Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe
Resource
win7-20240903-en
General
-
Target
b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe
-
Size
82KB
-
MD5
4ee152c31e1671b2e904510a13db0a70
-
SHA1
5f48b6a05fe1a676160096ed842d6cac672ddba7
-
SHA256
b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9
-
SHA512
0baef0e2e84e51aaf89fcb7a04a800e4285024bc9bd5e64a088b37a7100568fe0760a01e7f5389a49401da3391e850842a32f50b27c6e583e64e754b6332b14c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gth:ymb3NkkiQ3mdBjFo73thgQ/wEko
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3804-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1660 1bbbbh.exe 1424 pjvvp.exe 4860 pjppj.exe 2028 rxllffx.exe 5100 hnnnnn.exe 4284 pjjdd.exe 1528 hhnbbh.exe 4752 thtttb.exe 4908 pvdvv.exe 3496 ddpvv.exe 2428 rfxfffx.exe 1932 bnhnhn.exe 3568 jddjj.exe 4012 xrflrrx.exe 4988 rlrrlrr.exe 2368 bttnht.exe 4480 ppvvj.exe 3964 vjjpj.exe 1560 5frrxrf.exe 2152 ttbtnn.exe 1708 7vpjd.exe 4504 jdjjd.exe 1700 frlrlxx.exe 4136 nhnhhh.exe 756 vjjjp.exe 3384 rfflffx.exe 3108 btnhhb.exe 4000 pjppd.exe 4508 rllfxrl.exe 3048 7tbtnh.exe 2308 9vddv.exe 4180 jpvpp.exe 4716 llxfrxr.exe 1524 xfrxffl.exe 1444 nhtntn.exe 3576 hbbttn.exe 5032 dvjdd.exe 1624 xfrrrxx.exe 5072 lffxxxx.exe 4968 9hbtbb.exe 2052 3dpvv.exe 4712 rrffffr.exe 2200 tnbhbt.exe 4448 nnbtbb.exe 4532 vjjjj.exe 336 jdvpv.exe 3440 xlfxlll.exe 2828 tnnhbb.exe 2848 xxflxff.exe 372 lrrllrr.exe 404 nbnhnt.exe 2352 hbbtnn.exe 4396 7xfxrll.exe 324 rlflfxx.exe 2296 pjvdj.exe 3480 vdjpd.exe 4612 fxxrlrl.exe 5056 1tttnn.exe 2056 7nnhnn.exe 3172 5jjdj.exe 1432 thbhth.exe 1428 1tnbtt.exe 2284 fffxxfx.exe 3568 tbttnb.exe -
resource yara_rule behavioral2/memory/3804-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 1660 3804 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 85 PID 3804 wrote to memory of 1660 3804 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 85 PID 3804 wrote to memory of 1660 3804 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 85 PID 1660 wrote to memory of 1424 1660 1bbbbh.exe 86 PID 1660 wrote to memory of 1424 1660 1bbbbh.exe 86 PID 1660 wrote to memory of 1424 1660 1bbbbh.exe 86 PID 1424 wrote to memory of 4860 1424 pjvvp.exe 87 PID 1424 wrote to memory of 4860 1424 pjvvp.exe 87 PID 1424 wrote to memory of 4860 1424 pjvvp.exe 87 PID 4860 wrote to memory of 2028 4860 pjppj.exe 88 PID 4860 wrote to memory of 2028 4860 pjppj.exe 88 PID 4860 wrote to memory of 2028 4860 pjppj.exe 88 PID 2028 wrote to memory of 5100 2028 rxllffx.exe 89 PID 2028 wrote to memory of 5100 2028 rxllffx.exe 89 PID 2028 wrote to memory of 5100 2028 rxllffx.exe 89 PID 5100 wrote to memory of 4284 5100 hnnnnn.exe 90 PID 5100 wrote to memory of 4284 5100 hnnnnn.exe 90 PID 5100 wrote to memory of 4284 5100 hnnnnn.exe 90 PID 4284 wrote to memory of 1528 4284 pjjdd.exe 91 PID 4284 wrote to memory of 1528 4284 pjjdd.exe 91 PID 4284 wrote to memory of 1528 4284 pjjdd.exe 91 PID 1528 wrote to memory of 4752 1528 hhnbbh.exe 92 PID 1528 wrote to memory of 4752 1528 hhnbbh.exe 92 PID 1528 wrote to memory of 4752 1528 