Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe
Resource
win7-20240903-en
General
-
Target
8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe
-
Size
64KB
-
MD5
a36d3b9fbe4e5f29220b5d4566c47790
-
SHA1
41736eb9e71d5808278e306522cfc8e56d01615f
-
SHA256
8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8
-
SHA512
71b18f5ac4925c4ee2764f0d68ba082cdb11f397a544e3cd0d9fba5c28b82a7c0cb24e7d4a83e216ab5d7f4d4cee423f97b26ffadd61901067956353da5ddac5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiP:ymb3NkkiQ3mdBjF0y7kbK
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/3472-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 912 nhbthb.exe 4876 ddjdp.exe 1900 5vvpp.exe 4820 xrlfrfx.exe 3764 lrrlrlf.exe 1524 nbhthb.exe 3984 dddjd.exe 3116 5xfxxff.exe 2716 thbthb.exe 1868 vjddv.exe 1756 9djdj.exe 2488 xxxlfxl.exe 3140 bbhbtt.exe 4768 htbtnh.exe 2728 3pjvp.exe 4540 fxfxxrl.exe 2500 3tnbhb.exe 3748 httnhn.exe 1388 7djjj.exe 4032 7lrxrxr.exe 3736 tbbbnn.exe 548 9vpjd.exe 4756 lfxrrrl.exe 4180 hhbhnn.exe 3604 ddjjp.exe 4240 pdjdv.exe 4220 fxlfxxr.exe 3732 lfxfffx.exe 2044 ntnnhh.exe 1872 pjddv.exe 2444 lxrlrrl.exe 448 dvdpj.exe 4796 dpjjd.exe 2000 lxfxrrf.exe 8 flrrrrx.exe 1824 bttnbb.exe 716 tnnhtn.exe 3608 pvpjd.exe 4568 jdppv.exe 2324 llllxfr.exe 1676 1fllflf.exe 4324 5vddv.exe 912 rllrxll.exe 4900 nhnhnn.exe 1780 nntnnb.exe 2904 dvvpd.exe 3424 1rxlfxl.exe 4256 hhntht.exe 4048 tnnthh.exe 4060 vjjdd.exe 3288 vvdvp.exe 3696 rlxrlfx.exe 1132 bhnttt.exe 2608 nhnnnt.exe 740 jvddv.exe 4348 pjpjp.exe 1576 rfxxrrr.exe 3384 rrrfxrl.exe 2488 nttbtt.exe 3140 3vvjd.exe 3816 jvpdd.exe 3880 llfxrlf.exe 4468 bhnbtn.exe 2612 hbbtht.exe -
resource yara_rule behavioral2/memory/3472-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-184-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3472 wrote to memory of 912 3472 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 82 PID 3472 wrote to memory of 912 3472 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 82 PID 3472 wrote to memory of 912 3472 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 82 PID 912 wrote to memory of 4876 912 nhbthb.exe 83 PID 912 wrote to memory of 4876 912 nhbthb.exe 83 PID 912 wrote to memory of 4876 912 nhbthb.exe 83 PID 4876 wrote to memory of 1900 4876 ddjdp.exe 84 PID 4876 wrote to memory of 1900 4876 ddjdp.exe 84 PID 4876 wrote to memory of 1900 4876 ddjdp.exe 84 PID 1900 wrote to memory of 4820 1900 5vvpp.exe 85 PID 1900 wrote to memory of 4820 1900 5vvpp.exe 85 PID 1900 wrote to memory of 4820 1900 5vvpp.exe 85 PID 4820 wrote to memory of 3764 4820 xrlfrfx.exe 86 PID 4820 wrote to memory of 3764 4820 xrlfrfx.exe 86 PID 4820 wrote to memory of 3764 4820 xrlfrfx.exe 86 PID 3764 wrote to memory of 1524 3764 lrrlrlf.exe 87 PID 3764 wrote to memory of 1524 3764 lrrlrlf.exe 87 PID 3764 wrote to memory of 1524 3764 lrrlrlf.exe 87 PID 1524 wrote to memory of 3984 1524 nbhthb.exe 88 PID 1524 wrote to memory of 3984 1524 nbhthb.exe 88 PID 1524 wrote to memory of 3984 1524 nbhthb.exe 88 PID 3984 wrote to memory of 3116 3984 dddjd.exe 89 PID 3984 wrote to memory of 3116 