Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe
Resource
win7-20240903-en
General
-
Target
027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe
-
Size
80KB
-
MD5
03195d14c12a391bff77049cc121a240
-
SHA1
4ebd807db9270f9bf794b1754b76b8d9be14e19d
-
SHA256
027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891b
-
SHA512
be31a3a395889eaa8e3d7286608ac6204349cdbb685fc736961439032ea842e05751ae94f81140b0dc6c849b876e3094f6929befa1b16337598bdad7b2a247ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeCH:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4T
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4548-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/612-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4548 rrlffff.exe 612 tnnhbb.exe 2292 nhttbb.exe 3144 dpvdp.exe 3320 pjvvp.exe 3244 rffxrlr.exe 4416 nhhbnn.exe 1816 vdpjj.exe 1700 9fllfff.exe 4148 frlrflf.exe 1108 nbhhbb.exe 448 nhbtnn.exe 4944 vdpjp.exe 3728 pjjdd.exe 3900 9rlfrrl.exe 3592 thhbtt.exe 4964 9hnhbt.exe 1300 jpppj.exe 4368 pppjd.exe 3632 3vpjv.exe 452 fxrlffx.exe 2220 5ffxrrl.exe 4796 bttnhh.exe 4716 ntbthn.exe 4644 jdvdv.exe 3472 vjpjd.exe 2660 jjvpj.exe 3460 lrlfxrr.exe 628 5rfffff.exe 2276 3btttn.exe 3852 5btnhh.exe 2696 dvdvv.exe 3480 jdvdv.exe 744 7rrlffx.exe 4764 3rfxffl.exe 4820 tbttnn.exe 5088 bbnhnn.exe 5060 pjddp.exe 1896 vpdpj.exe 2004 5ddvj.exe 4648 frxrlff.exe 2556 lxfxrrl.exe 1948 bthbhh.exe 1704 bntnhh.exe 3720 btbtnn.exe 4308 9pdpj.exe 4016 pjjdv.exe 4460 lrfxxrr.exe 4792 5rfxxxf.exe 4500 nnhhnn.exe 3080 nnnhbb.exe 2464 dvvpj.exe 828 dvvdv.exe 940 rrfxrfx.exe 1700 fffxxfx.exe 3604 nhhhbb.exe 4860 7vddv.exe 1108 xxxrfxx.exe 3152 5ttnhh.exe 768 bnnbbb.exe 1420 1pvpd.exe 3456 vpdvd.exe 4768 rffrllf.exe 3172 lfrlrrf.exe -
resource yara_rule behavioral2/memory/5100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-7-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5100 wrote to memory of 4548 5100 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 82 PID 5100 wrote to memory of 4548 5100 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 82 PID 5100 wrote to memory of 4548 5100 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 82 PID 4548 wrote to memory of 612 4548 rrlffff.exe 83 PID 4548 wrote to memory of 612 4548 rrlffff.exe 83 PID 4548 wrote to memory of 612 4548 rrlffff.exe 83 PID 612 wrote to memory of 2292 612 tnnhbb.exe 84 PID 612 wrote to memory of 2292 612 tnnhbb.exe 84 PID 612 wrote to memory of 2292 612 tnnhbb.exe 84 PID 2292 wrote to memory of 3144 2292 nhttbb.exe 85 PID 2292 wrote to memory of 3144 2292 nhttbb.exe 85 PID 2292 wrote to memory of 3144 2292 nhttbb.exe 85 PID 3144 wrote to memory of 3320 3144 dpvdp.exe 86 PID 3144 wrote to memory of 3320 3144 dpvdp.exe 86 PID 3144 wrote to memory of 3320 3144 dpvdp.exe 86 PID 3320 wrote to memory of 3244 3320 pjvvp.exe 87 PID 3320 wrote to memory of 3244 3320 pjvvp.exe 87 PID 3320 wrote to memory of 3244 3320 pjvvp.exe 87 PID 3244 wrote to memory of 4416 3244 rffxrlr.exe 88 PID 3244 wrote to memory of 4416 3244 rffxrlr.exe 88 PID 3244 wrote to memory of 4416 3244 rffxrlr.exe 88 PID 4416 wrote