Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe
Resource
win7-20241010-en
General
-
Target
a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe
-
Size
392KB
-
MD5
1f7a325512d6c5f9acd1083bb1d33c30
-
SHA1
bd78e0c8a7cb37659e1283ad54be47b51d062c8a
-
SHA256
a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370
-
SHA512
1ddf94617f1420e8351af88684fdcfe2f5ad873680f43a44f1bd0b52186e48c384502f6f83a183e7c633e750a0c1b738afbd2c77abcb8ef1ffafdf87daf40b1d
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOwf:n3C9uYA7okVqdKwaO5CVCf
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1680-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2896 bbhtht.exe 2268 vvpjv.exe 5036 3ppdv.exe 744 btnhht.exe 2532 jpjdp.exe 4344 rrxfrlf.exe 1892 djpdp.exe 1388 thhnhh.exe 3328 7jjdd.exe 4168 9rrffxr.exe 2880 3jvjv.exe 3116 xfflxrf.exe 1172 htnhth.exe 4688 pjdvj.exe 2404 nnhbnh.exe 2288 hththn.exe 4768 pppdp.exe 3700 9hhtnh.exe 1492 xrfrrlf.exe 2436 9tnthb.exe 2784 vvvjv.exe 64 frlxlfr.exe 3020 9djvd.exe 3668 tbhbnh.exe 376 thnhtn.exe 1848 3jvpv.exe 4024 3rrlfxx.exe 2996 thhthb.exe 4696 lxlxrll.exe 1868 ffrrfrf.exe 2008 1pdvd.exe 4368 1bthbt.exe 3032 vjpdp.exe 3528 vpjvp.exe 1740 frlfrrl.exe 396 9ttbnh.exe 1364 7hhnbb.exe 3352 ddjvd.exe 1816 xxrlxxr.exe 4268 lflxrrx.exe 4960 thnhbt.exe 4876 vdddp.exe 4880 jdvvp.exe 4520 lxlflfl.exe 4504 7bbnbn.exe 2480 tttnhb.exe 1176 7jppj.exe 212 fxrflfr.exe 2368 xlrffxf.exe 1276 hhtbht.exe 3124 vjjdp.exe 2280 fxxxllx.exe 2384 7bthbt.exe 1528 hbtnnh.exe 1172 1jpdv.exe 4948 rxflfff.exe 3404 rxxrlfx.exe 3476 nnnbnn.exe 3200 ddppj.exe 3740 5vvpp.exe 776 lxrfrlx.exe 2248 5rllfff.exe 1532 btnbnb.exe 1376 3ddpj.exe -
resource yara_rule behavioral2/memory/1680-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2896 1680 a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe 83 PID 1680 wrote to memory of 2896 1680 a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe 83 PID 1680 wrote to memory of 2896 1680 a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe 83 PID 2896 wrote to memory of 2268 2896 bbhtht.exe 84 PID 2896 wrote to memory of 2268 2896 bbhtht.exe 84 PID 2896 wrote to memory of 2268 2896 bbhtht.exe 84 PID 2268 wrote to memory of 5036 2268 vvpjv.exe 85 PID 2268 wrote to memory of 5036 2268 vvpjv.exe 85 PID 2268 wrote to memory of 5036 2268 vvpjv.exe 85 PID 5036 wrote to memory of 744 5036 3ppdv.exe 87 PID 5036 wrote to memory of 744 5036 3ppdv.exe 87 PID 5036 wrote to memory of 744 5036 3ppdv.exe 87 PID 744 wrote to memory of 2532 744 btnhht.exe 88 PID 744 wrote to memory of 2532 744 btnhht.exe 88 PID 744 wrote to memory of 2532 744 btnhht.exe 88 PID 2532 wrote to memory of 4344 2532 jpjdp.exe 89 PID 2532 wrote to memory of 4344 2532 jpjdp.exe 89 PID 2532 wrote to memory of 4344 2532 jpjdp.exe 89 PID 4344 wrote to memory of 1892 4344 rrxfrlf.exe 91 PID 4344 wrote to memory of 1892 4344 rrxfrlf.exe 91 PID 4344 wrote to memory of 1892 4344 rrxfrlf.exe 91 PID 1892 wrote to memory of 1388 1892 djpdp.exe 92 PID 1892 wrote to memory of 1388 1892 djpdp.exe 92 PID 1892 wrote to memory of 1388 1892 djpdp.exe 92 PID 1388 wrote to memory of 3328 1388 thhnhh.exe 