3984 dddjd.exe 89 PID 3984 wrote to memory of 3116 3984 dddjd.exe 89 PID 3116 wrote to memory of 2716 3116 5xfxxff.exe 90 PID 3116 wrote to memory of 2716 3116 5xfxxff.exe 90 PID 3116 wrote to memory of 2716 3116 5xfxxff.exe 90 PID 2716 wrote to memory of 1868 2716 thbthb.exe 91 PID 2716 wrote to memory of 1868 2716 thbthb.exe 91 PID 2716 wrote to memory of 1868 2716 thbthb.exe 91 PID 1868 wrote to memory of 1756 1868 vjddv.exe 92 PID 1868 wrote to memory of 1756 1868 vjddv.exe 92 PID 1868 wrote to memory of 1756 1868 vjddv.exe 92 PID 1756 wrote to memory of 2488 1756 9djdj.exe 93 PID 1756 wrote to memory of 2488 1756 9djdj.exe 93 PID 1756 wrote to memory of 2488 1756 9djdj.exe 93 PID 2488 wrote to memory of 3140 2488 xxxlfxl.exe 94 PID 2488 wrote to memory of 3140 2488 xxxlfxl.exe 94 PID 2488 wrote to memory of 3140 2488 xxxlfxl.exe 94 PID 3140 wrote to memory of 4768 3140 bbhbtt.exe 95 PID 3140 wrote to memory of 4768 3140 bbhbtt.exe 95 PID 3140 wrote to memory of 4768 3140 bbhbtt.exe 95 PID 4768 wrote to memory of 2728 4768 htbtnh.exe 96 PID 4768 wrote to memory of 2728 4768 htbtnh.exe 96 PID 4768 wrote to memory of 2728 4768 htbtnh.exe 96 PID 2728 wrote to memory of 4540 2728 3pjvp.exe 97 PID 2728 wrote to memory of 4540 2728 3pjvp.exe 97 PID 2728 wrote to memory of 4540 2728 3pjvp.exe 97 PID 4540 wrote to memory of 2500 4540 fxfxxrl.exe 98 PID 4540 wrote to memory of 2500 4540 fxfxxrl.exe 98 PID 4540 wrote to memory of 2500 4540 fxfxxrl.exe 98 PID 2500 wrote to memory of 3748 2500 3tnbhb.exe 99 PID 2500 wrote to memory of 3748 2500 3tnbhb.exe 99 PID 2500 wrote to memory of 3748 2500 3tnbhb.exe 99 PID 3748 wrote to memory of 1388 3748 httnhn.exe 100 PID 3748 wrote to memory of 1388 3748 httnhn.exe 100 PID 3748 wrote to memory of 1388 3748 httnhn.exe 100 PID 1388 wrote to memory of 4032 1388 7djjj.exe 101 PID 1388 wrote to memory of 4032 1388 7djjj.exe 101 PID 1388 wrote to memory of 4032 1388 7djjj.exe 101 PID 4032 wrote to memory of 3736 4032 7lrxrxr.exe 102 PID 4032 wrote to memory of 3736 4032 7lrxrxr.exe 102 PID 4032 wrote to memory of 3736 4032 7lrxrxr.exe 102 PID 3736 wrote to memory of 548 3736 tbbbnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe"C:\Users\Admin\AppData\Local\Temp\8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\nhbthb.exec:\nhbthb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\ddjdp.exec:\ddjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\5vvpp.exec:\5vvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\xrlfrfx.exec:\xrlfrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\lrrlrlf.exec:\lrrlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\nbhthb.exec:\nbhthb.