Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 19:18
Behavioral task
behavioral1
Sample
1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe
Resource
win7-20240903-en
General
-
Target
1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe
-
Size
485KB
-
MD5
a73729110af72f656a3d255bf48ae9e1
-
SHA1
64c799d5a4d60d781a5baa97239f805ec690b0a0
-
SHA256
1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1
-
SHA512
ab6374f73f20ef42bd78c1a8d40428c26fb2dc3058749772cd7a06a75fb67ccaededf30bcbf99ad9c3820a365a09b2f69862f97dc6051a31190e55907bb0ef83
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVV:n3C9ytvngQjgtvngSV3CPobNVV
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/5060-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2144 5ntnhn.exe 1888 9nnhtt.exe 2612 fxxfxxr.exe 2356 pdpjv.exe 3992 ntbthb.exe 3616 pjdvp.exe 2432 lxfxllf.exe 2344 3vvpp.exe 1980 5tnhbb.exe 3656 vvdvp.exe 3236 lfllllr.exe 2216 pdpdv.exe 3728 vddvj.exe 4272 httntn.exe 3000 pppjv.exe 4652 frxlfxl.exe 5108 dpjvp.exe 2456 lrlxlrl.exe 2728 djvdp.exe 3120 xrlxlff.exe 1788 lxrrfrr.exe 4912 vjvpd.exe 4116 7xlxlfr.exe 4520 9vdpd.exe 3708 xfrfrlf.exe 1184 nnbhnb.exe 4616 pjpdp.exe 1348 lllrfrl.exe 4920 hnnbtn.exe 4804 1djdj.exe 1636 lllxrlf.exe 1104 jvvpd.exe 4252 ddjdd.exe 3860 lfrllfl.exe 5024 jpjvv.exe 3300 1rrfxlf.exe 2236 bnbthb.exe 836 vjjvj.exe 2716 9llxfxl.exe 4724 tnnhtb.exe 1452 1dvjv.exe 1020 3lfrlxl.exe 2556 rrllfxl.exe 3124 bhnbtt.exe 4356 5vdpv.exe 3408 rxfrlfr.exe 2900 xllfrfr.exe 4660 1hbnth.exe 4388 jddjd.exe 2168 xrfrlxl.exe 2584 5tnbbt.exe 1472 dpvpp.exe 1848 7llxrfx.exe 2612 7nhbnh.exe 3028 djjvj.exe 3604 vdvpj.exe 3216 rllxlfr.exe 4460 nbthtn.exe 2380 pppdp.exe 4452 rrffxfl.exe 1448 hnthtn.exe 4488 3jdvp.exe 3276 fxrlfxf.exe 436 xxrlxrl.exe -
resource yara_rule behavioral2/memory/5060-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5060 wrote to memory of 2144 5060 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 82 PID 5060 wrote to memory of 2144 5060 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 82 PID 5060 wrote to memory of 2144 5060 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 82 PID 2144 wrote to memory of 1888 2144 5ntnhn.exe 83 PID 2144 wrote to memory of 1888 2144 5ntnhn.exe 83 PID 2144 wrote to memory of 1888 2144 5ntnhn.exe 83 PID 1888 wrote to memory of 2612 1888 9nnhtt.exe 84 PID 1888 wrote to memory of 2612 1888 9nnhtt.exe 84 PID 1888 wrote to memory of 2612 1888 9nnhtt.exe 84 PID 2612 wrote to memory of 2356 2612 fxxfxxr.exe 85 PID 2612 wrote to memory of 2356 2612 fxxfxxr.exe 85 PID 2612 wrote to memory of 2356 2612 fxxfxxr.exe 85 PID 2356 wrote to memory of 3992 2356 pdpjv.exe 86 PID 2356 wrote to memory of 3992 2356 pdpjv.exe 86 PID 2356 wrote to memory of 3992 2356 pdpjv.exe 86 PID 3992 wrote to memory of 3616 3992 ntbthb.exe 87 PID 3992 wrote to memory of 3616 3992 ntbthb.exe 87 PID 3992 wrote to memory of 3616 3992 ntbthb.exe 87 PID 3616 wrote to memory of 2432 3616 pjdvp.exe 88 PID 3616 wrote to memory of 2432 3616 pjdvp.exe 88 PID 3616 wrote to memory of 2432 3616 pjdvp.exe 88 PID 2432 wrote to memory of 2344 2432 lxfxllf.exe 89 PID 2432 wrote to memory of 2344 2432 lxfxllf.exe 