Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe
Resource
win7-20241010-en
General
-
Target
4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe
-
Size
72KB
-
MD5
741a16fa6bd1780c20dbec27386101a0
-
SHA1
2b96aa5bb874913b624f4cb36a860416ebb86f45
-
SHA256
4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402
-
SHA512
55a8eb9968414f0b290121522b4dabaf931ac43818a7be37e4a928b1b33aa92d65f83e7b583fcdf0d69f978dbfd8218467f675ff75caad63e533fa08d34a256a
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7Ak3:0cdpeeBSHHMHLf9Rybx7DYec7F3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4672-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-397-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-434-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-509-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-580-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-602-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-687-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-712-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-797-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-855-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-997-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-1094-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-1191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-1676-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4324 bnnnnb.exe 4480 ddpvv.exe 3332 1rlllll.exe 3900 fllxxxx.exe 3820 vjvvp.exe 4304 rlffxff.exe 3832 rlrrrxx.exe 1764 bbtbbb.exe 4432 vvjjj.exe 1604 xlllfrr.exe 2828 xfrrrxf.exe 2976 hhnntb.exe 5012 ttnhht.exe 4256 vvjdj.exe 4216 fllllll.exe 3784 9hbnnn.exe 3360 3dddd.exe 4664 vppjp.exe 864 rffllll.exe 4080 bttttb.exe 2864 ddppv.exe 1048 jjvdd.exe 2784 xxxxxff.exe 2924 nbhnhb.exe 976 ddjjv.exe 1928 9pddd.exe 4636 9xxrrxr.exe 3280 nhhnnt.exe 4952 ttttnt.exe 1956 vvjpp.exe 1340 ffxrlrl.exe 4144 ttbhhh.exe 3380 pvjpj.exe 4648 9pddd.exe 2508 tntbtt.exe 3196 djdjd.exe 1688 ddppp.exe 3904 rrlfrrl.exe 4392 lflllrl.exe 4484 btnnnn.exe 3200 1vjjj.exe 2764 pvpjj.exe 2884 lxxxrxr.exe 4644 tttnnh.exe 3804 jpppp.exe 1460 pjjjd.exe 2644 7lrxrxx.exe 1052 ttnnbb.exe 4224 tnttnb.exe 2820 rllfxxx.exe 1932 bttttt.exe 4880 nbhnnn.exe 1984 1djjp.exe 808 xffxxxx.exe 860 flffrxl.exe 3332 vvppp.exe 3180 vvddd.exe 2104 fxrxxxr.exe 3268 lrxxrxx.exe 2096 jdddd.exe 4400 jpppp.exe 3940 xlrrflr.exe 3836 9nnnhh.exe 1124 hhhhhh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4672 wrote to memory of 4324 4672 4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe 83 PID 4672 wrote to memory of 4324 4672 4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe 83 PID 4672 wrote to memory of 4324 4672 4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe 83 PID 4324 wrote to memory of 4480 4324 bnnnnb.exe 84 PID 4324 wrote to memory of 4480 4324 bnnnnb.exe 84 PID 4324 wrote to memory of 4480 4324 bnnnnb.exe 84 PID 4480 wrote to memory of 3332 4480 ddpvv.exe 85 PID 4480 wrote to memory of 3332 4480 ddpvv.exe 85 PID 4480 wrote to memory of 3332 4480 ddpvv.exe 85 PID 3332 wrote to memory of 3900 3332 1rlllll.exe 86 PID 3332 wrote to memory of 3900 3332 1rlllll.exe 86 PID 3332 wrote to memory of 3900 3332 1rlllll.exe 86 PID 3900 wrote to memory of 3820 3900 fllxxxx.exe 87 PID 3900 wrote to memory of 