Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07d2bb369a31efed7f54403f8cd0a430N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
07d2bb369a31efed7f54403f8cd0a430N.exe
-
Size
73KB
-
MD5
07d2bb369a31efed7f54403f8cd0a430
-
SHA1
d704a51ba3cd67f817757d0076b042893ef72d49
-
SHA256
5e4d10c4af11c9880f84662b7e2a4ed542e276829fe6dc724180e7d7422f8991
-
SHA512
0a47359f59e56f1b04da126a2d59392bfcce6342e018af02d5134b0f714893ee4ccafa7f926c889e0a3d24d65ab5c7d88e0c8fb7ca7e4661e3d741a8d3b895c5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfeyj:ymb3NkkiQ3mdBjFIgUEBeyj
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3172-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4732 bbhbnh.exe 4004 ppdvd.exe 1452 jpdjj.exe 404 rfffxxf.exe 2124 frxrrrx.exe 4516 tthbhn.exe 3296 rlxffxx.exe 4640 bhnbth.exe 1760 jpvpp.exe 2588 rrxlffx.exe 2032 rrxxfff.exe 2420 hbnnnt.exe 2736 xffffff.exe 4744 xrlllrr.exe 4564 3hnnnt.exe 4792 5djjp.exe 1672 lrrrllf.exe 1492 rxllrxr.exe 940 ttttth.exe 2316 pvddv.exe 1012 5dppp.exe 1876 flrlfff.exe 3600 htbbtb.exe 1968 hthhbb.exe 2372 3pvdv.exe 4320 llfxxxx.exe 3824 nhhnnn.exe 4484 hhbttt.exe 3748 vpjdv.exe 5024 lxxxrrl.exe 2196 tbtthn.exe 4884 tnhntt.exe 3988 ddpdp.exe 1660 tttttb.exe 1304 nhbtnh.exe 2136 jpvpj.exe 5104 pvjdv.exe 4900 lxfxfxf.exe 4132 frxxrxx.exe 2492 tthbtb.exe 2260 nnhntb.exe 208 3vppd.exe 2012 9pddv.exe 1732 xxlrxll.exe 4992 rfrxrxr.exe 2164 bnnnhb.exe 2588 bbbbtb.exe 2032 vddjj.exe 2496 jvvjd.exe 2088 rrlrflx.exe 2736 lflfxxl.exe 2376 nnhhnt.exe 4564 tthnhh.exe 1504 pjpvp.exe 2332 vvdjd.exe 1820 rxrlflf.exe 1492 xrxxxff.exe 1984 hnbbnt.exe 1656 tthhbh.exe 1484 bbhbtb.exe 3224 pvjjd.exe 3496 7vdvp.exe 2796 rxflffl.exe 1532 xxxxxxr.exe -
resource yara_rule behavioral2/memory/3172-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 4732 3172 07d2bb369a31efed7f54403f8cd0a430N.exe 83 PID 3172 wrote to memory of 4732 3172 07d2bb369a31efed7f54403f8cd0a430N.exe 83 PID 3172 wrote to memory of 4732 3172 07d2bb369a31efed7f54403f8cd0a430N.exe 83 PID 4732 wrote to memory of 4004 4732 bbhbnh.exe 84 PID 4732 wrote to memory of 4004 4732 bbhbnh.exe 84 PID 4732 wrote to memory of 4004 4732 bbhbnh.exe 84 PID 4004 wrote to memory of 1452 4004 ppdvd.exe 85 PID 4004 wrote to memory of 1452 4004 ppdvd.exe 85 PID 4004 wrote to memory of 1452 4004 ppdvd.exe 85 PID 1452 wrote to memory of 404 1452 jpdjj.exe 86 PID 1452 wrote to memory of 404 1452 jpdjj.exe 86 PID 1452 wrote to memory of 404 1452 jpdjj.exe 86 PID 404 wrote to memory of 2124 404 rfffxxf.exe 87 PID 404 wrote to memory of 2124 404 rfffxxf.exe 87 PID 404 wrote to memory of 2124 404 rfffxxf.exe 87 PID 2124 wrote to memory of 4516 2124 frxrrrx.exe 88 PID 2124 wrote to memory of 4516 2124 frxrrrx.exe 88 PID 2124 wrote to memory of 4516 2124 frxrrrx.exe 88 PID 4516 wrote to memory of 3296 4516 tthbhn.exe 89 PID 4516 wrote to memory of 3296 4516 tthbhn.exe 89 PID 4516 wrote to memory of 3296 4516 tthbhn.exe 89 PID 3296 wrote to memory of 4640 3296 rlxffxx.exe 90 PID 3296 wrote to memory of 4640 3296 rlxffxx.exe 90 PID 3296 wrote to memory of 4640 3296 rlxffxx.exe 90 PID 4640 wrote to memory of 1760 4640 bhnbth.exe 91 PID 4640 