Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe
Resource
win7-20240729-en
General
-
Target
cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe
-
Size
62KB
-
MD5
fe788810050ecfc9a0276eedd413e320
-
SHA1
f2de6793dbe79b21c1c30ecdf7e1caa5a2bb5d6a
-
SHA256
cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9
-
SHA512
65a2f7204861aa3c4a4ad09d48afa2e8e49f9d834872cac3dd3d7f80c8f6fd3d7e41b8ac91b38ae9e8463190b018e8596ba3e7f309d2117a33520c69ad566f01
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKES+:ymb3NkkiQ3mdBjFII9ZvHKET
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4456-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1040 pjjdd.exe 3732 rlxrffr.exe 696 frrlfxr.exe 2108 nhtnhh.exe 1088 7ddvv.exe 4252 frrfxfx.exe 3032 tbbtnh.exe 2556 jdpdv.exe 5052 rlfxlxl.exe 5116 3hthbt.exe 1356 pddvj.exe 2452 jvvjv.exe 4308 rxrlfxr.exe 212 nhnhhb.exe 4432 5jvpp.exe 1616 lrxlxrl.exe 2896 nttnhb.exe 4468 hbbttn.exe 888 vjpjd.exe 4932 3fxrfxf.exe 4736 bhntnh.exe 388 tbhbnn.exe 4988 pvvpd.exe 3208 lfxrllf.exe 3564 lfflflf.exe 2660 nntttt.exe 3048 3vvpd.exe 2960 jdddp.exe 1332 xrrlxxr.exe 1504 ffxrllf.exe 3476 nbtnhh.exe 1560 dddvp.exe 116 vpjdj.exe 4276 xffffll.exe 4780 nnhbtt.exe 2664 bbhbbb.exe 4996 nttnht.exe 2680 nhbtbt.exe 4148 hbhhtn.exe 1168 pjppd.exe 4044 1xrlxrl.exe 4636 rrrrlfx.exe 2280 bthbhb.exe 4252 htnhtt.exe 5084 jdjvj.exe 3016 pdddp.exe 2556 frlfrll.exe 5040 lfflfll.exe 4576 hntnhh.exe 3128 tnhbnh.exe 452 dpvpd.exe 1656 pddvj.exe 3600 rlrxfxr.exe 1756 fxlfrrf.exe 3924 bnnhtt.exe 2892 bttbtn.exe 3196 pjjpv.exe 4748 pvdpd.exe 544 vpddv.exe 1412 rrrfrlf.exe 1924 5llllfx.exe 4680 hhbttn.exe 1912 tttbtt.exe 3532 jdvpj.exe -
resource yara_rule behavioral2/memory/4456-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1040 4456 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 83 PID 4456 wrote to memory of 1040 4456 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 83 PID 4456 wrote to memory of 1040 4456 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 83 PID 1040 wrote to memory of 3732 1040 pjjdd.exe 84 PID 1040 wrote to memory of 3732 1040 pjjdd.exe 84 PID 1040 wrote to memory of 3732 1040 pjjdd.exe 84 PID 3732 wrote to memory of 696 3732 rlxrffr.exe 85 PID 3732 wrote to memory of 696 3732 rlxrffr.exe 85 PID 3732 wrote to memory of 696 3732 rlxrffr.exe 85 PID 696 wrote to memory of 2108 696 frrlfxr.exe 86 PID 696 wrote to memory of 2108 696 frrlfxr.exe 86 PID 696 wrote to memory of 2108 696 frrlfxr.exe 86 PID 2108 wrote to memory of 1088 2108 nhtnhh.exe 87 PID 2108 wrote to memory of 1088 2108 nhtnhh.exe 87 PID 2108 wrote to memory of 1088 2108 nhtnhh.exe 87 PID 1088 wrote to memory of 4252 1088 7ddvv.exe 88 PID 1088 wrote to memory of 4252 1088 7ddvv.exe 88 PID 1088 wrote to memory of 4252 1088 7ddvv.exe 88 PID 4252 wrote to memory of 3032 4252 frrfxfx.exe 90 PID 4252 wrote to memory of 3032 4252 frrfxfx.exe 90 PID 4252 wrote to memory of 3032 4252 frrfxfx.exe 90 PID 3032 wrote to memory of 2556 3032 tbbtnh.exe 91 PID 3032 wrote to memory of 2556 3032 tbbtnh.exe 91 PID 3032 wrote to memory of 