Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe
Resource
win7-20240903-en
General
-
Target
790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe
-
Size
58KB
-
MD5
4d01de6bdf1632cb941a3f7519def474
-
SHA1
e300f449a7e02f34b8309f3cf94e948d3d1d345e
-
SHA256
790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83
-
SHA512
12076f90cde5214ea8948f2d8dd11ef51aa0a68e3dd46578ce74db18ee4ebe4ee68ea988a4ff5a2525785c3b5712539ac9586c16a42f479c81f3903ef41b41ae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgTdCo:ymb3NkkiQ3mdBjFIg0o
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3612-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-20713-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4324 1ttnnn.exe 3196 3vvvp.exe 4632 vjppp.exe 4936 lflfxxr.exe 1824 5xxfllf.exe 1536 bthhhh.exe 2796 5jjdp.exe 4872 5rlfllf.exe 1980 ffxrxxf.exe 1192 nhnhbb.exe 4460 dvjjj.exe 2528 frrrlfx.exe 736 frxrlfl.exe 3504 tttnnn.exe 5084 pjddd.exe 1832 9xfxrrl.exe 2380 xllfrrl.exe 920 nhbtnn.exe 2428 vdddd.exe 2940 9vvvp.exe 3404 5nnhhn.exe 916 pvdjj.exe 3060 pppvv.exe 2372 xlrxllf.exe 964 btnhbb.exe 1180 jpddd.exe 5096 jddvd.exe 1432 fxxxllr.exe 2820 9hthhn.exe 684 hnnbtn.exe 4860 jdpdp.exe 4624 xfrfrrl.exe 1880 hbttnn.exe 924 5ttnhh.exe 2148 jdjdd.exe 1524 frrlfff.exe 1632 hnnhbb.exe 4420 tbhbtt.exe 2028 7lffxrl.exe 5068 7xrlfxx.exe 1756 7tnbth.exe 3612 dvdvd.exe 4788 lxrlfxf.exe 2432 btnnhh.exe 3924 lxffxxr.exe 4428 hbbtnn.exe 4544 9xllffx.exe 3904 xlrlllf.exe 3980 bbntbb.exe 2504 9tnhbb.exe 4104 dvppd.exe 2704 vjdpp.exe 3840 9flfxxx.exe 2848 bbtnnh.exe 1800 nntntb.exe 4616 bttnnn.exe 2152 vpjjd.exe 1676 rllfxxx.exe 612 9rxxxll.exe 2528 tnnnhh.exe 3716 pjdvv.exe 4836 3vdvd.exe 2084 rrxrrrx.exe 5076 fxxrrrr.exe -
resource yara_rule behavioral2/memory/3612-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-20713-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3612 wrote to memory of 4324 3612 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 82 PID 3612 wrote to memory of 4324 3612 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 82 PID 3612 wrote to memory of 4324 3612 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 82 PID 4324 wrote to memory of 3196 4324 1ttnnn.exe 83 PID 4324 wrote to memory of 3196 4324 1ttnnn.exe 83 PID 4324 wrote to memory of 3196 4324 1ttnnn.exe 83 PID 3196 wrote to memory of 4632 3196 3vvvp.exe 84 PID 3196 wrote to memory of 4632 3196 3vvvp.exe 84 PID 3196 wrote to memory of 4632 3196 3vvvp.exe 84 PID 4632 wrote to memory of 4936 4632 vjppp.exe 85 PID 4632 wrote to memory of 4936 4632 vjppp.exe 85 PID 4632 wrote to memory of 4936 4632 vjppp.exe 85 PID 4936 wrote to memory of 1824 4936 lflfxxr.exe 86 PID 4936 wrote to memory of 1824 4936 lflfxxr.exe 86 PID 4936 wrote to memory of 1824 4936 lflfxxr.exe 86 PID 1824 wrote to memory of 1536 1824 5xxfllf.exe 87 PID 1824 wrote to memory of 1536 1824 5xxfllf.exe 87 PID 1824 wrote to memory of 1536 1824 5xxfllf.exe 87 PID 1536 wrote to memory of 2796 1536 bthhhh.exe 88 PID 1536 wrote to memory of 2796 1536 bthhhh.exe 88 PID 1536 wrote to memory of 2796 1536 bthhhh.exe 88 PID 2796 wrote to memory of 