3820 3900 fllxxxx.exe 87 PID 3900 wrote to memory of 3820 3900 fllxxxx.exe 87 PID 3820 wrote to memory of 4304 3820 vjvvp.exe 88 PID 3820 wrote to memory of 4304 3820 vjvvp.exe 88 PID 3820 wrote to memory of 4304 3820 vjvvp.exe 88 PID 4304 wrote to memory of 3832 4304 rlffxff.exe 89 PID 4304 wrote to memory of 3832 4304 rlffxff.exe 89 PID 4304 wrote to memory of 3832 4304 rlffxff.exe 89 PID 3832 wrote to memory of 1764 3832 rlrrrxx.exe 90 PID 3832 wrote to memory of 1764 3832 rlrrrxx.exe 90 PID 3832 wrote to memory of 1764 3832 rlrrrxx.exe 90 PID 1764 wrote to memory of 4432 1764 bbtbbb.exe 91 PID 1764 wrote to memory of 4432 1764 bbtbbb.exe 91 PID 1764 wrote to memory of 4432 1764 bbtbbb.exe 91 PID 4432 wrote to memory of 1604 4432 vvjjj.exe 92 PID 4432 wrote to memory of 1604 4432 vvjjj.exe 92 PID 4432 wrote to memory of 1604 4432 vvjjj.exe 92 PID 1604 wrote to memory of 2828 1604 xlllfrr.exe 93 PID 1604 wrote to memory of 2828 1604 xlllfrr.exe 93 PID 1604 wrote to memory of 2828 1604 xlllfrr.exe 93 PID 2828 wrote to memory of 2976 2828 xfrrrxf.exe 94 PID 2828 wrote to memory of 2976 2828 xfrrrxf.exe 94 PID 2828 wrote to memory of 2976 2828 xfrrrxf.exe 94 PID 2976 wrote to memory of 5012 2976 hhnntb.exe 95 PID 2976 wrote to memory of 5012 2976 hhnntb.exe 95 PID 2976 wrote to memory of 5012 2976 hhnntb.exe 95 PID 5012 wrote to memory of 4256 5012 ttnhht.exe 96 PID 5012 wrote to memory of 4256 5012 ttnhht.exe 96 PID 5012 wrote to memory of 4256 5012 ttnhht.exe 96 PID 4256 wrote to memory of 4216 4256 vvjdj.exe 97 PID 4256 wrote to memory of 4216 4256 vvjdj.exe 97 PID 4256 wrote to memory of 4216 4256 vvjdj.exe 97 PID 4216 wrote to memory of 3784 4216 fllllll.exe 98 PID 4216 wrote to memory of 3784 4216 fllllll.exe 98 PID 4216 wrote to memory of 3784 4216 fllllll.exe 98 PID 3784 wrote to memory of 3360 3784 9hbnnn.exe 99 PID 3784 wrote to memory of 3360 3784 9hbnnn.exe 99 PID 3784 wrote to memory of 3360 3784 9hbnnn.exe 99 PID 3360 wrote to memory of 4664 3360 3dddd.exe 100 PID 3360 wrote to memory of 4664 3360 3dddd.exe 100 PID 3360 wrote to memory of 4664 3360 3dddd.exe 100 PID 4664 wrote to memory of 864 4664 vppjp.exe 101 PID 4664 wrote to memory of 864 4664 vppjp.exe 101 PID 4664 wrote to memory of 864 4664 vppjp.exe 101 PID 864 wrote to memory of 4080 864 rffllll.exe 102 PID 864 wrote to memory of 4080 864 rffllll.exe 102 PID 864 wrote to memory of 4080 864 rffllll.exe 102 PID 4080 wrote to memory of 2864 4080 bttttb.exe 103 PID 4080 wrote to memory of 2864 4080 bttttb.exe 103 PID 4080 wrote to memory of 2864 4080 bttttb.exe 103 PID 2864 wrote to memory of 1048 2864 ddppv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe"C:\Users\Admin\AppData\Local\Temp\4cbbd904896383afdc5760fd62827da6879ce9e1ffb5363f513eb40d4ff97402N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\bnnnnb.exec:\bnnnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\ddpvv.exec:\ddpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\1rlllll.exec:\1rlllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\fllxxxx.exec:\fllxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\vjvvp.exec:\vjvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\rlffxff.exec:\rlffxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\bbtbbb.exec:\bbtbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