Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe
Resource
win7-20240729-en
General
-
Target
3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe
-
Size
250KB
-
MD5
b9565267b2735db164191e6b0a149fbd
-
SHA1
d71184b326c3b5fdd6526a258d5304653b62577d
-
SHA256
3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521
-
SHA512
3da5edff109b1491baf701360d9536d4d930febe20fc1225ea0dda5757c4c1d201908c91adc3f9e02d490a1ed9e930e6b4731f8e71d0e23cefe6b3e0667f2bff
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1oa:n3C9BRo7MlrWKo+lxtvGt1oa
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2148-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4424 vjvvv.exe 3692 hhnnnn.exe 2856 djpdv.exe 5020 lfffrrf.exe 1088 xrrlffx.exe 2940 5tbnhh.exe 2376 fxrlfxr.exe 116 tnnhhh.exe 1720 vjpjd.exe 2188 tnttnn.exe 4132 vppjd.exe 3256 nhtttb.exe 920 rrfrxlr.exe 976 bhntnn.exe 4600 dvpjv.exe 3540 bthhtt.exe 1364 1ntnhh.exe 2116 lfrrrlr.exe 2832 hbtnnh.exe 1348 ffffxxr.exe 1756 vjvjd.exe 2392 lxfxrrl.exe 1600 hnnbnh.exe 1100 vdvpd.exe 1212 lfrrrrl.exe 3960 nnnhhb.exe 3652 tttnth.exe 3904 vddvj.exe 2980 hbntnn.exe 4968 7vjdj.exe 3512 hbbttn.exe 676 vjjjj.exe 5064 pjjjd.exe 4340 xffxrll.exe 2768 5nttnh.exe 4540 7pjdd.exe 4472 lffxrlf.exe 3328 frlflfx.exe 3436 hbbtnh.exe 868 dppvj.exe 1200 rfxrfxl.exe 4752 rxxxrxr.exe 2872 hththb.exe 2664 jpppj.exe 2244 lxlflfl.exe 1432 lflrlfl.exe 3508 tthbbb.exe 2156 ppdvj.exe 208 1dvpj.exe 1720 3lrlrrx.exe 2296 7bnhtn.exe 4348 5jvjp.exe 4088 jvdvp.exe 2276 lrlfrlx.exe 2172 3lfxrxx.exe 1524 hntnnn.exe 4600 jjvjp.exe 2976 rflrlll.exe 1632 lfxxxlr.exe 1488 tnttnn.exe 3224 pjjvp.exe 5068 jjpjj.exe 2356 rflrfff.exe 3188 nnbbtb.exe -
resource yara_rule behavioral2/memory/2148-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 4424 2148 3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe 83 PID 2148 wrote to memory of 4424 2148 3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe 83 PID 2148 wrote to memory of 4424 2148 3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe 83 PID 4424 wrote to memory of 3692 4424 vjvvv.exe 84 PID 4424 wrote to memory of 3692 4424 vjvvv.exe 84 PID 4424 wrote to memory of 3692 4424 vjvvv.exe 84 PID 3692 wrote to memory of 2856 3692 hhnnnn.exe 85 PID 3692 wrote to memory of 2856 3692 hhnnnn.exe 85 PID 3692 wrote to memory of 2856 3692 hhnnnn.exe 85 PID 2856 wrote to memory of 5020 2856 djpdv.exe 86 PID 2856 wrote to memory of 5020 2856 djpdv.exe 86 PID 2856 wrote to memory of 5020 2856 djpdv.exe 86 PID 5020 wrote to memory of 1088 5020 lfffrrf.exe 87 PID 5020 wrote to memory of 1088 5020 lfffrrf.exe 87 PID 5020 wrote to memory of 1088 5020 lfffrrf.exe 87 PID 1088 wrote to memory of 2940 1088 xrrlffx.exe 88 PID 1088 wrote to memory of 2940 1088 xrrlffx.exe 88 PID 1088 wrote to memory of 2940 1088 xrrlffx.exe 88 PID 2940 wrote to memory of 2376 2940 5tbnhh.exe 89 PID 2940 wrote to memory of 2376 2940 5tbnhh.exe 89 PID 2940 wrote to memory of 2376 2940 5tbnhh.exe 89 PID 2376 wrote to memory of 116 2376 fxrlfxr.exe 90 PID 2376 wrote to memory of 116 2376 fxrlfxr.exe 90 PID 2376 wrote to memory of 116 2376 fxrlfxr.exe 90 PID 116 wrote to