Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe
Resource
win7-20240708-en
General
-
Target
a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe
-
Size
69KB
-
MD5
3e88103cdf4469b3fa09048c08308c3c
-
SHA1
bad18ebcf2fe06408593aac905cfa9a6b9c85166
-
SHA256
a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72
-
SHA512
3f1e0db1b9d9b7e4202ee3940169abf760d45e7b5f0d1a1021c8d6a4b9133f9b40860d95b63205707d3d0d1e875632ede52cd7dbb62a2121530a141864e7655e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdv:ymb3NkkiQ3mdBjF0yMliv
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4244-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/592-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3604 5lxrllf.exe 4800 nnthbt.exe 1736 pjdvp.exe 5064 1ntnhh.exe 2128 7nnnhh.exe 1588 pjjdp.exe 116 pjpjv.exe 2124 tttttb.exe 2940 5thbtt.exe 4780 7jdvv.exe 640 lflfffx.exe 3988 7thhbb.exe 4004 7pvvp.exe 3868 pjdvp.exe 1632 fxllffr.exe 592 bttnhn.exe 4660 nttnhh.exe 3516 vpjvp.exe 2240 rrlfrlf.exe 1328 nnthbn.exe 4940 3tbtbb.exe 4612 jpvvv.exe 1964 7rrlfff.exe 1224 hhttbb.exe 5112 bntnnt.exe 2172 vjddv.exe 4992 frxxffl.exe 3088 lffxrrl.exe 3360 btnhnn.exe 4516 vpppj.exe 3920 vvddv.exe 4340 lfxfrxf.exe 4240 1lrrxxx.exe 4308 tbnttt.exe 628 7nbtnb.exe 2932 1pddd.exe 2736 rxlrllr.exe 1640 xlffffx.exe 5008 9ntnhh.exe 3560 7hnhbb.exe 3132 1jpjj.exe 4420 jpddd.exe 4012 xlllfxx.exe 2568 xxxrrrr.exe 3536 3nhhbb.exe 1944 1bbnnb.exe 4912 vpjdv.exe 4540 dvvpv.exe 640 5rrlxrr.exe 3912 9rfxffl.exe 4580 btbhbb.exe 4004 7bhbbh.exe 4584 djppd.exe 456 jpdpp.exe 4400 5rxfrrl.exe 4596 llxxffr.exe 2844 hhbbtt.exe 2148 7btnhh.exe 1532 5pvpp.exe 3208 pdvpp.exe 5080 xrfxrrl.exe 3876 9rlflrl.exe 2500 5nbbth.exe 4772 nhnhbb.exe -
resource yara_rule behavioral2/memory/4244-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/592-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 3604 4244 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 84 PID 4244 wrote to memory of 3604 4244 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 84 PID 4244 wrote to memory of 3604 4244 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 84 PID 3604 wrote to memory of 4800 3604 5lxrllf.exe 85 PID 3604 wrote to memory of 4800 3604 5lxrllf.exe 85 PID 3604 wrote to memory of 4800 3604 5lxrllf.exe 85 PID 4800 wrote to memory of 1736 4800 nnthbt.exe 86 PID 4800 wrote to memory of 1736 4800 nnthbt.exe 86 PID 4800 wrote to memory of 1736 4800 nnthbt.exe 86 PID 1736 wrote to memory of 5064 1736 pjdvp.exe 87 PID 1736 wrote to memory of 5064 1736 pjdvp.exe 87 PID 1736 wrote to memory of 5064 1736 pjdvp.exe 87 PID 5064 wrote to memory of 2128 5064 1ntnhh.exe 88 PID 5064 wrote to memory of 2128 5064 1ntnhh.exe 88 PID 5064 wrote to memory of 2128 5064 1ntnhh.exe 88 PID 2128 wrote to memory of 1588 2128 7nnnhh.exe 89 PID 2128 wrote to memory of 1588 2128 7nnnhh.exe 89 PID 2128 wrote to memory of 1588 2128 7nnnhh.exe 89 PID 1588 wrote to memory of 116 1588 pjjdp.exe 90 PID 1588 wrote to memory of 116 1588 pjjdp.exe 90 PID 1588 wrote to memory of 116 1588 pjjdp.exe 90 PID 116 wrote to memory of 2124 116 pjpjv.exe 92 PID 116 wrote to