Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe
Resource
win7-20240903-en
General
-
Target
34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe
-
Size
65KB
-
MD5
d3b85f7c04f24ed881373477bcf50af0
-
SHA1
746bb10f0750140e4deafcf50bb4eca14499b76d
-
SHA256
34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55
-
SHA512
fb2605e99df6c79bb697ae1e4ec83c8de1973f8f3dae286cabe65d15e033705f85e5db70484913bf46c035aeaa8d797a8c7478bb882812de18947d5f2d4523fc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfm:ymb3NkkiQ3mdBjFI9cqfm
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1216 tntnhh.exe 3540 vvddv.exe 2172 xrfxrll.exe 3752 hbhbtn.exe 1396 nhnhnt.exe 1480 1vvpj.exe 4772 fxxrrrl.exe 744 9hhnhh.exe 3476 vjvvd.exe 5116 7rfrffr.exe 3676 tbbbtb.exe 1128 ttthtn.exe 1172 vpjjp.exe 2824 lrrlffl.exe 3532 bnhbhb.exe 3096 bntbbb.exe 4076 djjvv.exe 680 rffrfxr.exe 2516 nhthhb.exe 1960 7pppd.exe 224 5jpdv.exe 1028 btnbnb.exe 1588 vpdpp.exe 4564 xllxlxx.exe 4460 1nnthb.exe 2244 djpdj.exe 4168 pdvdp.exe 4252 lffrflx.exe 4752 btntnh.exe 804 thnhtb.exe 2256 vpjvj.exe 592 rxlffrr.exe 2004 hbtnhb.exe 4780 nbbnbb.exe 1584 vvpdp.exe 2088 lrxrlfx.exe 4320 7bnbtn.exe 3032 bhnnhb.exe 1956 jdvvj.exe 1812 5jvjv.exe 5084 rxxrffr.exe 468 nhtnnb.exe 912 5ppjd.exe 1700 vvjvd.exe 1624 xxxrrxf.exe 1156 btbbhb.exe 4400 vpvpj.exe 1452 jdpdp.exe 544 lfllffl.exe 4980 tnnnbt.exe 2308 ttnbtb.exe 4488 dvvpd.exe 5092 rfrxxrf.exe 3628 tbnhhb.exe 3688 nbhbtt.exe 4816 djvvv.exe 5040 1fffllr.exe 2272 5nnhnn.exe 3076 dpdpd.exe 3180 llffxfl.exe 936 lxfxrlf.exe 744 5nnhtt.exe 2444 nbbbnb.exe 4552 vvvpp.exe -
resource yara_rule behavioral2/memory/704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 704 wrote to memory of 1216 704 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 82 PID 704 wrote to memory of 1216 704 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 82 PID 704 wrote to memory of 1216 704 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 82 PID 1216 wrote to memory of 3540 1216 tntnhh.exe 83 PID 1216 wrote to memory of 3540 1216 tntnhh.exe 83 PID 1216 wrote to memory of 3540 1216 tntnhh.exe 83 PID 3540 wrote to memory of 2172 3540 vvddv.exe 84 PID 3540 wrote to memory of 2172 3540 vvddv.exe 84 PID 3540 wrote to memory of 2172 3540 vvddv.exe 84 PID 2172 wrote to memory of 3752 2172 xrfxrll.exe 85 PID 2172 wrote to memory of 3752 2172 xrfxrll.exe 85 PID 2172 wrote to memory of 3752 2172 xrfxrll.exe 85 PID 3752 wrote to memory of 1396 3752 hbhbtn.exe 86 PID 3752 wrote to memory of 1396 3752 hbhbtn.exe 86 PID 3752 wrote to memory of 1396 3752 hbhbtn.exe 86 PID 1396 wrote to memory of 1480 1396 nhnhnt.exe 87 PID 1396 wrote to memory of 1480 1396 nhnhnt.exe 87 PID 1396 wrote to memory of 1480 1396 nhnhnt.exe 87 PID 1480 wrote to memory of 4772 1480 1vvpj.exe 88 PID 1480 wrote to memory of 4772 1480 1vvpj.exe 88 PID 1480 wrote to memory of 4772 1480 1vvpj.exe 88 PID 4772 wrote to memory of 744 4772 fxxrrrl.exe 89 PID 4772 wrote to memory of 744 4772 fxxrrrl.exe 89 PID 4772 wrote to memory of 744 4772 fxxrrrl.exe 89 PID 744 wrote to memory of 3476 744 