89 PID 2432 wrote to memory of 2344 2432 lxfxllf.exe 89 PID 2344 wrote to memory of 1980 2344 3vvpp.exe 90 PID 2344 wrote to memory of 1980 2344 3vvpp.exe 90 PID 2344 wrote to memory of 1980 2344 3vvpp.exe 90 PID 1980 wrote to memory of 3656 1980 5tnhbb.exe 91 PID 1980 wrote to memory of 3656 1980 5tnhbb.exe 91 PID 1980 wrote to memory of 3656 1980 5tnhbb.exe 91 PID 3656 wrote to memory of 3236 3656 vvdvp.exe 92 PID 3656 wrote to memory of 3236 3656 vvdvp.exe 92 PID 3656 wrote to memory of 3236 3656 vvdvp.exe 92 PID 3236 wrote to memory of 2216 3236 lfllllr.exe 93 PID 3236 wrote to memory of 2216 3236 lfllllr.exe 93 PID 3236 wrote to memory of 2216 3236 lfllllr.exe 93 PID 2216 wrote to memory of 3728 2216 pdpdv.exe 94 PID 2216 wrote to memory of 3728 2216 pdpdv.exe 94 PID 2216 wrote to memory of 3728 2216 pdpdv.exe 94 PID 3728 wrote to memory of 4272 3728 vddvj.exe 95 PID 3728 wrote to memory of 4272 3728 vddvj.exe 95 PID 3728 wrote to memory of 4272 3728 vddvj.exe 95 PID 4272 wrote to memory of 3000 4272 httntn.exe 96 PID 4272 wrote to memory of 3000 4272 httntn.exe 96 PID 4272 wrote to memory of 3000 4272 httntn.exe 96 PID 3000 wrote to memory of 4652 3000 pppjv.exe 97 PID 3000 wrote to memory of 4652 3000 pppjv.exe 97 PID 3000 wrote to memory of 4652 3000 pppjv.exe 97 PID 4652 wrote to memory of 5108 4652 frxlfxl.exe 98 PID 4652 wrote to memory of 5108 4652 frxlfxl.exe 98 PID 4652 wrote to memory of 5108 4652 frxlfxl.exe 98 PID 5108 wrote to memory of 2456 5108 dpjvp.exe 99 PID 5108 wrote to memory of 2456 5108 dpjvp.exe 99 PID 5108 wrote to memory of 2456 5108 dpjvp.exe 99 PID 2456 wrote to memory of 2728 2456 lrlxlrl.exe 100 PID 2456 wrote to memory of 2728 2456 lrlxlrl.exe 100 PID 2456 wrote to memory of 2728 2456 lrlxlrl.exe 100 PID 2728 wrote to memory of 3120 2728 djvdp.exe 101 PID 2728 wrote to memory of 3120 2728 djvdp.exe 101 PID 2728 wrote to memory of 3120 2728 djvdp.exe 101 PID 3120 wrote to memory of 1788 3120 xrlxlff.exe 102 PID 3120 wrote to memory of 1788 3120 xrlxlff.exe 102 PID 3120 wrote to memory of 1788 3120 xrlxlff.exe 102 PID 1788 wrote to memory of 4912 1788 lxrrfrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe"C:\Users\Admin\AppData\Local\Temp\1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\5ntnhn.exec:\5ntnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\9nnhtt.exec:\9nnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\fxxfxxr.exec:\fxxfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\pdpjv.exec:\pdpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ntbthb.exec:\ntbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\pjdvp.exec:\pjdvp.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\lxfxllf.exec:\lxfxllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\3vvpp.exec:\3vvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\5tnhbb.exec:\5tnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\vvdvp.exec:\vvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\lfllllr.exec:\lfllllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\pdpdv.exec:\pdpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\vddvj.exec:\vddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\httntn.exec:\httntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\pppjv.exec:\pppjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\frxlfxl.exec:\frxlfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\dpjvp.exec:\dpjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\djvdp.exec:\djvdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xrlxlff.exec:\xrlxlff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\lxrrfrr.exec:\lxrrfrr.