Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 23:52
Static task
static1
Behavioral task
behavioral1
Sample
8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe
Resource
win7-20240903-en
General
-
Target
8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe
-
Size
70KB
-
MD5
2adf4179e2d501c51cf356be3840681e
-
SHA1
0a6d6f8f33d399288279496bcb1108781d3d56bb
-
SHA256
8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce
-
SHA512
07548fb09bba1d946b5580778fd23a7eda1f84b684793d7cea39c0d4cc3670b07a2e947f612af3eb040d1ffaef4ef6a40c56b4e68edb40b08014d539df4ecba0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP:ymb3NkkiQ3mdBjFI4V4ciU
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3816-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3864 vppjv.exe 3440 3fxlxrf.exe 740 htbtnt.exe 4588 dvvjp.exe 2760 9jpdp.exe 3640 frlxrlf.exe 1860 tntthn.exe 4580 9nhbhh.exe 4276 lllxrrf.exe 1792 bnhbtn.exe 1724 dppdp.exe 3204 xrrxlff.exe 112 lxfxxrx.exe 3540 vvvdv.exe 2740 lxrrffr.exe 4204 nbtthh.exe 1392 jdjdp.exe 2236 pvdvj.exe 768 1fflfrl.exe 2500 7nbnbt.exe 2292 vjpjd.exe 1412 jjdvj.exe 2120 7xrfllx.exe 2356 fxrfxrf.exe 1416 3btnbn.exe 3764 dpdpd.exe 3876 lxrfrll.exe 2580 thnbbn.exe 3200 hnbbtn.exe 2480 9lfflfx.exe 1056 nhhbnh.exe 2036 jddvv.exe 1516 5rfrfxr.exe 3528 nhntbb.exe 2536 nbthtb.exe 3840 3pjvd.exe 3392 rlxrxxr.exe 1360 5fflxfx.exe 3836 thtttn.exe 2300 5tnhtn.exe 4128 7pvpd.exe 1196 xlxrrfl.exe 4660 xllfxrf.exe 4732 hbnhbb.exe 3108 9nhhtn.exe 4520 vppjv.exe 3816 vjjdp.exe 1512 rxlfrlx.exe 856 lxrlxrf.exe 508 bthtbn.exe 2972 ddddp.exe 3604 9dpdp.exe 3520 lxffxrl.exe 2920 thbnbn.exe 4948 thhthb.exe 2748 vjjdp.exe 4012 jvpdd.exe 1260 rlrffxl.exe 2072 nhtnbb.exe 3624 tnhhhh.exe 3828 pdvpd.exe 228 dvdvd.exe 4968 lfxlrxl.exe 3676 rrxrlfr.exe -
resource yara_rule behavioral2/memory/3816-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3816 wrote to memory of 3864 3816 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 82 PID 3816 wrote to memory of 3864 3816 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 82 PID 3816 wrote to memory of 3864 3816 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 82 PID 3864 wrote to memory of 3440 3864 vppjv.exe 83 PID 3864 wrote to memory of 3440 3864 vppjv.exe 83 PID 3864 wrote to memory of 3440 3864 vppjv.exe 83 PID 3440 wrote to memory of 740 3440 3fxlxrf.exe 84 PID 3440 wrote to memory of 740 3440 3fxlxrf.exe 84 PID 3440 wrote to memory of 740 3440 3fxlxrf.exe 84 PID 740 wrote to memory of 4588 740 htbtnt.exe 85 PID 740 wrote to memory of 4588 740 htbtnt.exe 85 PID 740 wrote to memory of 4588 740 htbtnt.exe 85 PID 4588 wrote to memory of 2760 4588 dvvjp.exe 86 PID 4588 wrote to memory of 2760 4588 dvvjp.exe 86 PID 4588 wrote to memory of 2760 4588 dvvjp.exe 86 PID 2760 wrote to memory of 3640 2760 9jpdp.exe 87 PID 2760 wrote to memory of 3640 2760 9jpdp.exe 87 PID 2760 wrote to memory of 3640 2760 9jpdp.exe 87 PID 3640 wrote to memory of 1860 3640 frlxrlf.exe 88 PID 3640 wrote to memory of 1860 3640 frlxrlf.exe 88 PID 3640 wrote to memory of 1860 3640 frlxrlf.exe 88 PID 1860 wrote to memory of 4580 1860 tntthn.exe 89 PID 1860 wrote to memory