9hhnhh.exe 90 PID 744 wrote to memory of 3476 744 9hhnhh.exe 90 PID 744 wrote to memory of 3476 744 9hhnhh.exe 90 PID 3476 wrote to memory of 5116 3476 vjvvd.exe 91 PID 3476 wrote to memory of 5116 3476 vjvvd.exe 91 PID 3476 wrote to memory of 5116 3476 vjvvd.exe 91 PID 5116 wrote to memory of 3676 5116 7rfrffr.exe 92 PID 5116 wrote to memory of 3676 5116 7rfrffr.exe 92 PID 5116 wrote to memory of 3676 5116 7rfrffr.exe 92 PID 3676 wrote to memory of 1128 3676 tbbbtb.exe 93 PID 3676 wrote to memory of 1128 3676 tbbbtb.exe 93 PID 3676 wrote to memory of 1128 3676 tbbbtb.exe 93 PID 1128 wrote to memory of 1172 1128 ttthtn.exe 94 PID 1128 wrote to memory of 1172 1128 ttthtn.exe 94 PID 1128 wrote to memory of 1172 1128 ttthtn.exe 94 PID 1172 wrote to memory of 2824 1172 vpjjp.exe 95 PID 1172 wrote to memory of 2824 1172 vpjjp.exe 95 PID 1172 wrote to memory of 2824 1172 vpjjp.exe 95 PID 2824 wrote to memory of 3532 2824 lrrlffl.exe 96 PID 2824 wrote to memory of 3532 2824 lrrlffl.exe 96 PID 2824 wrote to memory of 3532 2824 lrrlffl.exe 96 PID 3532 wrote to memory of 3096 3532 bnhbhb.exe 97 PID 3532 wrote to memory of 3096 3532 bnhbhb.exe 97 PID 3532 wrote to memory of 3096 3532 bnhbhb.exe 97 PID 3096 wrote to memory of 4076 3096 bntbbb.exe 98 PID 3096 wrote to memory of 4076 3096 bntbbb.exe 98 PID 3096 wrote to memory of 4076 3096 bntbbb.exe 98 PID 4076 wrote to memory of 680 4076 djjvv.exe 99 PID 4076 wrote to memory of 680 4076 djjvv.exe 99 PID 4076 wrote to memory of 680 4076 djjvv.exe 99 PID 680 wrote to memory of 2516 680 rffrfxr.exe 100 PID 680 wrote to memory of 2516 680 rffrfxr.exe 100 PID 680 wrote to memory of 2516 680 rffrfxr.exe 100 PID 2516 wrote to memory of 1960 2516 nhthhb.exe 101 PID 2516 wrote to memory of 1960 2516 nhthhb.exe 101 PID 2516 wrote to memory of 1960 2516 nhthhb.exe 101 PID 1960 wrote to memory of 224 1960 7pppd.exe 102 PID 1960 wrote to memory of 224 1960 7pppd.exe 102 PID 1960 wrote to memory of 224 1960 7pppd.exe 102 PID 224 wrote to memory of 1028 224 5jpdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe"C:\Users\Admin\AppData\Local\Temp\34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\tntnhh.exec:\tntnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\vvddv.exec:\vvddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\xrfxrll.exec:\xrfxrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hbhbtn.exec:\hbhbtn.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\nhnhnt.exec:\nhnhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\1vvpj.exec:\1vvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\9hhnhh.exec:\9hhnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\vjvvd.exec:\vjvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\7rfrffr.exec:\7rfrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\tbbbtb.exec:\tbbbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\ttthtn.exec:\ttthtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vpjjp.exec:\vpjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\lrrlffl.exec:\lrrlffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bnhbhb