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vjvpd.exec:\vjvpd.exe23⤵
- Executes dropped EXE
PID:4912 -
\??\c:\7xlxlfr.exec:\7xlxlfr.exe24⤵
- Executes dropped EXE
PID:4116 -
\??\c:\9vdpd.exec:\9vdpd.exe25⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xfrfrlf.exec:\xfrfrlf.exe26⤵
- Executes dropped EXE
PID:3708 -
\??\c:\nnbhnb.exec:\nnbhnb.exe27⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pjpdp.exec:\pjpdp.exe28⤵
- Executes dropped EXE
PID:4616 -
\??\c:\lllrfrl.exec:\lllrfrl.exe29⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hnnbtn.exec:\hnnbtn.exe30⤵
- Executes dropped EXE
PID:4920 -
\??\c:\1djdj.exec:\1djdj.exe31⤵
- Executes dropped EXE
PID:4804 -
\??\c:\lllxrlf.exec:\lllxrlf.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jvvpd.exec:\jvvpd.exe33⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ddjdd.exec:\ddjdd.exe34⤵
- Executes dropped EXE
PID:4252 -
\??\c:\lfrllfl.exec:\lfrllfl.exe35⤵
- Executes dropped EXE
PID:3860 -
\??\c:\jpjvv.exec:\jpjvv.exe36⤵
- Executes dropped EXE
PID:5024 -
\??\c:\1rrfxlf.exec:\1rrfxlf.exe37⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bnbthb.exec:\bnbthb.exe38⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjjvj.exec:\vjjvj.exe39⤵
- Executes dropped EXE
PID:836 -
\??\c:\9llxfxl.exec:\9llxfxl.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnnhtb.exec:\tnnhtb.exe41⤵
- Executes dropped EXE
PID:4724 -
\??\c:\1dvjv.exec:\1dvjv.exe42⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3lfrlxl.exec:\3lfrlxl.exe43⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rrllfxl.exec:\rrllfxl.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bhnbtt.exec:\bhnbtt.exe45⤵
- Executes dropped EXE
PID:3124 -
\??\c:\5vdpv.exec:\5vdpv.exe46⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rxfrlfr.exec:\rxfrlfr.exe47⤵
- Executes dropped EXE
PID:3408 -
\??\c:\xllfrfr.exec:\xllfrfr.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1hbnth.exec:\1hbnth.exe49⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jddjd.exec:\jddjd.exe50⤵
- Executes dropped EXE
PID:4388 -
\??\c:\xrfrlxl.exec:\xrfrlxl.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5tnbbt.exec:\5tnbbt.exe52⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpvpp.exec:\dpvpp.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7llxrfx.exec:\7llxrfx.exe54⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7nhbnh.exec:\7nhbnh.exe55⤵
- Executes dropped EXE
PID:2612 -
\??\c:\djjvj.exec:\djjvj.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vdvpj.exec:\vdvpj.exe57⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rllxlfr.exec:\rllxlfr.exe58⤵
- Executes dropped EXE
PID:3216 -
