Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tenkovi.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
tenkovi.exe
-
Size
426KB
-
MD5
7c57f3ec878c31b87695949efb2f4670
-
SHA1
b2c93693d56f95690d55e06dbc2505f85fd7776f
-
SHA256
da0f7a737c235298caf3ed9ac9b988909ed614e00243083e11569f327a5a6c35
-
SHA512
7f8ca7902a8be6711ecc364ab959bb912d59d954670ecfdaea2eea0dfc636634d1b66743bc13a8f69083ace4644eede9cfd0284277be301ca924436a22cb060f
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSpTOttUpHXXxxuvCz:Pcm7ImGddXtWrXD486jJqTGUpHxuQ
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2792-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-224-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/108-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-643-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1524-713-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2768-932-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-984-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 bnhnbh.exe 2524 3ddpp.exe 2820 9nbbbn.exe 2684 266846.exe 2448 a2080.exe 2532 5rlrxlr.exe 2484 4080444.exe 2464 4442266.exe 1304 288220.exe 2608 0842248.exe 2772 028882.exe 2928 jdpvd.exe 568 xxrrrrf.exe 1584 ttnbnn.exe 2228 066084.exe 1836 6046222.exe 1032 bntttb.exe 1300 060408.exe 2896 vjvpj.exe 828 jjdvd.exe 3052 hbtbnb.exe 2380 606022.exe 1244 046262.exe 1744 482488.exe 1764 26808.exe 108 1vvjd.exe 1980 bththt.exe 2016 ffffxll.exe 2020 thhnhh.exe 872 0046660.exe 2356 hbtnnn.exe 2188 nhbhbh.exe 2560 000484.exe 2080 fxrxlrf.exe 1704 6040680.exe 2820 62828.exe 2536 lrrrffr.exe 2980 3nbnnh.exe 2640 0846244.exe 2200 tbbhnt.exe 2612 2662002.exe 2128 4868628.exe 1824 nnhthn.exe 612 vvvpj.exe 2740 m6064.exe 2716 6460620.exe 1716 2448044.exe 1636 bhbhth.exe 1484 8262868.exe 1720 nhtthn.exe 2224 6040246.exe 1772 88248.exe 1964 c040884.exe 2880 jdvvd.exe 1032 1vpvd.exe 1028 608200.exe 2516 7rfxfll.exe 1124 02006.exe 1496 hhbbhh.exe 1380 420022.exe 1856 7xxxrlr.exe 380 42820.exe 824 htbhnn.exe 1744 4244040.exe -
resource yara_rule behavioral1/memory/1688-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-487-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-570-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-629-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-727-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-789-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-812-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-825-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-932-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-958-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-973-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-984-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-991-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-998-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-1005-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66080.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u806888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k42806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g4280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6084024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2028062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8088846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2792 1688 tenkovi.exe 30 PID 1688 wrote to memory of 2792 1688 tenkovi.exe 30 PID 1688 wrote to memory of 2792 1688 tenkovi.exe 30 PID 1688 wrote to memory