.exec:\bnhbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\bntbbb.exec:\bntbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\djjvv.exec:\djjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\rffrfxr.exec:\rffrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\nhthhb.exec:\nhthhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\7pppd.exec:\7pppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\5jpdv.exec:\5jpdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\btnbnb.exec:\btnbnb.exe23⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vpdpp.exec:\vpdpp.exe24⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xllxlxx.exec:\xllxlxx.exe25⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1nnthb.exec:\1nnthb.exe26⤵
- Executes dropped EXE
PID:4460 -
\??\c:\djpdj.exec:\djpdj.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pdvdp.exec:\pdvdp.exe28⤵
- Executes dropped EXE
PID:4168 -
\??\c:\lffrflx.exec:\lffrflx.exe29⤵
- Executes dropped EXE
PID:4252 -
\??\c:\btntnh.exec:\btntnh.exe30⤵
- Executes dropped EXE
PID:4752 -
\??\c:\thnhtb.exec:\thnhtb.exe31⤵
- Executes dropped EXE
PID:804 -
\??\c:\vpjvj.exec:\vpjvj.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rxlffrr.exec:\rxlffrr.exe33⤵
- Executes dropped EXE
PID:592 -
\??\c:\hbtnhb.exec:\hbtnhb.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nbbnbb.exec:\nbbnbb.exe35⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vvpdp.exec:\vvpdp.exe36⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe37⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7bnbtn.exec:\7bnbtn.exe38⤵
- Executes dropped EXE
PID:4320 -
\??\c:\bhnnhb.exec:\bhnnhb.exe39⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdvvj.exec:\jdvvj.exe40⤵
- Executes dropped EXE
PID:1956 -
\??\c:\5jvjv.exec:\5jvjv.exe41⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rxxrffr.exec:\rxxrffr.exe42⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nhtnnb.exec:\nhtnnb.exe43⤵
- Executes dropped EXE
PID:468 -
\??\c:\5ppjd.exec:\5ppjd.exe44⤵
- Executes dropped EXE
PID:912 -
\??\c:\vvjvd.exec:\vvjvd.exe45⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xxxrrxf.exec:\xxxrrxf.exe46⤵
- Executes dropped EXE
PID:1624 -
\??\c:\btbbhb.exec:\btbbhb.exe47⤵
- Executes dropped EXE
PID:1156 -
\??\c:\vpvpj.exec:\vpvpj.exe48⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jdpdp.exec:\jdpdp.exe49⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lfllffl.exec:\lfllffl.exe50⤵
- Executes dropped EXE
PID:544 -
\??\c:\tnnnbt.exec:\tnnnbt.exe51⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ttnbtb.exec:\ttnbtb.exe52⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dvvpd.exec:\dvvpd.exe53⤵
- Executes dropped EXE
PID:4488 -
\??\c:\rfrxxrf.exec:\rfrxxrf.exe54⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tbnhhb.exec:\tbnhhb.exe55⤵
- Executes dropped EXE
PID:3628 -
\??\c:\nbhbtt.exec:\nbhbtt.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3688 -
\??\c:\djvvv.exec:\djvvv.exe57⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1fffllr.exec:\1fffllr.exe58⤵
- Executes dropped EXE