to memory of 1816 4416 nhhbnn.exe 89 PID 4416 wrote to memory of 1816 4416 nhhbnn.exe 89 PID 4416 wrote to memory of 1816 4416 nhhbnn.exe 89 PID 1816 wrote to memory of 1700 1816 vdpjj.exe 136 PID 1816 wrote to memory of 1700 1816 vdpjj.exe 136 PID 1816 wrote to memory of 1700 1816 vdpjj.exe 136 PID 1700 wrote to memory of 4148 1700 9fllfff.exe 91 PID 1700 wrote to memory of 4148 1700 9fllfff.exe 91 PID 1700 wrote to memory of 4148 1700 9fllfff.exe 91 PID 4148 wrote to memory of 1108 4148 frlrflf.exe 139 PID 4148 wrote to memory of 1108 4148 frlrflf.exe 139 PID 4148 wrote to memory of 1108 4148 frlrflf.exe 139 PID 1108 wrote to memory of 448 1108 nbhhbb.exe 93 PID 1108 wrote to memory of 448 1108 nbhhbb.exe 93 PID 1108 wrote to memory of 448 1108 nbhhbb.exe 93 PID 448 wrote to memory of 4944 448 nhbtnn.exe 94 PID 448 wrote to memory of 4944 448 nhbtnn.exe 94 PID 448 wrote to memory of 4944 448 nhbtnn.exe 94 PID 4944 wrote to memory of 3728 4944 vdpjp.exe 95 PID 4944 wrote to memory of 3728 4944 vdpjp.exe 95 PID 4944 wrote to memory of 3728 4944 vdpjp.exe 95 PID 3728 wrote to memory of 3900 3728 pjjdd.exe 96 PID 3728 wrote to memory of 3900 3728 pjjdd.exe 96 PID 3728 wrote to memory of 3900 3728 pjjdd.exe 96 PID 3900 wrote to memory of 3592 3900 9rlfrrl.exe 146 PID 3900 wrote to memory of 3592 3900 9rlfrrl.exe 146 PID 3900 wrote to memory of 3592 3900 9rlfrrl.exe 146 PID 3592 wrote to memory of 4964 3592 thhbtt.exe 147 PID 3592 wrote to memory of 4964 3592 thhbtt.exe 147 PID 3592 wrote to memory of 4964 3592 thhbtt.exe 147 PID 4964 wrote to memory of 1300 4964 9hnhbt.exe 99 PID 4964 wrote to memory of 1300 4964 9hnhbt.exe 99 PID 4964 wrote to memory of 1300 4964 9hnhbt.exe 99 PID 1300 wrote to memory of 4368 1300 jpppj.exe 100 PID 1300 wrote to memory of 4368 1300 jpppj.exe 100 PID 1300 wrote to memory of 4368 1300 jpppj.exe 100 PID 4368 wrote to memory of 3632 4368 pppjd.exe 150 PID 4368 wrote to memory of 3632 4368 pppjd.exe 150 PID 4368 wrote to memory of 3632 4368 pppjd.exe 150 PID 3632 wrote to memory of 452 3632 3vpjv.exe 102 PID 3632 wrote to memory of 452 3632 3vpjv.exe 102 PID 3632 wrote to memory of 452 3632 3vpjv.exe 102 PID 452 wrote to memory of 2220 452 fxrlffx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe"C:\Users\Admin\AppData\Local\Temp\027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\rrlffff.exec:\rrlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\tnnhbb.exec:\tnnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\nhttbb.exec:\nhttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\dpvdp.exec:\dpvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\pjvvp.exec:\pjvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rffxrlr.exec:\rffxrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\nhhbnn.exec:\nhhbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\vdpjj.exec:\vdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\9fllfff.exec:\9fllfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\frlrflf.exec:\frlrflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\nbhhbb.exec:\nbhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\nhbtnn.exec:\nhbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vdpjp.exec:\vdpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pjjdd.exec:\pjjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\9rlfrrl.exec:\9rlfrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\thhbtt.exec:\thhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\9hnhbt.exec:\9hnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\jpppj.exec:\jpppj.