Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
Resource
win7-20240903-en
General
-
Target
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
-
Size
83KB
-
MD5
cc843f29569041b4c5f5cfbda3acbbba
-
SHA1
00f60f53883096623fd59c71beebb5dd172f2e03
-
SHA256
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f
-
SHA512
95c7f249f15992a059ba2e5c43f201ffa5319267ab2563cef62ed43654f4899bc0ff2eff4040fb23d602a8b20524684c18cb8d49c2f8f2b8a915e47b6eb6ca18
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QR:ymb3NkkiQ3mdBjFIIp9L9QrrA8m
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4440-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-24-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4372 dvjjd.exe 3024 rrlxfrl.exe 876 xxfxrlf.exe 3360 ntbbbb.exe 3236 jpdvd.exe 2672 5pjdv.exe 2640 rfffxrr.exe 3688 tnbbtt.exe 4408 ppvpd.exe 4400 ffxlxrl.exe 636 ntttnn.exe 3048 tbhbbh.exe 2824 jpjpv.exe 4448 9xrfxxr.exe 5000 btttnt.exe 2164 nnhhnn.exe 2188 vjjjj.exe 2776 dvppj.exe 2760 djvdj.exe 412 xxxxxxf.exe 3876 ntbbhh.exe 2148 ddddv.exe 4000 xxxxxff.exe 3116 tthhtt.exe 3848 hhtthb.exe 5076 jpvvd.exe 5080 3lrlffx.exe 1500 5ttttt.exe 1764 jvvdv.exe 3504 fxfrxrx.exe 1732 tbtnnt.exe 3832 bthbhh.exe 3516 ppdpj.exe 3916 rlfxrlf.exe 1692 lxxrllf.exe 3500 bttnhb.exe 4072 jjpjd.exe 2928 vvpdv.exe 4852 fxxrlll.exe 4856 frxxffr.exe 4960 1bbbtb.exe 3604 hbnnhh.exe 1464 7vvjp.exe 2548 vppjj.exe 516 nhnhtb.exe 3264 nhhhbb.exe 4380 jdpjp.exe 1956 rfxxxxx.exe 2536 rfrlllr.exe 3440 tthntb.exe 4588 thhbht.exe 4496 jjppd.exe 1092 vjddp.exe 4904 xxxxrrx.exe 3304 tttnht.exe 4280 hhhtbb.exe 3716 jvvvj.exe 4416 9pvpj.exe 1304 fflfxxx.exe 3680 5rlllll.exe 3556 htbbhh.exe 3412 jdvvp.exe 544 pjvvp.exe 3880 rxlfllf.exe -
resource yara_rule behavioral2/memory/4440-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4372 4440 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 82 PID 4440 wrote to memory of 4372 4440 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 82 PID 4440 wrote to memory of 4372 4440 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 82 PID 4372 wrote to memory of 3024 4372 dvjjd.exe 83 PID 4372 wrote to memory of 3024 4372 dvjjd.exe 83 PID 4372 wrote to memory of 3024 4372 dvjjd.exe 83 PID 3024 wrote to memory of 876 3024 rrlxfrl.exe 84 PID 3024 wrote to memory of 876 3024 rrlxfrl.exe 84 PID 3024 wrote to memory of 876 3024 rrlxfrl.exe 84 PID 876 wrote to memory of 3360 876 xxfxrlf.exe 85 PID 876 wrote to memory of 3360 876 xxfxrlf.exe 85 PID 876 wrote to memory of 3360 876 xxfxrlf.exe 85 PID 3360 wrote to memory of 3236 3360 ntbbbb.exe 86 PID 3360 wrote to memory of 3236 3360 ntbbbb.exe 86 PID 3360 wrote to memory of 3236 3360 ntbbbb.exe 86 PID 3236 wrote to memory of 2672 3236 jpdvd.exe 87 PID 3236 wrote to memory of 2672 3236 jpdvd.exe 87 PID 3236 wrote to memory of 2672 3236 jpdvd.exe 87 PID 2672 wrote to memory of 2640 2672 5pjdv.exe 88 PID 2672 wrote to memory of 2640 2672 5pjdv.exe 88 PID 2672 wrote to memory of 2640 2672 5pjdv.exe 88 PID 2640 wrote to memory of 3688 2640 rfffxrr.exe 89 