memory of 2124 116 pjpjv.exe 92 PID 116 wrote to memory of 2124 116 pjpjv.exe 92 PID 2124 wrote to memory of 2940 2124 tttttb.exe 93 PID 2124 wrote to memory of 2940 2124 tttttb.exe 93 PID 2124 wrote to memory of 2940 2124 tttttb.exe 93 PID 2940 wrote to memory of 4780 2940 5thbtt.exe 94 PID 2940 wrote to memory of 4780 2940 5thbtt.exe 94 PID 2940 wrote to memory of 4780 2940 5thbtt.exe 94 PID 4780 wrote to memory of 640 4780 7jdvv.exe 95 PID 4780 wrote to memory of 640 4780 7jdvv.exe 95 PID 4780 wrote to memory of 640 4780 7jdvv.exe 95 PID 640 wrote to memory of 3988 640 lflfffx.exe 96 PID 640 wrote to memory of 3988 640 lflfffx.exe 96 PID 640 wrote to memory of 3988 640 lflfffx.exe 96 PID 3988 wrote to memory of 4004 3988 7thhbb.exe 97 PID 3988 wrote to memory of 4004 3988 7thhbb.exe 97 PID 3988 wrote to memory of 4004 3988 7thhbb.exe 97 PID 4004 wrote to memory of 3868 4004 7pvvp.exe 98 PID 4004 wrote to memory of 3868 4004 7pvvp.exe 98 PID 4004 wrote to memory of 3868 4004 7pvvp.exe 98 PID 3868 wrote to memory of 1632 3868 pjdvp.exe 100 PID 3868 wrote to memory of 1632 3868 pjdvp.exe 100 PID 3868 wrote to memory of 1632 3868 pjdvp.exe 100 PID 1632 wrote to memory of 592 1632 fxllffr.exe 101 PID 1632 wrote to memory of 592 1632 fxllffr.exe 101 PID 1632 wrote to memory of 592 1632 fxllffr.exe 101 PID 592 wrote to memory of 4660 592 bttnhn.exe 102 PID 592 wrote to memory of 4660 592 bttnhn.exe 102 PID 592 wrote to memory of 4660 592 bttnhn.exe 102 PID 4660 wrote to memory of 3516 4660 nttnhh.exe 103 PID 4660 wrote to memory of 3516 4660 nttnhh.exe 103 PID 4660 wrote to memory of 3516 4660 nttnhh.exe 103 PID 3516 wrote to memory of 2240 3516 vpjvp.exe 104 PID 3516 wrote to memory of 2240 3516 vpjvp.exe 104 PID 3516 wrote to memory of 2240 3516 vpjvp.exe 104 PID 2240 wrote to memory of 1328 2240 rrlfrlf.exe 105 PID 2240 wrote to memory of 1328 2240 rrlfrlf.exe 105 PID 2240 wrote to memory of 1328 2240 rrlfrlf.exe 105 PID 1328 wrote to memory of 4940 1328 nnthbn.exe 106 PID 1328 wrote to memory of 4940 1328 nnthbn.exe 106 PID 1328 wrote to memory of 4940 1328 nnthbn.exe 106 PID 4940 wrote to memory of 4612 4940 3tbtbb.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe"C:\Users\Admin\AppData\Local\Temp\a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\5lxrllf.exec:\5lxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\nnthbt.exec:\nnthbt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\pjdvp.exec:\pjdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\1ntnhh.exec:\1ntnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\7nnnhh.exec:\7nnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\pjjdp.exec:\pjjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\pjpjv.exec:\pjpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\tttttb.exec:\tttttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\5thbtt.exec:\5thbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\7jdvv.exec:\7jdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\lflfffx.exec:\lflfffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\7thhbb.exec:\7thhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