Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe
Resource
win7-20240903-en
General
-
Target
b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe
-
Size
64KB
-
MD5
9a6b6b4f4e785bb958c9f7081c82add4
-
SHA1
edaa8204e0b1bdf788abdbdba554bb45a06630cb
-
SHA256
b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36
-
SHA512
d5ccf6c5f1adb6fc31463e77a10c5dfaf8e8d5dc65d508074e19027629332a834c7cea7356923423dab3eb1cce46e187a46dfddf8c5477b737bef20472cd949a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPt5:ymb3NkkiQ3mdBjFIj+qX
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4252 tbhhbb.exe 2992 bbbhnt.exe 1068 dpvjd.exe 5008 dvvpj.exe 4592 xffxlfx.exe 1436 thhbtt.exe 4792 5dvdp.exe 3076 vppjv.exe 1960 5rllxrr.exe 4412 nhhnnb.exe 4828 7tbttt.exe 4888 pjpdv.exe 3632 xxlxlrf.exe 1548 tntntn.exe 4028 1tbtth.exe 4712 dvvjd.exe 2408 dvdvp.exe 4812 xfxrffr.exe 3880 9nbtnn.exe 2816 nnnnhh.exe 1540 ddvpd.exe 4156 rxfxlll.exe 1160 rffrllf.exe 2076 bnhhbb.exe 3736 hntnbb.exe 516 pvjpd.exe 2092 fxxxxrx.exe 4024 xrxrllf.exe 3096 ntbbtt.exe 2464 7jjdv.exe 4072 1pjdv.exe 2260 dvddp.exe 4256 rxxrllf.exe 3580 ttnhbb.exe 3508 5hnbbb.exe 3836 vvvvp.exe 4836 dpdvv.exe 860 dppjv.exe 4376 xrrrfff.exe 2280 1lfrlxl.exe 3692 xlrlxrf.exe 2716 nhhbbn.exe 348 5bbntn.exe 3368 7nbnbn.exe 2552 dpjdp.exe 5096 dvjdp.exe 1688 xrrfxrr.exe 4912 fxrxxrl.exe 2088 rrxlxlx.exe 1128 thnhhb.exe 2556 thbntn.exe 1496 djjjj.exe 3652 5vvdp.exe 4940 dvpjp.exe 4412 lflxrrl.exe 1980 rfrrxrr.exe 1524 bbbthb.exe 3208 nbtbnb.exe 4432 vjpvp.exe 536 jpjpd.exe 1548 dppdj.exe 2616 1lfrfxl.exe 736 frfxlfx.exe 960 nnbhhn.exe -
resource yara_rule behavioral2/memory/2704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 4252 2704 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 85 PID 2704 wrote to memory of 4252 2704 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 85 PID 2704 wrote to memory of 4252 2704 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 85 PID 4252 wrote to memory of 2992 4252 tbhhbb.exe 86 PID 4252 wrote to memory of 2992 4252 tbhhbb.exe 86 PID 4252 wrote to memory of 2992 4252 tbhhbb.exe 86 PID 2992 wrote to memory of 1068 2992 bbbhnt.exe 87 PID 2992 wrote to memory of 1068 2992 bbbhnt.exe 87 PID 2992 wrote to memory of 1068 2992 bbbhnt.exe 87 PID 1068 wrote to memory of 5008 1068 dpvjd.exe 88 PID 1068 wrote to memory of 5008 1068 dpvjd.exe 88 PID 1068 wrote to memory of 5008 1068 dpvjd.exe 88 PID 5008 wrote to memory of 4592 5008 dvvpj.exe 89 PID 5008 wrote to memory of 4592 5008 dvvpj.exe 89 PID 5008 wrote to memory of 4592 5008 dvvpj.exe 89 PID 4592 wrote to memory of 1436 4592 xffxlfx.exe 91 PID 4592 wrote to memory of 1436 4592 xffxlfx.exe 91 PID 4592 wrote to memory of 1436 4592 xffxlfx.exe 91 PID 1436 wrote to memory of 4792 1436 thhbtt.exe 92 PID 1436 wrote to memory of 4792 1436 thhbtt.exe 92 PID 1436 wrote to memory of 4792 1436 thhbtt.exe 92 PID 4792 wrote to memory of 3076 4792 5dvdp.exe 93 PID 4792 wrote to memory of 3076 4792 5dvdp.exe 93 PID 4792 wrote to memory of 3076 4792 5dvdp.exe 93 PID 3076 wrote to memory of 1960 3076 vppjv.exe 94 PID 3076 wrote to memory of 1960 3076 vppjv.exe 