Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe
Resource
win7-20240903-en
General
-
Target
150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe
-
Size
383KB
-
MD5
e10912ffc2ce6d07940672e9f6dee201
-
SHA1
bd4aa760ce86808e11cbc8efc976640f9e2d5c8c
-
SHA256
150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54
-
SHA512
0e6d55450664835cacafb40c662a94afb3dccacfb8f6799b5d0e54c5ac160fe4bff5282b630cebeed2ee3249bed909a2c39530787b9740be606f8b4826ac096a
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwv:n3C9uYA7okVqdKwaO5CVS
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1508-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1852 dpvpv.exe 3012 xrfxffx.exe 2856 hnbbbb.exe 1904 1djdp.exe 5028 pjddj.exe 2720 hhnhht.exe 808 9jjdd.exe 1672 xrrfrrx.exe 544 lrxrxfx.exe 3020 llflfxf.exe 3808 flrlfxr.exe 1968 hhtnbb.exe 1236 nbtttt.exe 4832 nhnntt.exe 1208 hbbttn.exe 4860 5jpjv.exe 2584 fxlflfl.exe 964 7vpjd.exe 2452 nhnnhh.exe 4548 vdddv.exe 2628 lfrlfff.exe 4708 5bhbhb.exe 2832 fflfxxr.exe 4568 vppjd.exe 1792 dddvv.exe 232 btbbnn.exe 1180 hhhhbt.exe 4684 fflffxr.exe 2376 nnbhbb.exe 4848 flxrlfx.exe 4828 bhthnn.exe 3916 fxxfxff.exe 3940 hnnnbb.exe 4304 dpdvv.exe 2996 7jddd.exe 1432 lfrlffx.exe 3704 btttbb.exe 2000 hhbbtn.exe 2808 djppj.exe 2412 rxfxxlr.exe 2168 lrrxrxr.exe 2436 ntbbbb.exe 208 9nnhtn.exe 812 vpvpp.exe 4564 ffrrrrr.exe 5116 xfxrllf.exe 3812 hbtttb.exe 1596 nthbtt.exe 2724 dpvjd.exe 1916 fffxllr.exe 3096 tnnnhn.exe 2176 btbbnn.exe 4244 dvvpd.exe 2484 rfrxxxr.exe 2924 5lrrrrr.exe 2396 hnnhbb.exe 1384 pppjd.exe 4900 jpjjp.exe 4888 rlxxxrx.exe 4860 fxlffll.exe 2296 ntbbtt.exe 1676 pvvpp.exe 4656 pvdvp.exe 4380 llllflf.exe -
resource yara_rule behavioral2/memory/1508-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1852 1508 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 83 PID 1508 wrote to memory of 1852 1508 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 83 PID 1508 wrote to memory of 1852 1508 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 83 PID 1852 wrote to memory of 3012 1852 dpvpv.exe 84 PID 1852 wrote to memory of 3012 1852 dpvpv.exe 84 PID 1852 wrote to memory of 3012 1852 dpvpv.exe 84 PID 3012 wrote to memory of 2856 3012 xrfxffx.exe 85 PID 3012 wrote to memory of 2856 3012 xrfxffx.exe 85 PID 3012 wrote to memory of 2856 3012 xrfxffx.exe 85 PID 2856 wrote to memory of 1904 2856 hnbbbb.exe 86 PID 2856 wrote to memory of 1904 2856 hnbbbb.exe 86 PID 2856 wrote to memory of 1904 2856 hnbbbb.exe 86 PID 1904 wrote to memory of 5028 1904 1djdp.exe 87 PID 1904 wrote to memory of 5028 1904 1djdp.exe 87 PID 1904 wrote to memory of 5028 1904 1djdp.exe 87 PID 5028 wrote to memory of 2720 5028 pjddj.exe 88 PID 5028 wrote to memory of 2720 5028 pjddj.exe 88 PID 5028 wrote to memory of 2720 5028 pjddj.exe 88 PID 2720 wrote to memory of 808 2720 hhnhht.exe 90 PID 2720 wrote to memory of 808 2720 hhnhht.exe 90 PID 2720 wrote to memory of 808 2720 hhnhht.exe 90 PID 808 wrote to memory of 1672 808 9jjdd.exe 91 PID 808 wrote to memory of 1672 808 9jjdd.exe 91 PID 808 wrote to memory of 1672 808 9jjdd.exe 91 PID 1672 wrote to memory of 544 1672 xrrfrrx.exe 92 PID 