Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe
Resource
win7-20240708-en
General
-
Target
315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe
-
Size
362KB
-
MD5
93c12dd984d9070199e2948d55462239
-
SHA1
24ba1cb59d672a278d9cb485bdad7dea11958d44
-
SHA256
315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d
-
SHA512
768056e4963fa4179ffda1ec6702d4286de71358da76989ce43d928913808cf335c95fcfcbe853ffc863ffdca223e50ff1b0d54c81ebe7f27d18ab0007f6ff81
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq7mj9+04xNZ:n3C9yMo+S0L9xRnoq7mR+04xf
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/576-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 rrffllr.exe 2336 hbthnh.exe 3936 3pvjp.exe 2588 vpvpp.exe 4944 rllxrlf.exe 2412 5hhtnb.exe 620 5pppj.exe 3288 dvvjd.exe 4724 hntnbt.exe 4996 3jdvp.exe 5096 llrlxxx.exe 4064 hthtnt.exe 4608 vvpjd.exe 4416 rxfxrlx.exe 4112 9xrfxrr.exe 576 bnnhbt.exe 1652 nhnbbt.exe 4000 3ddpd.exe 3476 xfrfxlf.exe 2884 lxrlfxl.exe 4320 vjjdv.exe 1724 3xxxxxl.exe 4956 nntnnn.exe 4268 pjvpd.exe 3280 lfxrfxr.exe 560 frrlfxl.exe 1712 ntthtn.exe 1788 pvjjd.exe 1936 frffrlx.exe 856 btbtnh.exe 1832 httnhh.exe 452 xxfxxfx.exe 3204 btbttt.exe 4532 ddjjd.exe 4512 pvjdv.exe 4168 pjvjp.exe 1948 7xfxrrl.exe 4948 fxffffx.exe 3636 bbbthh.exe 776 3djdv.exe 2588 5vpdp.exe 2156 rllxlfx.exe 1424 7ffxllx.exe 1116 tnnbtn.exe 2084 1tbthh.exe 2916 9djjd.exe 4300 1dvpd.exe 3288 7rrlllf.exe 4520 hhbtnh.exe 2912 hhhbnn.exe 5020 5djpj.exe 248 dvvjd.exe 1644 fxlfllf.exe 1520 frflxrl.exe 116 tttnhh.exe 3800 hbtnhb.exe 472 7pvdj.exe 2956 lxlffrl.exe 1384 bnntnn.exe 4812 vdjjj.exe 3440 7dpdv.exe 1148 ffrlffx.exe 388 tntttt.exe 2884 jvdpp.exe -
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/576-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-106-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 2232 4252 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 83 PID 4252 wrote to memory of 2232 4252 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 83 PID 4252 wrote to memory of 2232 4252 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 83 PID 2232 wrote to memory of 2336 2232 rrffllr.exe 84 PID 2232 wrote to memory of 2336 2232 rrffllr.exe 84 PID 2232 wrote to memory of 2336 2232 rrffllr.exe 84 PID 2336 wrote to memory of 3936 2336 hbthnh.exe 85 PID 2336 wrote to memory of 3936 2336 hbthnh.exe 85 PID 2336 wrote to memory of 3936 2336 hbthnh.exe 85 PID 3936 wrote to memory of 2588 3936 3pvjp.exe 126 PID 3936 wrote to memory of 2588 3936 3pvjp.exe 126 PID 3936 wrote to memory of 2588 3936 3pvjp.exe 126 PID 2588 wrote to memory of 4944 2588 vpvpp.exe 87 PID 2588 wrote to memory of 4944 2588 vpvpp.exe 87 PID 2588 wrote to memory of 4944 2588 vpvpp.exe 87 PID 4944 wrote to memory of 2412 4944 rllxrlf.exe 88 PID 4944 wrote to memory of 2412 4944 rllxrlf.exe 88 PID 4944 wrote to memory of 2412 4944 rllxrlf.exe 88 PID 2412 wrote to memory of 620 2412 5hhtnb.exe 90 PID 2412 wrote to memory of 620 2412 5hhtnb.exe 90 PID 2412 wrote to memory of 620 2412 5hhtnb.exe 90 PID 620 wrote to memory of 3288 620 5pppj.exe 133 PID 620 wrote to memory of 3288 620 