2556 3032 tbbtnh.exe 91 PID 2556 wrote to memory of 5052 2556 jdpdv.exe 92 PID 2556 wrote to memory of 5052 2556 jdpdv.exe 92 PID 2556 wrote to memory of 5052 2556 jdpdv.exe 92 PID 5052 wrote to memory of 5116 5052 rlfxlxl.exe 93 PID 5052 wrote to memory of 5116 5052 rlfxlxl.exe 93 PID 5052 wrote to memory of 5116 5052 rlfxlxl.exe 93 PID 5116 wrote to memory of 1356 5116 3hthbt.exe 94 PID 5116 wrote to memory of 1356 5116 3hthbt.exe 94 PID 5116 wrote to memory of 1356 5116 3hthbt.exe 94 PID 1356 wrote to memory of 2452 1356 pddvj.exe 95 PID 1356 wrote to memory of 2452 1356 pddvj.exe 95 PID 1356 wrote to memory of 2452 1356 pddvj.exe 95 PID 2452 wrote to memory of 4308 2452 jvvjv.exe 96 PID 2452 wrote to memory of 4308 2452 jvvjv.exe 96 PID 2452 wrote to memory of 4308 2452 jvvjv.exe 96 PID 4308 wrote to memory of 212 4308 rxrlfxr.exe 97 PID 4308 wrote to memory of 212 4308 rxrlfxr.exe 97 PID 4308 wrote to memory of 212 4308 rxrlfxr.exe 97 PID 212 wrote to memory of 4432 212 nhnhhb.exe 99 PID 212 wrote to memory of 4432 212 nhnhhb.exe 99 PID 212 wrote to memory of 4432 212 nhnhhb.exe 99 PID 4432 wrote to memory of 1616 4432 5jvpp.exe 100 PID 4432 wrote to memory of 1616 4432 5jvpp.exe 100 PID 4432 wrote to memory of 1616 4432 5jvpp.exe 100 PID 1616 wrote to memory of 2896 1616 lrxlxrl.exe 101 PID 1616 wrote to memory of 2896 1616 lrxlxrl.exe 101 PID 1616 wrote to memory of 2896 1616 lrxlxrl.exe 101 PID 2896 wrote to memory of 4468 2896 nttnhb.exe 102 PID 2896 wrote to memory of 4468 2896 nttnhb.exe 102 PID 2896 wrote to memory of 4468 2896 nttnhb.exe 102 PID 4468 wrote to memory of 888 4468 hbbttn.exe 104 PID 4468 wrote to memory of 888 4468 hbbttn.exe 104 PID 4468 wrote to memory of 888 4468 hbbttn.exe 104 PID 888 wrote to memory of 4932 888 vjpjd.exe 105 PID 888 wrote to memory of 4932 888 vjpjd.exe 105 PID 888 wrote to memory of 4932 888 vjpjd.exe 105 PID 4932 wrote to memory of 4736 4932 3fxrfxf.exe 106 PID 4932 wrote to memory of 4736 4932 3fxrfxf.exe 106 PID 4932 wrote to memory of 4736 4932 3fxrfxf.exe 106 PID 4736 wrote to memory of 388 4736 bhntnh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe"C:\Users\Admin\AppData\Local\Temp\cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\pjjdd.exec:\pjjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\rlxrffr.exec:\rlxrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\frrlfxr.exec:\frrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\nhtnhh.exec:\nhtnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\7ddvv.exec:\7ddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\frrfxfx.exec:\frrfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\tbbtnh.exec:\tbbtnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jdpdv.exec:\jdpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rlfxlxl.exec:\rlfxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\3hthbt.exec:\3hthbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\pddvj.exec:\pddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\jvvjv.exec:\jvvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\nhnhhb