94 PID 3076 wrote to memory of 1960 3076 vppjv.exe 94 PID 1960 wrote to memory of 4412 1960 5rllxrr.exe 96 PID 1960 wrote to memory of 4412 1960 5rllxrr.exe 96 PID 1960 wrote to memory of 4412 1960 5rllxrr.exe 96 PID 4412 wrote to memory of 4828 4412 nhhnnb.exe 97 PID 4412 wrote to memory of 4828 4412 nhhnnb.exe 97 PID 4412 wrote to memory of 4828 4412 nhhnnb.exe 97 PID 4828 wrote to memory of 4888 4828 7tbttt.exe 98 PID 4828 wrote to memory of 4888 4828 7tbttt.exe 98 PID 4828 wrote to memory of 4888 4828 7tbttt.exe 98 PID 4888 wrote to memory of 3632 4888 pjpdv.exe 99 PID 4888 wrote to memory of 3632 4888 pjpdv.exe 99 PID 4888 wrote to memory of 3632 4888 pjpdv.exe 99 PID 3632 wrote to memory of 1548 3632 xxlxlrf.exe 100 PID 3632 wrote to memory of 1548 3632 xxlxlrf.exe 100 PID 3632 wrote to memory of 1548 3632 xxlxlrf.exe 100 PID 1548 wrote to memory of 4028 1548 tntntn.exe 101 PID 1548 wrote to memory of 4028 1548 tntntn.exe 101 PID 1548 wrote to memory of 4028 1548 tntntn.exe 101 PID 4028 wrote to memory of 4712 4028 1tbtth.exe 102 PID 4028 wrote to memory of 4712 4028 1tbtth.exe 102 PID 4028 wrote to memory of 4712 4028 1tbtth.exe 102 PID 4712 wrote to memory of 2408 4712 dvvjd.exe 103 PID 4712 wrote to memory of 2408 4712 dvvjd.exe 103 PID 4712 wrote to memory of 2408 4712 dvvjd.exe 103 PID 2408 wrote to memory of 4812 2408 dvdvp.exe 104 PID 2408 wrote to memory of 4812 2408 dvdvp.exe 104 PID 2408 wrote to memory of 4812 2408 dvdvp.exe 104 PID 4812 wrote to memory of 3880 4812 xfxrffr.exe 106 PID 4812 wrote to memory of 3880 4812 xfxrffr.exe 106 PID 4812 wrote to memory of 3880 4812 xfxrffr.exe 106 PID 3880 wrote to memory of 2816 3880 9nbtnn.exe 107 PID 3880 wrote to memory of 2816 3880 9nbtnn.exe 107 PID 3880 wrote to memory of 2816 3880 9nbtnn.exe 107 PID 2816 wrote to memory of 1540 2816 nnnnhh.exe 108 PID 2816 wrote to memory of 1540 2816 nnnnhh.exe 108 PID 2816 wrote to memory of 1540 2816 nnnnhh.exe 108 PID 1540 wrote to memory of 4156 1540 ddvpd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe"C:\Users\Admin\AppData\Local\Temp\b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tbhhbb.exec:\tbhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\bbbhnt.exec:\bbbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\dpvjd.exec:\dpvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\dvvpj.exec:\dvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\xffxlfx.exec:\xffxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\thhbtt.exec:\thhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\5dvdp.exec:\5dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\vppjv.exec:\vppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\5rllxrr.exec:\5rllxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\nhhnnb.exec:\nhhnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\7tbttt.exec:\7tbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\pjpdv.exec:\pjpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\xxlxlrf.exec:\xxlxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\tntntn.exec:\tntntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\1tbtth.exec:\1tbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\dvvjd.exec:\dvvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\dvdvp.exec:\dvdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xfxrffr.exec:\xfxrffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\9nbtnn.exec:\9nbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\nnnnhh.exec:\nnnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ddvpd.exec:\ddvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\rxfxlll.exec:\rxfxlll.exe23⤵
- Executes dropped EXE
PID:4156 -
\??\c:\rffrllf.exec:\rffrllf.exe24⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bnhhbb.exec:\bnhhbb.exe25⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hntnbb.exec:\hntnbb.exe26⤵
- Executes dropped EXE
PID:3736 -
\??\c:\pvjpd.exec:\pvjpd.exe27⤵
- Executes dropped EXE
PID:516 -
\??\c:\fxxxxrx.exec:\fxxxxrx.exe28⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xrxrllf.exec:\xrxrllf.exe29⤵
- Executes dropped EXE
PID:4024 -
\??\c:\ntbbtt.exec:\ntbbtt.exe30⤵
- Executes dropped EXE
PID:3096 -
\??\c:\7jjdv.exec:\7jjdv.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\1pjdv.exec:\1pjdv.exe32⤵
- Executes dropped EXE
PID:4072 -
\??\c:\dvddp.exec:\dvddp.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rxxrllf.exec:\rxxrllf.exe34⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ttnhbb.exec:\ttnhbb.exe35⤵
- Executes dropped EXE
PID:3580 -
\??\c:\5hnbbb.exec:\5hnbbb.exe36⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vvvvp.exec:\vvvvp.exe37⤵
- Executes dropped EXE
PID:3836 -
\??\c:\dpdvv.exec:\dpdvv.exe38⤵
- Executes dropped EXE
PID:4836 -
\??\c:\dppjv.exec:\dppjv.exe39⤵
- Executes dropped EXE
PID:860 -
\??\c:\xrrrfff.exec:\xrrrfff.exe40⤵
- Executes dropped EXE
PID:4376 -
\??\c:\1lfrlxl.exec:\1lfrlxl.exe41⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xlrlxrf.exec:\xlrlxrf.exe42⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nhhbbn.exec:\nhhbbn.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5bbntn.exec:\5bbntn.exe44⤵
- Executes dropped EXE
PID:348 -
\??\c:\7nbnbn.exec:\7nbnbn.exe45⤵
- Executes dropped EXE
PID:3368 -
\??\c:\dpjdp.exec:\dpjdp.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvjdp.exec:\dvjdp.exe47⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xrrfxrr.exec:\xrrfxrr.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxrxxrl.exec:\fxrxxrl.exe49⤵
- Executes dropped EXE
PID:4912 -
\??\c:\rrxlxlx.exec:\rrxlxlx.exe50⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thnhhb.exec:\thnhhb.exe51⤵
- Executes dropped EXE
PID:1128 -
\??\c:\thbntn.exec:\thbntn.exe52⤵
- Executes dropped EXE
PID:2556 -
\??\c:\djjjj.exec:\djjjj.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5vvdp.exec:\5vvdp.exe54⤵
- Executes dropped EXE
PID:3652 -
\??\c:\dvpjp.exec:\dvpjp.exe55⤵
- Executes dropped EXE
PID:4940 -
\??\c:\lflxrrl.exec:\lflxrrl.exe56⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rfrrxrr.exec:\rfrrxrr.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bbbthb.exec:\bbbthb.exe58⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nbtbnb.exec:\nbtbnb.exe59⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vjpvp.exec:\vjpvp.exe60⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jpjpd.exec:\jpjpd.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\dppdj.exec:\dppdj.exe62⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1lfrfxl.exec:\1lfrfxl.exe63⤵