PID 2640 wrote to memory of 3688 2640 rfffxrr.exe 89 PID 2640 wrote to memory of 3688 2640 rfffxrr.exe 89 PID 3688 wrote to memory of 4408 3688 tnbbtt.exe 90 PID 3688 wrote to memory of 4408 3688 tnbbtt.exe 90 PID 3688 wrote to memory of 4408 3688 tnbbtt.exe 90 PID 4408 wrote to memory of 4400 4408 ppvpd.exe 91 PID 4408 wrote to memory of 4400 4408 ppvpd.exe 91 PID 4408 wrote to memory of 4400 4408 ppvpd.exe 91 PID 4400 wrote to memory of 636 4400 ffxlxrl.exe 92 PID 4400 wrote to memory of 636 4400 ffxlxrl.exe 92 PID 4400 wrote to memory of 636 4400 ffxlxrl.exe 92 PID 636 wrote to memory of 3048 636 ntttnn.exe 93 PID 636 wrote to memory of 3048 636 ntttnn.exe 93 PID 636 wrote to memory of 3048 636 ntttnn.exe 93 PID 3048 wrote to memory of 2824 3048 tbhbbh.exe 94 PID 3048 wrote to memory of 2824 3048 tbhbbh.exe 94 PID 3048 wrote to memory of 2824 3048 tbhbbh.exe 94 PID 2824 wrote to memory of 4448 2824 jpjpv.exe 95 PID 2824 wrote to memory of 4448 2824 jpjpv.exe 95 PID 2824 wrote to memory of 4448 2824 jpjpv.exe 95 PID 4448 wrote to memory of 5000 4448 9xrfxxr.exe 96 PID 4448 wrote to memory of 5000 4448 9xrfxxr.exe 96 PID 4448 wrote to memory of 5000 4448 9xrfxxr.exe 96 PID 5000 wrote to memory of 2164 5000 btttnt.exe 97 PID 5000 wrote to memory of 2164 5000 btttnt.exe 97 PID 5000 wrote to memory of 2164 5000 btttnt.exe 97 PID 2164 wrote to memory of 2188 2164 nnhhnn.exe 98 PID 2164 wrote to memory of 2188 2164 nnhhnn.exe 98 PID 2164 wrote to memory of 2188 2164 nnhhnn.exe 98 PID 2188 wrote to memory of 2776 2188 vjjjj.exe 99 PID 2188 wrote to memory of 2776 2188 vjjjj.exe 99 PID 2188 wrote to memory of 2776 2188 vjjjj.exe 99 PID 2776 wrote to memory of 2760 2776 dvppj.exe 100 PID 2776 wrote to memory of 2760 2776 dvppj.exe 100 PID 2776 wrote to memory of 2760 2776 dvppj.exe 100 PID 2760 wrote to memory of 412 2760 djvdj.exe 101 PID 2760 wrote to memory of 412 2760 djvdj.exe 101 PID 2760 wrote to memory of 412 2760 djvdj.exe 101 PID 412 wrote to memory of 3876 412 xxxxxxf.exe 102 PID 412 wrote to memory of 3876 412 xxxxxxf.exe 102 PID 412 wrote to memory of 3876 412 xxxxxxf.exe 102 PID 3876 wrote to memory of 2148 3876 ntbbhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\dvjjd.exec:\dvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\ntbbbb.exec:\ntbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\jpdvd.exec:\jpdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\5pjdv.exec:\5pjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rfffxrr.exec:\rfffxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnbbtt.exec:\tnbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\ppvpd.exec:\ppvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\ntttnn.exec:\ntttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tbhbbh.exec:\tbhbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jpjpv.exec:\jpjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9xrfxxr.exec:\9xrfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\btttnt.exec:\btttnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