1672 wrote to memory of 544 1672 xrrfrrx.exe 92 PID 1672 wrote to memory of 544 1672 xrrfrrx.exe 92 PID 544 wrote to memory of 3020 544 lrxrxfx.exe 94 PID 544 wrote to memory of 3020 544 lrxrxfx.exe 94 PID 544 wrote to memory of 3020 544 lrxrxfx.exe 94 PID 3020 wrote to memory of 3808 3020 llflfxf.exe 95 PID 3020 wrote to memory of 3808 3020 llflfxf.exe 95 PID 3020 wrote to memory of 3808 3020 llflfxf.exe 95 PID 3808 wrote to memory of 1968 3808 flrlfxr.exe 96 PID 3808 wrote to memory of 1968 3808 flrlfxr.exe 96 PID 3808 wrote to memory of 1968 3808 flrlfxr.exe 96 PID 1968 wrote to memory of 1236 1968 hhtnbb.exe 98 PID 1968 wrote to memory of 1236 1968 hhtnbb.exe 98 PID 1968 wrote to memory of 1236 1968 hhtnbb.exe 98 PID 1236 wrote to memory of 4832 1236 nbtttt.exe 99 PID 1236 wrote to memory of 4832 1236 nbtttt.exe 99 PID 1236 wrote to memory of 4832 1236 nbtttt.exe 99 PID 4832 wrote to memory of 1208 4832 nhnntt.exe 100 PID 4832 wrote to memory of 1208 4832 nhnntt.exe 100 PID 4832 wrote to memory of 1208 4832 nhnntt.exe 100 PID 1208 wrote to memory of 4860 1208 hbbttn.exe 101 PID 1208 wrote to memory of 4860 1208 hbbttn.exe 101 PID 1208 wrote to memory of 4860 1208 hbbttn.exe 101 PID 4860 wrote to memory of 2584 4860 5jpjv.exe 102 PID 4860 wrote to memory of 2584 4860 5jpjv.exe 102 PID 4860 wrote to memory of 2584 4860 5jpjv.exe 102 PID 2584 wrote to memory of 964 2584 fxlflfl.exe 103 PID 2584 wrote to memory of 964 2584 fxlflfl.exe 103 PID 2584 wrote to memory of 964 2584 fxlflfl.exe 103 PID 964 wrote to memory of 2452 964 7vpjd.exe 104 PID 964 wrote to memory of 2452 964 7vpjd.exe 104 PID 964 wrote to memory of 2452 964 7vpjd.exe 104 PID 2452 wrote to memory of 4548 2452 nhnnhh.exe 105 PID 2452 wrote to memory of 4548 2452 nhnnhh.exe 105 PID 2452 wrote to memory of 4548 2452 nhnnhh.exe 105 PID 4548 wrote to memory of 2628 4548 vdddv.exe 106 PID 4548 wrote to memory of 2628 4548 vdddv.exe 106 PID 4548 wrote to memory of 2628 4548 vdddv.exe 106 PID 2628 wrote to memory of 4708 2628 lfrlfff.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe"C:\Users\Admin\AppData\Local\Temp\150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\dpvpv.exec:\dpvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xrfxffx.exec:\xrfxffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hnbbbb.exec:\hnbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\1djdp.exec:\1djdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\pjddj.exec:\pjddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\hhnhht.exec:\hhnhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\9jjdd.exec:\9jjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\xrrfrrx.exec:\xrrfrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\lrxrxfx.exec:\lrxrxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\llflfxf.exec:\llflfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\flrlfxr.exec:\flrlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\hhtnbb.exec:\hhtnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nbtttt.exec:\nbtttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\nhnntt.exec:\nhnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