wrote to memory of 1760 4640 bhnbth.exe 91 PID 4640 wrote to memory of 1760 4640 bhnbth.exe 91 PID 1760 wrote to memory of 2588 1760 jpvpp.exe 92 PID 1760 wrote to memory of 2588 1760 jpvpp.exe 92 PID 1760 wrote to memory of 2588 1760 jpvpp.exe 92 PID 2588 wrote to memory of 2032 2588 rrxlffx.exe 94 PID 2588 wrote to memory of 2032 2588 rrxlffx.exe 94 PID 2588 wrote to memory of 2032 2588 rrxlffx.exe 94 PID 2032 wrote to memory of 2420 2032 rrxxfff.exe 95 PID 2032 wrote to memory of 2420 2032 rrxxfff.exe 95 PID 2032 wrote to memory of 2420 2032 rrxxfff.exe 95 PID 2420 wrote to memory of 2736 2420 hbnnnt.exe 96 PID 2420 wrote to memory of 2736 2420 hbnnnt.exe 96 PID 2420 wrote to memory of 2736 2420 hbnnnt.exe 96 PID 2736 wrote to memory of 4744 2736 xffffff.exe 97 PID 2736 wrote to memory of 4744 2736 xffffff.exe 97 PID 2736 wrote to memory of 4744 2736 xffffff.exe 97 PID 4744 wrote to memory of 4564 4744 xrlllrr.exe 99 PID 4744 wrote to memory of 4564 4744 xrlllrr.exe 99 PID 4744 wrote to memory of 4564 4744 xrlllrr.exe 99 PID 4564 wrote to memory of 4792 4564 3hnnnt.exe 100 PID 4564 wrote to memory of 4792 4564 3hnnnt.exe 100 PID 4564 wrote to memory of 4792 4564 3hnnnt.exe 100 PID 4792 wrote to memory of 1672 4792 5djjp.exe 101 PID 4792 wrote to memory of 1672 4792 5djjp.exe 101 PID 4792 wrote to memory of 1672 4792 5djjp.exe 101 PID 1672 wrote to memory of 1492 1672 lrrrllf.exe 102 PID 1672 wrote to memory of 1492 1672 lrrrllf.exe 102 PID 1672 wrote to memory of 1492 1672 lrrrllf.exe 102 PID 1492 wrote to memory of 940 1492 rxllrxr.exe 103 PID 1492 wrote to memory of 940 1492 rxllrxr.exe 103 PID 1492 wrote to memory of 940 1492 rxllrxr.exe 103 PID 940 wrote to memory of 2316 940 ttttth.exe 104 PID 940 wrote to memory of 2316 940 ttttth.exe 104 PID 940 wrote to memory of 2316 940 ttttth.exe 104 PID 2316 wrote to memory of 1012 2316 pvddv.exe 105 PID 2316 wrote to memory of 1012 2316 pvddv.exe 105 PID 2316 wrote to memory of 1012 2316 pvddv.exe 105 PID 1012 wrote to memory of 1876 1012 5dppp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d2bb369a31efed7f54403f8cd0a430N.exe"C:\Users\Admin\AppData\Local\Temp\07d2bb369a31efed7f54403f8cd0a430N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\bbhbnh.exec:\bbhbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\ppdvd.exec:\ppdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\jpdjj.exec:\jpdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\rfffxxf.exec:\rfffxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\frxrrrx.exec:\frxrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\tthbhn.exec:\tthbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rlxffxx.exec:\rlxffxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\bhnbth.exec:\bhnbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\jpvpp.exec:\jpvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rrxlffx.exec:\rrxlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\rrxxfff.exec:\rrxxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\hbnnnt.exec:\hbnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\xffffff.exec:\xffffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