nnhhnn.exec:\nnhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\vjjjj.exec:\vjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\dvppj.exec:\dvppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\djvdj.exec:\djvdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\ntbbhh.exec:\ntbbhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\ddddv.exec:\ddddv.exe23⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xxxxxff.exec:\xxxxxff.exe24⤵
- Executes dropped EXE
PID:4000 -
\??\c:\tthhtt.exec:\tthhtt.exe25⤵
- Executes dropped EXE
PID:3116 -
\??\c:\hhtthb.exec:\hhtthb.exe26⤵
- Executes dropped EXE
PID:3848 -
\??\c:\jpvvd.exec:\jpvvd.exe27⤵
- Executes dropped EXE
PID:5076 -
\??\c:\3lrlffx.exec:\3lrlffx.exe28⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5ttttt.exec:\5ttttt.exe29⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jvvdv.exec:\jvvdv.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fxfrxrx.exec:\fxfrxrx.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\tbtnnt.exec:\tbtnnt.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bthbhh.exec:\bthbhh.exe33⤵
- Executes dropped EXE
PID:3832 -
\??\c:\ppdpj.exec:\ppdpj.exe34⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe35⤵
- Executes dropped EXE
PID:3916 -
\??\c:\lxxrllf.exec:\lxxrllf.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bttnhb.exec:\bttnhb.exe37⤵
- Executes dropped EXE
PID:3500 -
\??\c:\jjpjd.exec:\jjpjd.exe38⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vvpdv.exec:\vvpdv.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fxxrlll.exec:\fxxrlll.exe40⤵
- Executes dropped EXE
PID:4852 -
\??\c:\frxxffr.exec:\frxxffr.exe41⤵
- Executes dropped EXE
PID:4856 -
\??\c:\1bbbtb.exec:\1bbbtb.exe42⤵
- Executes dropped EXE
PID:4960 -
\??\c:\hbnnhh.exec:\hbnnhh.exe43⤵
- Executes dropped EXE
PID:3604 -
\??\c:\7vvjp.exec:\7vvjp.exe44⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vppjj.exec:\vppjj.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nhnhtb.exec:\nhnhtb.exe46⤵
- Executes dropped EXE
PID:516 -
\??\c:\nhhhbb.exec:\nhhhbb.exe47⤵
- Executes dropped EXE
PID:3264 -
\??\c:\jdpjp.exec:\jdpjp.exe48⤵
- Executes dropped EXE
PID:4380 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe49⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rfrlllr.exec:\rfrlllr.exe50⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tthntb.exec:\tthntb.exe51⤵
- Executes dropped EXE
PID:3440 -
\??\c:\thhbht.exec:\thhbht.exe52⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jjppd.exec:\jjppd.exe53⤵
- Executes dropped EXE
PID:4496 -
\??\c:\vjddp.exec:\vjddp.exe54⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xxxxrrx.exec:\xxxxrrx.exe55⤵
- Executes dropped EXE
PID:4904 -
\??\c:\tttnht.exec:\tttnht.exe56⤵
- Executes dropped EXE
PID:3304 -
\??\c:\hhhtbb.exec:\hhhtbb.exe57⤵
- Executes dropped EXE
PID:4280 -
\??\c:\jvvvj.exec:\jvvvj.exe58⤵
- Executes dropped EXE
PID:3716 -
\??\c:\9pvpj.exec:\9pvpj.exe59⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fflfxxx.exec:\fflfxxx.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\5rlllll.exec:\5rlllll.exe61⤵