\hbbttn.exec:\hbbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\5jpjv.exec:\5jpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\fxlflfl.exec:\fxlflfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\7vpjd.exec:\7vpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\nhnnhh.exec:\nhnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\vdddv.exec:\vdddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\lfrlfff.exec:\lfrlfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5bhbhb.exec:\5bhbhb.exe23⤵
- Executes dropped EXE
PID:4708 -
\??\c:\fflfxxr.exec:\fflfxxr.exe24⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vppjd.exec:\vppjd.exe25⤵
- Executes dropped EXE
PID:4568 -
\??\c:\dddvv.exec:\dddvv.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\btbbnn.exec:\btbbnn.exe27⤵
- Executes dropped EXE
PID:232 -
\??\c:\hhhhbt.exec:\hhhhbt.exe28⤵
- Executes dropped EXE
PID:1180 -
\??\c:\fflffxr.exec:\fflffxr.exe29⤵
- Executes dropped EXE
PID:4684 -
\??\c:\nnbhbb.exec:\nnbhbb.exe30⤵
- Executes dropped EXE
PID:2376 -
\??\c:\flxrlfx.exec:\flxrlfx.exe31⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bhthnn.exec:\bhthnn.exe32⤵
- Executes dropped EXE
PID:4828 -
\??\c:\fxxfxff.exec:\fxxfxff.exe33⤵
- Executes dropped EXE
PID:3916 -
\??\c:\hnnnbb.exec:\hnnnbb.exe34⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dpdvv.exec:\dpdvv.exe35⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7jddd.exec:\7jddd.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lfrlffx.exec:\lfrlffx.exe37⤵
- Executes dropped EXE
PID:1432 -
\??\c:\btttbb.exec:\btttbb.exe38⤵
- Executes dropped EXE
PID:3704 -
\??\c:\hhbbtn.exec:\hhbbtn.exe39⤵
- Executes dropped EXE
PID:2000 -
\??\c:\djppj.exec:\djppj.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rxfxxlr.exec:\rxfxxlr.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lrrxrxr.exec:\lrrxrxr.exe42⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ntbbbb.exec:\ntbbbb.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\9nnhtn.exec:\9nnhtn.exe44⤵
- Executes dropped EXE
PID:208 -
\??\c:\vpvpp.exec:\vpvpp.exe45⤵
- Executes dropped EXE
PID:812 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe46⤵
- Executes dropped EXE
PID:4564 -
\??\c:\xfxrllf.exec:\xfxrllf.exe47⤵
- Executes dropped EXE
PID:5116 -
\??\c:\hbtttb.exec:\hbtttb.exe48⤵
- Executes dropped EXE
PID:3812 -
\??\c:\nthbtt.exec:\nthbtt.exe49⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dpvjd.exec:\dpvjd.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fffxllr.exec:\fffxllr.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tnnnhn.exec:\tnnnhn.exe52⤵
- Executes dropped EXE
PID:3096 -
\??\c:\btbbnn.exec:\btbbnn.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvvpd.exec:\dvvpd.exe54⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rfrxxxr.exec:\rfrxxxr.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5lrrrrr.exec:\5lrrrrr.exe56⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hnnhbb.exec:\hnnhbb.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pppjd.exec:\pppjd.exe58⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jpjjp.exec:\jpjjp.exe59⤵
