1492
-
\??\c:\fllfxrl.exec:\fllfxrl.exe92⤵PID:4584
-
\??\c:\nttnhb.exec:\nttnhb.exe93⤵PID:2496
-
\??\c:\tttnht.exec:\tttnht.exe94⤵PID:2336
-
\??\c:\vpdpd.exec:\vpdpd.exe95⤵PID:3708
-
\??\c:\pddvp.exec:\pddvp.exe96⤵PID:1012
-
\??\c:\lfxrffx.exec:\lfxrffx.exe97⤵PID:348
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe98⤵PID:3384
-
\??\c:\flfrlfr.exec:\flfrlfr.exe99⤵PID:4472
-
\??\c:\1hnnbt.exec:\1hnnbt.exe100⤵PID:1512
-
\??\c:\hnnnth.exec:\hnnnth.exe101⤵PID:4312
-
\??\c:\ppjpj.exec:\ppjpj.exe102⤵PID:2920
-
\??\c:\jddvd.exec:\jddvd.exe103⤵PID:4560
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe104⤵PID:3228
-
\??\c:\ntbtnt.exec:\ntbtnt.exe105⤵PID:4516
-
\??\c:\9tthtn.exec:\9tthtn.exe106⤵PID:4424
-
\??\c:\vvddv.exec:\vvddv.exe107⤵PID:4628
-
\??\c:\9jjvj.exec:\9jjvj.exe108⤵PID:4872
-
\??\c:\flrflfx.exec:\flrflfx.exe109⤵PID:2340
-
\??\c:\xrfxrll.exec:\xrfxrll.exe110⤵PID:2832
-
\??\c:\bnttnn.exec:\bnttnn.exe111⤵PID:1504
-
\??\c:\5hnbnn.exec:\5hnbnn.exe112⤵PID:4272
-
\??\c:\pddpd.exec:\pddpd.exe113⤵PID:628
-
\??\c:\9rlxfxr.exec:\9rlxfxr.exe114⤵PID:4904
-
\??\c:\frxlxrf.exec:\frxlxrf.exe115⤵PID:2952
-
\??\c:\nhthbh.exec:\nhthbh.exe116⤵PID:1444
-
\??\c:\9tthnn.exec:\9tthnn.exe117⤵PID:3216
-
\??\c:\dvjdv.exec:\dvjdv.exe118⤵PID:1516
-
\??\c:\9lxlrlx.exec:\9lxlrlx.exe119⤵PID:2820
-
\??\c:\lfxrrlx.exec:\lfxrrlx.exe120⤵PID:4528
-
\??\c:\hnbhbh.exec:\hnbhbh.exe121⤵PID:2388
-
\??\c:\hbbtnh.exec:\hbbtnh.exe122⤵PID:1296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-