of 2792 1688 tenkovi.exe 30 PID 2792 wrote to memory of 2524 2792 bnhnbh.exe 31 PID 2792 wrote to memory of 2524 2792 bnhnbh.exe 31 PID 2792 wrote to memory of 2524 2792 bnhnbh.exe 31 PID 2792 wrote to memory of 2524 2792 bnhnbh.exe 31 PID 2524 wrote to memory of 2820 2524 3ddpp.exe 32 PID 2524 wrote to memory of 2820 2524 3ddpp.exe 32 PID 2524 wrote to memory of 2820 2524 3ddpp.exe 32 PID 2524 wrote to memory of 2820 2524 3ddpp.exe 32 PID 2820 wrote to memory of 2684 2820 9nbbbn.exe 33 PID 2820 wrote to memory of 2684 2820 9nbbbn.exe 33 PID 2820 wrote to memory of 2684 2820 9nbbbn.exe 33 PID 2820 wrote to memory of 2684 2820 9nbbbn.exe 33 PID 2684 wrote to memory of 2448 2684 266846.exe 34 PID 2684 wrote to memory of 2448 2684 266846.exe 34 PID 2684 wrote to memory of 2448 2684 266846.exe 34 PID 2684 wrote to memory of 2448 2684 266846.exe 34 PID 2448 wrote to memory of 2532 2448 a2080.exe 35 PID 2448 wrote to memory of 2532 2448 a2080.exe 35 PID 2448 wrote to memory of 2532 2448 a2080.exe 35 PID 2448 wrote to memory of 2532 2448 a2080.exe 35 PID 2532 wrote to memory of 2484 2532 5rlrxlr.exe 36 PID 2532 wrote to memory of 2484 2532 5rlrxlr.exe 36 PID 2532 wrote to memory of 2484 2532 5rlrxlr.exe 36 PID 2532 wrote to memory of 2484 2532 5rlrxlr.exe 36 PID 2484 wrote to memory of 2464 2484 4080444.exe 37 PID 2484 wrote to memory of 2464 2484 4080444.exe 37 PID 2484 wrote to memory of 2464 2484 4080444.exe 37 PID 2484 wrote to memory of 2464 2484 4080444.exe 37 PID 2464 wrote to memory of 1304 2464 4442266.exe 38 PID 2464 wrote to memory of 1304 2464 4442266.exe 38 PID 2464 wrote to memory of 1304 2464 4442266.exe 38 PID 2464 wrote to memory of 1304 2464 4442266.exe 38 PID 1304 wrote to memory of 2608 1304 288220.exe 39 PID 1304 wrote to memory of 2608 1304 288220.exe 39 PID 1304 wrote to memory of 2608 1304 288220.exe 39 PID 1304 wrote to memory of 2608 1304 288220.exe 39 PID 2608 wrote to memory of 2772 2608 0842248.exe 40 PID 2608 wrote to memory of 2772 2608 0842248.exe 40 PID 2608 wrote to memory of 2772 2608 0842248.exe 40 PID 2608 wrote to memory of 2772 2608 0842248.exe 40 PID 2772 wrote to memory of 2928 2772 028882.exe 41 PID 2772 wrote to memory of 2928 2772 028882.exe 41 PID 2772 wrote to memory of 2928 2772 028882.exe 41 PID 2772 wrote to memory of 2928 2772 028882.exe 41 PID 2928 wrote to memory of 568 2928 jdpvd.exe 42 PID 2928 wrote to memory of 568 2928 jdpvd.exe 42 PID 2928 wrote to memory of 568 2928 jdpvd.exe 42 PID 2928 wrote to memory of 568 2928 jdpvd.exe 42 PID 568 wrote to memory of 1584 568 xxrrrrf.exe 43 PID 568 wrote to memory of 1584 568 xxrrrrf.exe 43 PID 568 wrote to memory of 1584 568 xxrrrrf.exe 43 PID 568 wrote to memory of 1584 568 xxrrrrf.exe 43 PID 1584 wrote to memory of 2228 1584 ttnbnn.exe 44 PID 1584 wrote to memory of 2228 1584 ttnbnn.exe 44 PID 1584 wrote to memory of 2228 1584 ttnbnn.exe 44 PID 1584 wrote to memory of 2228 1584 ttnbnn.exe 44 PID 2228 wrote to memory of 1836 2228 066084.exe 45 PID 2228 wrote to memory of 1836 2228 066084.exe 45 PID 2228 wrote to memory of 1836 2228 066084.exe 45 PID 2228 wrote to memory of 1836 2228 066084.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\tenkovi.exe"C:\Users\Admin\AppData\Local\Temp\tenkovi.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bnhnbh.exec:\bnhnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\3ddpp.exec:\3ddpp.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\9nbbbn.exec:\9nbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\266846.exec:\266846.