Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe
Resource
win7-20240903-en
General
-
Target
d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe
-
Size
69KB
-
MD5
fbfbda2474ee80121cc7b0eea7ddb270
-
SHA1
b784745c56916fb0104a904b96e071598d66243f
-
SHA256
d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75a
-
SHA512
319fc54fb9458b85ce55f8ee5aeb5433021668c9c5492fefffb7936b12c3cf113469c930f3afb0f23860d64d5791ed1f478369d2df7447823bba32995f58e19b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLW:ymb3NkkiQ3mdBjF0yMlia
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2988-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4468 7hbtnn.exe 2552 1xxrfrx.exe 3860 ntbnhb.exe 3716 7tnbtb.exe 2644 dpdvj.exe 4440 7fxrffr.exe 1936 htttnn.exe 184 jvvjd.exe 220 3llfrlx.exe 4252 hbtnbb.exe 3456 nbnhbb.exe 512 jvpdv.exe 3304 flxlrff.exe 2312 bhnhhb.exe 3740 1pdjp.exe 2424 3rrrrrl.exe 3216 htnnhh.exe 4964 7tbhtt.exe 628 vjvpd.exe 1820 rrxlxrf.exe 3944 7tnhtt.exe 1644 nhhhhb.exe 4864 vvdvp.exe 1064 xffxfrx.exe 1996 9lffxfx.exe 2356 5hbtnn.exe 2960 jvdvv.exe 2760 9rfrlrl.exe 1384 1tbthb.exe 960 vdjvj.exe 2884 lxllxfr.exe 4876 xfffrlf.exe 3312 bnnhbt.exe 4016 hhbthh.exe 1160 1vvpd.exe 1980 7fflfxx.exe 3780 frxrxxx.exe 3560 httnbh.exe 4460 hbntht.exe 4608 3ddpj.exe 5012 rxxlfrl.exe 3784 xllxrfx.exe 2168 httnhb.exe 4292 tnbnhb.exe 3588 1jjvj.exe 3580 9dvdd.exe 4536 lrxxrrf.exe 3464 bhnhbt.exe 2028 hthbnh.exe 3808 jdvpd.exe 4676 rxrlfxr.exe 3592 lflfrll.exe 1672 tbntbb.exe 4252 5dpjj.exe 376 fffxlfr.exe 4504 xrlfxrf.exe 3212 1tbtnn.exe 4656 pjvpp.exe 3364 jvpjd.exe 1868 5xfxrlf.exe 716 flfxrrx.exe 4092 nhbthh.exe 3468 3hhtbb.exe 3940 vpdpd.exe -
resource yara_rule behavioral2/memory/2988-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 4468 2988 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 83 PID 2988 wrote to memory of 4468 2988 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 83 PID 2988 wrote to memory of 4468 2988 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 83 PID 4468 wrote to memory of 2552 4468 7hbtnn.exe 84 PID 4468 wrote to memory of 2552 4468 7hbtnn.exe 84 PID 4468 wrote to memory of 2552 4468 7hbtnn.exe 84 PID 2552 wrote to memory of 3860 2552 1xxrfrx.exe 85 PID 2552 wrote to memory of 3860 2552 1xxrfrx.exe 85 PID 2552 wrote to memory of 3860 2552 1xxrfrx.exe 85 PID 3860 wrote to memory of 3716 3860 ntbnhb.exe 87 PID 3860 wrote to memory of 3716 3860 ntbnhb.exe 87 PID 3860 wrote to memory of 3716 3860 ntbnhb.exe 87 PID 3716 wrote to memory of 2644 3716 7tnbtb.exe 88 PID 3716 wrote to memory of 2644 3716 7tnbtb.exe 88 PID 3716 wrote to memory of 2644 3716 7tnbtb.exe 88 PID 2644 wrote to memory of 4440 2644 dpdvj.exe 89 PID 2644 wrote to memory of 4440 2644 dpdvj.exe 89 PID 2644 wrote to memory of 4440 2644 dpdvj.exe 89 PID 4440 wrote to memory of 1936 4440 7fxrffr.exe 90 PID 4440 wrote to memory of 1936 4440 7fxrffr.exe 90 PID 4440 wrote to memory of 1936 4440 7fxrffr.exe 90 PID 1936 wrote to memory of 184 1936 htttnn.exe 91 PID 1936 wrote to memory of 184 1936 htttnn.exe 91 PID 1936 wrote to memory of 184 1936 htttnn.exe 91 PID 184 wrote to