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\dddjd.exec:\dddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\5xfxxff.exec:\5xfxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\thbthb.exec:\thbthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vjddv.exec:\vjddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\9djdj.exec:\9djdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\bbhbtt.exec:\bbhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\htbtnh.exec:\htbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\3pjvp.exec:\3pjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\3tnbhb.exec:\3tnbhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\httnhn.exec:\httnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\7djjj.exec:\7djjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\7lrxrxr.exec:\7lrxrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\tbbbnn.exec:\tbbbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\9vpjd.exec:\9vpjd.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe24⤵
- Executes dropped EXE
PID:4756 -
\??\c:\hhbhnn.exec:\hhbhnn.exe25⤵
- Executes dropped EXE
PID:4180 -
\??\c:\ddjjp.exec:\ddjjp.exe26⤵
- Executes dropped EXE
PID:3604 -
\??\c:\pdjdv.exec:\pdjdv.exe27⤵
- Executes dropped EXE
PID:4240 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe28⤵
- Executes dropped EXE
PID:4220 -
\??\c:\lfxfffx.exec:\lfxfffx.exe29⤵
- Executes dropped EXE
PID:3732 -
\??\c:\ntnnhh.exec:\ntnnhh.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pjddv.exec:\pjddv.exe31⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dvdpj.exec:\dvdpj.exe33⤵
- Executes dropped EXE
PID:448 -
\??\c:\dpjjd.exec:\dpjjd.exe34⤵
- Executes dropped EXE
PID:4796 -
\??\c:\lxfxrrf.exec:\lxfxrrf.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\flrrrrx.exec:\flrrrrx.exe36⤵
- Executes dropped EXE
PID:8 -
\??\c:\bttnbb.exec:\bttnbb.exe37⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tnnhtn.exec:\tnnhtn.exe38⤵
- Executes dropped EXE
PID:716 -
\??\c:\pvpjd.exec:\pvpjd.exe39⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jdppv.exec:\jdppv.exe40⤵
- Executes dropped EXE
PID:4568 -
\??\c:\llllxfr.exec:\llllxfr.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1fllflf.exec:\1fllflf.exe42⤵
- Executes dropped EXE
PID:1676 -
\??\c:\5vddv.exec:\5vddv.exe43⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rllrxll.exec:\rllrxll.exe44⤵
- Executes dropped EXE
PID:912 -
\??\c:\nhnhnn.exec:\nhnhnn.exe45⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nntnnb.exec:\nntnnb.exe46⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dvvpd.exec:\dvvpd.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1rxlfxl.exec:\1rxlfxl.exe48⤵
- Executes dropped EXE
PID:3424 -
\??\c:\hhntht.exec:\hhntht.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4256 -
\??\c:\tnnthh.exec:\tnnthh.exe50⤵
- Executes dropped EXE
PID:4048 -
\??\c:\vjjdd.exec:\vjjdd.exe51⤵
- Executes dropped EXE
PID:4060 -
\??\c:\vvdvp.exec:\vvdvp.exe52⤵
- Executes dropped EXE
PID:3288 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe53⤵
- Executes dropped EXE
PID:3696 -
\??\c:\bhnttt.exec:\bhnttt.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nhnnnt.exec:\nhnnnt.exe55⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jvddv.exec:\jvddv.exe56⤵
- Executes dropped EXE
PID:740 -
\??\c:\pjpjp.exec:\pjpjp.exe57⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe58⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe59⤵
- Executes dropped EXE
PID:3384 -