.exec:\nhnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\5jvpp.exec:\5jvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\nttnhb.exec:\nttnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbbttn.exec:\hbbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\vjpjd.exec:\vjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\3fxrfxf.exec:\3fxrfxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\bhntnh.exec:\bhntnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\tbhbnn.exec:\tbhbnn.exe23⤵
- Executes dropped EXE
PID:388 -
\??\c:\pvvpd.exec:\pvvpd.exe24⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lfxrllf.exec:\lfxrllf.exe25⤵
- Executes dropped EXE
PID:3208 -
\??\c:\lfflflf.exec:\lfflflf.exe26⤵
- Executes dropped EXE
PID:3564 -
\??\c:\nntttt.exec:\nntttt.exe27⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3vvpd.exec:\3vvpd.exe28⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jdddp.exec:\jdddp.exe29⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe30⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ffxrllf.exec:\ffxrllf.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nbtnhh.exec:\nbtnhh.exe32⤵
- Executes dropped EXE
PID:3476 -
\??\c:\dddvp.exec:\dddvp.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpjdj.exec:\vpjdj.exe34⤵
- Executes dropped EXE
PID:116 -
\??\c:\xffffll.exec:\xffffll.exe35⤵
- Executes dropped EXE
PID:4276 -
\??\c:\nnhbtt.exec:\nnhbtt.exe36⤵
- Executes dropped EXE
PID:4780 -
\??\c:\bbhbbb.exec:\bbhbbb.exe37⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nttnht.exec:\nttnht.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\nhbtbt.exec:\nhbtbt.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hbhhtn.exec:\hbhhtn.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4148 -
\??\c:\pjppd.exec:\pjppd.exe41⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1xrlxrl.exec:\1xrlxrl.exe42⤵
- Executes dropped EXE
PID:4044 -
\??\c:\rrrrlfx.exec:\rrrrlfx.exe43⤵
- Executes dropped EXE
PID:4636 -
\??\c:\bthbhb.exec:\bthbhb.exe44⤵
- Executes dropped EXE
PID:2280 -
\??\c:\htnhtt.exec:\htnhtt.exe45⤵
- Executes dropped EXE
PID:4252 -
\??\c:\jdjvj.exec:\jdjvj.exe46⤵
- Executes dropped EXE
PID:5084 -
\??\c:\pdddp.exec:\pdddp.exe47⤵
- Executes dropped EXE
PID:3016 -
\??\c:\frlfrll.exec:\frlfrll.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfflfll.exec:\lfflfll.exe49⤵
- Executes dropped EXE
PID:5040 -
\??\c:\hntnhh.exec:\hntnhh.exe50⤵
- Executes dropped EXE
PID:4576 -
\??\c:\tnhbnh.exec:\tnhbnh.exe51⤵
- Executes dropped EXE
PID:3128 -
\??\c:\dpvpd.exec:\dpvpd.exe52⤵
- Executes dropped EXE
PID:452 -
\??\c:\pddvj.exec:\pddvj.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rlrxfxr.exec:\rlrxfxr.exe54⤵
- Executes dropped EXE
PID:3600 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bnnhtt.exec:\bnnhtt.exe56⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bttbtn.exec:\bttbtn.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjjpv.exec:\pjjpv.exe58⤵
- Executes dropped EXE
PID:3196 -
\??\c:\pvdpd.exec:\pvdpd.exe59⤵
- Executes dropped EXE
PID:4748 -