4872 2796 5jjdp.exe 89 PID 2796 wrote to memory of 4872 2796 5jjdp.exe 89 PID 2796 wrote to memory of 4872 2796 5jjdp.exe 89 PID 4872 wrote to memory of 1980 4872 5rlfllf.exe 90 PID 4872 wrote to memory of 1980 4872 5rlfllf.exe 90 PID 4872 wrote to memory of 1980 4872 5rlfllf.exe 90 PID 1980 wrote to memory of 1192 1980 ffxrxxf.exe 91 PID 1980 wrote to memory of 1192 1980 ffxrxxf.exe 91 PID 1980 wrote to memory of 1192 1980 ffxrxxf.exe 91 PID 1192 wrote to memory of 4460 1192 nhnhbb.exe 92 PID 1192 wrote to memory of 4460 1192 nhnhbb.exe 92 PID 1192 wrote to memory of 4460 1192 nhnhbb.exe 92 PID 4460 wrote to memory of 2528 4460 dvjjj.exe 93 PID 4460 wrote to memory of 2528 4460 dvjjj.exe 93 PID 4460 wrote to memory of 2528 4460 dvjjj.exe 93 PID 2528 wrote to memory of 736 2528 frrrlfx.exe 94 PID 2528 wrote to memory of 736 2528 frrrlfx.exe 94 PID 2528 wrote to memory of 736 2528 frrrlfx.exe 94 PID 736 wrote to memory of 3504 736 frxrlfl.exe 95 PID 736 wrote to memory of 3504 736 frxrlfl.exe 95 PID 736 wrote to memory of 3504 736 frxrlfl.exe 95 PID 3504 wrote to memory of 5084 3504 tttnnn.exe 96 PID 3504 wrote to memory of 5084 3504 tttnnn.exe 96 PID 3504 wrote to memory of 5084 3504 tttnnn.exe 96 PID 5084 wrote to memory of 1832 5084 pjddd.exe 97 PID 5084 wrote to memory of 1832 5084 pjddd.exe 97 PID 5084 wrote to memory of 1832 5084 pjddd.exe 97 PID 1832 wrote to memory of 2380 1832 9xfxrrl.exe 98 PID 1832 wrote to memory of 2380 1832 9xfxrrl.exe 98 PID 1832 wrote to memory of 2380 1832 9xfxrrl.exe 98 PID 2380 wrote to memory of 920 2380 xllfrrl.exe 99 PID 2380 wrote to memory of 920 2380 xllfrrl.exe 99 PID 2380 wrote to memory of 920 2380 xllfrrl.exe 99 PID 920 wrote to memory of 2428 920 nhbtnn.exe 100 PID 920 wrote to memory of 2428 920 nhbtnn.exe 100 PID 920 wrote to memory of 2428 920 nhbtnn.exe 100 PID 2428 wrote to memory of 2940 2428 vdddd.exe 101 PID 2428 wrote to memory of 2940 2428 vdddd.exe 101 PID 2428 wrote to memory of 2940 2428 vdddd.exe 101 PID 2940 wrote to memory of 3404 2940 9vvvp.exe 102 PID 2940 wrote to memory of 3404 2940 9vvvp.exe 102 PID 2940 wrote to memory of 3404 2940 9vvvp.exe 102 PID 3404 wrote to memory of 916 3404 5nnhhn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe"C:\Users\Admin\AppData\Local\Temp\790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\1ttnnn.exec:\1ttnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\3vvvp.exec:\3vvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\vjppp.exec:\vjppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\lflfxxr.exec:\lflfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\5xxfllf.exec:\5xxfllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\bthhhh.exec:\bthhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\5jjdp.exec:\5jjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5rlfllf.exec:\5rlfllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\nhnhbb.exec:\nhnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\dvjjj.exec:\dvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\frrrlfx.exec:\frrrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\frxrlfl.exec:\frxrlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\tttnnn.exec:\tttnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\pjddd.exec:\pjddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\xllfrrl.exec:\xllfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhbtnn.exec:\nhbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\vdddd.exec:\vdddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\9vvvp.exec:\9vvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5nnhhn.exec:\5nnhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\pvdjj.exec:\pvdjj.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\pppvv.exec:\pppvv.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xlrxllf.exec:\xlrxllf.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\btnhbb.exec:\btnhbb.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\jpddd.exec:\jpddd.exe27⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jddvd.exec:\jddvd.exe28⤵
- Executes dropped EXE
PID:5096 -
\??\c:\fxxxllr.exec:\fxxxllr.exe29⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9hthhn.exec:\9hthhn.exe30⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hnnbtn.exec:\hnnbtn.exe31⤵
- Executes dropped EXE
PID:684 -
\??\c:\jdpdp.exec:\jdpdp.exe32⤵
- Executes dropped EXE
PID:4860 -
\??\c:\xfrfrrl.exec:\xfrfrrl.exe33⤵
- Executes dropped EXE
PID:4624 -
\??\c:\hbttnn.exec:\hbttnn.exe34⤵
- Executes dropped EXE
PID:1880 -
\??\c:\5ttnhh.exec:\5ttnhh.exe35⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdjdd.exec:\jdjdd.exe36⤵
- Executes dropped EXE
PID:2148 -
\??\c:\frrlfff.exec:\frrlfff.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hnnhbb.exec:\hnnhbb.exe38⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tbhbtt.exec:\tbhbtt.exe39⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7lffxrl.exec:\7lffxrl.exe40⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7xrlfxx.exec:\7xrlfxx.exe41⤵
- Executes dropped EXE
PID:5068 -
\??\c:\7tnbth.exec:\7tnbth.exe42⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dvdvd.exec:\dvdvd.exe43⤵
- Executes dropped EXE
PID:3612 -
\??\c:\lxrlfxf.exec:\lxrlfxf.exe44⤵
- Executes dropped EXE
PID:4788 -
\??\c:\btnnhh.exec:\btnnhh.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lxffxxr.exec:\lxffxxr.exe46⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hbbtnn.exec:\hbbtnn.exe47⤵
- Executes dropped EXE
PID:4428 -
\??\c:\9xllffx.exec:\9xllffx.exe48⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xlrlllf.exec:\xlrlllf.exe49⤵
- Executes dropped EXE
PID:3904 -
\??\c:\bbntbb.exec:\bbntbb.exe50⤵
- Executes dropped EXE
PID:3980 -
\??\c:\9tnhbb.exec:\9tnhbb.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvppd.exec:\dvppd.exe52⤵
- Executes dropped EXE
PID:4104 -
\??\c:\vjdpp.exec:\vjdpp.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9flfxxx.exec:\9flfxxx.exe54⤵
- Executes dropped EXE
PID:3840 -
\??\c:\bbtnnh.exec:\bbtnnh.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\nntntb.exec:\nntntb.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bttnnn.exec:\bttnnn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616 -
