Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe
Resource
win7-20240708-en
General
-
Target
b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe
-
Size
66KB
-
MD5
29a7b54cca8b8ee40972bc949edacca0
-
SHA1
57a9eeedd7234ea9ee8ccb094b18fa4aa63d21de
-
SHA256
b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7d
-
SHA512
01141ed95e51c08a34aa94bfb5e166f9bfacc3c87196f79627f8ea57db9c60ac600107618a75eba962f9f673ef211ecad341b904fc291a0198e0906d31d11ec8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeH:ymb3NkkiQ3mdBjF0y7kbUH
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4944-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/348-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1576 vjjvd.exe 2128 nttnbt.exe 348 9tthnb.exe 848 bbthtt.exe 4900 xlrflxx.exe 2156 rllffxx.exe 5096 nntnbt.exe 212 3jdjv.exe 4444 frlxxrx.exe 2904 hbbtht.exe 976 3dvjd.exe 4512 xrlxrfr.exe 2920 hbtnnh.exe 4964 btnhtt.exe 2392 dvpjv.exe 1860 1rllfxl.exe 560 llfxfxr.exe 4132 vppjj.exe 3440 5frlrlx.exe 2040 ttnbnn.exe 3988 5nhbhb.exe 3688 vjdvj.exe 3164 1rxflfr.exe 1476 lfrffxx.exe 1632 thnhhb.exe 4056 tnhtnt.exe 2776 ppvpv.exe 2736 3dvjp.exe 4016 7xlfxlf.exe 3612 tbnbnh.exe 1836 bhhnbn.exe 3520 pdjdd.exe 1376 rfrlrlf.exe 2256 rlfrlxl.exe 2596 nnhbhb.exe 4524 7ddvp.exe 3420 xfrlfxx.exe 4460 xrxlxrl.exe 2204 1hhhhn.exe 2036 9hthtb.exe 2056 pvdvp.exe 4376 7jdpd.exe 2344 rxxlffx.exe 932 rxxrlfr.exe 2080 5tttnh.exe 5012 3ppdj.exe 3756 3vdjj.exe 1788 xllflfx.exe 2520 frlfxrf.exe 3012 3bthhb.exe 2716 bthbtn.exe 440 9jdpd.exe 2996 vjvjv.exe 976 jddvp.exe 3536 7xfxxff.exe 3660 thbnnh.exe 3436 3thtnn.exe 2976 vddpv.exe 1592 pjdvj.exe 3340 xxfrrlr.exe 4064 9hbthn.exe 4572 7bthtn.exe 3600 jvpdj.exe 3256 jjdpv.exe -
resource yara_rule behavioral2/memory/4944-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/348-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 1576 4944 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 85 PID 4944 wrote to memory of 1576 4944 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 85 PID 4944 wrote to memory of 1576 4944 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 85 PID 1576 wrote to memory of 2128 1576 vjjvd.exe 86 PID 1576 wrote to memory of 2128 1576 vjjvd.exe 86 PID 1576 wrote to memory of 2128 1576 vjjvd.exe 86 PID 2128 wrote to memory of 348 2128 nttnbt.exe 88 PID 2128 wrote to memory of 348 2128 nttnbt.exe 88 PID 2128 wrote to memory of 348 2128 nttnbt.exe 88 PID 348 wrote to memory of 848 348 9tthnb.exe 89 PID 348 wrote to memory of 848 348 9tthnb.exe 89 PID 348 wrote to memory of 848 348 9tthnb.exe 89 PID 848 wrote to memory of 4900 848 bbthtt.exe 90 PID 848 wrote to memory of 4900 848 bbthtt.exe 90 PID 848 wrote to memory of 4900 848 bbthtt.exe 90 PID 4900 wrote to memory of 2156 4900 xlrflxx.exe 91 PID 4900 wrote to memory of 2156 4900 xlrflxx.exe 91 PID 4900 wrote to memory of 2156 4900 xlrflxx.exe 91 PID 2156 wrote to memory of 5096 2156 rllffxx.exe 92 PID 2156 wrote to memory of 5096 2156 rllffxx.exe 92 PID 2156 wrote to memory of 5096 2156 rllffxx.exe 92 PID 5096 wrote to memory of 212 5096 nntnbt.exe 93 PID 5096 wrote to memory of 212 5096 