of 4580 1860 tntthn.exe 89 PID 1860 wrote to memory of 4580 1860 tntthn.exe 89 PID 4580 wrote to memory of 4276 4580 9nhbhh.exe 90 PID 4580 wrote to memory of 4276 4580 9nhbhh.exe 90 PID 4580 wrote to memory of 4276 4580 9nhbhh.exe 90 PID 4276 wrote to memory of 1792 4276 lllxrrf.exe 91 PID 4276 wrote to memory of 1792 4276 lllxrrf.exe 91 PID 4276 wrote to memory of 1792 4276 lllxrrf.exe 91 PID 1792 wrote to memory of 1724 1792 bnhbtn.exe 92 PID 1792 wrote to memory of 1724 1792 bnhbtn.exe 92 PID 1792 wrote to memory of 1724 1792 bnhbtn.exe 92 PID 1724 wrote to memory of 3204 1724 dppdp.exe 93 PID 1724 wrote to memory of 3204 1724 dppdp.exe 93 PID 1724 wrote to memory of 3204 1724 dppdp.exe 93 PID 3204 wrote to memory of 112 3204 xrrxlff.exe 94 PID 3204 wrote to memory of 112 3204 xrrxlff.exe 94 PID 3204 wrote to memory of 112 3204 xrrxlff.exe 94 PID 112 wrote to memory of 3540 112 lxfxxrx.exe 95 PID 112 wrote to memory of 3540 112 lxfxxrx.exe 95 PID 112 wrote to memory of 3540 112 lxfxxrx.exe 95 PID 3540 wrote to memory of 2740 3540 vvvdv.exe 96 PID 3540 wrote to memory of 2740 3540 vvvdv.exe 96 PID 3540 wrote to memory of 2740 3540 vvvdv.exe 96 PID 2740 wrote to memory of 4204 2740 lxrrffr.exe 97 PID 2740 wrote to memory of 4204 2740 lxrrffr.exe 97 PID 2740 wrote to memory of 4204 2740 lxrrffr.exe 97 PID 4204 wrote to memory of 1392 4204 nbtthh.exe 98 PID 4204 wrote to memory of 1392 4204 nbtthh.exe 98 PID 4204 wrote to memory of 1392 4204 nbtthh.exe 98 PID 1392 wrote to memory of 2236 1392 jdjdp.exe 99 PID 1392 wrote to memory of 2236 1392 jdjdp.exe 99 PID 1392 wrote to memory of 2236 1392 jdjdp.exe 99 PID 2236 wrote to memory of 768 2236 pvdvj.exe 100 PID 2236 wrote to memory of 768 2236 pvdvj.exe 100 PID 2236 wrote to memory of 768 2236 pvdvj.exe 100 PID 768 wrote to memory of 2500 768 1fflfrl.exe 101 PID 768 wrote to memory of 2500 768 1fflfrl.exe 101 PID 768 wrote to memory of 2500 768 1fflfrl.exe 101 PID 2500 wrote to memory of 2292 2500 7nbnbt.exe 102 PID 2500 wrote to memory of 2292 2500 7nbnbt.exe 102 PID 2500 wrote to memory of 2292 2500 7nbnbt.exe 102 PID 2292 wrote to memory of 1412 2292 vjpjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe"C:\Users\Admin\AppData\Local\Temp\8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\vppjv.exec:\vppjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\3fxlxrf.exec:\3fxlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\htbtnt.exec:\htbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\dvvjp.exec:\dvvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\9jpdp.exec:\9jpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\frlxrlf.exec:\frlxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\tntthn.exec:\tntthn.