93 PID 1388 wrote to memory of 3328 1388 thhnhh.exe 93 PID 1388 wrote to memory of 3328 1388 thhnhh.exe 93 PID 3328 wrote to memory of 4168 3328 7jjdd.exe 95 PID 3328 wrote to memory of 4168 3328 7jjdd.exe 95 PID 3328 wrote to memory of 4168 3328 7jjdd.exe 95 PID 4168 wrote to memory of 2880 4168 9rrffxr.exe 96 PID 4168 wrote to memory of 2880 4168 9rrffxr.exe 96 PID 4168 wrote to memory of 2880 4168 9rrffxr.exe 96 PID 2880 wrote to memory of 3116 2880 3jvjv.exe 97 PID 2880 wrote to memory of 3116 2880 3jvjv.exe 97 PID 2880 wrote to memory of 3116 2880 3jvjv.exe 97 PID 3116 wrote to memory of 1172 3116 xfflxrf.exe 98 PID 3116 wrote to memory of 1172 3116 xfflxrf.exe 98 PID 3116 wrote to memory of 1172 3116 xfflxrf.exe 98 PID 1172 wrote to memory of 4688 1172 htnhth.exe 99 PID 1172 wrote to memory of 4688 1172 htnhth.exe 99 PID 1172 wrote to memory of 4688 1172 htnhth.exe 99 PID 4688 wrote to memory of 2404 4688 pjdvj.exe 100 PID 4688 wrote to memory of 2404 4688 pjdvj.exe 100 PID 4688 wrote to memory of 2404 4688 pjdvj.exe 100 PID 2404 wrote to memory of 2288 2404 nnhbnh.exe 101 PID 2404 wrote to memory of 2288 2404 nnhbnh.exe 101 PID 2404 wrote to memory of 2288 2404 nnhbnh.exe 101 PID 2288 wrote to memory of 4768 2288 hththn.exe 102 PID 2288 wrote to memory of 4768 2288 hththn.exe 102 PID 2288 wrote to memory of 4768 2288 hththn.exe 102 PID 4768 wrote to memory of 3700 4768 pppdp.exe 103 PID 4768 wrote to memory of 3700 4768 pppdp.exe 103 PID 4768 wrote to memory of 3700 4768 pppdp.exe 103 PID 3700 wrote to memory of 1492 3700 9hhtnh.exe 104 PID 3700 wrote to memory of 1492 3700 9hhtnh.exe 104 PID 3700 wrote to memory of 1492 3700 9hhtnh.exe 104 PID 1492 wrote to memory of 2436 1492 xrfrrlf.exe 105 PID 1492 wrote to memory of 2436 1492 xrfrrlf.exe 105 PID 1492 wrote to memory of 2436 1492 xrfrrlf.exe 105 PID 2436 wrote to memory of 2784 2436 9tnthb.exe 106 PID 2436 wrote to memory of 2784 2436 9tnthb.exe 106 PID 2436 wrote to memory of 2784 2436 9tnthb.exe 106 PID 2784 wrote to memory of 64 2784 vvvjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe"C:\Users\Admin\AppData\Local\Temp\a53a9f125fb936f5b6e20bcef14ea16275d4208d6c16c3bc947978dbe7f31370N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\bbhtht.exec:\bbhtht.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vvpjv.exec:\vvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\3ppdv.exec:\3ppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\btnhht.exec:\btnhht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\jpjdp.exec:\jpjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rrxfrlf.exec:\rrxfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\djpdp.exec:\djpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\thhnhh.exec:\thhnhh.