nntnbt.exe 93 PID 5096 wrote to memory of 212 5096 nntnbt.exe 93 PID 212 wrote to memory of 4444 212 3jdjv.exe 94 PID 212 wrote to memory of 4444 212 3jdjv.exe 94 PID 212 wrote to memory of 4444 212 3jdjv.exe 94 PID 4444 wrote to memory of 2904 4444 frlxxrx.exe 95 PID 4444 wrote to memory of 2904 4444 frlxxrx.exe 95 PID 4444 wrote to memory of 2904 4444 frlxxrx.exe 95 PID 2904 wrote to memory of 976 2904 hbbtht.exe 96 PID 2904 wrote to memory of 976 2904 hbbtht.exe 96 PID 2904 wrote to memory of 976 2904 hbbtht.exe 96 PID 976 wrote to memory of 4512 976 3dvjd.exe 97 PID 976 wrote to memory of 4512 976 3dvjd.exe 97 PID 976 wrote to memory of 4512 976 3dvjd.exe 97 PID 4512 wrote to memory of 2920 4512 xrlxrfr.exe 98 PID 4512 wrote to memory of 2920 4512 xrlxrfr.exe 98 PID 4512 wrote to memory of 2920 4512 xrlxrfr.exe 98 PID 2920 wrote to memory of 4964 2920 hbtnnh.exe 99 PID 2920 wrote to memory of 4964 2920 hbtnnh.exe 99 PID 2920 wrote to memory of 4964 2920 hbtnnh.exe 99 PID 4964 wrote to memory of 2392 4964 btnhtt.exe 100 PID 4964 wrote to memory of 2392 4964 btnhtt.exe 100 PID 4964 wrote to memory of 2392 4964 btnhtt.exe 100 PID 2392 wrote to memory of 1860 2392 dvpjv.exe 101 PID 2392 wrote to memory of 1860 2392 dvpjv.exe 101 PID 2392 wrote to memory of 1860 2392 dvpjv.exe 101 PID 1860 wrote to memory of 560 1860 1rllfxl.exe 102 PID 1860 wrote to memory of 560 1860 1rllfxl.exe 102 PID 1860 wrote to memory of 560 1860 1rllfxl.exe 102 PID 560 wrote to memory of 4132 560 llfxfxr.exe 103 PID 560 wrote to memory of 4132 560 llfxfxr.exe 103 PID 560 wrote to memory of 4132 560 llfxfxr.exe 103 PID 4132 wrote to memory of 3440 4132 vppjj.exe 104 PID 4132 wrote to memory of 3440 4132 vppjj.exe 104 PID 4132 wrote to memory of 3440 4132 vppjj.exe 104 PID 3440 wrote to memory of 2040 3440 5frlrlx.exe 105 PID 3440 wrote to memory of 2040 3440 5frlrlx.exe 105 PID 3440 wrote to memory of 2040 3440 5frlrlx.exe 105 PID 2040 wrote to memory of 3988 2040 ttnbnn.exe 106 PID 2040 wrote to memory of 3988 2040 ttnbnn.exe 106 PID 2040 wrote to memory of 3988 2040 ttnbnn.exe 106 PID 3988 wrote to memory of 3688 3988 5nhbhb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe"C:\Users\Admin\AppData\Local\Temp\b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\vjjvd.exec:\vjjvd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nttnbt.exec:\nttnbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\9tthnb.exec:\9tthnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\bbthtt.exec:\bbthtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\xlrflxx.exec:\xlrflxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\rllffxx.exec:\rllffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nntnbt.exec:\nntnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3jdjv.exec:\3jdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\frlxxrx.exec:\frlxxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\hbbtht.exec:\hbbtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3dvjd.exec:\3dvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\xrlxrfr.exec:\xrlxrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\hbtnnh.exec:\hbtnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\btnhtt.exec:\btnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\dvpjv.exec:\dvpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\1rllfxl.exec:\1rllfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\llfxfxr.exec:\llfxfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\vppjj.exec:\vppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\5frlrlx.exec:\5frlrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\ttnbnn.exec:\ttnbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\5nhbhb.exec:\5nhbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\vjdvj.exec:\vjdvj.exe23⤵
- Executes dropped EXE
PID:3688 -
\??\c:\1rxflfr.exec:\1rxflfr.exe24⤵
- Executes dropped EXE
PID:3164 -
\??\c:\lfrffxx.exec:\lfrffxx.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\thnhhb.exec:\thnhhb.exe26⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tnhtnt.exec:\tnhtnt.exe27⤵
- Executes dropped EXE
PID:4056 -
\??\c:\ppvpv.exec:\ppvpv.exe28⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3dvjp.exec:\3dvjp.exe29⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7xlfxlf.exec:\7xlfxlf.exe30⤵
- Executes dropped EXE
PID:4016 -
\??\c:\tbnbnh.exec:\tbnbnh.exe31⤵
- Executes dropped EXE
PID:3612 -
\??\c:\bhhnbn.exec:\bhhnbn.exe32⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pdjdd.exec:\pdjdd.exe33⤵
- Executes dropped EXE
PID:3520 -
\??\c:\rfrlrlf.exec:\rfrlrlf.exe34⤵
- Executes dropped EXE
PID:1376 -
\??\c:\rlfrlxl.exec:\rlfrlxl.exe35⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nnhbhb.exec:\nnhbhb.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbtntt.exec:\hbtntt.exe37⤵PID:3808
-
\??\c:\7ddvp.exec:\7ddvp.exe38⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe39⤵
- Executes dropped EXE
PID:3420 -
\??\c:\xrxlxrl.exec:\xrxlxrl.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1hhhhn.exec:\1hhhhn.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9hthtb.exec:\9hthtb.exe42⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7jdpd.exec:\7jdpd.exe44⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rxxlffx.exec:\rxxlffx.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe46⤵
- Executes dropped EXE
PID:932 -
\??\c:\5tttnh.exec:\5tttnh.exe47⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3ppdj.exec:\3ppdj.exe48⤵
- Executes dropped EXE
PID:5012 -
\??\c:\3vdjj.exec:\3vdjj.exe49⤵
- Executes dropped EXE
PID:3756 -
\??\c:\xllflfx.exec:\xllflfx.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\frlfxrf.exec:\frlfxrf.exe51⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3bthhb.exec:\3bthhb.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bthbtn.exec:\bthbtn.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9jdpd.exec:\9jdpd.exe54⤵
- Executes dropped EXE
PID:440 -
\??\c:\vjvjv.exec:\vjvjv.exe55⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jddvp.exec:\jddvp.exe56⤵
- Executes dropped EXE
PID:976 -
\??\c:\7xfxxff.exec:\7xfxxff.exe57⤵
- Executes dropped EXE
PID:3536 -
\??\c:\thbnnh.exec:\thbnnh.exe58⤵
- Executes dropped EXE
PID:3660 -