\vvjjj.exec:\vvjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\xlllfrr.exec:\xlllfrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\xfrrrxf.exec:\xfrrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hhnntb.exec:\hhnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\ttnhht.exec:\ttnhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vvjdj.exec:\vvjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\fllllll.exec:\fllllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\9hbnnn.exec:\9hbnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\3dddd.exec:\3dddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\vppjp.exec:\vppjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\rffllll.exec:\rffllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\bttttb.exec:\bttttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\ddppv.exec:\ddppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jjvdd.exec:\jjvdd.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xxxxxff.exec:\xxxxxff.exe24⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nbhnhb.exec:\nbhnhb.exe25⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ddjjv.exec:\ddjjv.exe26⤵
- Executes dropped EXE
PID:976 -
\??\c:\9pddd.exec:\9pddd.exe27⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9xxrrxr.exec:\9xxrrxr.exe28⤵
- Executes dropped EXE
PID:4636 -
\??\c:\nhhnnt.exec:\nhhnnt.exe29⤵
- Executes dropped EXE
PID:3280 -
\??\c:\ttttnt.exec:\ttttnt.exe30⤵
- Executes dropped EXE
PID:4952 -
\??\c:\vvjpp.exec:\vvjpp.exe31⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ffxrlrl.exec:\ffxrlrl.exe32⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ttbhhh.exec:\ttbhhh.exe33⤵
- Executes dropped EXE
PID:4144 -
\??\c:\pvjpj.exec:\pvjpj.exe34⤵
- Executes dropped EXE
PID:3380 -
\??\c:\9pddd.exec:\9pddd.exe35⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tntbtt.exec:\tntbtt.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\djdjd.exec:\djdjd.exe37⤵
- Executes dropped EXE
PID:3196 -
\??\c:\ddppp.exec:\ddppp.exe38⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe39⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lflllrl.exec:\lflllrl.exe40⤵
- Executes dropped EXE
PID:4392 -
\??\c:\btnnnn.exec:\btnnnn.exe41⤵
- Executes dropped EXE
PID:4484 -
\??\c:\1vjjj.exec:\1vjjj.exe42⤵
- Executes dropped EXE
PID:3200 -
\??\c:\pvpjj.exec:\pvpjj.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lxxxrxr.exec:\lxxxrxr.exe44⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tttnnh.exec:\tttnnh.exe45⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jpppp.exec:\jpppp.exe46⤵
- Executes dropped EXE
PID:3804 -
\??\c:\pjjjd.exec:\pjjjd.exe47⤵
- Executes dropped EXE
PID:1460 -
\??\c:\7lrxrxx.exec:\7lrxrxx.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ttnnbb.exec:\ttnnbb.exe49⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tnttnb.exec:\tnttnb.exe50⤵
- Executes dropped EXE
PID:4224 -
\??\c:\rllfxxx.exec:\rllfxxx.exe51⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bttttt.exec:\bttttt.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nbhnnn.exec:\nbhnnn.exe53⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1djjp.exec:\1djjp.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xffxxxx.exec:\xffxxxx.exe55⤵
- Executes dropped EXE
PID:808 -