hhnbbh.exe 92 PID 4752 wrote to memory of 4908 4752 thtttb.exe 93 PID 4752 wrote to memory of 4908 4752 thtttb.exe 93 PID 4752 wrote to memory of 4908 4752 thtttb.exe 93 PID 4908 wrote to memory of 3496 4908 pvdvv.exe 94 PID 4908 wrote to memory of 3496 4908 pvdvv.exe 94 PID 4908 wrote to memory of 3496 4908 pvdvv.exe 94 PID 3496 wrote to memory of 2428 3496 ddpvv.exe 95 PID 3496 wrote to memory of 2428 3496 ddpvv.exe 95 PID 3496 wrote to memory of 2428 3496 ddpvv.exe 95 PID 2428 wrote to memory of 1932 2428 rfxfffx.exe 96 PID 2428 wrote to memory of 1932 2428 rfxfffx.exe 96 PID 2428 wrote to memory of 1932 2428 rfxfffx.exe 96 PID 1932 wrote to memory of 3568 1932 bnhnhn.exe 97 PID 1932 wrote to memory of 3568 1932 bnhnhn.exe 97 PID 1932 wrote to memory of 3568 1932 bnhnhn.exe 97 PID 3568 wrote to memory of 4012 3568 jddjj.exe 98 PID 3568 wrote to memory of 4012 3568 jddjj.exe 98 PID 3568 wrote to memory of 4012 3568 jddjj.exe 98 PID 4012 wrote to memory of 4988 4012 xrflrrx.exe 99 PID 4012 wrote to memory of 4988 4012 xrflrrx.exe 99 PID 4012 wrote to memory of 4988 4012 xrflrrx.exe 99 PID 4988 wrote to memory of 2368 4988 rlrrlrr.exe 100 PID 4988 wrote to memory of 2368 4988 rlrrlrr.exe 100 PID 4988 wrote to memory of 2368 4988 rlrrlrr.exe 100 PID 2368 wrote to memory of 4480 2368 bttnht.exe 101 PID 2368 wrote to memory of 4480 2368 bttnht.exe 101 PID 2368 wrote to memory of 4480 2368 bttnht.exe 101 PID 4480 wrote to memory of 3964 4480 ppvvj.exe 102 PID 4480 wrote to memory of 3964 4480 ppvvj.exe 102 PID 4480 wrote to memory of 3964 4480 ppvvj.exe 102 PID 3964 wrote to memory of 1560 3964 vjjpj.exe 103 PID 3964 wrote to memory of 1560 3964 vjjpj.exe 103 PID 3964 wrote to memory of 1560 3964 vjjpj.exe 103 PID 1560 wrote to memory of 2152 1560 5frrxrf.exe 104 PID 1560 wrote to memory of 2152 1560 5frrxrf.exe 104 PID 1560 wrote to memory of 2152 1560 5frrxrf.exe 104 PID 2152 wrote to memory of 1708 2152 ttbtnn.exe 105 PID 2152 wrote to memory of 1708 2152 ttbtnn.exe 105 PID 2152 wrote to memory of 1708 2152 ttbtnn.exe 105 PID 1708 wrote to memory of 4504 1708 7vpjd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe"C:\Users\Admin\AppData\Local\Temp\b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\1bbbbh.exec:\1bbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\pjvvp.exec:\pjvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\pjppj.exec:\pjppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\rxllffx.exec:\rxllffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hnnnnn.exec:\hnnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\pjjdd.exec:\pjjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\hhnbbh.exec:\hhnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\thtttb.exec:\thtttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\pvdvv.exec:\pvdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\ddpvv.exec:\ddpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\rfxfffx.exec:\rfxfffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bnhnhn.exec:\bnhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\jddjj.exec:\jddjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\xrflrrx.exec:\xrflrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\bttnht.exec:\bttnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ppvvj.exec:\ppvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\vjjpj.exec:\vjjpj.