memory of 220 184 jvvjd.exe 93 PID 184 wrote to memory of 220 184 jvvjd.exe 93 PID 184 wrote to memory of 220 184 jvvjd.exe 93 PID 220 wrote to memory of 4252 220 3llfrlx.exe 94 PID 220 wrote to memory of 4252 220 3llfrlx.exe 94 PID 220 wrote to memory of 4252 220 3llfrlx.exe 94 PID 4252 wrote to memory of 3456 4252 hbtnbb.exe 95 PID 4252 wrote to memory of 3456 4252 hbtnbb.exe 95 PID 4252 wrote to memory of 3456 4252 hbtnbb.exe 95 PID 3456 wrote to memory of 512 3456 nbnhbb.exe 96 PID 3456 wrote to memory of 512 3456 nbnhbb.exe 96 PID 3456 wrote to memory of 512 3456 nbnhbb.exe 96 PID 512 wrote to memory of 3304 512 jvpdv.exe 97 PID 512 wrote to memory of 3304 512 jvpdv.exe 97 PID 512 wrote to memory of 3304 512 jvpdv.exe 97 PID 3304 wrote to memory of 2312 3304 flxlrff.exe 98 PID 3304 wrote to memory of 2312 3304 flxlrff.exe 98 PID 3304 wrote to memory of 2312 3304 flxlrff.exe 98 PID 2312 wrote to memory of 3740 2312 bhnhhb.exe 99 PID 2312 wrote to memory of 3740 2312 bhnhhb.exe 99 PID 2312 wrote to memory of 3740 2312 bhnhhb.exe 99 PID 3740 wrote to memory of 2424 3740 1pdjp.exe 101 PID 3740 wrote to memory of 2424 3740 1pdjp.exe 101 PID 3740 wrote to memory of 2424 3740 1pdjp.exe 101 PID 2424 wrote to memory of 3216 2424 3rrrrrl.exe 102 PID 2424 wrote to memory of 3216 2424 3rrrrrl.exe 102 PID 2424 wrote to memory of 3216 2424 3rrrrrl.exe 102 PID 3216 wrote to memory of 4964 3216 htnnhh.exe 103 PID 3216 wrote to memory of 4964 3216 htnnhh.exe 103 PID 3216 wrote to memory of 4964 3216 htnnhh.exe 103 PID 4964 wrote to memory of 628 4964 7tbhtt.exe 104 PID 4964 wrote to memory of 628 4964 7tbhtt.exe 104 PID 4964 wrote to memory of 628 4964 7tbhtt.exe 104 PID 628 wrote to memory of 1820 628 vjvpd.exe 105 PID 628 wrote to memory of 1820 628 vjvpd.exe 105 PID 628 wrote to memory of 1820 628 vjvpd.exe 105 PID 1820 wrote to memory of 3944 1820 rrxlxrf.exe 106 PID 1820 wrote to memory of 3944 1820 rrxlxrf.exe 106 PID 1820 wrote to memory of 3944 1820 rrxlxrf.exe 106 PID 3944 wrote to memory of 1644 3944 7tnhtt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe"C:\Users\Admin\AppData\Local\Temp\d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7hbtnn.exec:\7hbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\1xxrfrx.exec:\1xxrfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ntbnhb.exec:\ntbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\7tnbtb.exec:\7tnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\dpdvj.exec:\dpdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7fxrffr.exec:\7fxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\htttnn.exec:\htttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\jvvjd.exec:\jvvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\3llfrlx.exec:\3llfrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\hbtnbb.exec:\hbtnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\nbnhbb.exec:\nbnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\jvpdv.exec:\jvpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\flxlrff.exec:\flxlrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\bhnhhb.exec:\bhnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\1pdjp.exec:\1pdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\3rrrrrl.exec:\3rrrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\htnnhh.exec:\htnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\7tbhtt.exec:\7tbhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\vjvpd.exec:\vjvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\rrxlxrf.exec:\rrxlxrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\7tnhtt.exec:\7tnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\nhhhhb.exec:\nhhhhb.exe23⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vvdvp.exec:\vvdvp.exe24⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xffxfrx.exec:\xffxfrx.exe25⤵
- Executes dropped EXE
PID:1064 -
\??\c:\9lffxfx.exec:\9lffxfx.exe26⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5hbtnn.exec:\5hbtnn.exe27⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jvdvv.exec:\jvdvv.exe28⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9rfrlrl.exec:\9rfrlrl.exe29⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1tbthb.exec:\1tbthb.exe30⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vdjvj.exec:\vdjvj.exe31⤵
- Executes dropped EXE
PID:960 -
\??\c:\lxllxfr.exec:\lxllxfr.exe32⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xfffrlf.exec:\xfffrlf.exe33⤵
- Executes dropped EXE
PID:4876 -
\??\c:\bnnhbt.exec:\bnnhbt.exe34⤵
- Executes dropped EXE
PID:3312 -
\??\c:\hhbthh.exec:\hhbthh.exe35⤵
- Executes dropped EXE
PID:4016 -
\??\c:\1vvpd.exec:\1vvpd.exe36⤵
- Executes dropped EXE
PID:1160 -
\??\c:\7fflfxx.exec:\7fflfxx.exe37⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frxrxxx.exec:\frxrxxx.exe38⤵
- Executes dropped EXE
PID:3780 -
\??\c:\httnbh.exec:\httnbh.exe39⤵
- Executes dropped EXE
PID:3560 -
\??\c:\hbntht.exec:\hbntht.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\3ddpj.exec:\3ddpj.exe41⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rxxlfrl.exec:\rxxlfrl.exe42⤵
- Executes dropped EXE
PID:5012 -
\??\c:\xllxrfx.exec:\xllxrfx.exe43⤵
- Executes dropped EXE
PID:3784 -
\??\c:\httnhb.exec:\httnhb.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tnbnhb.exec:\tnbnhb.exe45⤵
- Executes dropped EXE
PID:4292 -
\??\c:\1jjvj.exec:\1jjvj.exe46⤵
- Executes dropped EXE
PID:3588 -
\??\c:\9dvdd.exec:\9dvdd.exe47⤵
- Executes dropped EXE
PID:3580 -
\??\c:\lrxxrrf.exec:\lrxxrrf.exe48⤵
- Executes dropped EXE
PID:4536 -
\??\c:\bhnhbt.exec:\bhnhbt.exe49⤵
- Executes dropped EXE
PID:3464 -
\??\c:\hthbnh.exec:\hthbnh.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jdvpd.exec:\jdvpd.exe51⤵
- Executes dropped EXE
PID:3808 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe52⤵
- Executes dropped EXE
PID:4676 -
\??\c:\lflfrll.exec:\lflfrll.exe53⤵
- Executes dropped EXE
PID:3592 -
\??\c:\tbntbb.exec:\tbntbb.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5dpjj.exec:\5dpjj.exe55⤵
- Executes dropped EXE
PID:4252 -
\??\c:\fffxlfr.exec:\fffxlfr.exe56⤵
- Executes dropped EXE
PID:376 -
\??\c:\xrlfxrf.exec:\xrlfxrf.exe57⤵
- Executes dropped EXE
PID:4504 -
\??\c:\1tbtnn.exec:\1tbtnn.exe58⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pjvpp.exec:\pjvpp.exe59⤵
