Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 10:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eaf1f5a94189ec963d5692d428d5c390N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
eaf1f5a94189ec963d5692d428d5c390N.exe
-
Size
64KB
-
MD5
eaf1f5a94189ec963d5692d428d5c390
-
SHA1
ce250897becd6dc02da5e96bd28eebea707108f8
-
SHA256
9ac72314d261bcda0fd8e985fcca41c1f520fa36b985cdca4911f05c203441cd
-
SHA512
e86e47a830b969fba79aa9be3d21f219e9b8555f88eea9a9603ad5c8f730405397feb9ff23fbf697b65999fa61e4f064f11e391e2fac6cd92031c9f5ffb35999
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNL:ymb3NkkiQ3mdBjFIvlpL
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4312-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3276 5nhhbb.exe 2212 pdvpp.exe 3844 thhtht.exe 2144 bhhhhh.exe 4248 xlfxrlf.exe 4184 bhbhht.exe 1076 ntnbnn.exe 2236 fxxrrfx.exe 3768 rrffxxx.exe 312 tnnntt.exe 2764 pjppj.exe 1176 1pvpj.exe 5056 rlrfxfx.exe 2292 bhnhbb.exe 1188 dvjvj.exe 4648 xxfxllx.exe 2404 httnnn.exe 1560 jjdpv.exe 3856 rxfxxfx.exe 4032 rlfflrl.exe 3252 7bbbbb.exe 2892 vvvdv.exe 1548 dpvpp.exe 4900 ffrrxff.exe 4036 nhhnhn.exe 2480 bnbthh.exe 764 pjjdv.exe 2156 1vpjp.exe 4620 rfxlfff.exe 1932 1hntnn.exe 3284 nhttth.exe 3272 vvvvp.exe 1908 xxlfffr.exe 3460 fxrfrfr.exe 728 bbhhhh.exe 4800 djjpj.exe 4512 jddjp.exe 3988 rllxrrr.exe 3280 xxrrrxx.exe 2992 5nntbh.exe 3776 5bhhtb.exe 1420 tbhnnb.exe 4564 djjjd.exe 5012 djjdd.exe 4008 lxfxxxl.exe 3060 hbnnnb.exe 2212 ttnhnt.exe 2084 3dppp.exe 3412 ddvvp.exe 2144 xfxxflr.exe 1220 btnbnb.exe 1232 tbhtbb.exe 1364 vjdvv.exe 3264 lrrrffl.exe 3888 rxfxxrf.exe 5076 nntthn.exe 224 jjppp.exe 4676 9djjd.exe 1376 fxxflxl.exe 2764 thnnth.exe 4072 nnttnn.exe 1176 pvddj.exe 868 rrrflll.exe 4868 rfffxxx.exe -
resource yara_rule behavioral2/memory/4312-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 3276 4312 eaf1f5a94189ec963d5692d428d5c390N.exe 83 PID 4312 wrote to memory of 3276 4312 eaf1f5a94189ec963d5692d428d5c390N.exe 83 PID 4312 wrote to memory of 3276 4312 eaf1f5a94189ec963d5692d428d5c390N.exe 83 PID 3276 wrote to memory of 2212 3276 5nhhbb.exe 84 PID 3276 wrote to memory of 2212 3276 5nhhbb.exe 84 PID 3276 wrote to memory of 2212 3276 5nhhbb.exe 84 PID 2212 wrote to memory of 3844 2212 pdvpp.exe 85 PID 2212 wrote to memory of 3844 2212 pdvpp.exe 85 PID 2212 wrote to memory of 3844 2212 pdvpp.exe 85 PID 3844 wrote to memory of 2144 3844 thhtht.exe 87 PID 3844 wrote to memory of 2144 3844 thhtht.exe 87 PID 3844 wrote to memory of 2144 3844 thhtht.exe 87 PID 2144 wrote to memory of 4248 2144 bhhhhh.exe 88 PID 2144 wrote to memory of 4248 2144 bhhhhh.exe 88 PID 2144 wrote to memory of 4248 2144 bhhhhh.exe 88 PID 4248 wrote to memory of 4184 4248 xlfxrlf.exe 89 PID 4248 wrote to memory of 4184 4248 xlfxrlf.exe 89 PID 4248 wrote to memory of 4184 4248 xlfxrlf.exe 89 PID 4184 wrote to memory of 1076 4184 bhbhht.exe 91 PID 4184 wrote to memory of 1076 4184 bhbhht.exe 91 PID 4184 wrote to memory of 1076 4184 bhbhht.exe 91 PID 1076 wrote to memory of 2236 1076 ntnbnn.exe 92 PID 1076 wrote to memory of 2236 1076 ntnbnn.exe 92 PID 1076 wrote to memory of 2236 