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\5frrxrf.exec:\5frrxrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\ttbtnn.exec:\ttbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\7vpjd.exec:\7vpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\jdjjd.exec:\jdjjd.exe23⤵
- Executes dropped EXE
PID:4504 -
\??\c:\frlrlxx.exec:\frlrlxx.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhnhhh.exec:\nhnhhh.exe25⤵
- Executes dropped EXE
PID:4136 -
\??\c:\vjjjp.exec:\vjjjp.exe26⤵
- Executes dropped EXE
PID:756 -
\??\c:\rfflffx.exec:\rfflffx.exe27⤵
- Executes dropped EXE
PID:3384 -
\??\c:\btnhhb.exec:\btnhhb.exe28⤵
- Executes dropped EXE
PID:3108 -
\??\c:\pjppd.exec:\pjppd.exe29⤵
- Executes dropped EXE
PID:4000 -
\??\c:\rllfxrl.exec:\rllfxrl.exe30⤵
- Executes dropped EXE
PID:4508 -
\??\c:\7tbtnh.exec:\7tbtnh.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9vddv.exec:\9vddv.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jpvpp.exec:\jpvpp.exe33⤵
- Executes dropped EXE
PID:4180 -
\??\c:\llxfrxr.exec:\llxfrxr.exe34⤵
- Executes dropped EXE
PID:4716 -
\??\c:\xfrxffl.exec:\xfrxffl.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nhtntn.exec:\nhtntn.exe36⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hbbttn.exec:\hbbttn.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\dvjdd.exec:\dvjdd.exe38⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lffxxxx.exec:\lffxxxx.exe40⤵
- Executes dropped EXE
PID:5072 -
\??\c:\9hbtbb.exec:\9hbtbb.exe41⤵
- Executes dropped EXE
PID:4968 -
\??\c:\3dpvv.exec:\3dpvv.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rrffffr.exec:\rrffffr.exe43⤵
- Executes dropped EXE
PID:4712 -
\??\c:\tnbhbt.exec:\tnbhbt.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nnbtbb.exec:\nnbtbb.exe45⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vjjjj.exec:\vjjjj.exe46⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jdvpv.exec:\jdvpv.exe47⤵
- Executes dropped EXE
PID:336 -
\??\c:\xlfxlll.exec:\xlfxlll.exe48⤵
- Executes dropped EXE
PID:3440 -
\??\c:\tnnhbb.exec:\tnnhbb.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxflxff.exec:\xxflxff.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lrrllrr.exec:\lrrllrr.exe51⤵
- Executes dropped EXE
PID:372 -
\??\c:\nbnhnt.exec:\nbnhnt.exe52⤵
- Executes dropped EXE
PID:404 -
\??\c:\hbbtnn.exec:\hbbtnn.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7xfxrll.exec:\7xfxrll.exe54⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rlflfxx.exec:\rlflfxx.exe55⤵
- Executes dropped EXE
PID:324 -
\??\c:\pjvdj.exec:\pjvdj.exe56⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdjpd.exec:\vdjpd.exe57⤵
- Executes dropped EXE
PID:3480 -
\??\c:\fxxrlrl.exec:\fxxrlrl.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\1tttnn.exec:\1tttnn.exe59⤵
- Executes dropped EXE