\??\c:\nttbtt.exec:\nttbtt.exe60⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3vvjd.exec:\3vvjd.exe61⤵
- Executes dropped EXE
PID:3140 -
\??\c:\jvpdd.exec:\jvpdd.exe62⤵
- Executes dropped EXE
PID:3816 -
\??\c:\llfxrlf.exec:\llfxrlf.exe63⤵
- Executes dropped EXE
PID:3880 -
\??\c:\bhnbtn.exec:\bhnbtn.exe64⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hbbtht.exec:\hbbtht.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdjdj.exec:\jdjdj.exe66⤵PID:2500
-
\??\c:\9lxxrrr.exec:\9lxxrrr.exe67⤵PID:2932
-
\??\c:\bhnnhh.exec:\bhnnhh.exe68⤵PID:1716
-
\??\c:\bttnnn.exec:\bttnnn.exe69⤵PID:4268
-
\??\c:\pjdvj.exec:\pjdvj.exe70⤵PID:3208
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe71⤵PID:896
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe72⤵PID:4200
-
\??\c:\bbhnhh.exec:\bbhnhh.exe73⤵PID:1680
-
\??\c:\jddvv.exec:\jddvv.exe74⤵PID:2368
-
\??\c:\3fxlxrr.exec:\3fxlxrr.exe75⤵PID:1380
-
\??\c:\lxfffll.exec:\lxfffll.exe76⤵PID:1436
-
\??\c:\ttbthh.exec:\ttbthh.exe77⤵PID:4788
-
\??\c:\nttbbb.exec:\nttbbb.exe78⤵PID:4964
-
\??\c:\7vjdj.exec:\7vjdj.exe79⤵PID:4828
-
\??\c:\jddvj.exec:\jddvj.exe80⤵PID:228
-
\??\c:\lfllllr.exec:\lfllllr.exe81⤵PID:4360
-
\??\c:\bhbtnn.exec:\bhbtnn.exe82⤵PID:4340
-
\??\c:\thhhbb.exec:\thhhbb.exe83⤵PID:3808
-
\??\c:\jdddv.exec:\jdddv.exe84⤵PID:3752
-
\??\c:\xrffrxl.exec:\xrffrxl.exe85⤵PID:3488
-
\??\c:\fllxlxr.exec:\fllxlxr.exe86⤵PID:1428
-
\??\c:\httnhb.exec:\httnhb.exe87⤵PID:4796
-
\??\c:\nbnhbb.exec:\nbnhbb.exe88⤵PID:440
-
\??\c:\pvvvp.exec:\pvvvp.exe89⤵PID:8
-
\??\c:\vppjj.exec:\vppjj.exe90⤵PID:1080
-
\??\c:\frfxrrr.exec:\frfxrrr.exe91⤵PID:716
-
\??\c:\tnhtnh.exec:\tnhtnh.exe92⤵PID:4760
-
\??\c:\thbnht.exec:\thbnht.exe93⤵PID:1396
-
\??\c:\vddvp.exec:\vddvp.exe94⤵PID:4008
-
\??\c:\3rlfrlf.exec:\3rlfrlf.exe95⤵
- System Location Discovery: System Language Discovery
PID:4300 -
\??\c:\3lfllll.exec:\3lfllll.exe96⤵PID:3588
-
\??\c:\bhbbbt.exec:\bhbbbt.exe97⤵PID:4036
-
\??\c:\hnhbnh.exec:\hnhbnh.exe98⤵PID:4064
-
\??\c:\5dvpv.exec:\5dvpv.exe99⤵PID:4584
-
\??\c:\rlfxrll.exec:\rlfxrll.exe100⤵PID:1900
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe101⤵PID:3792
-
\??\c:\hhhbtt.exec:\hhhbtt.exe102⤵PID:1448
-
\??\c:\3pjdv.exec:\3pjdv.exe103⤵PID:4664
-
\??\c:\djvpd.exec:\djvpd.exe104⤵PID:1796
-
\??\c:\1xxrffx.exec:\1xxrffx.exe105⤵PID:3836
-
\??\c:\5rfxrlf.exec:\5rfxrlf.exe106⤵PID:3980
-
\??\c:\nhhhbn.exec:\nhhhbn.exe107⤵PID:952
-
\??\c:\1nnhhh.exec:\1nnhhh.exe108⤵PID:436
-
\??\c:\ddjdj.exec:\ddjdj.exe109⤵PID:812
-
\??\c:\9xlfrrl.exec:\9xlfrrl.exe110⤵PID:4016
-
\??\c:\llffxxx.exec:\llffxxx.exe111⤵PID:1756
-
\??\c:\btttnn.exec:\btttnn.exe112⤵PID:3640
-
\??\c:\nbbtnt.exec:\nbbtnt.exe113⤵PID:224
-
\??\c:\pvddp.exec:\pvddp.exe114⤵PID:2908
-
\??\c:\jdjdd.exec:\jdjdd.exe115⤵PID:3412
-
\??\c:\1frfxrl.exec:\1frfxrl.exe116⤵PID:1660
-
\??\c:\nnhhhh.exec:\nnhhhh.exe117⤵PID:1656
-
\??\c:\nhbtnh.exec:\nhbtnh.exe118⤵PID:4840
-
\??\c:\vpvpd.exec:\vpvpd.exe119⤵PID:3748
-
\??\c:\1ddvv.exec:\1ddvv.exe120⤵PID:4956
-
\??\c:\3rxrlrl.exec:\3rxrlrl.exe121⤵PID:4576
-
\??\c:\fffrlfl.exec:\fffrlfl.exe122⤵PID:4084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-