1076 ntnbnn.exe 92 PID 2236 wrote to memory of 3768 2236 fxxrrfx.exe 93 PID 2236 wrote to memory of 3768 2236 fxxrrfx.exe 93 PID 2236 wrote to memory of 3768 2236 fxxrrfx.exe 93 PID 3768 wrote to memory of 312 3768 rrffxxx.exe 94 PID 3768 wrote to memory of 312 3768 rrffxxx.exe 94 PID 3768 wrote to memory of 312 3768 rrffxxx.exe 94 PID 312 wrote to memory of 2764 312 tnnntt.exe 95 PID 312 wrote to memory of 2764 312 tnnntt.exe 95 PID 312 wrote to memory of 2764 312 tnnntt.exe 95 PID 2764 wrote to memory of 1176 2764 pjppj.exe 96 PID 2764 wrote to memory of 1176 2764 pjppj.exe 96 PID 2764 wrote to memory of 1176 2764 pjppj.exe 96 PID 1176 wrote to memory of 5056 1176 1pvpj.exe 97 PID 1176 wrote to memory of 5056 1176 1pvpj.exe 97 PID 1176 wrote to memory of 5056 1176 1pvpj.exe 97 PID 5056 wrote to memory of 2292 5056 rlrfxfx.exe 98 PID 5056 wrote to memory of 2292 5056 rlrfxfx.exe 98 PID 5056 wrote to memory of 2292 5056 rlrfxfx.exe 98 PID 2292 wrote to memory of 1188 2292 bhnhbb.exe 99 PID 2292 wrote to memory of 1188 2292 bhnhbb.exe 99 PID 2292 wrote to memory of 1188 2292 bhnhbb.exe 99 PID 1188 wrote to memory of 4648 1188 dvjvj.exe 100 PID 1188 wrote to memory of 4648 1188 dvjvj.exe 100 PID 1188 wrote to memory of 4648 1188 dvjvj.exe 100 PID 4648 wrote to memory of 2404 4648 xxfxllx.exe 101 PID 4648 wrote to memory of 2404 4648 xxfxllx.exe 101 PID 4648 wrote to memory of 2404 4648 xxfxllx.exe 101 PID 2404 wrote to memory of 1560 2404 httnnn.exe 103 PID 2404 wrote to memory of 1560 2404 httnnn.exe 103 PID 2404 wrote to memory of 1560 2404 httnnn.exe 103 PID 1560 wrote to memory of 3856 1560 jjdpv.exe 104 PID 1560 wrote to memory of 3856 1560 jjdpv.exe 104 PID 1560 wrote to memory of 3856 1560 jjdpv.exe 104 PID 3856 wrote to memory of 4032 3856 rxfxxfx.exe 105 PID 3856 wrote to memory of 4032 3856 rxfxxfx.exe 105 PID 3856 wrote to memory of 4032 3856 rxfxxfx.exe 105 PID 4032 wrote to memory of 3252 4032 rlfflrl.exe 106 PID 4032 wrote to memory of 3252 4032 rlfflrl.exe 106 PID 4032 wrote to memory of 3252 4032 rlfflrl.exe 106 PID 3252 wrote to memory of 2892 3252 7bbbbb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaf1f5a94189ec963d5692d428d5c390N.exe"C:\Users\Admin\AppData\Local\Temp\eaf1f5a94189ec963d5692d428d5c390N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\5nhhbb.exec:\5nhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\pdvpp.exec:\pdvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\thhtht.exec:\thhtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\bhhhhh.exec:\bhhhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\bhbhht.exec:\bhbhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\ntnbnn.exec:\ntnbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\fxxrrfx.exec:\fxxrrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rrffxxx.exec:\rrffxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\tnnntt.exec:\tnnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\pjppj.exec:\pjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\1pvpj.exec:\1pvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\rlrfxfx.exec:\rlrfxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