xrlllrr.exec:\xrlllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\3hnnnt.exec:\3hnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\5djjp.exec:\5djjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\lrrrllf.exec:\lrrrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\rxllrxr.exec:\rxllrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\ttttth.exec:\ttttth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\pvddv.exec:\pvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\5dppp.exec:\5dppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\flrlfff.exec:\flrlfff.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\htbbtb.exec:\htbbtb.exe24⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hthhbb.exec:\hthhbb.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\3pvdv.exec:\3pvdv.exe26⤵
- Executes dropped EXE
PID:2372 -
\??\c:\llfxxxx.exec:\llfxxxx.exe27⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nhhnnn.exec:\nhhnnn.exe28⤵
- Executes dropped EXE
PID:3824 -
\??\c:\hhbttt.exec:\hhbttt.exe29⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vpjdv.exec:\vpjdv.exe30⤵
- Executes dropped EXE
PID:3748 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe31⤵
- Executes dropped EXE
PID:5024 -
\??\c:\tbtthn.exec:\tbtthn.exe32⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnhntt.exec:\tnhntt.exe33⤵
- Executes dropped EXE
PID:4884 -
\??\c:\ddpdp.exec:\ddpdp.exe34⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tttttb.exec:\tttttb.exe35⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhbtnh.exec:\nhbtnh.exe36⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jpvpj.exec:\jpvpj.exe37⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pvjdv.exec:\pvjdv.exe38⤵
- Executes dropped EXE
PID:5104 -
\??\c:\lxfxfxf.exec:\lxfxfxf.exe39⤵
- Executes dropped EXE
PID:4900 -
\??\c:\frxxrxx.exec:\frxxrxx.exe40⤵
- Executes dropped EXE
PID:4132 -
\??\c:\tthbtb.exec:\tthbtb.exe41⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nnhntb.exec:\nnhntb.exe42⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3vppd.exec:\3vppd.exe43⤵
- Executes dropped EXE
PID:208 -
\??\c:\9pddv.exec:\9pddv.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxlrxll.exec:\xxlrxll.exe45⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe46⤵
- Executes dropped EXE
PID:4992 -
\??\c:\bnnnhb.exec:\bnnnhb.exe47⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bbbbtb.exec:\bbbbtb.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vddjj.exec:\vddjj.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvvjd.exec:\jvvjd.exe50⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrlrflx.exec:\rrlrflx.exe51⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lflfxxl.exec:\lflfxxl.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nnhhnt.exec:\nnhhnt.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tthnhh.exec:\tthnhh.exe54⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pjpvp.exec:\pjpvp.exe55⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vvdjd.exec:\vvdjd.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rxrlflf.exec:\rxrlflf.exe57⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xrxxxff.exec:\xrxxxff.exe58⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hnbbnt.exec:\hnbbnt.exe59⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tthhbh.exec:\tthhbh.exe60⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbhbtb.exec:\bbhbtb.exe61⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pvjjd.exec:\pvjjd.exe62⤵