- Executes dropped EXE
PID:2616 -
\??\c:\frfxlfx.exec:\frfxlfx.exe64⤵
- Executes dropped EXE
PID:736 -
\??\c:\nnbhhn.exec:\nnbhhn.exe65⤵
- Executes dropped EXE
PID:960 -
\??\c:\pjpdd.exec:\pjpdd.exe66⤵PID:2408
-
\??\c:\jdpdp.exec:\jdpdp.exe67⤵PID:4820
-
\??\c:\dvdpv.exec:\dvdpv.exe68⤵PID:3100
-
\??\c:\5llflfx.exec:\5llflfx.exe69⤵PID:4392
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe70⤵PID:2520
-
\??\c:\htthtn.exec:\htthtn.exe71⤵PID:1480
-
\??\c:\tnnbnh.exec:\tnnbnh.exe72⤵PID:4488
-
\??\c:\bnhthb.exec:\bnhthb.exe73⤵PID:3812
-
\??\c:\jddjp.exec:\jddjp.exe74⤵PID:4060
-
\??\c:\vjjvp.exec:\vjjvp.exe75⤵PID:3536
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe76⤵PID:4624
-
\??\c:\frlrfrf.exec:\frlrfrf.exe77⤵PID:2820
-
\??\c:\btnhhb.exec:\btnhhb.exe78⤵PID:4628
-
\??\c:\bnnbnh.exec:\bnnbnh.exe79⤵PID:2416
-
\??\c:\vvvpv.exec:\vvvpv.exe80⤵PID:5044
-
\??\c:\dpdpd.exec:\dpdpd.exe81⤵PID:2080
-
\??\c:\lxrlrlf.exec:\lxrlrlf.exe82⤵PID:1720
-
\??\c:\lrrfllr.exec:\lrrfllr.exe83⤵PID:2264
-
\??\c:\rfffxfx.exec:\rfffxfx.exe84⤵PID:3184
-
\??\c:\9nnbtn.exec:\9nnbtn.exe85⤵PID:868
-
\??\c:\vjjdj.exec:\vjjdj.exe86⤵PID:2260
-
\??\c:\vvpjv.exec:\vvpjv.exe87⤵PID:2508
-
\??\c:\rrxfrll.exec:\rrxfrll.exe88⤵PID:3372
-
\??\c:\lflrlxx.exec:\lflrlxx.exe89⤵PID:4040
-
\??\c:\nhhtnh.exec:\nhhtnh.exe90⤵PID:3836
-
\??\c:\1bhbhb.exec:\1bhbhb.exe91⤵PID:5032
-
\??\c:\pjdvj.exec:\pjdvj.exe92⤵PID:860
-
\??\c:\vvdpd.exec:\vvdpd.exe93⤵PID:3584
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe94⤵PID:2696
-
\??\c:\lrxrffx.exec:\lrxrffx.exe95⤵PID:4004
-
\??\c:\ttnnbb.exec:\ttnnbb.exe96⤵PID:2716
-
\??\c:\pvvpj.exec:\pvvpj.exe97⤵PID:348
-
\??\c:\rxxlffx.exec:\rxxlffx.exe98⤵PID:4996
-
\??\c:\1xxxrll.exec:\1xxxrll.exe99⤵PID:2552
-
\??\c:\hbhhhh.exec:\hbhhhh.exe100⤵PID:3144
-
\??\c:\bnbbtt.exec:\bnbbtt.exe101⤵PID:1688
-
\??\c:\ddpjv.exec:\ddpjv.exe102⤵PID:1684
-
\??\c:\jdpdv.exec:\jdpdv.exe103⤵PID:704
-
\??\c:\7lrffrr.exec:\7lrffrr.exe104⤵PID:1128
-
\??\c:\btnthb.exec:\btnthb.exe105⤵PID:2028
-
\??\c:\hbbbnn.exec:\hbbbnn.exe106⤵PID:3612
-
\??\c:\1tnhhh.exec:\1tnhhh.exe107⤵PID:32
-
\??\c:\vddjp.exec:\vddjp.exe108⤵PID:4344
-
\??\c:\pvvpj.exec:\pvvpj.exe109⤵PID:3952
-
\??\c:\7jddp.exec:\7jddp.exe110⤵PID:4888
-
\??\c:\rxffxxx.exec:\rxffxxx.exe111⤵PID:964
-
\??\c:\9bhhbh.exec:\9bhhbh.exe112⤵PID:3036
-
\??\c:\nbbthh.exec:\nbbthh.exe113⤵PID:1624
-
\??\c:\djjjp.exec:\djjjp.exe114⤵PID:448
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe115⤵PID:540
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe116⤵PID:908
-
\??\c:\3lllfff.exec:\3lllfff.exe117⤵PID:1772
-
\??\c:\btnhnn.exec:\btnhnn.exe118⤵PID:960
-
\??\c:\vdpjd.exec:\vdpjd.exe119⤵PID:2408
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe120⤵PID:3924
-
\??\c:\tntttt.exec:\tntttt.exe121⤵PID:2268
-
\??\c:\tnttht.exec:\tnttht.exe122⤵PID:512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-