\??\c:\nbthtn.exec:\nbthtn.exe59⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pppdp.exec:\pppdp.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rrffxfl.exec:\rrffxfl.exe61⤵
- Executes dropped EXE
PID:4452 -
\??\c:\hnthtn.exec:\hnthtn.exe62⤵
- Executes dropped EXE
PID:1448 -
\??\c:\3jdvp.exec:\3jdvp.exe63⤵
- Executes dropped EXE
PID:4488 -
\??\c:\fxrlfxf.exec:\fxrlfxf.exe64⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe65⤵
- Executes dropped EXE
PID:436 -
\??\c:\bbhbtt.exec:\bbhbtt.exe66⤵PID:2260
-
\??\c:\pddpd.exec:\pddpd.exe67⤵PID:3164
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe68⤵PID:2764
-
\??\c:\9nnhtn.exec:\9nnhtn.exe69⤵PID:2216
-
\??\c:\djjvp.exec:\djjvp.exe70⤵PID:1708
-
\??\c:\rrflfxf.exec:\rrflfxf.exe71⤵PID:3800
-
\??\c:\lllfrll.exec:\lllfrll.exe72⤵PID:468
-
\??\c:\ttbtbt.exec:\ttbtbt.exe73⤵PID:3000
-
\??\c:\7jdpd.exec:\7jdpd.exe74⤵PID:4568
-
\??\c:\9fxlxrx.exec:\9fxlxrx.exe75⤵
- System Location Discovery: System Language Discovery
PID:3752 -
\??\c:\5nnbnn.exec:\5nnbnn.exe76⤵PID:5000
-
\??\c:\jdvdp.exec:\jdvdp.exe77⤵PID:1984
-
\??\c:\dpjvp.exec:\dpjvp.exe78⤵
- System Location Discovery: System Language Discovery
PID:4376 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe79⤵PID:2472
-
\??\c:\1hhhbt.exec:\1hhhbt.exe80⤵PID:4132
-
\??\c:\hbnbtn.exec:\hbnbtn.exe81⤵PID:2508
-
\??\c:\vdjjp.exec:\vdjjp.exe82⤵PID:2916
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe83⤵PID:4440
-
\??\c:\htnbhb.exec:\htnbhb.exe84⤵PID:4612
-
\??\c:\7jjdv.exec:\7jjdv.exe85⤵PID:4284
-
\??\c:\vvvjd.exec:\vvvjd.exe86⤵PID:1748
-
\??\c:\lrfrllx.exec:\lrfrllx.exe87⤵PID:772
-
\??\c:\thbnht.exec:\thbnht.exe88⤵PID:4280
-
\??\c:\3bhbtb.exec:\3bhbtb.exe89⤵PID:1104
-
\??\c:\ppvjd.exec:\ppvjd.exe90⤵PID:4252
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe91⤵PID:3860
-
\??\c:\xrfxlxr.exec:\xrfxlxr.exe92⤵PID:1912
-
\??\c:\htnbnn.exec:\htnbnn.exe93⤵PID:3008
-
\??\c:\vjjdj.exec:\vjjdj.exe94⤵PID:1884
-
\??\c:\frxffxl.exec:\frxffxl.exe95⤵PID:3428
-
\??\c:\3bnbnb.exec:\3bnbnb.exe96⤵PID:3580
-
\??\c:\pdjvj.exec:\pdjvj.exe97⤵PID:2724
-
\??\c:\fxxlrll.exec:\fxxlrll.exe98⤵PID:5056
-
\??\c:\rxrfrll.exec:\rxrfrll.exe99⤵PID:2996
-
\??\c:\hhnhtn.exec:\hhnhtn.exe100⤵PID:2468
-
\??\c:\jvjdj.exec:\jvjdj.exe101⤵PID:1484
-
\??\c:\rxrlrlr.exec:\rxrlrlr.exe102⤵PID:4204
-
\??\c:\hhnhnn.exec:\hhnhnn.exe103⤵PID:5040
-
\??\c:\jdpjd.exec:\jdpjd.exe104⤵PID:4380
-
\??\c:\1llxrlx.exec:\1llxrlx.exe105⤵PID:3108
-
\??\c:\1lxlxrf.exec:\1lxlxrf.exe106⤵PID:3684
-
\??\c:\bnhtbt.exec:\bnhtbt.exe107⤵PID:4464
-
\??\c:\dpvpp.exec:\dpvpp.exe108⤵PID:3700
-
\??\c:\bhtnbh.exec:\bhtnbh.exe109⤵PID:4404
-
\??\c:\vjdpd.exec:\vjdpd.exe110⤵PID:2188
-
\??\c:\3xffrrf.exec:\3xffrrf.exe111⤵PID:2872
-
\??\c:\xrlfffr.exec:\xrlfffr.exe112⤵PID:408
-
\??\c:\hnnbtn.exec:\hnnbtn.exe113⤵PID:5096
-
\??\c:\djpjp.exec:\djpjp.exe114⤵PID:4800
-
\??\c:\rrlxllx.exec:\rrlxllx.exe115⤵PID:3928
-
\??\c:\hhhtht.exec:\hhhtht.exe116⤵PID:3020
-
\??\c:\7tbnht.exec:\7tbnht.exe117⤵PID:3636
-
\??\c:\pjvpv.exec:\pjvpv.exe118⤵PID:2344
-
\??\c:\5llxrlx.exec:\5llxrlx.exe119⤵PID:2596
-
\??\c:\hntnnh.exec:\hntnnh.exe120⤵PID:2488
-
\??\c:\nhnbtb.exec:\nhnbtb.exe121⤵PID:4032
-
\??\c:\jvpvp.exec:\jvpvp.exe122⤵PID:180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-