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\pppjd.exec:\pppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\3vpjv.exec:\3vpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\fxrlffx.exec:\fxrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bttnhh.exec:\bttnhh.exe24⤵
- Executes dropped EXE
PID:4796 -
\??\c:\ntbthn.exec:\ntbthn.exe25⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jdvdv.exec:\jdvdv.exe26⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vjpjd.exec:\vjpjd.exe27⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jjvpj.exec:\jjvpj.exe28⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lrlfxrr.exec:\lrlfxrr.exe29⤵
- Executes dropped EXE
PID:3460 -
\??\c:\5rfffff.exec:\5rfffff.exe30⤵
- Executes dropped EXE
PID:628 -
\??\c:\3btttn.exec:\3btttn.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5btnhh.exec:\5btnhh.exe32⤵
- Executes dropped EXE
PID:3852 -
\??\c:\dvdvv.exec:\dvdvv.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdvdv.exec:\jdvdv.exe34⤵
- Executes dropped EXE
PID:3480 -
\??\c:\7rrlffx.exec:\7rrlffx.exe35⤵
- Executes dropped EXE
PID:744 -
\??\c:\3rfxffl.exec:\3rfxffl.exe36⤵
- Executes dropped EXE
PID:4764 -
\??\c:\tbttnn.exec:\tbttnn.exe37⤵
- Executes dropped EXE
PID:4820 -
\??\c:\bbnhnn.exec:\bbnhnn.exe38⤵
- Executes dropped EXE
PID:5088 -
\??\c:\pjddp.exec:\pjddp.exe39⤵
- Executes dropped EXE
PID:5060 -
\??\c:\vpdpj.exec:\vpdpj.exe40⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5ddvj.exec:\5ddvj.exe41⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frxrlff.exec:\frxrlff.exe42⤵
- Executes dropped EXE
PID:4648 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bthbhh.exec:\bthbhh.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bntnhh.exec:\bntnhh.exe45⤵
- Executes dropped EXE
PID:1704 -
\??\c:\btbtnn.exec:\btbtnn.exe46⤵
- Executes dropped EXE
PID:3720 -
\??\c:\9pdpj.exec:\9pdpj.exe47⤵
- Executes dropped EXE
PID:4308 -
\??\c:\pjjdv.exec:\pjjdv.exe48⤵
- Executes dropped EXE
PID:4016 -
\??\c:\lrfxxrr.exec:\lrfxxrr.exe49⤵
- Executes dropped EXE
PID:4460 -
\??\c:\5rfxxxf.exec:\5rfxxxf.exe50⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nnhhnn.exec:\nnhhnn.exe51⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nnnhbb.exec:\nnnhbb.exe52⤵
- Executes dropped EXE
PID:3080 -
\??\c:\dvvpj.exec:\dvvpj.exe53⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvvdv.exec:\dvvdv.exe54⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrfxrfx.exec:\rrfxrfx.exe55⤵
- Executes dropped EXE
PID:940 -
\??\c:\fffxxfx.exec:\fffxxfx.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhhhbb.exec:\nhhhbb.exe57⤵
- Executes dropped EXE
PID:3604 -
\??\c:\7vddv.exec:\7vddv.exe58⤵