- Executes dropped EXE
PID:3224 -
\??\c:\7vdvp.exec:\7vdvp.exe63⤵
- Executes dropped EXE
PID:3496 -
\??\c:\rxflffl.exec:\rxflffl.exe64⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ttnnnt.exec:\ttnnnt.exe66⤵PID:5068
-
\??\c:\nhhbbt.exec:\nhhbbt.exe67⤵PID:3600
-
\??\c:\vvvvp.exec:\vvvvp.exe68⤵PID:4396
-
\??\c:\dddvj.exec:\dddvj.exe69⤵PID:3700
-
\??\c:\llllxrr.exec:\llllxrr.exe70⤵PID:3428
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe71⤵PID:2768
-
\??\c:\nnnntt.exec:\nnnntt.exe72⤵PID:904
-
\??\c:\bthntb.exec:\bthntb.exe73⤵PID:3808
-
\??\c:\pjjpp.exec:\pjjpp.exe74⤵PID:3748
-
\??\c:\djppp.exec:\djppp.exe75⤵PID:5072
-
\??\c:\lrxffff.exec:\lrxffff.exe76⤵PID:220
-
\??\c:\lflllll.exec:\lflllll.exe77⤵PID:4352
-
\??\c:\nnhttb.exec:\nnhttb.exe78⤵PID:4496
-
\??\c:\hhbhhn.exec:\hhbhhn.exe79⤵PID:4732
-
\??\c:\ntnntt.exec:\ntnntt.exe80⤵PID:4812
-
\??\c:\5pvvv.exec:\5pvvv.exe81⤵PID:3556
-
\??\c:\jpvvp.exec:\jpvvp.exe82⤵PID:2000
-
\??\c:\xrrllll.exec:\xrrllll.exe83⤵PID:1864
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe84⤵PID:4928
-
\??\c:\htnntb.exec:\htnntb.exe85⤵PID:1144
-
\??\c:\tbhbhn.exec:\tbhbhn.exe86⤵PID:2492
-
\??\c:\tnhbhn.exec:\tnhbhn.exe87⤵PID:2260
-
\??\c:\vpddv.exec:\vpddv.exe88⤵PID:208
-
\??\c:\vpddd.exec:\vpddd.exe89⤵PID:2308
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe90⤵PID:1460
-
\??\c:\btttnn.exec:\btttnn.exe91⤵PID:1216
-
\??\c:\djjjp.exec:\djjjp.exe92⤵PID:3120
-
\??\c:\vjvvp.exec:\vjvvp.exe93⤵PID:3672
-
\??\c:\xflffff.exec:\xflffff.exe94⤵PID:4908
-
\??\c:\bhbbbh.exec:\bhbbbh.exe95⤵PID:3928
-
\??\c:\dvjjj.exec:\dvjjj.exe96⤵PID:2792
-
\??\c:\rrfllrr.exec:\rrfllrr.exe97⤵PID:3144
-
\??\c:\llfflrr.exec:\llfflrr.exe98⤵PID:920
-
\??\c:\xfxxxxf.exec:\xfxxxxf.exe99⤵PID:3644
-
\??\c:\bnbbtb.exec:\bnbbtb.exe100⤵PID:4552
-
\??\c:\tbhnhn.exec:\tbhnhn.exe101⤵PID:1488
-
\??\c:\jvvvv.exec:\jvvvv.exe102⤵PID:3084
-
\??\c:\lrllxrf.exec:\lrllxrf.exe103⤵PID:1996
-
\??\c:\tnbbnn.exec:\tnbbnn.exe104⤵PID:1584
-
\??\c:\tnbbtb.exec:\tnbbtb.exe105⤵PID:1012
-
\??\c:\vdjjd.exec:\vdjjd.exe106⤵PID:1644
-
\??\c:\pjppj.exec:\pjppj.exe107⤵PID:4440
-
\??\c:\fxlfxff.exec:\fxlfxff.exe108⤵PID:812
-
\??\c:\llrrrxx.exec:\llrrrxx.exe109⤵PID:1364
-
\??\c:\bbbhht.exec:\bbbhht.exe110⤵PID:2872
-
\??\c:\bthbhh.exec:\bthbhh.exe111⤵PID:5112
-
\??\c:\hbhhhh.exec:\hbhhhh.exe112⤵PID:3920
-
\??\c:\jdppj.exec:\jdppj.exe113⤵PID:4288
-
\??\c:\jdddd.exec:\jdddd.exe114⤵PID:4784
-
\??\c:\ffllrrx.exec:\ffllrrx.exe115⤵PID:3148
-
\??\c:\flxfxfl.exec:\flxfxfl.exe116⤵PID:1708
-
\??\c:\ttbbbb.exec:\ttbbbb.exe117⤵PID:4144
-
\??\c:\1vjjj.exec:\1vjjj.exe118⤵PID:4524
-
\??\c:\ppdvv.exec:\ppdvv.exe119⤵PID:4948
-
\??\c:\llffffx.exec:\llffffx.exe120⤵PID:1784
-
\??\c:\xffffff.exec:\xffffff.exe121⤵PID:3172
-
\??\c:\fxrxfff.exec:\fxrxfff.exe122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-