5pppj.exe 133 PID 620 wrote to memory of 3288 620 5pppj.exe 133 PID 3288 wrote to memory of 4724 3288 dvvjd.exe 93 PID 3288 wrote to memory of 4724 3288 dvvjd.exe 93 PID 3288 wrote to memory of 4724 3288 dvvjd.exe 93 PID 4724 wrote to memory of 4996 4724 hntnbt.exe 94 PID 4724 wrote to memory of 4996 4724 hntnbt.exe 94 PID 4724 wrote to memory of 4996 4724 hntnbt.exe 94 PID 4996 wrote to memory of 5096 4996 3jdvp.exe 96 PID 4996 wrote to memory of 5096 4996 3jdvp.exe 96 PID 4996 wrote to memory of 5096 4996 3jdvp.exe 96 PID 5096 wrote to memory of 4064 5096 llrlxxx.exe 97 PID 5096 wrote to memory of 4064 5096 llrlxxx.exe 97 PID 5096 wrote to memory of 4064 5096 llrlxxx.exe 97 PID 4064 wrote to memory of 4608 4064 hthtnt.exe 98 PID 4064 wrote to memory of 4608 4064 hthtnt.exe 98 PID 4064 wrote to memory of 4608 4064 hthtnt.exe 98 PID 4608 wrote to memory of 4416 4608 vvpjd.exe 99 PID 4608 wrote to memory of 4416 4608 vvpjd.exe 99 PID 4608 wrote to memory of 4416 4608 vvpjd.exe 99 PID 4416 wrote to memory of 4112 4416 rxfxrlx.exe 100 PID 4416 wrote to memory of 4112 4416 rxfxrlx.exe 100 PID 4416 wrote to memory of 4112 4416 rxfxrlx.exe 100 PID 4112 wrote to memory of 576 4112 9xrfxrr.exe 101 PID 4112 wrote to memory of 576 4112 9xrfxrr.exe 101 PID 4112 wrote to memory of 576 4112 9xrfxrr.exe 101 PID 576 wrote to memory of 1652 576 bnnhbt.exe 102 PID 576 wrote to memory of 1652 576 bnnhbt.exe 102 PID 576 wrote to memory of 1652 576 bnnhbt.exe 102 PID 1652 wrote to memory of 4000 1652 nhnbbt.exe 103 PID 1652 wrote to memory of 4000 1652 nhnbbt.exe 103 PID 1652 wrote to memory of 4000 1652 nhnbbt.exe 103 PID 4000 wrote to memory of 3476 4000 3ddpd.exe 104 PID 4000 wrote to memory of 3476 4000 3ddpd.exe 104 PID 4000 wrote to memory of 3476 4000 3ddpd.exe 104 PID 3476 wrote to memory of 2884 3476 xfrfxlf.exe 149 PID 3476 wrote to memory of 2884 3476 xfrfxlf.exe 149 PID 3476 wrote to memory of 2884 3476 xfrfxlf.exe 149 PID 2884 wrote to memory of 4320 2884 lxrlfxl.exe 106 PID 2884 wrote to memory of 4320 2884 lxrlfxl.exe 106 PID 2884 wrote to memory of 4320 2884 lxrlfxl.exe 106 PID 4320 wrote to memory of 1724 4320 vjjdv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe"C:\Users\Admin\AppData\Local\Temp\315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\rrffllr.exec:\rrffllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hbthnh.exec:\hbthnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\3pvjp.exec:\3pvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vpvpp.exec:\vpvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\rllxrlf.exec:\rllxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\5hhtnb.exec:\5hhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\5pppj.exec:\5pppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\dvvjd.exec:\dvvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\hntnbt.exec:\hntnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\3jdvp.exec:\3jdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\llrlxxx.exec:\llrlxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\hthtnt.exec:\hthtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\vvpjd.exec:\vvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\rxfxrlx.exec:\rxfxrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\9xrfxrr.exec:\9xrfxrr.