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\7jjdd.exec:\7jjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\9rrffxr.exec:\9rrffxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\3jvjv.exec:\3jvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xfflxrf.exec:\xfflxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\htnhth.exec:\htnhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\pjdvj.exec:\pjdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\nnhbnh.exec:\nnhbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\hththn.exec:\hththn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\pppdp.exec:\pppdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\9hhtnh.exec:\9hhtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xrfrrlf.exec:\xrfrrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\9tnthb.exec:\9tnthb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vvvjv.exec:\vvvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\frlxlfr.exec:\frlxlfr.exe23⤵
- Executes dropped EXE
PID:64 -
\??\c:\9djvd.exec:\9djvd.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tbhbnh.exec:\tbhbnh.exe25⤵
- Executes dropped EXE
PID:3668 -
\??\c:\thnhtn.exec:\thnhtn.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\3jvpv.exec:\3jvpv.exe27⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3rrlfxx.exec:\3rrlfxx.exe28⤵
- Executes dropped EXE
PID:4024 -
\??\c:\thhthb.exec:\thhthb.exe29⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lxlxrll.exec:\lxlxrll.exe30⤵
- Executes dropped EXE
PID:4696 -
\??\c:\ffrrfrf.exec:\ffrrfrf.exe31⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1pdvd.exec:\1pdvd.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1bthbt.exec:\1bthbt.exe33⤵
- Executes dropped EXE
PID:4368 -
\??\c:\vjpdp.exec:\vjpdp.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vpjvp.exec:\vpjvp.exe35⤵
- Executes dropped EXE
PID:3528 -
\??\c:\frlfrrl.exec:\frlfrrl.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9ttbnh.exec:\9ttbnh.exe37⤵
- Executes dropped EXE
PID:396 -
\??\c:\7hhnbb.exec:\7hhnbb.exe38⤵
- Executes dropped EXE
PID:1364 -
\??\c:\ddjvd.exec:\ddjvd.exe39⤵
- Executes dropped EXE
PID:3352 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe40⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lflxrrx.exec:\lflxrrx.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4268 -
\??\c:\thnhbt.exec:\thnhbt.exe42⤵
- Executes dropped EXE
PID:4960 -
\??\c:\vdddp.exec:\vdddp.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4876 -
\??\c:\jdvvp.exec:\jdvvp.exe44⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lxlflfl.exec:\lxlflfl.exe45⤵
- Executes dropped EXE
PID:4520 -
\??\c:\7bbnbn.exec:\7bbnbn.exe46⤵
- Executes dropped EXE
PID:4504 -
\??\c:\tttnhb.exec:\tttnhb.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7jppj.exec:\7jppj.exe48⤵
- Executes dropped EXE
PID:1176 -
\??\c:\fxrflfr.exec:\fxrflfr.exe49⤵
- Executes dropped EXE
PID:212 -
\??\c:\xlrffxf.exec:\xlrffxf.exe50⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hhtbht.exec:\hhtbht.exe51⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vjjdp.exec:\vjjdp.exe52⤵
- Executes dropped EXE
PID:3124 -
\??\c:\fxxxllx.exec:\fxxxllx.exe53⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7bthbt.exec:\7bthbt.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hbtnnh.exec:\hbtnnh.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1jpdv.exec:\1jpdv.exe56⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rxflfff.exec:\rxflfff.exe57⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe58⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nnnbnn.exec:\nnnbnn.exe59⤵