- Executes dropped EXE
PID:4860 -
\??\c:\xxxrfxx.exec:\xxxrfxx.exe59⤵
- Executes dropped EXE
PID:1108 -
\??\c:\5ttnhh.exec:\5ttnhh.exe60⤵
- Executes dropped EXE
PID:3152 -
\??\c:\bnnbbb.exec:\bnnbbb.exe61⤵
- Executes dropped EXE
PID:768 -
\??\c:\1pvpd.exec:\1pvpd.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vpdvd.exec:\vpdvd.exe63⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rffrllf.exec:\rffrllf.exe64⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe65⤵
- Executes dropped EXE
PID:3172 -
\??\c:\btbbth.exec:\btbbth.exe66⤵PID:3592
-
\??\c:\bttthn.exec:\bttthn.exe67⤵PID:4964
-
\??\c:\vjpjj.exec:\vjpjj.exe68⤵PID:3336
-
\??\c:\frxlrrl.exec:\frxlrrl.exe69⤵PID:2496
-
\??\c:\nhbtnn.exec:\nhbtnn.exe70⤵PID:3632
-
\??\c:\ttnnnh.exec:\ttnnnh.exe71⤵PID:3528
-
\??\c:\dvdjd.exec:\dvdjd.exe72⤵PID:2476
-
\??\c:\dvppp.exec:\dvppp.exe73⤵PID:4480
-
\??\c:\bnbtbb.exec:\bnbtbb.exe74⤵PID:216
-
\??\c:\dpjjd.exec:\dpjjd.exe75⤵PID:1028
-
\??\c:\nhhhbb.exec:\nhhhbb.exe76⤵PID:3812
-
\??\c:\bnnhhh.exec:\bnnhhh.exe77⤵PID:3472
-
\??\c:\hbhbtt.exec:\hbhbtt.exe78⤵PID:1032
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe79⤵PID:3360
-
\??\c:\hhhhbh.exec:\hhhhbh.exe80⤵PID:2260
-
\??\c:\hntnhb.exec:\hntnhb.exe81⤵PID:2916
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe82⤵PID:2804
-
\??\c:\jjvvv.exec:\jjvvv.exe83⤵PID:1508
-
\??\c:\ffxfxll.exec:\ffxfxll.exe84⤵PID:5036
-
\??\c:\5tbtbt.exec:\5tbtbt.exe85⤵PID:1168
-
\??\c:\vpddv.exec:\vpddv.exe86⤵PID:2488
-
\??\c:\7bnhnn.exec:\7bnhnn.exe87⤵PID:2708
-
\??\c:\frrrlll.exec:\frrrlll.exe88⤵PID:4236
-
\??\c:\ttnhbh.exec:\ttnhbh.exe89⤵PID:4380
-
\??\c:\7ffxxxr.exec:\7ffxxxr.exe90⤵PID:4576
-
\??\c:\pddpd.exec:\pddpd.exe91⤵PID:4348
-
\??\c:\xfllfxx.exec:\xfllfxx.exe92⤵PID:5060
-
\??\c:\rflfffx.exec:\rflfffx.exe93⤵PID:2944
-
\??\c:\bnbbtt.exec:\bnbbtt.exe94⤵PID:1116
-
\??\c:\fxrfxll.exec:\fxrfxll.exe95⤵PID:4284
-
\??\c:\lllfxxx.exec:\lllfxxx.exe96⤵PID:4316
-
\??\c:\tntnhb.exec:\tntnhb.exe97⤵PID:2148
-
\??\c:\dvvpd.exec:\dvvpd.exe98⤵PID:3344
-
\??\c:\jvpjd.exec:\jvpjd.exe99⤵PID:4372
-
\??\c:\xrflfrl.exec:\xrflfrl.exe100⤵PID:2560
-
\??\c:\3rxrllf.exec:\3rxrllf.exe101⤵PID:3144
-
\??\c:\htthnb.exec:\htthnb.exe102⤵PID:4016
-
\??\c:\djdvp.exec:\djdvp.exe103⤵PID:1432
-
\??\c:\lxxfrrr.exec:\lxxfrrr.exe104⤵PID:4792
-
\??\c:\1bbbtt.exec:\1bbbtt.exe105⤵PID:4500
-
\??\c:\jjdvp.exec:\jjdvp.exe106⤵PID:4788
-
\??\c:\vvvjd.exec:\vvvjd.exe107⤵PID:2928
-
\??\c:\xrllrfl.exec:\xrllrfl.exe108⤵PID:5020
-
\??\c:\ntnttt.exec:\ntnttt.exe109⤵PID:940
-
\??\c:\pjvpd.exec:\pjvpd.exe110⤵PID:1700
-
\??\c:\xrfxffl.exec:\xrfxffl.exe111⤵PID:3584
-
\??\c:\nhhhhn.exec:\nhhhhn.exe112⤵PID:4860
-
\??\c:\vppjj.exec:\vppjj.exe113⤵PID:656
-
\??\c:\fxxrlll.exec:\fxxrlll.exe114⤵PID:4944
-
\??\c:\flffffx.exec:\flffffx.exe115⤵PID:1376
-
\??\c:\tnhhtt.exec:\tnhhtt.exe116⤵PID:1904
-
\??\c:\jjjpj.exec:\jjjpj.exe117⤵PID:516
-
\??\c:\rrflxrl.exec:\rrflxrl.exe118⤵PID:3116
-
\??\c:\nhnbnt.exec:\nhnbnt.exe119⤵PID:1324
-
\??\c:\hbhbbh.exec:\hbhbbh.exe120⤵PID:1708
-
\??\c:\pjjpp.exec:\pjjpp.exe121⤵PID:540
-
\??\c:\dvdpv.exec:\dvdpv.exe122⤵PID:1892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-