\??\c:\3thtnn.exec:\3thtnn.exe59⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vddpv.exec:\vddpv.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pjdvj.exec:\pjdvj.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xxfrrlr.exec:\xxfrrlr.exe62⤵
- Executes dropped EXE
PID:3340 -
\??\c:\9hbthn.exec:\9hbthn.exe63⤵
- Executes dropped EXE
PID:4064 -
\??\c:\7bthtn.exec:\7bthtn.exe64⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jvpdj.exec:\jvpdj.exe65⤵
- Executes dropped EXE
PID:3600 -
\??\c:\jjdpv.exec:\jjdpv.exe66⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rxlrflx.exec:\rxlrflx.exe67⤵PID:2588
-
\??\c:\bnnhbb.exec:\bnnhbb.exe68⤵PID:3036
-
\??\c:\btnhnh.exec:\btnhnh.exe69⤵PID:4032
-
\??\c:\jjvpd.exec:\jjvpd.exe70⤵PID:1528
-
\??\c:\dvvpv.exec:\dvvpv.exe71⤵PID:1016
-
\??\c:\fxfrxxr.exec:\fxfrxxr.exe72⤵PID:3692
-
\??\c:\tnnhbt.exec:\tnnhbt.exe73⤵PID:1824
-
\??\c:\hbbtnn.exec:\hbbtnn.exe74⤵PID:1988
-
\??\c:\xxxlxxr.exec:\xxxlxxr.exe75⤵PID:660
-
\??\c:\7bbttn.exec:\7bbttn.exe76⤵PID:1384
-
\??\c:\nhnhnh.exec:\nhnhnh.exe77⤵PID:4588
-
\??\c:\7hbtbt.exec:\7hbtbt.exe78⤵PID:1520
-
\??\c:\pjdvj.exec:\pjdvj.exe79⤵PID:5076
-
\??\c:\xxlflrx.exec:\xxlflrx.exe80⤵PID:1564
-
\??\c:\frrrllf.exec:\frrrllf.exe81⤵PID:1076
-
\??\c:\bbbbtt.exec:\bbbbtt.exe82⤵PID:3148
-
\??\c:\pppjv.exec:\pppjv.exe83⤵PID:1492
-
\??\c:\jdjvp.exec:\jdjvp.exe84⤵PID:4140
-
\??\c:\xlflxrf.exec:\xlflxrf.exe85⤵PID:2256
-
\??\c:\lfrlxlr.exec:\lfrlxlr.exe86⤵PID:4836
-
\??\c:\9thtbb.exec:\9thtbb.exe87⤵PID:4944
-
\??\c:\jdpjd.exec:\jdpjd.exe88⤵PID:2540
-
\??\c:\pddvv.exec:\pddvv.exe89⤵PID:1716
-
\??\c:\rffrxrl.exec:\rffrxrl.exe90⤵PID:4932
-
\??\c:\1llxrll.exec:\1llxrll.exe91⤵PID:5004
-
\??\c:\nbhbhb.exec:\nbhbhb.exe92⤵PID:3200
-
\??\c:\9pdvp.exec:\9pdvp.exe93⤵PID:1004
-
\??\c:\djdvj.exec:\djdvj.exe94⤵PID:1296
-
\??\c:\pdvvd.exec:\pdvvd.exe95⤵PID:4468
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe96⤵PID:4900
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe97⤵PID:1616
-
\??\c:\hhhbnh.exec:\hhhbnh.exe98⤵PID:1472
-
\??\c:\htbbnt.exec:\htbbnt.exe99⤵PID:3444
-
\??\c:\5dpjv.exec:\5dpjv.exe100⤵PID:2060
-
\??\c:\dpvvp.exec:\dpvvp.exe101⤵PID:4956
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe102⤵PID:4444
-
\??\c:\xfffrlr.exec:\xfffrlr.exe103⤵PID:4432
-
\??\c:\bttntn.exec:\bttntn.exe104⤵PID:5104
-
\??\c:\bhtnbb.exec:\bhtnbb.exe105⤵PID:2584
-
\??\c:\jpppv.exec:\jpppv.exe106⤵PID:3160
-
\??\c:\rxxlxxx.exec:\rxxlxxx.exe107⤵PID:4896
-
\??\c:\lxrrlfr.exec:\lxrrlfr.exe108⤵PID:4024
-
\??\c:\hbtnhn.exec:\hbtnhn.exe109⤵PID:4240
-
\??\c:\bbtnnh.exec:\bbtnnh.exe110⤵PID:1008
-
\??\c:\pddpd.exec:\pddpd.exe111⤵PID:1860
-
\??\c:\vvjpj.exec:\vvjpj.exe112⤵PID:2012
-
\??\c:\llfrlxf.exec:\llfrlxf.exe113⤵PID:4972
-
\??\c:\9bbnht.exec:\9bbnht.exe114⤵PID:4940
-
\??\c:\hbbnbt.exec:\hbbnbt.exe115⤵PID:1628
-
\??\c:\ppjjj.exec:\ppjjj.exe116⤵PID:2448
-
\??\c:\dvjjj.exec:\dvjjj.exe117⤵PID:2948
-
\??\c:\rxxrfxl.exec:\rxxrfxl.exe118⤵PID:880
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe119⤵PID:1224
-
\??\c:\bttttn.exec:\bttttn.exe120⤵PID:3164
-
\??\c:\3tthtn.exec:\3tthtn.exe121⤵PID:752
-
\??\c:\3jjjp.exec:\3jjjp.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-