- Executes dropped EXE
PID:3476 -
\??\c:\ddppj.exec:\ddppj.exe60⤵
- Executes dropped EXE
PID:3200 -
\??\c:\5vvpp.exec:\5vvpp.exe61⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\5rllfff.exec:\5rllfff.exe63⤵
- Executes dropped EXE
PID:2248 -
\??\c:\btnbnb.exec:\btnbnb.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3ddpj.exec:\3ddpj.exe65⤵
- Executes dropped EXE
PID:1376 -
\??\c:\5dpjv.exec:\5dpjv.exe66⤵PID:2584
-
\??\c:\rlffxfx.exec:\rlffxfx.exe67⤵PID:3596
-
\??\c:\3ffrflx.exec:\3ffrflx.exe68⤵PID:4828
-
\??\c:\9bbtnn.exec:\9bbtnn.exe69⤵PID:4428
-
\??\c:\bbhtbb.exec:\bbhtbb.exe70⤵PID:1972
-
\??\c:\7pdvv.exec:\7pdvv.exe71⤵PID:792
-
\??\c:\rlrrlfl.exec:\rlrrlfl.exe72⤵PID:2980
-
\??\c:\tththb.exec:\tththb.exe73⤵PID:4964
-
\??\c:\ntbhtn.exec:\ntbhtn.exe74⤵PID:2132
-
\??\c:\pddvp.exec:\pddvp.exe75⤵PID:5016
-
\??\c:\fxlxlxl.exec:\fxlxlxl.exe76⤵PID:3028
-
\??\c:\hhtnhb.exec:\hhtnhb.exe77⤵PID:4692
-
\??\c:\7nbnbt.exec:\7nbnbt.exe78⤵PID:4452
-
\??\c:\vvjdp.exec:\vvjdp.exe79⤵PID:1648
-
\??\c:\xfffxrr.exec:\xfffxrr.exe80⤵PID:1996
-
\??\c:\3hbtnb.exec:\3hbtnb.exe81⤵PID:4368
-
\??\c:\7hhhhb.exec:\7hhhhb.exe82⤵PID:3032
-
\??\c:\dppdj.exec:\dppdj.exe83⤵PID:2028
-
\??\c:\frrllff.exec:\frrllff.exe84⤵PID:1740
-
\??\c:\rrxxfll.exec:\rrxxfll.exe85⤵PID:2316
-
\??\c:\thbntn.exec:\thbntn.exe86⤵PID:1364
-
\??\c:\dvdvd.exec:\dvdvd.exe87⤵PID:2236
-
\??\c:\rlrfxfl.exec:\rlrfxfl.exe88⤵PID:1816
-
\??\c:\frrxrxr.exec:\frrxrxr.exe89⤵PID:4832
-
\??\c:\3tnhbb.exec:\3tnhbb.exe90⤵PID:464
-
\??\c:\jjpdv.exec:\jjpdv.exe91⤵PID:2796
-
\??\c:\9jvjv.exec:\9jvjv.exe92⤵PID:4880
-
\??\c:\llrflfx.exec:\llrflfx.exe93⤵
- System Location Discovery: System Language Discovery
PID:3784 -
\??\c:\9nhbnn.exec:\9nhbnn.exe94⤵PID:2168
-
\??\c:\btbthh.exec:\btbthh.exe95⤵PID:1436
-
\??\c:\dvvjd.exec:\dvvjd.exe96⤵PID:3036
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe97⤵PID:940
-
\??\c:\hnnhbn.exec:\hnnhbn.exe98⤵PID:3924
-
\??\c:\5hnhbt.exec:\5hnhbt.exe99⤵PID:1276
-
\??\c:\jjppv.exec:\jjppv.exe100⤵PID:2388
-
\??\c:\rllfxrr.exec:\rllfxrr.exe101⤵PID:2280
-
\??\c:\hhhhbh.exec:\hhhhbh.exe102⤵PID:2384
-
\??\c:\jpjdd.exec:\jpjdd.exe103⤵PID:4424
-
\??\c:\ppvpp.exec:\ppvpp.exe104⤵PID:4688
-
\??\c:\xffrrlf.exec:\xffrrlf.exe105⤵PID:4392
-
\??\c:\1rfxfxf.exec:\1rfxfxf.exe106⤵PID:5116
-
\??\c:\tnhhbb.exec:\tnhhbb.exe107⤵PID:1432
-
\??\c:\pvpdv.exec:\pvpdv.exe108⤵PID:2396
-
\??\c:\1dvvp.exec:\1dvvp.exe109⤵PID:3188
-
\??\c:\3lfxllx.exec:\3lfxllx.exe110⤵PID:1308
-
\??\c:\tbhhbb.exec:\tbhhbb.exe111⤵PID:2436
-
\??\c:\djjdv.exec:\djjdv.exe112⤵PID:428
-
\??\c:\3xrlxrl.exec:\3xrlxrl.exe113⤵PID:2784
-
\??\c:\1rlfxrl.exec:\1rlfxrl.exe114⤵PID:4112
-
\??\c:\tntnnn.exec:\tntnnn.exe115⤵PID:3440
-
\??\c:\hnnnhb.exec:\hnnnhb.exe116⤵PID:4160
-
\??\c:\ddjvv.exec:\ddjvv.exe117⤵PID:3252
-
\??\c:\vvvpp.exec:\vvvpp.exe118⤵PID:4916
-
\??\c:\3frxfxr.exec:\3frxfxr.exe119⤵PID:3672
-
\??\c:\ththbt.exec:\ththbt.exe120⤵PID:1848
-
\??\c:\pdpjj.exec:\pdpjj.exe121⤵PID:2408
-
\??\c:\5llxrlr.exec:\5llxrlr.exe122⤵PID:5060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-