bhnhbb.exec:\bhnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\dvjvj.exec:\dvjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xxfxllx.exec:\xxfxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\httnnn.exec:\httnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\jjdpv.exec:\jjdpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rxfxxfx.exec:\rxfxxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\rlfflrl.exec:\rlfflrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\7bbbbb.exec:\7bbbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\vvvdv.exec:\vvvdv.exe23⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpvpp.exec:\dpvpp.exe24⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ffrrxff.exec:\ffrrxff.exe25⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nhhnhn.exec:\nhhnhn.exe26⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bnbthh.exec:\bnbthh.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\1vpjp.exec:\1vpjp.exe29⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rfxlfff.exec:\rfxlfff.exe30⤵
- Executes dropped EXE
PID:4620 -
\??\c:\1hntnn.exec:\1hntnn.exe31⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nhttth.exec:\nhttth.exe32⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vvvvp.exec:\vvvvp.exe33⤵
- Executes dropped EXE
PID:3272 -
\??\c:\xxlfffr.exec:\xxlfffr.exe34⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe35⤵
- Executes dropped EXE
PID:3460 -
\??\c:\bbhhhh.exec:\bbhhhh.exe36⤵
- Executes dropped EXE
PID:728 -
\??\c:\djjpj.exec:\djjpj.exe37⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jddjp.exec:\jddjp.exe38⤵
- Executes dropped EXE
PID:4512 -
\??\c:\rllxrrr.exec:\rllxrrr.exe39⤵
- Executes dropped EXE
PID:3988 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe40⤵
- Executes dropped EXE
PID:3280 -
\??\c:\5nntbh.exec:\5nntbh.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5bhhtb.exec:\5bhhtb.exe42⤵
- Executes dropped EXE
PID:3776 -
\??\c:\tbhnnb.exec:\tbhnnb.exe43⤵
- Executes dropped EXE
PID:1420 -
\??\c:\djjjd.exec:\djjjd.exe44⤵
- Executes dropped EXE
PID:4564 -
\??\c:\djjdd.exec:\djjdd.exe45⤵
- Executes dropped EXE
PID:5012 -
\??\c:\lxfxxxl.exec:\lxfxxxl.exe46⤵
- Executes dropped EXE
PID:4008 -
\??\c:\hbnnnb.exec:\hbnnnb.exe47⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ttnhnt.exec:\ttnhnt.exe48⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3dppp.exec:\3dppp.exe49⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ddvvp.exec:\ddvvp.exe50⤵
- Executes dropped EXE
PID:3412 -
\??\c:\xfxxflr.exec:\xfxxflr.exe51⤵
- Executes dropped EXE
PID:2144 -
\??\c:\btnbnb.exec:\btnbnb.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\tbhtbb.exec:\tbhtbb.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vjdvv.exec:\vjdvv.exe54⤵
- Executes dropped EXE
PID:1364 -
\??\c:\lrrrffl.exec:\lrrrffl.exe55⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rxfxxrf.exec:\rxfxxrf.exe56⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nntthn.exec:\nntthn.exe57⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jjppp.exec:\jjppp.exe58⤵
- Executes dropped EXE