memory of 1720 116 tnnhhh.exe 92 PID 116 wrote to memory of 1720 116 tnnhhh.exe 92 PID 116 wrote to memory of 1720 116 tnnhhh.exe 92 PID 1720 wrote to memory of 2188 1720 vjpjd.exe 93 PID 1720 wrote to memory of 2188 1720 vjpjd.exe 93 PID 1720 wrote to memory of 2188 1720 vjpjd.exe 93 PID 2188 wrote to memory of 4132 2188 tnttnn.exe 94 PID 2188 wrote to memory of 4132 2188 tnttnn.exe 94 PID 2188 wrote to memory of 4132 2188 tnttnn.exe 94 PID 4132 wrote to memory of 3256 4132 vppjd.exe 95 PID 4132 wrote to memory of 3256 4132 vppjd.exe 95 PID 4132 wrote to memory of 3256 4132 vppjd.exe 95 PID 3256 wrote to memory of 920 3256 nhtttb.exe 96 PID 3256 wrote to memory of 920 3256 nhtttb.exe 96 PID 3256 wrote to memory of 920 3256 nhtttb.exe 96 PID 920 wrote to memory of 976 920 rrfrxlr.exe 97 PID 920 wrote to memory of 976 920 rrfrxlr.exe 97 PID 920 wrote to memory of 976 920 rrfrxlr.exe 97 PID 976 wrote to memory of 4600 976 bhntnn.exe 99 PID 976 wrote to memory of 4600 976 bhntnn.exe 99 PID 976 wrote to memory of 4600 976 bhntnn.exe 99 PID 4600 wrote to memory of 3540 4600 dvpjv.exe 100 PID 4600 wrote to memory of 3540 4600 dvpjv.exe 100 PID 4600 wrote to memory of 3540 4600 dvpjv.exe 100 PID 3540 wrote to memory of 1364 3540 bthhtt.exe 101 PID 3540 wrote to memory of 1364 3540 bthhtt.exe 101 PID 3540 wrote to memory of 1364 3540 bthhtt.exe 101 PID 1364 wrote to memory of 2116 1364 1ntnhh.exe 102 PID 1364 wrote to memory of 2116 1364 1ntnhh.exe 102 PID 1364 wrote to memory of 2116 1364 1ntnhh.exe 102 PID 2116 wrote to memory of 2832 2116 lfrrrlr.exe 103 PID 2116 wrote to memory of 2832 2116 lfrrrlr.exe 103 PID 2116 wrote to memory of 2832 2116 lfrrrlr.exe 103 PID 2832 wrote to memory of 1348 2832 hbtnnh.exe 104 PID 2832 wrote to memory of 1348 2832 hbtnnh.exe 104 PID 2832 wrote to memory of 1348 2832 hbtnnh.exe 104 PID 1348 wrote to memory of 1756 1348 ffffxxr.exe 105 PID 1348 wrote to memory of 1756 1348 ffffxxr.exe 105 PID 1348 wrote to memory of 1756 1348 ffffxxr.exe 105 PID 1756 wrote to memory of 2392 1756 vjvjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe"C:\Users\Admin\AppData\Local\Temp\3fb075a131556c630300dbbe12b9352fba3640759d37f9ced4b7738aeea18521.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vjvvv.exec:\vjvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\hhnnnn.exec:\hhnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\djpdv.exec:\djpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lfffrrf.exec:\lfffrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\xrrlffx.exec:\xrrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\5tbnhh.exec:\5tbnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\tnnhhh.exec:\tnnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\vjpjd.exec:\vjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\tnttnn.exec:\tnttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\vppjd.exec:\vppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\nhtttb.exec:\nhtttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\rrfrxlr.exec:\rrfrxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\bhntnn.exec:\bhntnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\dvpjv.exec:\dvpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\bthhtt.exec:\bthhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\1ntnhh.exec:\1ntnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\lfrrrlr.exec:\lfrrrlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hbtnnh.exec:\hbtnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ffffxxr.exec:\ffffxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\vjvjd.exec:\vjvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hnnbnh.exec:\hnnbnh.exe24⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vdvpd.exec:\vdvpd.exe25⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lfrrrrl.exec:\lfrrrrl.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nnnhhb.exec:\nnnhhb.exe27⤵
- Executes dropped EXE
PID:3960 -
\??\c:\tttnth.exec:\tttnth.exe28⤵
- Executes dropped EXE
PID:3652 -
\??\c:\vddvj.exec:\vddvj.exe29⤵
- Executes dropped EXE
PID:3904 -
\??\c:\hbntnn.exec:\hbntnn.exe30⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7vjdj.exec:\7vjdj.exe31⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hbbttn.exec:\hbbttn.exe32⤵
- Executes dropped EXE
PID:3512 -
\??\c:\vjjjj.exec:\vjjjj.exe33⤵
- Executes dropped EXE
PID:676 -
\??\c:\pjjjd.exec:\pjjjd.exe34⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xffxrll.exec:\xffxrll.exe35⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5nttnh.exec:\5nttnh.exe36⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7pjdd.exec:\7pjdd.exe37⤵
- Executes dropped EXE
PID:4540 -
\??\c:\lffxrlf.exec:\lffxrlf.exe38⤵
- Executes dropped EXE
PID:4472 -
\??\c:\frlflfx.exec:\frlflfx.exe39⤵
- Executes dropped EXE
PID:3328 -
\??\c:\hbbtnh.exec:\hbbtnh.exe40⤵
- Executes dropped EXE
PID:3436 -
\??\c:\dppvj.exec:\dppvj.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe42⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rxxxrxr.exec:\rxxxrxr.exe43⤵
- Executes dropped EXE
PID:4752 -
\??\c:\hththb.exec:\hththb.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jpppj.exec:\jpppj.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lxlflfl.exec:\lxlflfl.exe46⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lflrlfl.exec:\lflrlfl.exe47⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tthbbb.exec:\tthbbb.exe48⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ppdvj.exec:\ppdvj.exe49⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1dvpj.exec:\1dvpj.exe50⤵
- Executes dropped EXE
PID:208 -
\??\c:\3lrlrrx.exec:\3lrlrrx.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7bnhtn.exec:\7bnhtn.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5jvjp.exec:\5jvjp.exe53⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jvdvp.exec:\jvdvp.exe54⤵
- Executes dropped EXE
PID:4088 -
\??\c:\lrlfrlx.exec:\lrlfrlx.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3lfxrxx.exec:\3lfxrxx.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hntnnn.exec:\hntnnn.exe57⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jjvjp.exec:\jjvjp.exe58⤵
- Executes dropped EXE
PID:4600 -