\7pvvp.exec:\7pvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\pjdvp.exec:\pjdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\fxllffr.exec:\fxllffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\bttnhn.exec:\bttnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\nttnhh.exec:\nttnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\vpjvp.exec:\vpjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nnthbn.exec:\nnthbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\3tbtbb.exec:\3tbtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\jpvvv.exec:\jpvvv.exe23⤵
- Executes dropped EXE
PID:4612 -
\??\c:\7rrlfff.exec:\7rrlfff.exe24⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hhttbb.exec:\hhttbb.exe25⤵
- Executes dropped EXE
PID:1224 -
\??\c:\bntnnt.exec:\bntnnt.exe26⤵
- Executes dropped EXE
PID:5112 -
\??\c:\vjddv.exec:\vjddv.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\frxxffl.exec:\frxxffl.exe28⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lffxrrl.exec:\lffxrrl.exe29⤵
- Executes dropped EXE
PID:3088 -
\??\c:\btnhnn.exec:\btnhnn.exe30⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vpppj.exec:\vpppj.exe31⤵
- Executes dropped EXE
PID:4516 -
\??\c:\vvddv.exec:\vvddv.exe32⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe33⤵
- Executes dropped EXE
PID:4340 -
\??\c:\1lrrxxx.exec:\1lrrxxx.exe34⤵
- Executes dropped EXE
PID:4240 -
\??\c:\tbnttt.exec:\tbnttt.exe35⤵
- Executes dropped EXE
PID:4308 -
\??\c:\7nbtnb.exec:\7nbtnb.exe36⤵
- Executes dropped EXE
PID:628 -
\??\c:\1pddd.exec:\1pddd.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rxlrllr.exec:\rxlrllr.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xlffffx.exec:\xlffffx.exe39⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9ntnhh.exec:\9ntnhh.exe40⤵
- Executes dropped EXE
PID:5008 -
\??\c:\7hnhbb.exec:\7hnhbb.exe41⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1jpjj.exec:\1jpjj.exe42⤵
- Executes dropped EXE
PID:3132 -
\??\c:\jpddd.exec:\jpddd.exe43⤵
- Executes dropped EXE
PID:4420 -
\??\c:\xlllfxx.exec:\xlllfxx.exe44⤵
- Executes dropped EXE
PID:4012 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3nhhbb.exec:\3nhhbb.exe46⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1bbnnb.exec:\1bbnnb.exe47⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpjdv.exec:\vpjdv.exe48⤵
- Executes dropped EXE
PID:4912 -
\??\c:\dvvpv.exec:\dvvpv.exe49⤵
- Executes dropped EXE
PID:4540 -
\??\c:\5rrlxrr.exec:\5rrlxrr.exe50⤵
- Executes dropped EXE
PID:640 -
\??\c:\9rfxffl.exec:\9rfxffl.exe51⤵
- Executes dropped EXE
PID:3912 -
\??\c:\btbhbb.exec:\btbhbb.exe52⤵
- Executes dropped EXE
PID:4580 -
\??\c:\7bhbbh.exec:\7bhbbh.exe53⤵
- Executes dropped EXE
PID:4004 -
\??\c:\djppd.exec:\djppd.exe54⤵
- Executes dropped EXE
PID:4584 -
\??\c:\jpdpp.exec:\jpdpp.exe55⤵
- Executes dropped EXE
PID:456 -
\??\c:\5rxfrrl.exec:\5rxfrrl.exe56⤵
- Executes dropped EXE
PID:4400 -
\??\c:\llxxffr.exec:\llxxffr.exe57⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hhbbtt.exec:\hhbbtt.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7btnhh.exec:\7btnhh.exe59⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5pvpp.exec:\5pvpp.exe60⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pdvpp.exec:\pdvpp.exe61⤵