- Executes dropped EXE
PID:4900 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe60⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fxlffll.exec:\fxlffll.exe61⤵
- Executes dropped EXE
PID:4860 -
\??\c:\ntbbtt.exec:\ntbbtt.exe62⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pvvpp.exec:\pvvpp.exe63⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pvdvp.exec:\pvdvp.exe64⤵
- Executes dropped EXE
PID:4656 -
\??\c:\llllflf.exec:\llllflf.exe65⤵
- Executes dropped EXE
PID:4380 -
\??\c:\btthhh.exec:\btthhh.exe66⤵PID:4548
-
\??\c:\hntbtn.exec:\hntbtn.exe67⤵PID:3548
-
\??\c:\vvddp.exec:\vvddp.exe68⤵PID:2868
-
\??\c:\3flxrrx.exec:\3flxrrx.exe69⤵PID:4932
-
\??\c:\fxlflll.exec:\fxlflll.exe70⤵PID:4024
-
\??\c:\hnthbh.exec:\hnthbh.exe71⤵PID:4568
-
\??\c:\tbhbtt.exec:\tbhbtt.exe72⤵PID:1792
-
\??\c:\vvdvp.exec:\vvdvp.exe73⤵PID:1112
-
\??\c:\lrxrxrl.exec:\lrxrxrl.exe74⤵PID:1020
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe75⤵PID:2040
-
\??\c:\bnnnhh.exec:\bnnnhh.exe76⤵PID:3752
-
\??\c:\btbttt.exec:\btbttt.exe77⤵PID:5112
-
\??\c:\pddvj.exec:\pddvj.exe78⤵PID:5056
-
\??\c:\xrrrlff.exec:\xrrrlff.exe79⤵PID:4220
-
\??\c:\bthhbt.exec:\bthhbt.exe80⤵PID:2960
-
\??\c:\dvpjj.exec:\dvpjj.exe81⤵PID:4308
-
\??\c:\fflxrlf.exec:\fflxrlf.exe82⤵PID:1080
-
\??\c:\frfflrf.exec:\frfflrf.exe83⤵PID:1508
-
\??\c:\ttbtnn.exec:\ttbtnn.exe84⤵PID:3524
-
\??\c:\jvjdd.exec:\jvjdd.exe85⤵PID:4320
-
\??\c:\7jjjd.exec:\7jjjd.exe86⤵PID:4808
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe87⤵PID:1880
-
\??\c:\lxlllll.exec:\lxlllll.exe88⤵PID:4920
-
\??\c:\hhbtnn.exec:\hhbtnn.exe89⤵PID:4076
-
\??\c:\jpvvp.exec:\jpvvp.exe90⤵PID:2184
-
\??\c:\jvvpp.exec:\jvvpp.exe91⤵PID:1000
-
\??\c:\llrrxff.exec:\llrrxff.exe92⤵PID:4256
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe93⤵PID:1524
-
\??\c:\bthhhn.exec:\bthhhn.exe94⤵PID:1160
-
\??\c:\thhbbb.exec:\thhbbb.exe95⤵PID:1944
-
\??\c:\vvvpj.exec:\vvvpj.exe96⤵PID:3016
-
\??\c:\7frrlll.exec:\7frrlll.exe97⤵PID:4364
-
\??\c:\rfllfff.exec:\rfllfff.exe98⤵PID:3808
-
\??\c:\bhttbt.exec:\bhttbt.exe99⤵PID:2500
-
\??\c:\ppjdj.exec:\ppjdj.exe100⤵PID:4560
-
\??\c:\rxffffx.exec:\rxffffx.exe101⤵PID:1968
-
\??\c:\frfflll.exec:\frfflll.exe102⤵PID:4728
-
\??\c:\htnnbb.exec:\htnnbb.exe103⤵PID:3004
-
\??\c:\jvdvj.exec:\jvdvj.exe104⤵PID:4940
-
\??\c:\9pdvp.exec:\9pdvp.exe105⤵PID:1572
-
\??\c:\lllxxxx.exec:\lllxxxx.exe106⤵PID:1492
-
\??\c:\rflfrxr.exec:\rflfrxr.exe107⤵PID:3552
-
\??\c:\tnbbbb.exec:\tnbbbb.exe108⤵PID:2228
-
\??\c:\jdjjd.exec:\jdjjd.exe109⤵PID:2604
-
\??\c:\pdjpp.exec:\pdjpp.exe110⤵PID:1920
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe111⤵PID:380
-
\??\c:\3fflllf.exec:\3fflllf.exe112⤵PID:3296
-
\??\c:\tnbttt.exec:\tnbttt.exe113⤵PID:3688
-
\??\c:\dvdvv.exec:\dvdvv.exe114⤵PID:1708
-
\??\c:\ppjdv.exec:\ppjdv.exe115⤵PID:2152
-
\??\c:\fxfxrff.exec:\fxfxrff.exe116⤵PID:452
-
\??\c:\bbtbnn.exec:\bbtbnn.exe117⤵PID:4484
-
\??\c:\5nnhbb.exec:\5nnhbb.exe118⤵PID:4500
-
\??\c:\vppjv.exec:\vppjv.exe119⤵PID:4496
-
\??\c:\jjvpp.exec:\jjvpp.exe120⤵PID:1960
-
\??\c:\lrrfrxl.exec:\lrrfrxl.exe121⤵PID:4464
-
\??\c:\3nttnb.exec:\3nttnb.exe122⤵PID:3928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-