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\a2080.exec:\a2080.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5rlrxlr.exec:\5rlrxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\4080444.exec:\4080444.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\4442266.exec:\4442266.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\288220.exec:\288220.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\0842248.exec:\0842248.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\028882.exec:\028882.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jdpvd.exec:\jdpvd.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xxrrrrf.exec:\xxrrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\ttnbnn.exec:\ttnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\066084.exec:\066084.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\6046222.exec:\6046222.exe17⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bntttb.exec:\bntttb.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\060408.exec:\060408.exe19⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vjvpj.exec:\vjvpj.exe20⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jjdvd.exec:\jjdvd.exe21⤵
- Executes dropped EXE
PID:828 -
\??\c:\hbtbnb.exec:\hbtbnb.exe22⤵
- Executes dropped EXE
PID:3052 -
\??\c:\606022.exec:\606022.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\046262.exec:\046262.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\482488.exec:\482488.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\26808.exec:\26808.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1vvjd.exec:\1vvjd.exe27⤵
- Executes dropped EXE
PID:108 -
\??\c:\bththt.exec:\bththt.exe28⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffffxll.exec:\ffffxll.exe29⤵
- Executes dropped EXE
PID:2016 -
\??\c:\thhnhh.exec:\thhnhh.exe30⤵
- Executes dropped EXE
PID:2020 -
\??\c:\0046660.exec:\0046660.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbtnnn.exec:\hbtnnn.exe32⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhbhbh.exec:\nhbhbh.exe33⤵
- Executes dropped EXE
PID:2188 -
\??\c:\000484.exec:\000484.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\6040680.exec:\6040680.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\62828.exec:\62828.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lrrrffr.exec:\lrrrffr.exe38⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3nbnnh.exec:\3nbnnh.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\0846244.exec:\0846244.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tbbhnt.exec:\tbbhnt.exe41⤵
- Executes dropped EXE
PID:2200 -
\??\c:\2662002.exec:\2662002.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\4868628.exec:\4868628.exe43⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnhthn.exec:\nnhthn.exe44⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvvpj.exec:\vvvpj.exe45⤵
- Executes dropped EXE
PID:612 -
\??\c:\m6064.exec:\m6064.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\6460620.exec:\6460620.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\2448044.exec:\2448044.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bhbhth.exec:\bhbhth.exe49⤵
- Executes dropped EXE
PID:1636 -
\??\c:\8262868.exec:\8262868.exe50⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhtthn.exec:\nhtthn.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\6040246.exec:\6040246.exe52⤵
- Executes dropped EXE
PID:2224 -