- Executes dropped EXE
PID:3208 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe62⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9rlflrl.exec:\9rlflrl.exe63⤵
- Executes dropped EXE
PID:3876 -
\??\c:\5nbbth.exec:\5nbbth.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhnhbb.exec:\nhnhbb.exe65⤵
- Executes dropped EXE
PID:4772 -
\??\c:\9jpjv.exec:\9jpjv.exe66⤵PID:2524
-
\??\c:\dvddv.exec:\dvddv.exe67⤵PID:2008
-
\??\c:\xllfxrl.exec:\xllfxrl.exe68⤵PID:1812
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe69⤵PID:4160
-
\??\c:\bnbtnb.exec:\bnbtnb.exe70⤵PID:3064
-
\??\c:\bnbtnn.exec:\bnbtnn.exe71⤵PID:1228
-
\??\c:\vppjj.exec:\vppjj.exe72⤵PID:1872
-
\??\c:\pvddp.exec:\pvddp.exe73⤵PID:2712
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe74⤵PID:4732
-
\??\c:\fllllll.exec:\fllllll.exe75⤵PID:1908
-
\??\c:\tnhhnn.exec:\tnhhnn.exe76⤵PID:3920
-
\??\c:\nhtntt.exec:\nhtntt.exe77⤵PID:884
-
\??\c:\3nnhtt.exec:\3nnhtt.exe78⤵PID:5072
-
\??\c:\vddvp.exec:\vddvp.exe79⤵PID:3604
-
\??\c:\dvvpd.exec:\dvvpd.exe80⤵PID:4756
-
\??\c:\lfxrrrf.exec:\lfxrrrf.exe81⤵PID:4800
-
\??\c:\lfrrrxr.exec:\lfrrrxr.exe82⤵PID:4492
-
\??\c:\bbttnt.exec:\bbttnt.exe83⤵PID:3956
-
\??\c:\ttbthh.exec:\ttbthh.exe84⤵PID:1992
-
\??\c:\pvdvp.exec:\pvdvp.exe85⤵PID:2056
-
\??\c:\jddvj.exec:\jddvj.exe86⤵PID:3488
-
\??\c:\xffxffx.exec:\xffxffx.exe87⤵PID:3528
-
\??\c:\ffllfxr.exec:\ffllfxr.exe88⤵PID:3252
-
\??\c:\nhhbtn.exec:\nhhbtn.exe89⤵PID:2568
-
\??\c:\bnhbnh.exec:\bnhbnh.exe90⤵PID:1156
-
\??\c:\pvjdd.exec:\pvjdd.exe91⤵PID:3884
-
\??\c:\9pjdp.exec:\9pjdp.exe92⤵PID:4912
-
\??\c:\rxfrrlf.exec:\rxfrrlf.exe93⤵PID:4064
-
\??\c:\hbbtnh.exec:\hbbtnh.exe94⤵PID:640
-
\??\c:\3ttntn.exec:\3ttntn.exe95⤵PID:436
-
\??\c:\bbnhtb.exec:\bbnhtb.exe96⤵PID:4580
-
\??\c:\dvpjd.exec:\dvpjd.exe97⤵PID:4820
-
\??\c:\fxxlffx.exec:\fxxlffx.exe98⤵PID:4584
-
\??\c:\fxrxlll.exec:\fxrxlll.exe99⤵PID:4728
-
\??\c:\tnhbtt.exec:\tnhbtt.exe100⤵PID:3480
-
\??\c:\9nhtbt.exec:\9nhtbt.exe101⤵PID:2348
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe102⤵PID:4960
-
\??\c:\rllfrlf.exec:\rllfrlf.exe103⤵PID:3500
-
\??\c:\bttnhh.exec:\bttnhh.exe104⤵PID:2648
-
\??\c:\btnhhh.exec:\btnhhh.exe105⤵PID:5080
-
\??\c:\9jjvj.exec:\9jjvj.exe106⤵PID:1512
-
\??\c:\dpvpp.exec:\dpvpp.exe107⤵PID:3940
-
\??\c:\xflxlfx.exec:\xflxlfx.exe108⤵PID:2528
-
\??\c:\xlrllff.exec:\xlrllff.exe109⤵PID:1076
-
\??\c:\7tbtnt.exec:\7tbtnt.exe110⤵PID:4964
-
\??\c:\dpvpj.exec:\dpvpj.exe111⤵PID:3832
-
\??\c:\jpppd.exec:\jpppd.exe112⤵PID:4992
-
\??\c:\3ffrfxl.exec:\3ffrfxl.exe113⤵PID:4380
-
\??\c:\thtttb.exec:\thtttb.exe114⤵PID:4188
-
\??\c:\7nhhnn.exec:\7nhhnn.exe115⤵PID:4360
-
\??\c:\3jjvj.exec:\3jjvj.exe116⤵PID:208
-
\??\c:\9pvpj.exec:\9pvpj.exe117⤵PID:1368
-
\??\c:\5frlxrl.exec:\5frlxrl.exe118⤵PID:3660
-
\??\c:\llrfrrf.exec:\llrfrrf.exe119⤵PID:3836
-
\??\c:\bbbthh.exec:\bbbthh.exe120⤵PID:4564
-
\??\c:\hnhbtt.exec:\hnhbtt.exe121⤵PID:4308
-
\??\c:\tbhnbt.exec:\tbhnbt.exe122⤵PID:4124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-