\??\c:\vpjjd.exec:\vpjjd.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rllfxxx.exec:\rllfxxx.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9rxxxll.exec:\9rxxxll.exe60⤵
- Executes dropped EXE
PID:612 -
\??\c:\tnnnhh.exec:\tnnnhh.exe61⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pjdvv.exec:\pjdvv.exe62⤵
- Executes dropped EXE
PID:3716 -
\??\c:\3vdvd.exec:\3vdvd.exe63⤵
- Executes dropped EXE
PID:4836 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe64⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe65⤵
- Executes dropped EXE
PID:5076 -
\??\c:\5nbbhh.exec:\5nbbhh.exe66⤵PID:2960
-
\??\c:\thhttt.exec:\thhttt.exe67⤵PID:1832
-
\??\c:\dvjjp.exec:\dvjjp.exe68⤵PID:2380
-
\??\c:\jdddp.exec:\jdddp.exe69⤵PID:1660
-
\??\c:\flllxfl.exec:\flllxfl.exe70⤵PID:2524
-
\??\c:\5pjjp.exec:\5pjjp.exe71⤵PID:4864
-
\??\c:\lflfxrr.exec:\lflfxrr.exe72⤵PID:4724
-
\??\c:\llllxxl.exec:\llllxxl.exe73⤵PID:4228
-
\??\c:\bttnnn.exec:\bttnnn.exe74⤵PID:952
-
\??\c:\dvjvp.exec:\dvjvp.exe75⤵PID:3488
-
\??\c:\djvpp.exec:\djvpp.exe76⤵PID:4400
-
\??\c:\rlllxxr.exec:\rlllxxr.exe77⤵PID:4640
-
\??\c:\lffxxff.exec:\lffxxff.exe78⤵PID:2372
-
\??\c:\tnbtbh.exec:\tnbtbh.exe79⤵PID:4496
-
\??\c:\hbnnhn.exec:\hbnnhn.exe80⤵PID:2460
-
\??\c:\jdppj.exec:\jdppj.exe81⤵PID:1388
-
\??\c:\xxlllll.exec:\xxlllll.exe82⤵PID:5096
-
\??\c:\lxlllll.exec:\lxlllll.exe83⤵PID:1812
-
\??\c:\bttnhb.exec:\bttnhb.exe84⤵PID:4560
-
\??\c:\ppjjj.exec:\ppjjj.exe85⤵PID:3200
-
\??\c:\rlfxfff.exec:\rlfxfff.exe86⤵PID:4476
-
\??\c:\fxxffrl.exec:\fxxffrl.exe87⤵PID:1480
-
\??\c:\5httnn.exec:\5httnn.exe88⤵PID:4204
-
\??\c:\vppjd.exec:\vppjd.exe89⤵PID:4624
-
\??\c:\lfflfff.exec:\lfflfff.exe90⤵PID:5064
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe91⤵PID:2348
-
\??\c:\thbttt.exec:\thbttt.exe92⤵PID:2804
-
\??\c:\vvpjv.exec:\vvpjv.exe93⤵PID:2364
-
\??\c:\jjvjd.exec:\jjvjd.exe94⤵PID:1532
-
\??\c:\rrxflrx.exec:\rrxflrx.exe95⤵PID:3644
-
\??\c:\7hnhnn.exec:\7hnhnn.exe96⤵PID:4844
-
\??\c:\1hbttt.exec:\1hbttt.exe97⤵PID:2028
-
\??\c:\jddvj.exec:\jddvj.exe98⤵PID:2656
-
\??\c:\vpvpj.exec:\vpvpj.exe99⤵PID:4108
-
\??\c:\xrlfllr.exec:\xrlfllr.exe100⤵PID:4324
-
\??\c:\nnttbb.exec:\nnttbb.exe101⤵PID:3756
-
\??\c:\bhtttt.exec:\bhtttt.exe102⤵PID:4404
-
\??\c:\pjjjd.exec:\pjjjd.exe103⤵PID:4176
-
\??\c:\vpvvv.exec:\vpvvv.exe104⤵PID:3752
-
\??\c:\fxlflfl.exec:\fxlflfl.exe105⤵PID:2188
-
\??\c:\bnhbbh.exec:\bnhbbh.exe106⤵PID:1060
-
\??\c:\tbnbtb.exec:\tbnbtb.exe107⤵PID:1580
-
\??\c:\dvvpj.exec:\dvvpj.exe108⤵PID:624
-
\??\c:\xllfxxr.exec:\xllfxxr.exe109⤵PID:1764
-
\??\c:\lffxxrr.exec:\lffxxrr.exe110⤵PID:8
-
\??\c:\tntttt.exec:\tntttt.exe111⤵PID:2704
-
\??\c:\djdpd.exec:\djdpd.exe112⤵PID:412
-
\??\c:\jdpvv.exec:\jdpvv.exe113⤵PID:4032
-
\??\c:\fflxrlf.exec:\fflxrlf.exe114⤵PID:2192
-
\??\c:\htbttt.exec:\htbttt.exe115⤵PID:800
-
\??\c:\dvvvp.exec:\dvvvp.exe116⤵PID:2160
-
\??\c:\nnttnt.exec:\nnttnt.exe117⤵PID:2184
-
\??\c:\jvddd.exec:\jvddd.exe118⤵PID:2528
-
\??\c:\dpjdv.exec:\dpjdv.exe119⤵PID:912
-
\??\c:\7xxxxxx.exec:\7xxxxxx.exe120⤵PID:5084
-
\??\c:\hbbtnh.exec:\hbbtnh.exe121⤵PID:456
-
\??\c:\bthbnn.exec:\bthbnn.exe122⤵PID:732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-