PID:224 -
\??\c:\9djjd.exec:\9djjd.exe59⤵
- Executes dropped EXE
PID:4676 -
\??\c:\fxxflxl.exec:\fxxflxl.exe60⤵
- Executes dropped EXE
PID:1376 -
\??\c:\thnnth.exec:\thnnth.exe61⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nnttnn.exec:\nnttnn.exe62⤵
- Executes dropped EXE
PID:4072 -
\??\c:\pvddj.exec:\pvddj.exe63⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rrrflll.exec:\rrrflll.exe64⤵
- Executes dropped EXE
PID:868 -
\??\c:\rfffxxx.exec:\rfffxxx.exe65⤵
- Executes dropped EXE
PID:4868 -
\??\c:\nhbbhh.exec:\nhbbhh.exe66⤵PID:3884
-
\??\c:\vjddp.exec:\vjddp.exe67⤵PID:2932
-
\??\c:\dddvd.exec:\dddvd.exe68⤵PID:1072
-
\??\c:\7rrfxrl.exec:\7rrfxrl.exe69⤵PID:2276
-
\??\c:\fxxrrxx.exec:\fxxrrxx.exe70⤵PID:1020
-
\??\c:\7tnnhn.exec:\7tnnhn.exe71⤵PID:4856
-
\??\c:\tbhtnh.exec:\tbhtnh.exe72⤵PID:1644
-
\??\c:\7ddvp.exec:\7ddvp.exe73⤵PID:2244
-
\??\c:\xlfxllf.exec:\xlfxllf.exe74⤵PID:4488
-
\??\c:\1rlfxxx.exec:\1rlfxxx.exe75⤵PID:2868
-
\??\c:\1btnhb.exec:\1btnhb.exe76⤵PID:2892
-
\??\c:\djdpp.exec:\djdpp.exe77⤵PID:2748
-
\??\c:\3xxrlfx.exec:\3xxrlfx.exe78⤵PID:4140
-
\??\c:\3hnnnt.exec:\3hnnnt.exe79⤵PID:1952
-
\??\c:\jpddd.exec:\jpddd.exe80⤵PID:1036
-
\??\c:\1vdvp.exec:\1vdvp.exe81⤵PID:2480
-
\??\c:\9fxffff.exec:\9fxffff.exe82⤵PID:764
-
\??\c:\tntthb.exec:\tntthb.exe83⤵PID:4604
-
\??\c:\jpdjd.exec:\jpdjd.exe84⤵PID:1580
-
\??\c:\rxxrfff.exec:\rxxrfff.exe85⤵PID:3404
-
\??\c:\7xflfrf.exec:\7xflfrf.exe86⤵PID:632
-
\??\c:\3bnhht.exec:\3bnhht.exe87⤵PID:1980
-
\??\c:\dvvpp.exec:\dvvpp.exe88⤵PID:672
-
\??\c:\dddvd.exec:\dddvd.exe89⤵PID:3688
-
\??\c:\rxxfxxl.exec:\rxxfxxl.exe90⤵PID:2424
-
\??\c:\hnbbht.exec:\hnbbht.exe91⤵PID:3528
-
\??\c:\dppjd.exec:\dppjd.exe92⤵PID:4500
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe93⤵PID:1844
-
\??\c:\llrrxxl.exec:\llrrxxl.exe94⤵PID:2796
-
\??\c:\httnht.exec:\httnht.exe95⤵PID:1664
-
\??\c:\9jvpd.exec:\9jvpd.exe96⤵PID:792
-
\??\c:\xxrlffx.exec:\xxrlffx.exe97⤵PID:332
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe98⤵PID:4432
-
\??\c:\bbnnhn.exec:\bbnnhn.exe99⤵PID:4464
-
\??\c:\9bhbhh.exec:\9bhbhh.exe100⤵PID:4452
-
\??\c:\jpvvp.exec:\jpvvp.exe101⤵PID:4312
-
\??\c:\fflrflr.exec:\fflrflr.exe102⤵PID:4688
-
\??\c:\lffrllr.exec:\lffrllr.exe103⤵PID:3680
-
\??\c:\hhhbbh.exec:\hhhbbh.exe104⤵PID:2212
-
\??\c:\nnnbnb.exec:\nnnbnb.exe105⤵PID:536
-
\??\c:\jddvv.exec:\jddvv.exe106⤵PID:3412
-
\??\c:\dvjvv.exec:\dvjvv.exe107⤵PID:1064
-
\??\c:\llrrffx.exec:\llrrffx.exe108⤵PID:3224
-
\??\c:\thbbbb.exec:\thbbbb.exe109⤵PID:1232
-
\??\c:\nnnhbb.exec:\nnnhbb.exe110⤵PID:1824
-
\??\c:\vjjdv.exec:\vjjdv.exe111⤵PID:3820
-
\??\c:\fxxrllf.exec:\fxxrllf.exe112⤵PID:2364
-
\??\c:\flrllxx.exec:\flrllxx.exe113⤵PID:2020
-
\??\c:\hnnnhh.exec:\hnnnhh.exe114⤵PID:3676
-
\??\c:\pjdpv.exec:\pjdpv.exe115⤵PID:4120
-
\??\c:\9xxffrl.exec:\9xxffrl.exe116⤵PID:4776
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe117⤵PID:4076
-
\??\c:\bhthnb.exec:\bhthnb.exe118⤵PID:2072
-
\??\c:\5bhbhh.exec:\5bhbhh.exe119⤵PID:1696
-
\??\c:\jdvvd.exec:\jdvvd.exe120⤵PID:2412
-
\??\c:\pdjdp.exec:\pdjdp.exe121⤵PID:3052
-
\??\c:\bbnnbb.exec:\bbnnbb.exe122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-