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\bnnhbt.exec:\bnnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\nhnbbt.exec:\nhnbbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\3ddpd.exec:\3ddpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vjjdv.exec:\vjjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\3xxxxxl.exec:\3xxxxxl.exe23⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nntnnn.exec:\nntnnn.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pjvpd.exec:\pjvpd.exe25⤵
- Executes dropped EXE
PID:4268 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe26⤵
- Executes dropped EXE
PID:3280 -
\??\c:\frrlfxl.exec:\frrlfxl.exe27⤵
- Executes dropped EXE
PID:560 -
\??\c:\ntthtn.exec:\ntthtn.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pvjjd.exec:\pvjjd.exe29⤵
- Executes dropped EXE
PID:1788 -
\??\c:\frffrlx.exec:\frffrlx.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\btbtnh.exec:\btbtnh.exe31⤵
- Executes dropped EXE
PID:856 -
\??\c:\httnhh.exec:\httnhh.exe32⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe33⤵
- Executes dropped EXE
PID:452 -
\??\c:\btbttt.exec:\btbttt.exe34⤵
- Executes dropped EXE
PID:3204 -
\??\c:\ddjjd.exec:\ddjjd.exe35⤵
- Executes dropped EXE
PID:4532 -
\??\c:\pvjdv.exec:\pvjdv.exe36⤵
- Executes dropped EXE
PID:4512 -
\??\c:\pjvjp.exec:\pjvjp.exe37⤵
- Executes dropped EXE
PID:4168 -
\??\c:\7xfxrrl.exec:\7xfxrrl.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fxffffx.exec:\fxffffx.exe39⤵
- Executes dropped EXE
PID:4948 -
\??\c:\bbbthh.exec:\bbbthh.exe40⤵
- Executes dropped EXE
PID:3636 -
\??\c:\3djdv.exec:\3djdv.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:776 -
\??\c:\5vpdp.exec:\5vpdp.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rllxlfx.exec:\rllxlfx.exe43⤵
- Executes dropped EXE
PID:2156 -
\??\c:\7ffxllx.exec:\7ffxllx.exe44⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tnnbtn.exec:\tnnbtn.exe45⤵
- Executes dropped EXE
PID:1116 -
\??\c:\1tbthh.exec:\1tbthh.exe46⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9djjd.exec:\9djjd.exe47⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1dvpd.exec:\1dvpd.exe48⤵
- Executes dropped EXE
PID:4300 -
\??\c:\7rrlllf.exec:\7rrlllf.exe49⤵
- Executes dropped EXE
PID:3288 -
\??\c:\hhbtnh.exec:\hhbtnh.exe50⤵
- Executes dropped EXE
PID:4520 -
\??\c:\hhhbnn.exec:\hhhbnn.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5djpj.exec:\5djpj.exe52⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dvvjd.exec:\dvvjd.exe53⤵
- Executes dropped EXE
PID:248 -
\??\c:\fxlfllf.exec:\fxlfllf.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\frflxrl.exec:\frflxrl.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\tttnhh.exec:\tttnhh.exe56⤵
- Executes dropped EXE
PID:116 -
\??\c:\hbtnhb.exec:\hbtnhb.exe57⤵
- Executes dropped EXE
PID:3800 -
\??\c:\7pvdj.exec:\7pvdj.exe58⤵
- Executes dropped EXE
PID:472 -