PID:5040 -
\??\c:\5nnhnn.exec:\5nnhnn.exe59⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dpdpd.exec:\dpdpd.exe60⤵
- Executes dropped EXE
PID:3076 -
\??\c:\llffxfl.exec:\llffxfl.exe61⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\5nnhtt.exec:\5nnhtt.exe63⤵
- Executes dropped EXE
PID:744 -
\??\c:\nbbbnb.exec:\nbbbnb.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvvpp.exec:\vvvpp.exe65⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vddvv.exec:\vddvv.exe66⤵PID:2836
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe67⤵PID:2588
-
\??\c:\nhbhbt.exec:\nhbhbt.exe68⤵PID:3988
-
\??\c:\dpjvp.exec:\dpjvp.exe69⤵PID:1400
-
\??\c:\djpjv.exec:\djpjv.exe70⤵PID:1172
-
\??\c:\lffrllf.exec:\lffrllf.exe71⤵PID:3744
-
\??\c:\ppppj.exec:\ppppj.exe72⤵PID:2824
-
\??\c:\7jpjd.exec:\7jpjd.exe73⤵PID:4028
-
\??\c:\lfflxlf.exec:\lfflxlf.exe74⤵PID:4200
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe75⤵PID:1740
-
\??\c:\7bhbnn.exec:\7bhbnn.exe76⤵PID:2864
-
\??\c:\5dvpp.exec:\5dvpp.exe77⤵PID:4880
-
\??\c:\pjjdp.exec:\pjjdp.exe78⤵PID:3852
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe79⤵PID:1680
-
\??\c:\bnnhnn.exec:\bnnhnn.exe80⤵PID:532
-
\??\c:\btbhtb.exec:\btbhtb.exe81⤵PID:3328
-
\??\c:\1dvjv.exec:\1dvjv.exe82⤵PID:4860
-
\??\c:\xffxffr.exec:\xffxffr.exe83⤵PID:2204
-
\??\c:\rrfxlfr.exec:\rrfxlfr.exe84⤵PID:1588
-
\??\c:\nnbnhb.exec:\nnbnhb.exe85⤵PID:2596
-
\??\c:\jdddp.exec:\jdddp.exe86⤵PID:4460
-
\??\c:\ddjdd.exec:\ddjdd.exe87⤵PID:1412
-
\??\c:\xxrfrlf.exec:\xxrfrlf.exe88⤵PID:3732
-
\??\c:\9nnbhb.exec:\9nnbhb.exe89⤵PID:3984
-
\??\c:\nbhnnh.exec:\nbhnnh.exe90⤵PID:2852
-
\??\c:\hbhthb.exec:\hbhthb.exe91⤵PID:4648
-
\??\c:\djdpd.exec:\djdpd.exe92⤵PID:2800
-
\??\c:\vjpdp.exec:\vjpdp.exe93⤵PID:2472
-
\??\c:\xxrlflx.exec:\xxrlflx.exe94⤵PID:2700
-
\??\c:\tnnhbt.exec:\tnnhbt.exe95⤵PID:2248
-
\??\c:\9ddpd.exec:\9ddpd.exe96⤵PID:1188
-
\??\c:\dpjvd.exec:\dpjvd.exe97⤵PID:716
-
\??\c:\frrlxxr.exec:\frrlxxr.exe98⤵PID:4580
-
\??\c:\hnbthb.exec:\hnbthb.exe99⤵PID:3772
-
\??\c:\nnbthb.exec:\nnbthb.exe100⤵PID:4320
-
\??\c:\ntbthb.exec:\ntbthb.exe101⤵PID:3032
-
\??\c:\jppjv.exec:\jppjv.exe102⤵PID:2268
-
\??\c:\rflfrrr.exec:\rflfrrr.exe103⤵PID:364
-
\??\c:\fxrfrll.exec:\fxrfrll.exe104⤵PID:2132
-
\??\c:\htnnnn.exec:\htnnnn.exe105⤵PID:1748
-
\??\c:\bttbnh.exec:\bttbnh.exe106⤵PID:3224
-
\??\c:\vjjdp.exec:\vjjdp.exe107⤵PID:4012
-
\??\c:\xlrlfff.exec:\xlrlfff.exe108⤵PID:4408
-
\??\c:\3frrllx.exec:\3frrllx.exe109⤵PID:3680
-
\??\c:\btbbhh.exec:\btbbhh.exe110⤵PID:4428
-
\??\c:\httnbt.exec:\httnbt.exe111⤵PID:1728
-
\??\c:\dvvvp.exec:\dvvvp.exe112⤵PID:2080
-
\??\c:\xxffxll.exec:\xxffxll.exe113⤵PID:3016
-
\??\c:\3rrfrlf.exec:\3rrfrlf.exe114⤵PID:3700
-
\??\c:\thbtnn.exec:\thbtnn.exe115⤵PID:1640
-
\??\c:\tbbtbb.exec:\tbbtbb.exe116⤵PID:4484
-
\??\c:\djppj.exec:\djppj.exe117⤵PID:3652
-
\??\c:\dvjdj.exec:\dvjdj.exe118⤵PID:2692
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:4072
-
\??\c:\rrfxffx.exec:\rrfxffx.exe120⤵PID:2688
-
\??\c:\xlllfxl.exec:\xlllfxl.exe121⤵PID:4688
-
\??\c:\bhhhhn.exec:\bhhhhn.exe122⤵PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-