Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4508b3065128bff4d98c6a13bb8f1fb0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
4508b3065128bff4d98c6a13bb8f1fb0N.exe
-
Size
59KB
-
MD5
4508b3065128bff4d98c6a13bb8f1fb0
-
SHA1
867de64fd52c80d06769b119db92bddab2fa87f0
-
SHA256
a05852291fbc686247cb432de4bf11e79baaed738f38a453699fa2b63dfaa1f5
-
SHA512
7cbd5326476d360a048a5476b99c8f208df8e721d826b15435e301bb07bc3efd267a8fd13fd9a2571a540422c440f57b00c857dd0d42b21045bdd531f1963f7c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb+8RI:ymb3NkkiQ3mdBjFIjRI
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4312-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 hnttnn.exe 2360 jjjvj.exe 408 frxrrll.exe 4800 rxrrffx.exe 672 btbttn.exe 3636 pjppd.exe 2596 ttnhbb.exe 660 pvdpd.exe 560 djpdp.exe 1388 xrrfrlx.exe 3440 bnhbnh.exe 2760 dppjd.exe 3652 rffllrl.exe 4684 bttnhb.exe 4128 5hhttn.exe 2364 pvjdv.exe 4944 dpjvj.exe 4504 lrllxrl.exe 4520 thnhbn.exe 2244 ntnhtn.exe 4928 llxrxxx.exe 4840 lfxxfxf.exe 3632 tnbnhb.exe 2376 hntbhn.exe 1104 vdddv.exe 4280 lxlfxxr.exe 5024 fxxxxff.exe 1912 nbhtbn.exe 4868 dppdv.exe 3428 fllffxr.exe 444 frrlfrl.exe 1020 httttt.exe 1216 hnntnb.exe 1256 jjddd.exe 440 pdvpp.exe 3688 lfxllff.exe 2168 nbhhhh.exe 2496 9bbbnn.exe 1672 nhhbtn.exe 2612 pppjv.exe 3700 dpvvj.exe 4188 lffffff.exe 4980 1xfxxxl.exe 4220 7btnhb.exe 4452 7thbnh.exe 1128 tnhbnn.exe 1980 9ppjd.exe 2488 dpppv.exe 3656 lffxxfx.exe 4932 ffxlfff.exe 4032 vpppj.exe 2240 1pvpp.exe 5044 jppvp.exe 3424 xlxfrff.exe 3440 nbhnnt.exe 2512 pjpjj.exe 2480 pjjdj.exe 4264 xffxxxr.exe 4128 rlffffx.exe 2364 5nhhtn.exe 1228 1btnnn.exe 5088 pjvpp.exe 456 vddvj.exe 616 xlxrrrr.exe -
resource yara_rule behavioral2/memory/4312-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 2276 4312 4508b3065128bff4d98c6a13bb8f1fb0N.exe 84 PID 4312 wrote to memory of 2276 4312 4508b3065128bff4d98c6a13bb8f1fb0N.exe 84 PID 4312 wrote to memory of 2276 4312 4508b3065128bff4d98c6a13bb8f1fb0N.exe 84 PID 2276 wrote to memory of 2360 2276 hnttnn.exe 85 PID 2276 wrote to memory of 2360 2276 hnttnn.exe 85 PID 2276 wrote to memory of 2360 2276 hnttnn.exe 85 PID 2360 wrote to memory of 408 2360 jjjvj.exe 86 PID 2360 wrote to memory of 408 2360 jjjvj.exe 86 PID 2360 wrote to memory of 408 2360 jjjvj.exe 86 PID 408 wrote to memory of 4800 408 frxrrll.exe 87 PID 408 wrote to memory of 4800 408 frxrrll.exe 87 PID 408 wrote to memory of 4800 408 frxrrll.exe 87 PID 4800 wrote to memory of 672 4800 rxrrffx.exe 88 PID 4800 wrote to memory of 672 4800 rxrrffx.exe 88 PID 4800 wrote to memory of 672 4800 rxrrffx.exe 88 PID 672 wrote to memory of 3636 672 btbttn.exe 89 PID 672 wrote to memory of 3636 672 btbttn.exe 89 PID 672 wrote to memory of 3636 672 btbttn.exe 89 PID 3636 wrote to memory of 2596 3636 pjppd.exe 90 PID 3636 wrote to memory of 2596 3636 pjppd.exe 90 PID 3636 wrote to memory of 2596 3636 pjppd.exe 90 PID 2596 wrote to memory of 660 2596 ttnhbb.exe 91 PID 2596 wrote to memory of 660 2596 ttnhbb.exe 91 PID 2596 wrote to memory of 660 2596 ttnhbb.exe 91 PID 660 wrote to memory of 560 660 pvdpd.exe 