\??\c:\lxlffrl.exec:\lxlffrl.exe59⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bnntnn.exec:\bnntnn.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vdjjj.exec:\vdjjj.exe61⤵
- Executes dropped EXE
PID:4812 -
\??\c:\7dpdv.exec:\7dpdv.exe62⤵
- Executes dropped EXE
PID:3440 -
\??\c:\ffrlffx.exec:\ffrlffx.exe63⤵
- Executes dropped EXE
PID:1148 -
\??\c:\tntttt.exec:\tntttt.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\jvdpp.exec:\jvdpp.exe65⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pdpjp.exec:\pdpjp.exe66⤵PID:1296
-
\??\c:\9rxrllf.exec:\9rxrllf.exe67⤵PID:2148
-
\??\c:\nhbttt.exec:\nhbttt.exe68⤵PID:2796
-
\??\c:\bbhhbb.exec:\bbhhbb.exe69⤵PID:4472
-
\??\c:\pdjdd.exec:\pdjdd.exe70⤵PID:3280
-
\??\c:\rlxrllr.exec:\rlxrllr.exe71⤵PID:4164
-
\??\c:\tnbtbt.exec:\tnbtbt.exe72⤵PID:3692
-
\??\c:\jvvjv.exec:\jvvjv.exe73⤵PID:4572
-
\??\c:\lffxxrr.exec:\lffxxrr.exe74⤵PID:3520
-
\??\c:\rxlfxff.exec:\rxlfxff.exe75⤵PID:3428
-
\??\c:\httntb.exec:\httntb.exe76⤵PID:3932
-
\??\c:\ppdvj.exec:\ppdvj.exe77⤵PID:1020
-
\??\c:\jdjvp.exec:\jdjvp.exe78⤵PID:1900
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe79⤵PID:4092
-
\??\c:\bbhbbb.exec:\bbhbbb.exe80⤵PID:5040
-
\??\c:\hhbthh.exec:\hhbthh.exe81⤵PID:3204
-
\??\c:\pdddd.exec:\pdddd.exe82⤵PID:336
-
\??\c:\1rrfxxr.exec:\1rrfxxr.exe83⤵PID:4264
-
\??\c:\flxrllf.exec:\flxrllf.exe84⤵PID:1524
-
\??\c:\1nbbbb.exec:\1nbbbb.exe85⤵PID:1512
-
\??\c:\3vdvp.exec:\3vdvp.exe86⤵PID:652
-
\??\c:\vvppp.exec:\vvppp.exe87⤵PID:364
-
\??\c:\xlrlllf.exec:\xlrlllf.exe88⤵PID:2096
-
\??\c:\nbnnhh.exec:\nbnnhh.exe89⤵
- System Location Discovery: System Language Discovery
PID:3348 -
\??\c:\thnhhh.exec:\thnhhh.exe90⤵PID:4804
-
\??\c:\dvppj.exec:\dvppj.exe91⤵PID:1328
-
\??\c:\xfrlffx.exec:\xfrlffx.exe92⤵PID:2480
-
\??\c:\btbbtt.exec:\btbbtt.exe93⤵PID:32
-
\??\c:\pddvp.exec:\pddvp.exe94⤵PID:2936
-
\??\c:\jdddv.exec:\jdddv.exe95⤵PID:5032
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe96⤵PID:4620
-
\??\c:\btnhbh.exec:\btnhbh.exe97⤵PID:3432
-
\??\c:\jdvpd.exec:\jdvpd.exe98⤵PID:3224
-
\??\c:\7vdjv.exec:\7vdjv.exe99⤵PID:3136
-
\??\c:\frlrlxr.exec:\frlrlxr.exe100⤵PID:2792
-
\??\c:\bhnnnt.exec:\bhnnnt.exe101⤵PID:4976
-
\??\c:\vppjj.exec:\vppjj.exe102⤵PID:5096
-
\??\c:\7rxxffr.exec:\7rxxffr.exe103⤵PID:872
-
\??\c:\xrxxffr.exec:\xrxxffr.exe104⤵PID:3988
-
\??\c:\hntnhh.exec:\hntnhh.exe105⤵PID:860
-
\??\c:\vppjv.exec:\vppjv.exe106⤵PID:4700
-
\??\c:\7xrfrrf.exec:\7xrfrrf.exe107⤵PID:4652
-
\??\c:\thbbnh.exec:\thbbnh.exe108⤵PID:4624
-
\??\c:\jjpjj.exec:\jjpjj.exe109⤵PID:2312
-
\??\c:\xffxlfr.exec:\xffxlfr.exe110⤵PID:1544
-
\??\c:\1hnnnn.exec:\1hnnnn.exe111⤵PID:3728
-
\??\c:\bntnbh.exec:\bntnbh.exe112⤵PID:1716
-
\??\c:\9dvvj.exec:\9dvvj.exe113⤵PID:3328
-
\??\c:\rflfllf.exec:\rflfllf.exe114⤵PID:3568
-
\??\c:\9bttnn.exec:\9bttnn.exe115⤵PID:1124
-
\??\c:\nhhbnn.exec:\nhhbnn.exe116⤵PID:2644
-
\??\c:\vdjdv.exec:\vdjdv.exe117⤵PID:2796
-
\??\c:\lxlfxxl.exec:\lxlfxxl.exe118⤵PID:3096
-
\??\c:\7nnbtt.exec:\7nnbtt.exe119⤵PID:3504
-
\??\c:\1bbthh.exec:\1bbthh.exe120⤵PID:1804
-
\??\c:\jjvpd.exec:\jjvpd.exe121⤵PID:764
-
\??\c:\xflfxxr.exec:\xflfxxr.exe122⤵PID:1936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-