- Executes dropped EXE
PID:4656 -
\??\c:\jvpjd.exec:\jvpjd.exe60⤵
- Executes dropped EXE
PID:3364 -
\??\c:\5xfxrlf.exec:\5xfxrlf.exe61⤵
- Executes dropped EXE
PID:1868 -
\??\c:\flfxrrx.exec:\flfxrrx.exe62⤵
- Executes dropped EXE
PID:716 -
\??\c:\nhbthh.exec:\nhbthh.exe63⤵
- Executes dropped EXE
PID:4092 -
\??\c:\3hhtbb.exec:\3hhtbb.exe64⤵
- Executes dropped EXE
PID:3468 -
\??\c:\vpdpd.exec:\vpdpd.exe65⤵
- Executes dropped EXE
PID:3940 -
\??\c:\rfxrxfr.exec:\rfxrxfr.exe66⤵PID:552
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe67⤵PID:628
-
\??\c:\nbhnht.exec:\nbhnht.exe68⤵PID:4924
-
\??\c:\5nhbbt.exec:\5nhbbt.exe69⤵PID:2980
-
\??\c:\vvjdv.exec:\vvjdv.exe70⤵PID:3944
-
\??\c:\pjvpv.exec:\pjvpv.exe71⤵PID:5036
-
\??\c:\1llfxxr.exec:\1llfxxr.exe72⤵PID:3720
-
\??\c:\xflllll.exec:\xflllll.exe73⤵PID:1432
-
\??\c:\llfrflr.exec:\llfrflr.exe74⤵PID:2264
-
\??\c:\3nbnnh.exec:\3nbnnh.exe75⤵PID:2568
-
\??\c:\djpdj.exec:\djpdj.exe76⤵PID:1696
-
\??\c:\1dvpv.exec:\1dvpv.exe77⤵PID:3964
-
\??\c:\rfflxlx.exec:\rfflxlx.exe78⤵PID:2760
-
\??\c:\nhhtnh.exec:\nhhtnh.exe79⤵PID:1856
-
\??\c:\htbnbb.exec:\htbnbb.exe80⤵PID:4660
-
\??\c:\vpvpd.exec:\vpvpd.exe81⤵PID:5016
-
\??\c:\djjjv.exec:\djjjv.exe82⤵PID:2780
-
\??\c:\7lxlxrl.exec:\7lxlxrl.exe83⤵PID:832
-
\??\c:\xffrlxx.exec:\xffrlxx.exe84⤵PID:3252
-
\??\c:\hbttnn.exec:\hbttnn.exe85⤵PID:4176
-
\??\c:\vpddv.exec:\vpddv.exe86⤵PID:3516
-
\??\c:\pvdpj.exec:\pvdpj.exe87⤵PID:4968
-
\??\c:\llfxrrl.exec:\llfxrrl.exe88⤵PID:3880
-
\??\c:\9hbtnn.exec:\9hbtnn.exe89⤵PID:2584
-
\??\c:\hbbtnh.exec:\hbbtnh.exe90⤵PID:3616
-
\??\c:\jvpvp.exec:\jvpvp.exe91⤵PID:1728
-
\??\c:\5dvpd.exec:\5dvpd.exe92⤵PID:2580
-
\??\c:\frxrxxx.exec:\frxrxxx.exe93⤵PID:1416
-
\??\c:\bthbtt.exec:\bthbtt.exe94⤵PID:4988
-
\??\c:\hhtnhb.exec:\hhtnhb.exe95⤵PID:3696
-
\??\c:\jvpjv.exec:\jvpjv.exe96⤵PID:3440
-
\??\c:\ddvpd.exec:\ddvpd.exe97⤵PID:4704
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe98⤵PID:5112
-
\??\c:\bttbbb.exec:\bttbbb.exe99⤵PID:940
-
\??\c:\7dvvp.exec:\7dvvp.exe100⤵PID:2560
-
\??\c:\jdvpj.exec:\jdvpj.exe101⤵PID:4600
-
\??\c:\llfffff.exec:\llfffff.exe102⤵PID:4676
-
\??\c:\lffxxrr.exec:\lffxxrr.exe103⤵PID:4984
-
\??\c:\nhtttb.exec:\nhtttb.exe104⤵PID:1672
-
\??\c:\9vjvp.exec:\9vjvp.exe105⤵PID:4252
-
\??\c:\pdjjd.exec:\pdjjd.exe106⤵PID:1404
-
\??\c:\flrllrl.exec:\flrllrl.exe107⤵PID:4504
-
\??\c:\hhhhbt.exec:\hhhhbt.exe108⤵PID:512
-
\??\c:\tnhbnh.exec:\tnhbnh.exe109⤵PID:4628
-
\??\c:\jdjvp.exec:\jdjvp.exe110⤵
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\pddvj.exec:\pddvj.exe111⤵PID:2700
-
\??\c:\1xxrfxr.exec:\1xxrfxr.exe112⤵PID:380
-
\??\c:\1rrlllr.exec:\1rrlllr.exe113⤵PID:4844
-
\??\c:\hbthbt.exec:\hbthbt.exe114⤵PID:4964
-
\??\c:\7jjdv.exec:\7jjdv.exe115⤵PID:3940
-
\??\c:\jvdpd.exec:\jvdpd.exe116⤵PID:2056
-
\??\c:\fllxlxl.exec:\fllxlxl.exe117⤵PID:1744
-
\??\c:\ttbbbh.exec:\ttbbbh.exe118⤵PID:1908
-
\??\c:\fxflxrx.exec:\fxflxrx.exe119⤵PID:1644
-
\??\c:\tnhbnn.exec:\tnhbnn.exe120⤵PID:4568
-
\??\c:\jdpvd.exec:\jdpvd.exe121⤵PID:2556
-
\??\c:\lrfrlxl.exec:\lrfrlxl.exe122⤵PID:4312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-