92 PID 660 wrote to memory of 560 660 pvdpd.exe 92 PID 660 wrote to memory of 560 660 pvdpd.exe 92 PID 560 wrote to memory of 1388 560 djpdp.exe 93 PID 560 wrote to memory of 1388 560 djpdp.exe 93 PID 560 wrote to memory of 1388 560 djpdp.exe 93 PID 1388 wrote to memory of 3440 1388 xrrfrlx.exe 94 PID 1388 wrote to memory of 3440 1388 xrrfrlx.exe 94 PID 1388 wrote to memory of 3440 1388 xrrfrlx.exe 94 PID 3440 wrote to memory of 2760 3440 bnhbnh.exe 95 PID 3440 wrote to memory of 2760 3440 bnhbnh.exe 95 PID 3440 wrote to memory of 2760 3440 bnhbnh.exe 95 PID 2760 wrote to memory of 3652 2760 dppjd.exe 96 PID 2760 wrote to memory of 3652 2760 dppjd.exe 96 PID 2760 wrote to memory of 3652 2760 dppjd.exe 96 PID 3652 wrote to memory of 4684 3652 rffllrl.exe 97 PID 3652 wrote to memory of 4684 3652 rffllrl.exe 97 PID 3652 wrote to memory of 4684 3652 rffllrl.exe 97 PID 4684 wrote to memory of 4128 4684 bttnhb.exe 98 PID 4684 wrote to memory of 4128 4684 bttnhb.exe 98 PID 4684 wrote to memory of 4128 4684 bttnhb.exe 98 PID 4128 wrote to memory of 2364 4128 5hhttn.exe 99 PID 4128 wrote to memory of 2364 4128 5hhttn.exe 99 PID 4128 wrote to memory of 2364 4128 5hhttn.exe 99 PID 2364 wrote to memory of 4944 2364 pvjdv.exe 100 PID 2364 wrote to memory of 4944 2364 pvjdv.exe 100 PID 2364 wrote to memory of 4944 2364 pvjdv.exe 100 PID 4944 wrote to memory of 4504 4944 dpjvj.exe 101 PID 4944 wrote to memory of 4504 4944 dpjvj.exe 101 PID 4944 wrote to memory of 4504 4944 dpjvj.exe 101 PID 4504 wrote to memory of 4520 4504 lrllxrl.exe 103 PID 4504 wrote to memory of 4520 4504 lrllxrl.exe 103 PID 4504 wrote to memory of 4520 4504 lrllxrl.exe 103 PID 4520 wrote to memory of 2244 4520 thnhbn.exe 104 PID 4520 wrote to memory of 2244 4520 thnhbn.exe 104 PID 4520 wrote to memory of 2244 4520 thnhbn.exe 104 PID 2244 wrote to memory of 4928 2244 ntnhtn.exe 106 PID 2244 wrote to memory of 4928 2244 ntnhtn.exe 106 PID 2244 wrote to memory of 4928 2244 ntnhtn.exe 106 PID 4928 wrote to memory of 4840 4928 llxrxxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4508b3065128bff4d98c6a13bb8f1fb0N.exe"C:\Users\Admin\AppData\Local\Temp\4508b3065128bff4d98c6a13bb8f1fb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\hnttnn.exec:\hnttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jjjvj.exec:\jjjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\frxrrll.exec:\frxrrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\rxrrffx.exec:\rxrrffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\btbttn.exec:\btbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\pjppd.exec:\pjppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\ttnhbb.exec:\ttnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\pvdpd.exec:\pvdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\djpdp.exec:\djpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\bnhbnh.exec:\bnhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\dppjd.exec:\dppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rffllrl.exec:\rffllrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\bttnhb.exec:\bttnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\5hhttn.exec:\5hhttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\pvjdv.exec:\pvjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\dpjvj.exec:\dpjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\lrllxrl.exec:\lrllxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\thnhbn.exec:\thnhbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ntnhtn.exec:\ntnhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\llxrxxx.exec:\llxrxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe23⤵
- Executes dropped EXE
PID:4840 -
\??\c:\tnbnhb.exec:\tnbnhb.exe24⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hntbhn.exec:\hntbhn.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vdddv.exec:\vdddv.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe27⤵
- Executes dropped EXE
PID:4280 -
\??\c:\fxxxxff.exec:\fxxxxff.exe28⤵
- Executes dropped EXE
PID:5024 -
\??\c:\nbhtbn.exec:\nbhtbn.exe29⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dppdv.exec:\dppdv.exe30⤵
- Executes dropped EXE
PID:4868 -
\??\c:\fllffxr.exec:\fllffxr.exe31⤵
- Executes dropped EXE
PID:3428 -
\??\c:\frrlfrl.exec:\frrlfrl.exe32⤵
- Executes dropped EXE
PID:444 -
\??\c:\httttt.exec:\httttt.exe33⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hnntnb.exec:\hnntnb.exe34⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jjddd.exec:\jjddd.exe35⤵
- Executes dropped EXE
PID:1256 -
\??\c:\pdvpp.exec:\pdvpp.exe36⤵
- Executes dropped EXE
PID:440 -
\??\c:\lfxllff.exec:\lfxllff.exe37⤵
- Executes dropped EXE
PID:3688 -
\??\c:\nbhhhh.exec:\nbhhhh.exe38⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9bbbnn.exec:\9bbbnn.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nhhbtn.exec:\nhhbtn.exe40⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pppjv.exec:\pppjv.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpvvj.exec:\dpvvj.exe42⤵
- Executes dropped EXE
PID:3700 -
\??\c:\lffffff.exec:\lffffff.exe43⤵
- Executes dropped EXE
PID:4188 -
\??\c:\1xfxxxl.exec:\1xfxxxl.exe44⤵
- Executes dropped EXE
PID:4980 -
\??\c:\7btnhb.exec:\7btnhb.exe45⤵
- Executes dropped EXE
PID:4220 -
\??\c:\7thbnh.exec:\7thbnh.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\tnhbnn.exec:\tnhbnn.exe47⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9ppjd.exec:\9ppjd.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dpppv.exec:\dpppv.exe49⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lffxxfx.exec:\lffxxfx.exe50⤵
- Executes dropped EXE
PID:3656 -
\??\c:\ffxlfff.exec:\ffxlfff.exe51⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vpppj.exec:\vpppj.exe52⤵
- Executes dropped EXE
PID:4032 -
\??\c:\1pvpp.exec:\1pvpp.exe53⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jppvp.exec:\jppvp.exe54⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xlxfrff.exec:\xlxfrff.exe55⤵
- Executes dropped EXE
PID:3424 -
\??\c:\nbhnnt.exec:\nbhnnt.exe56⤵
- Executes dropped EXE
PID:3440 -
\??\c:\pjpjj.exec:\pjpjj.exe57⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjjdj.exec:\pjjdj.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xffxxxr.exec:\xffxxxr.exe59⤵