\??\c:\flffrxl.exec:\flffrxl.exe56⤵
- Executes dropped EXE
PID:860 -
\??\c:\vvppp.exec:\vvppp.exe57⤵
- Executes dropped EXE
PID:3332 -
\??\c:\vvddd.exec:\vvddd.exe58⤵
- Executes dropped EXE
PID:3180 -
\??\c:\fxrxxxr.exec:\fxrxxxr.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lrxxrxx.exec:\lrxxrxx.exe60⤵
- Executes dropped EXE
PID:3268 -
\??\c:\jdddd.exec:\jdddd.exe61⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jpppp.exec:\jpppp.exe62⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xlrrflr.exec:\xlrrflr.exe63⤵
- Executes dropped EXE
PID:3940 -
\??\c:\9nnnhh.exec:\9nnnhh.exe64⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hhhhhh.exec:\hhhhhh.exe65⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vjvvv.exec:\vjvvv.exe66⤵PID:4528
-
\??\c:\fxxllll.exec:\fxxllll.exe67⤵PID:2248
-
\??\c:\1nnnnn.exec:\1nnnnn.exe68⤵PID:2828
-
\??\c:\hnbbbb.exec:\hnbbbb.exe69⤵PID:1408
-
\??\c:\ddpjv.exec:\ddpjv.exe70⤵PID:4976
-
\??\c:\bbntbh.exec:\bbntbh.exe71⤵PID:3036
-
\??\c:\7djjd.exec:\7djjd.exe72⤵PID:2724
-
\??\c:\rxxrrxx.exec:\rxxrrxx.exe73⤵PID:3144
-
\??\c:\tbhhth.exec:\tbhhth.exe74⤵PID:232
-
\??\c:\hhhnnt.exec:\hhhnnt.exe75⤵PID:4824
-
\??\c:\7dpjp.exec:\7dpjp.exe76⤵PID:2520
-
\??\c:\xffffll.exec:\xffffll.exe77⤵PID:4780
-
\??\c:\tbbtnn.exec:\tbbtnn.exe78⤵PID:1404
-
\??\c:\9pppp.exec:\9pppp.exe79⤵PID:864
-
\??\c:\rrrffff.exec:\rrrffff.exe80⤵PID:3844
-
\??\c:\tnbbbb.exec:\tnbbbb.exe81⤵PID:2044
-
\??\c:\vpvvv.exec:\vpvvv.exe82⤵PID:3368
-
\??\c:\lflxrxx.exec:\lflxrxx.exe83⤵PID:1048
-
\??\c:\nttttt.exec:\nttttt.exe84⤵PID:628
-
\??\c:\pvdjj.exec:\pvdjj.exe85⤵PID:2980
-
\??\c:\jpvdj.exec:\jpvdj.exe86⤵PID:2924
-
\??\c:\fxrrlxx.exec:\fxrrlxx.exe87⤵PID:1716
-
\??\c:\ttnhhn.exec:\ttnhhn.exe88⤵PID:1448
-
\??\c:\hhbbbh.exec:\hhbbbh.exe89⤵PID:2376
-
\??\c:\pdppp.exec:\pdppp.exe90⤵PID:772
-
\??\c:\ddddj.exec:\ddddj.exe91⤵PID:4488
-
\??\c:\ffrxxff.exec:\ffrxxff.exe92⤵PID:4492
-
\??\c:\nbnbbb.exec:\nbnbbb.exe93⤵PID:816
-
\??\c:\nthttt.exec:\nthttt.exe94⤵PID:2236
-
\??\c:\dvjdd.exec:\dvjdd.exe95⤵PID:884
-
\??\c:\pppvv.exec:\pppvv.exe96⤵PID:4144
-
\??\c:\lrxrffr.exec:\lrxrffr.exe97⤵PID:4260
-
\??\c:\tnnttt.exec:\tnnttt.exe98⤵PID:3796
-
\??\c:\ddjjj.exec:\ddjjj.exe99⤵PID:2176
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe100⤵PID:3196
-
\??\c:\ntnhnn.exec:\ntnhnn.exe101⤵PID:1776
-
\??\c:\nttttb.exec:\nttttb.exe102⤵PID:1000
-
\??\c:\jjppp.exec:\jjppp.exe103⤵PID:2384
-
\??\c:\llxxrxl.exec:\llxxrxl.exe104⤵PID:1160
-
\??\c:\7lxlfrr.exec:\7lxlfrr.exe105⤵PID:3648
-
\??\c:\bbnnhh.exec:\bbnnhh.exe106⤵PID:2336
-
\??\c:\bbnhhn.exec:\bbnhhn.exe107⤵PID:1032
-
\??\c:\dvdjd.exec:\dvdjd.exe108⤵PID:4604
-
\??\c:\xfxxlrf.exec:\xfxxlrf.exe109⤵PID:3392
-
\??\c:\rrxxxff.exec:\rrxxxff.exe110⤵PID:4556
-
\??\c:\ttbtbb.exec:\ttbtbb.exe111⤵PID:2512
-
\??\c:\jdjjd.exec:\jdjjd.exe112⤵PID:2644
-
\??\c:\vjjjj.exec:\vjjjj.exe113⤵PID:1052
-
\??\c:\xrxxlll.exec:\xrxxlll.exe114⤵PID:4224
-
\??\c:\nthhhh.exec:\nthhhh.exe115⤵PID:2820
-
\??\c:\hnnttn.exec:\hnnttn.exe116⤵PID:1932
-
\??\c:\3vjjd.exec:\3vjjd.exe117⤵PID:4880
-
\??\c:\3pjdv.exec:\3pjdv.exe118⤵PID:4876
-
\??\c:\lrllfxx.exec:\lrllfxx.exe119⤵PID:2124
-
\??\c:\bthbbb.exec:\bthbbb.exe120⤵PID:860
-
\??\c:\nhbtnn.exec:\nhbtnn.exe121⤵PID:3332
-
\??\c:\jjpjd.exec:\jjpjd.exe122⤵PID:3176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-