\??\c:\rflrlll.exec:\rflrlll.exe59⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfxxxlr.exec:\lfxxxlr.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tnttnn.exec:\tnttnn.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pjjvp.exec:\pjjvp.exe62⤵
- Executes dropped EXE
PID:3224 -
\??\c:\jjpjj.exec:\jjpjj.exe63⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rflrfff.exec:\rflrfff.exe64⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nnbbtb.exec:\nnbbtb.exe65⤵
- Executes dropped EXE
PID:3188 -
\??\c:\tbhbtt.exec:\tbhbtt.exe66⤵PID:668
-
\??\c:\pdpjp.exec:\pdpjp.exe67⤵PID:1028
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe68⤵PID:640
-
\??\c:\nhnhth.exec:\nhnhth.exe69⤵PID:4416
-
\??\c:\7pvjp.exec:\7pvjp.exe70⤵PID:4172
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe71⤵PID:1100
-
\??\c:\thnhbb.exec:\thnhbb.exe72⤵PID:1584
-
\??\c:\nbbbtt.exec:\nbbbtt.exe73⤵PID:3960
-
\??\c:\jvjvp.exec:\jvjvp.exe74⤵PID:544
-
\??\c:\rrxrxll.exec:\rrxrxll.exe75⤵PID:3688
-
\??\c:\xlxxrxr.exec:\xlxxrxr.exe76⤵PID:3480
-
\??\c:\5nnhnn.exec:\5nnhnn.exe77⤵PID:2980
-
\??\c:\vppdv.exec:\vppdv.exe78⤵PID:4968
-
\??\c:\3fxrlrl.exec:\3fxrlrl.exe79⤵PID:3160
-
\??\c:\7ntnhh.exec:\7ntnhh.exe80⤵PID:676
-
\??\c:\ddpjv.exec:\ddpjv.exe81⤵PID:2992
-
\??\c:\7jjvp.exec:\7jjvp.exe82⤵PID:4420
-
\??\c:\lrlfrrx.exec:\lrlfrrx.exe83⤵PID:4340
-
\??\c:\bnnhbt.exec:\bnnhbt.exe84⤵PID:1980
-
\??\c:\5dvpp.exec:\5dvpp.exe85⤵PID:1924
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe86⤵PID:1912
-
\??\c:\tbhbtn.exec:\tbhbtn.exe87⤵PID:2168
-
\??\c:\vpvvv.exec:\vpvvv.exe88⤵PID:740
-
\??\c:\dvjpv.exec:\dvjpv.exe89⤵PID:3408
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe90⤵PID:4676
-
\??\c:\bthnnh.exec:\bthnnh.exe91⤵PID:316
-
\??\c:\dvpvv.exec:\dvpvv.exe92⤵PID:2256
-
\??\c:\5xxrllx.exec:\5xxrllx.exe93⤵PID:4144
-
\??\c:\7fxrffx.exec:\7fxrffx.exe94⤵PID:2324
-
\??\c:\bthbbb.exec:\bthbbb.exe95⤵PID:3020
-
\??\c:\vddvp.exec:\vddvp.exe96⤵PID:1432
-
\??\c:\3fxrllx.exec:\3fxrllx.exe97⤵PID:3508
-
\??\c:\7xxrrrf.exec:\7xxrrrf.exe98⤵PID:324
-
\??\c:\tttnhb.exec:\tttnhb.exe99⤵PID:4336
-
\??\c:\pdpjp.exec:\pdpjp.exe100⤵PID:2572
-
\??\c:\ffxxrxr.exec:\ffxxrxr.exe101⤵PID:1864
-
\??\c:\bnnhnn.exec:\bnnhnn.exe102⤵PID:756
-
\??\c:\vpdpj.exec:\vpdpj.exe103⤵PID:3900
-
\??\c:\lxflfxx.exec:\lxflfxx.exe104⤵PID:4176
-
\??\c:\1bhbbb.exec:\1bhbbb.exe105⤵PID:2812
-
\??\c:\3jjvp.exec:\3jjvp.exe106⤵PID:3624
-
\??\c:\jpjdp.exec:\jpjdp.exe107⤵PID:3928
-
\??\c:\lllrrrf.exec:\lllrrrf.exe108⤵
- System Location Discovery: System Language Discovery
PID:3404 -
\??\c:\tbhhtn.exec:\tbhhtn.exe109⤵PID:4400
-
\??\c:\3pjdv.exec:\3pjdv.exe110⤵PID:4972
-
\??\c:\lrfrllf.exec:\lrfrllf.exe111⤵PID:4092
-
\??\c:\nhbnbt.exec:\nhbnbt.exe112⤵PID:4276
-
\??\c:\dvdvp.exec:\dvdvp.exe113⤵PID:2728
-
\??\c:\fxxrllf.exec:\fxxrllf.exe114⤵PID:4456
-
\??\c:\nnhtnn.exec:\nnhtnn.exe115⤵PID:5004
-
\??\c:\jvdpd.exec:\jvdpd.exe116⤵PID:1756
-
\??\c:\lffxrrl.exec:\lffxrrl.exe117⤵PID:3992
-
\??\c:\3hhbtt.exec:\3hhbtt.exe118⤵PID:2752
-
\??\c:\jpvvd.exec:\jpvvd.exe119⤵PID:640
-
\??\c:\vddpj.exec:\vddpj.exe120⤵PID:4640
-
\??\c:\bttnhb.exec:\bttnhb.exe121⤵PID:4172
-
\??\c:\3nnttt.exec:\3nnttt.exe122⤵PID:4496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-