- Executes dropped EXE
PID:4264 -
\??\c:\rlffffx.exec:\rlffffx.exe60⤵
- Executes dropped EXE
PID:4128 -
\??\c:\5nhhtn.exec:\5nhhtn.exe61⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1btnnn.exec:\1btnnn.exe62⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pjvpp.exec:\pjvpp.exe63⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vddvj.exec:\vddvj.exe64⤵
- Executes dropped EXE
PID:456 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe65⤵
- Executes dropped EXE
PID:616 -
\??\c:\rflxlfr.exec:\rflxlfr.exe66⤵PID:2880
-
\??\c:\tnhtnn.exec:\tnhtnn.exe67⤵PID:2244
-
\??\c:\tnttnn.exec:\tnttnn.exe68⤵PID:3740
-
\??\c:\pvvpj.exec:\pvvpj.exe69⤵PID:4840
-
\??\c:\xrxrllf.exec:\xrxrllf.exe70⤵PID:1636
-
\??\c:\rlllrrr.exec:\rlllrrr.exe71⤵PID:744
-
\??\c:\bbhtnt.exec:\bbhtnt.exe72⤵PID:2508
-
\??\c:\hhhhbh.exec:\hhhhbh.exe73⤵PID:4044
-
\??\c:\ppddj.exec:\ppddj.exe74⤵PID:4596
-
\??\c:\5djdj.exec:\5djdj.exe75⤵PID:3764
-
\??\c:\dvdvp.exec:\dvdvp.exe76⤵PID:2484
-
\??\c:\xrfflll.exec:\xrfflll.exe77⤵PID:872
-
\??\c:\fflfxxr.exec:\fflfxxr.exe78⤵PID:1308
-
\??\c:\nnttnh.exec:\nnttnh.exe79⤵PID:4724
-
\??\c:\vvddv.exec:\vvddv.exe80⤵PID:4320
-
\??\c:\lffxrrl.exec:\lffxrrl.exe81⤵PID:728
-
\??\c:\hbbnnn.exec:\hbbnnn.exe82⤵PID:868
-
\??\c:\pjjdv.exec:\pjjdv.exe83⤵PID:3524
-
\??\c:\vjjdp.exec:\vjjdp.exe84⤵PID:2040
-
\??\c:\1jjvv.exec:\1jjvv.exe85⤵PID:1464
-
\??\c:\fffrfrr.exec:\fffrfrr.exe86⤵PID:3192
-
\??\c:\9thhtb.exec:\9thhtb.exe87⤵PID:4396
-
\??\c:\nbhhbt.exec:\nbhhbt.exe88⤵PID:632
-
\??\c:\pdddv.exec:\pdddv.exe89⤵PID:864
-
\??\c:\pjppj.exec:\pjppj.exe90⤵PID:2356
-
\??\c:\9frrffx.exec:\9frrffx.exe91⤵PID:4296
-
\??\c:\5tbtnn.exec:\5tbtnn.exe92⤵PID:4188
-
\??\c:\thhnht.exec:\thhnht.exe93⤵PID:3604
-
\??\c:\jjppp.exec:\jjppp.exe94⤵PID:2432
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe95⤵PID:5080
-
\??\c:\rlrllfx.exec:\rlrllfx.exe96⤵PID:1844
-
\??\c:\nnhbbb.exec:\nnhbbb.exe97⤵PID:1544
-
\??\c:\hbnhtt.exec:\hbnhtt.exe98⤵PID:2488
-
\??\c:\vvjjd.exec:\vvjjd.exe99⤵PID:2216
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe100⤵PID:2744
-
\??\c:\9tnhbb.exec:\9tnhbb.exe101⤵PID:208
-
\??\c:\nthbbb.exec:\nthbbb.exe102⤵PID:4200
-
\??\c:\vjppd.exec:\vjppd.exe103⤵PID:1960
-
\??\c:\jpppd.exec:\jpppd.exe104⤵PID:3040
-
\??\c:\lxrlffx.exec:\lxrlffx.exe105⤵PID:2184
-
\??\c:\lrrfxfx.exec:\lrrfxfx.exe106⤵PID:2512
-
\??\c:\bnnntb.exec:\bnnntb.exe107⤵PID:4424
-
\??\c:\bbbbbb.exec:\bbbbbb.exe108⤵PID:4544
-
\??\c:\vvpjj.exec:\vvpjj.exe109⤵PID:4144
-
\??\c:\vjvdd.exec:\vjvdd.exe110⤵PID:2752
-
\??\c:\rrrffxr.exec:\rrrffxr.exe111⤵PID:2200
-
\??\c:\5xrrllf.exec:\5xrrllf.exe112⤵PID:3432
-
\??\c:\bbtttt.exec:\bbtttt.exe113⤵PID:4636
-
\??\c:\vvjdp.exec:\vvjdp.exe114⤵PID:1904
-
\??\c:\pvvvp.exec:\pvvvp.exe115⤵PID:392
-
\??\c:\3xxrflf.exec:\3xxrflf.exe116⤵PID:3368
-
\??\c:\rllfxxx.exec:\rllfxxx.exe117⤵PID:1748
-
\??\c:\nbbnnn.exec:\nbbnnn.exe118⤵PID:3224
-
\??\c:\nhhbtt.exec:\nhhbtt.exe119⤵PID:536
-
\??\c:\dpjvd.exec:\dpjvd.exe120⤵PID:4492
-
\??\c:\jvpjv.exec:\jvpjv.exe121⤵PID:3156
-
\??\c:\5xfrxxx.exec:\5xfrxxx.exe122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-