- Executes dropped EXE
PID:3680 -
\??\c:\htbbhh.exec:\htbbhh.exe62⤵
- Executes dropped EXE
PID:3556 -
\??\c:\jdvvp.exec:\jdvvp.exe63⤵
- Executes dropped EXE
PID:3412 -
\??\c:\pjvvp.exec:\pjvvp.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\rxlfllf.exec:\rxlfllf.exe65⤵
- Executes dropped EXE
PID:3880 -
\??\c:\rlrrlff.exec:\rlrrlff.exe66⤵PID:4400
-
\??\c:\5ntttt.exec:\5ntttt.exe67⤵PID:636
-
\??\c:\7nbhhh.exec:\7nbhhh.exe68⤵PID:3616
-
\??\c:\jjvpd.exec:\jjvpd.exe69⤵PID:4488
-
\??\c:\flrllfx.exec:\flrllfx.exe70⤵PID:5004
-
\??\c:\frlffxl.exec:\frlffxl.exe71⤵PID:976
-
\??\c:\hhnttt.exec:\hhnttt.exe72⤵PID:5000
-
\??\c:\hnttnn.exec:\hnttnn.exe73⤵PID:3480
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:4552
-
\??\c:\nhbbhn.exec:\nhbbhn.exe75⤵PID:1388
-
\??\c:\ddpvj.exec:\ddpvj.exe76⤵PID:4920
-
\??\c:\xlxlxrl.exec:\xlxlxrl.exe77⤵PID:3100
-
\??\c:\frfrfxl.exec:\frfrfxl.exe78⤵PID:2004
-
\??\c:\tbbbtt.exec:\tbbbtt.exe79⤵PID:1596
-
\??\c:\vddvv.exec:\vddvv.exe80⤵PID:2980
-
\??\c:\pjdvj.exec:\pjdvj.exe81⤵PID:3144
-
\??\c:\fllxllf.exec:\fllxllf.exe82⤵PID:688
-
\??\c:\fxxrllf.exec:\fxxrllf.exe83⤵PID:4456
-
\??\c:\7nnhbt.exec:\7nnhbt.exe84⤵PID:1360
-
\??\c:\nnhnhn.exec:\nnhnhn.exe85⤵PID:212
-
\??\c:\bnntnn.exec:\bnntnn.exe86⤵PID:2196
-
\??\c:\jvjvp.exec:\jvjvp.exe87⤵PID:3936
-
\??\c:\rflffxf.exec:\rflffxf.exe88⤵PID:4984
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe89⤵PID:3940
-
\??\c:\nhbtnn.exec:\nhbtnn.exe90⤵PID:4428
-
\??\c:\5pppd.exec:\5pppd.exe91⤵PID:2116
-
\??\c:\fxxrxrr.exec:\fxxrxrr.exe92⤵PID:3504
-
\??\c:\xrrrffx.exec:\xrrrffx.exe93⤵PID:4780
-
\??\c:\bbhntt.exec:\bbhntt.exe94⤵PID:3248
-
\??\c:\3thbbb.exec:\3thbbb.exe95⤵PID:4092
-
\??\c:\vvjjd.exec:\vvjjd.exe96⤵PID:2488
-
\??\c:\1ppjp.exec:\1ppjp.exe97⤵PID:2608
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe98⤵PID:1632
-
\??\c:\3bhbhb.exec:\3bhbhb.exe99⤵PID:3500
-
\??\c:\jdvpv.exec:\jdvpv.exe100⤵PID:1892
-
\??\c:\7vdvp.exec:\7vdvp.exe101⤵PID:448
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe102⤵PID:4608
-
\??\c:\rxffxlx.exec:\rxffxlx.exe103⤵PID:2280
-
\??\c:\nhtnnt.exec:\nhtnnt.exe104⤵PID:3708
-
\??\c:\djdpj.exec:\djdpj.exe105⤵PID:1836
-
\??\c:\ppvpp.exec:\ppvpp.exe106⤵PID:1840
-
\??\c:\flllrll.exec:\flllrll.exe107⤵PID:3436
-
\??\c:\7nnhbt.exec:\7nnhbt.exe108⤵PID:4232
-
\??\c:\hhtthh.exec:\hhtthh.exe109⤵PID:1488
-
\??\c:\jdpjv.exec:\jdpjv.exe110⤵PID:4728
-
\??\c:\rxllxxr.exec:\rxllxxr.exe111⤵PID:5044
-
\??\c:\xflffrr.exec:\xflffrr.exe112⤵PID:3512
-
\??\c:\5tttnn.exec:\5tttnn.exe113⤵PID:3228
-
\??\c:\httbbb.exec:\httbbb.exe114⤵PID:4312
-
\??\c:\1vvpd.exec:\1vvpd.exe115⤵PID:5032
-
\??\c:\rlxrllf.exec:\rlxrllf.exe116⤵PID:1916
-
\??\c:\nbtbtb.exec:\nbtbtb.exe117⤵PID:4240
-
\??\c:\nnhtnh.exec:\nnhtnh.exe118⤵PID:4108
-
\??\c:\vjpvp.exec:\vjpvp.exe119⤵PID:4280
-
\??\c:\dppdp.exec:\dppdp.exe120⤵PID:756
-
\??\c:\9ppjd.exec:\9ppjd.exe121⤵PID:4416
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe122⤵PID:1304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-