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\9nhbhh.exec:\9nhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\lllxrrf.exec:\lllxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\bnhbtn.exec:\bnhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\dppdp.exec:\dppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\xrrxlff.exec:\xrrxlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\vvvdv.exec:\vvvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\lxrrffr.exec:\lxrrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nbtthh.exec:\nbtthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\jdjdp.exec:\jdjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\pvdvj.exec:\pvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\1fflfrl.exec:\1fflfrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\7nbnbt.exec:\7nbnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vjpjd.exec:\vjpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jjdvj.exec:\jjdvj.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7xrfllx.exec:\7xrfllx.exe24⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe25⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3btnbn.exec:\3btnbn.exe26⤵
- Executes dropped EXE
PID:1416 -
\??\c:\dpdpd.exec:\dpdpd.exe27⤵
- Executes dropped EXE
PID:3764 -
\??\c:\lxrfrll.exec:\lxrfrll.exe28⤵
- Executes dropped EXE
PID:3876 -
\??\c:\thnbbn.exec:\thnbbn.exe29⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hnbbtn.exec:\hnbbtn.exe30⤵
- Executes dropped EXE
PID:3200 -
\??\c:\9lfflfx.exec:\9lfflfx.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nhhbnh.exec:\nhhbnh.exe32⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jddvv.exec:\jddvv.exe33⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5rfrfxr.exec:\5rfrfxr.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nhntbb.exec:\nhntbb.exe35⤵
- Executes dropped EXE
PID:3528 -
\??\c:\nbthtb.exec:\nbthtb.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3pjvd.exec:\3pjvd.exe37⤵
- Executes dropped EXE
PID:3840 -
\??\c:\rlxrxxr.exec:\rlxrxxr.exe38⤵
- Executes dropped EXE
PID:3392 -
\??\c:\5fflxfx.exec:\5fflxfx.exe39⤵
- Executes dropped EXE
PID:1360 -
\??\c:\thtttn.exec:\thtttn.exe40⤵
- Executes dropped EXE
PID:3836 -
\??\c:\5tnhtn.exec:\5tnhtn.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7pvpd.exec:\7pvpd.exe42⤵
- Executes dropped EXE
PID:4128 -
\??\c:\xlxrrfl.exec:\xlxrrfl.exe43⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xllfxrf.exec:\xllfxrf.exe44⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hbnhbb.exec:\hbnhbb.exe45⤵
- Executes dropped EXE
PID:4732 -
\??\c:\9nhhtn.exec:\9nhhtn.exe46⤵
- Executes dropped EXE
PID:3108 -
\??\c:\vppjv.exec:\vppjv.exe47⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vjjdp.exec:\vjjdp.exe48⤵
- Executes dropped EXE
PID:3816 -
\??\c:\rxlfrlx.exec:\rxlfrlx.exe49⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxrlxrf.exec:\lxrlxrf.exe50⤵
- Executes dropped EXE
PID:856 -
\??\c:\bthtbn.exec:\bthtbn.exe51⤵
- Executes dropped EXE
PID:508 -
\??\c:\ddddp.exec:\ddddp.exe52⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9dpdp.exec:\9dpdp.exe53⤵
- Executes dropped EXE
PID:3604 -
\??\c:\lxffxrl.exec:\lxffxrl.exe54⤵
- Executes dropped EXE
PID:3520 -
\??\c:\thbnbn.exec:\thbnbn.exe55⤵
- Executes dropped EXE
PID:2920 -
\??\c:\thhthb.exec:\thhthb.exe56⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vjjdp.exec:\vjjdp.exe57⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jvpdd.exec:\jvpdd.exe58⤵
- Executes dropped EXE
PID:4012 -