\??\c:\vpddv.exec:\vpddv.exe60⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrrfrlf.exec:\rrrfrlf.exe61⤵
- Executes dropped EXE
PID:1412 -
\??\c:\5llllfx.exec:\5llllfx.exe62⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hhbttn.exec:\hhbttn.exe63⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tttbtt.exec:\tttbtt.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jdvpj.exec:\jdvpj.exe65⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jjpdj.exec:\jjpdj.exe66⤵PID:4736
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe67⤵PID:2212
-
\??\c:\llxrlxl.exec:\llxrlxl.exe68⤵PID:1176
-
\??\c:\tnbtnh.exec:\tnbtnh.exe69⤵PID:1000
-
\??\c:\thbthh.exec:\thbthh.exe70⤵PID:3140
-
\??\c:\pdvjv.exec:\pdvjv.exe71⤵PID:2036
-
\??\c:\jvvpv.exec:\jvvpv.exe72⤵PID:2160
-
\??\c:\lllfllf.exec:\lllfllf.exe73⤵PID:1956
-
\??\c:\lxxlfff.exec:\lxxlfff.exe74⤵PID:3512
-
\??\c:\hthhhb.exec:\hthhhb.exe75⤵PID:2960
-
\??\c:\hbbhtb.exec:\hbbhtb.exe76⤵PID:1332
-
\??\c:\djjdp.exec:\djjdp.exe77⤵PID:2448
-
\??\c:\vvdpj.exec:\vvdpj.exe78⤵PID:2544
-
\??\c:\frlfrll.exec:\frlfrll.exe79⤵PID:4916
-
\??\c:\lxxrffx.exec:\lxxrffx.exe80⤵PID:4304
-
\??\c:\httnhh.exec:\httnhh.exe81⤵PID:4292
-
\??\c:\nbbnbb.exec:\nbbnbb.exe82⤵PID:4276
-
\??\c:\jvvpd.exec:\jvvpd.exe83⤵PID:4840
-
\??\c:\pppjv.exec:\pppjv.exe84⤵PID:2836
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe85⤵PID:3732
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe86⤵PID:2680
-
\??\c:\3hhhbb.exec:\3hhhbb.exe87⤵PID:3996
-
\??\c:\hbtnbt.exec:\hbtnbt.exe88⤵PID:4764
-
\??\c:\jvpdp.exec:\jvpdp.exe89⤵PID:2284
-
\??\c:\pjjjd.exec:\pjjjd.exe90⤵PID:764
-
\??\c:\7ffxxxl.exec:\7ffxxxl.exe91⤵PID:2280
-
\??\c:\fflxrrf.exec:\fflxrrf.exe92⤵PID:1208
-
\??\c:\bnnhhb.exec:\bnnhhb.exe93⤵PID:3092
-
\??\c:\bbtnhh.exec:\bbtnhh.exe94⤵PID:1220
-
\??\c:\1ppjd.exec:\1ppjd.exe95⤵PID:1764
-
\??\c:\vpvpv.exec:\vpvpv.exe96⤵PID:5116
-
\??\c:\9xxlfxr.exec:\9xxlfxr.exe97⤵PID:372
-
\??\c:\xffxllr.exec:\xffxllr.exe98⤵PID:2260
-
\??\c:\hnnhtt.exec:\hnnhtt.exe99⤵PID:3976
-
\??\c:\nbnhnn.exec:\nbnhnn.exe100⤵PID:4308
-
\??\c:\1pjdv.exec:\1pjdv.exe101⤵PID:2948
-
\??\c:\1vvpp.exec:\1vvpp.exe102⤵PID:2312
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe103⤵PID:876
-
\??\c:\3fxlrrx.exec:\3fxlrrx.exe104⤵PID:3412
-
\??\c:\nbbtnb.exec:\nbbtnb.exe105⤵PID:2392
-
\??\c:\5bttnh.exec:\5bttnh.exe106⤵PID:1548
-
\??\c:\pjjjv.exec:\pjjjv.exe107⤵PID:2268
-
\??\c:\djjjd.exec:\djjjd.exe108⤵PID:620
-
\??\c:\lxxrfxf.exec:\lxxrfxf.exe109⤵PID:888
-
\??\c:\fflfffl.exec:\fflfffl.exe110⤵PID:1416
-
\??\c:\nbtnhb.exec:\nbtnhb.exe111⤵PID:4440
-
\??\c:\thhbhb.exec:\thhbhb.exe112⤵PID:4356
-
\??\c:\ddpjd.exec:\ddpjd.exe113⤵PID:428
-
\??\c:\7vpvj.exec:\7vpvj.exe114⤵PID:4200
-
\??\c:\7jjdd.exec:\7jjdd.exe115⤵PID:940
-
\??\c:\rfxrlxl.exec:\rfxrlxl.exe116⤵PID:1420
-
\??\c:\5htnbb.exec:\5htnbb.exe117⤵PID:3140
-
\??\c:\1vpdp.exec:\1vpdp.exe118⤵PID:4400
-
\??\c:\vjvpv.exec:\vjvpv.exe119⤵PID:3488
-
\??\c:\3rrfrrf.exec:\3rrfrrf.exe120⤵PID:1824
-
\??\c:\htntnh.exec:\htntnh.exe121⤵PID:2752
-
\??\c:\dpvpv.exec:\dpvpv.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-