PID:5056 -
\??\c:\7nnhnn.exec:\7nnhnn.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5jjdj.exec:\5jjdj.exe61⤵
- Executes dropped EXE
PID:3172 -
\??\c:\thbhth.exec:\thbhth.exe62⤵
- Executes dropped EXE
PID:1432 -
\??\c:\1tnbtt.exec:\1tnbtt.exe63⤵
- Executes dropped EXE
PID:1428 -
\??\c:\fffxxfx.exec:\fffxxfx.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tbttnb.exec:\tbttnb.exe65⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pjdpj.exec:\pjdpj.exe66⤵PID:3884
-
\??\c:\thnhht.exec:\thnhht.exe67⤵PID:4820
-
\??\c:\tntnhh.exec:\tntnhh.exe68⤵PID:956
-
\??\c:\7dpdp.exec:\7dpdp.exe69⤵PID:2276
-
\??\c:\lrxrxxl.exec:\lrxrxxl.exe70⤵PID:4796
-
\??\c:\rllrfrf.exec:\rllrfrf.exe71⤵PID:2516
-
\??\c:\nbbnhh.exec:\nbbnhh.exe72⤵PID:3964
-
\??\c:\hbhhhh.exec:\hbhhhh.exe73⤵PID:636
-
\??\c:\ppddd.exec:\ppddd.exe74⤵PID:5096
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe75⤵PID:3824
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe76⤵PID:1708
-
\??\c:\hbbthh.exec:\hbbthh.exe77⤵PID:1328
-
\??\c:\bhhthh.exec:\bhhthh.exe78⤵PID:4760
-
\??\c:\vvdpp.exec:\vvdpp.exe79⤵PID:5048
-
\??\c:\fflxxrr.exec:\fflxxrr.exe80⤵PID:2764
-
\??\c:\5xrlxxf.exec:\5xrlxxf.exe81⤵PID:1608
-
\??\c:\bhthbt.exec:\bhthbt.exe82⤵PID:2132
-
\??\c:\bnttnb.exec:\bnttnb.exe83⤵PID:4912
-
\??\c:\vpddv.exec:\vpddv.exe84⤵PID:3556
-
\??\c:\pvvvv.exec:\pvvvv.exe85⤵PID:4400
-
\??\c:\xffxlll.exec:\xffxlll.exe86⤵PID:3892
-
\??\c:\bttttt.exec:\bttttt.exe87⤵PID:3844
-
\??\c:\ddvjv.exec:\ddvjv.exe88⤵PID:428
-
\??\c:\pjddj.exec:\pjddj.exe89⤵PID:4560
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe90⤵PID:4716
-
\??\c:\7fxxrrx.exec:\7fxxrrx.exe91⤵PID:3636
-
\??\c:\hhthtn.exec:\hhthtn.exe92⤵PID:5116
-
\??\c:\pdppp.exec:\pdppp.exe93⤵PID:232
-
\??\c:\1flfxxx.exec:\1flfxxx.exe94⤵PID:2892
-
\??\c:\nhhttt.exec:\nhhttt.exe95⤵PID:2784
-
\??\c:\tnnnnt.exec:\tnnnnt.exe96⤵PID:5072
-
\??\c:\vpvvv.exec:\vpvvv.exe97⤵PID:4272
-
\??\c:\vpdvd.exec:\vpdvd.exe98⤵PID:3424
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe99⤵PID:4412
-
\??\c:\thnnnn.exec:\thnnnn.exe100⤵PID:4416
-
\??\c:\nhhtnn.exec:\nhhtnn.exe101⤵PID:3304
-
\??\c:\pjjdv.exec:\pjjdv.exe102⤵PID:3484
-
\??\c:\9jpjd.exec:\9jpjd.exe103⤵PID:1856
-
\??\c:\lxxrfff.exec:\lxxrfff.exe104⤵PID:1836
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe105⤵PID:4792
-
\??\c:\7btntt.exec:\7btntt.exe106⤵PID:804
-
\??\c:\1jppj.exec:\1jppj.exe107⤵PID:4860
-
\??\c:\dpppp.exec:\dpppp.exe108⤵PID:4880
-
\??\c:\frfrrrr.exec:\frfrrrr.exe109⤵PID:4276
-
\??\c:\bttbht.exec:\bttbht.exe110⤵PID:2144
-
\??\c:\tnbtnn.exec:\tnbtnn.exe111⤵PID:1564
-
\??\c:\dpdvv.exec:\dpdvv.exe112⤵PID:1928
-
\??\c:\dppvj.exec:\dppvj.exe113⤵PID:4868
-
\??\c:\rlllfxr.exec:\rlllfxr.exe114⤵PID:3396
-
\??\c:\nbhhhn.exec:\nbhhhn.exe115⤵PID:2448
-
\??\c:\hhhhbt.exec:\hhhhbt.exe116⤵PID:1380
-
\??\c:\vddvp.exec:\vddvp.exe117⤵PID:4960
-
\??\c:\pjjdd.exec:\pjjdd.exe118⤵PID:1456
-
\??\c:\9lrlfxx.exec:\9lrlfxx.exe119⤵PID:3392
-
\??\c:\frfxrrl.exec:\frfxrrl.exe120⤵PID:3548
-
\??\c:\thhhth.exec:\thhhth.exe121⤵PID:4256
-
\??\c:\nhhbtn.exec:\nhhbtn.exe122⤵PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-