\??\c:\rlrffxl.exec:\rlrffxl.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nhtnbb.exec:\nhtnbb.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\tnhhhh.exec:\tnhhhh.exe61⤵
- Executes dropped EXE
PID:3624 -
\??\c:\pdvpd.exec:\pdvpd.exe62⤵
- Executes dropped EXE
PID:3828 -
\??\c:\dvdvd.exec:\dvdvd.exe63⤵
- Executes dropped EXE
PID:228 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe64⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rrxrlfr.exec:\rrxrlfr.exe65⤵
- Executes dropped EXE
PID:3676 -
\??\c:\tthhht.exec:\tthhht.exe66⤵PID:3008
-
\??\c:\7ddvp.exec:\7ddvp.exe67⤵PID:1696
-
\??\c:\1jpdv.exec:\1jpdv.exe68⤵PID:3600
-
\??\c:\rxfrfxf.exec:\rxfrfxf.exe69⤵PID:1688
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe70⤵
- System Location Discovery: System Language Discovery
PID:4728 -
\??\c:\hbhbhb.exec:\hbhbhb.exe71⤵PID:2720
-
\??\c:\nbtnbt.exec:\nbtnbt.exe72⤵PID:1692
-
\??\c:\1jpdd.exec:\1jpdd.exe73⤵PID:3320
-
\??\c:\jppdp.exec:\jppdp.exe74⤵PID:2784
-
\??\c:\frxlxrf.exec:\frxlxrf.exe75⤵PID:8
-
\??\c:\frlfrlf.exec:\frlfrlf.exe76⤵PID:1844
-
\??\c:\3hnhtn.exec:\3hnhtn.exe77⤵PID:2928
-
\??\c:\vddpd.exec:\vddpd.exe78⤵PID:4704
-
\??\c:\jdvjv.exec:\jdvjv.exe79⤵PID:1084
-
\??\c:\rfrffxx.exec:\rfrffxx.exe80⤵PID:3664
-
\??\c:\rxfxlll.exec:\rxfxlll.exe81⤵PID:2120
-
\??\c:\htthbt.exec:\htthbt.exe82⤵PID:3916
-
\??\c:\bhhbtt.exec:\bhhbtt.exe83⤵PID:4448
-
\??\c:\jpjdv.exec:\jpjdv.exe84⤵PID:2204
-
\??\c:\jdjjd.exec:\jdjjd.exe85⤵PID:4196
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe86⤵PID:2008
-
\??\c:\hbtnbb.exec:\hbtnbb.exe87⤵PID:4744
-
\??\c:\nttntn.exec:\nttntn.exe88⤵PID:4932
-
\??\c:\vjjdp.exec:\vjjdp.exe89⤵PID:876
-
\??\c:\1vdvj.exec:\1vdvj.exe90⤵PID:3652
-
\??\c:\lrrlffr.exec:\lrrlffr.exe91⤵PID:4180
-
\??\c:\flrlxrl.exec:\flrlxrl.exe92⤵PID:4684
-
\??\c:\tbnnbt.exec:\tbnnbt.exe93⤵PID:1660
-
\??\c:\nnthbt.exec:\nnthbt.exe94⤵PID:1864
-
\??\c:\jdjjp.exec:\jdjjp.exe95⤵PID:1584
-
\??\c:\7djdv.exec:\7djdv.exe96⤵PID:2888
-
\??\c:\rxxlrll.exec:\rxxlrll.exe97⤵PID:1608
-
\??\c:\rxxxrlx.exec:\rxxxrlx.exe98⤵PID:1968
-
\??\c:\bttnhh.exec:\bttnhh.exe99⤵PID:5052
-
\??\c:\7pvpp.exec:\7pvpp.exe100⤵PID:3368
-
\??\c:\jjjvj.exec:\jjjvj.exe101⤵PID:1064
-
\??\c:\llllxrr.exec:\llllxrr.exe102⤵PID:368
-
\??\c:\xrxlffl.exec:\xrxlffl.exe103⤵PID:3060
-
\??\c:\1hbtnh.exec:\1hbtnh.exe104⤵PID:4348
-
\??\c:\hbtntn.exec:\hbtntn.exe105⤵PID:544
-
\??\c:\jvvpj.exec:\jvvpj.exe106⤵PID:2552
-
\??\c:\7jjvj.exec:\7jjvj.exe107⤵PID:4840
-
\??\c:\flrlxrl.exec:\flrlxrl.exe108⤵PID:816
-
\??\c:\lffxlfx.exec:\lffxlfx.exe109⤵PID:4440
-
\??\c:\btnhbt.exec:\btnhbt.exe110⤵PID:3860
-
\??\c:\3nbtnn.exec:\3nbtnn.exe111⤵PID:3980
-
\??\c:\vpjpj.exec:\vpjpj.exe112⤵PID:3616
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe113⤵PID:3176
-
\??\c:\3xxlfxr.exec:\3xxlfxr.exe114⤵PID:4400
-
\??\c:\nttnhb.exec:\nttnhb.exe115⤵PID:3592
-
\??\c:\hnbnhn.exec:\hnbnhn.exe116⤵PID:3488
-
\??\c:\3dvpd.exec:\3dvpd.exe117⤵PID:1372
-
\??\c:\5djdj.exec:\5djdj.exe118⤵PID:1672
-
\??\c:\rfflrlf.exec:\rfflrlf.exe119⤵PID:2272
-
\??\c:\xrrlflf.exec:\xrrlflf.exe120⤵PID:3416
-
\??\c:\bhhthh.exec:\bhhthh.exe121⤵PID:1012
-
\??\c:\nnnnhn.exec:\nnnnhn.exe122⤵PID:220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-