\??\c:\88248.exec:\88248.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\c040884.exec:\c040884.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jdvvd.exec:\jdvvd.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1vpvd.exec:\1vpvd.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\608200.exec:\608200.exe57⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7rfxfll.exec:\7rfxfll.exe58⤵
- Executes dropped EXE
PID:2516 -
\??\c:\02006.exec:\02006.exe59⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hhbbhh.exec:\hhbbhh.exe60⤵
- Executes dropped EXE
PID:1496 -
\??\c:\420022.exec:\420022.exe61⤵
- Executes dropped EXE
PID:1380 -
\??\c:\7xxxrlr.exec:\7xxxrlr.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\42820.exec:\42820.exe63⤵
- Executes dropped EXE
PID:380 -
\??\c:\htbhnn.exec:\htbhnn.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\4244040.exec:\4244040.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\86484.exec:\86484.exe66⤵PID:1320
-
\??\c:\9rlllxr.exec:\9rlllxr.exe67⤵PID:3068
-
\??\c:\dpjjj.exec:\dpjjj.exe68⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\lxffffr.exec:\lxffffr.exe69⤵PID:3056
-
\??\c:\1pvvj.exec:\1pvvj.exe70⤵PID:2008
-
\??\c:\64224.exec:\64224.exe71⤵PID:840
-
\??\c:\u084224.exec:\u084224.exe72⤵PID:2852
-
\??\c:\82024.exec:\82024.exe73⤵PID:872
-
\??\c:\a6402.exec:\a6402.exe74⤵PID:1676
-
\??\c:\s0224.exec:\s0224.exe75⤵PID:2512
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe76⤵PID:2632
-
\??\c:\lxlllll.exec:\lxlllll.exe77⤵PID:2544
-
\??\c:\jpjpp.exec:\jpjpp.exe78⤵PID:2624
-
\??\c:\xlrfffl.exec:\xlrfffl.exe79⤵PID:2660
-
\??\c:\0822006.exec:\0822006.exe80⤵PID:2444
-
\??\c:\462604.exec:\462604.exe81⤵PID:2752
-
\??\c:\42808.exec:\42808.exe82⤵PID:2644
-
\??\c:\nbnbnn.exec:\nbnbnn.exe83⤵PID:2984
-
\??\c:\4062060.exec:\4062060.exe84⤵PID:2688
-
\??\c:\7htbtn.exec:\7htbtn.exe85⤵PID:2328
-
\??\c:\7lxfrxf.exec:\7lxfrxf.exe86⤵PID:1476
-
\??\c:\3rfllxl.exec:\3rfllxl.exe87⤵PID:2520
-
\??\c:\1jvvv.exec:\1jvvv.exe88⤵PID:2732
-
\??\c:\dvpvd.exec:\dvpvd.exe89⤵PID:2776
-
\??\c:\08004.exec:\08004.exe90⤵PID:2312
-
\??\c:\5vjjp.exec:\5vjjp.exe91⤵PID:1444
-
\??\c:\q80666.exec:\q80666.exe92⤵PID:1928
-
\??\c:\604400.exec:\604400.exe93⤵PID:484
-
\??\c:\tbhntt.exec:\tbhntt.exe94⤵PID:1524
-
\??\c:\202240.exec:\202240.exe95⤵PID:2228
-
\??\c:\jvppv.exec:\jvppv.exe96⤵PID:344
-
\??\c:\a0662.exec:\a0662.exe97⤵PID:2952
-
\??\c:\68002.exec:\68002.exe98⤵PID:1756
-
\??\c:\jvpvd.exec:\jvpvd.exe99⤵PID:1300
-
\??\c:\hnhbhh.exec:\hnhbhh.exe100⤵PID:2896
-
\??\c:\424422.exec:\424422.exe101⤵PID:308
-
\??\c:\s4666.exec:\s4666.exe102⤵PID:1668
-
\??\c:\7tnnhh.exec:\7tnnhh.exe103⤵PID:1108
-
\??\c:\s2444.exec:\s2444.exe104⤵PID:1432
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe105⤵PID:1972
-
\??\c:\jpdpp.exec:\jpdpp.exe106⤵PID:2648
-
\??\c:\26802.exec:\26802.exe107⤵PID:956
-
\??\c:\g4284.exec:\g4284.exe108⤵PID:632
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe109⤵PID:108
-
\??\c:\o868680.exec:\o868680.exe110⤵PID:2268
-
\??\c:\8468422.exec:\8468422.exe111⤵PID:2084
-
\??\c:\3tntnt.exec:\3tntnt.exe112⤵PID:1508
-
\??\c:\w64404.exec:\w64404.exe113⤵PID:1220
-
\??\c:\pjjpj.exec:\pjjpj.exe114⤵PID:2040
-
\??\c:\26442.exec:\26442.exe115⤵PID:2356
-
\??\c:\dvjpj.exec:\dvjpj.exe116⤵PID:2188
-
\??\c:\bbtbnn.exec:\bbtbnn.exe117⤵PID:2564
-
\??\c:\dvpvp.exec:\dvpvp.exe118⤵PID:2524
-
\??\c:\84286.exec:\84286.exe119⤵PID:2620
-
\??\c:\6246628.exec:\6246628.exe120⤵PID:2552
-
\??\c:\9vjpv.exec:\9vjpv.exe121⤵PID:2684
-
\??\c:\tntbtn.exec:\tntbtn.exe122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-