Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
4df3ccb5f92fb2d201ab637d0d4e7140N.exe
Resource
win7-20240705-en
General
-
Target
4df3ccb5f92fb2d201ab637d0d4e7140N.exe
-
Size
92KB
-
MD5
4df3ccb5f92fb2d201ab637d0d4e7140
-
SHA1
44d94e796268137d88dd8289d5aa6cd5e423993d
-
SHA256
bfc4d47e057420e17486b5ccc269ad4eace48ff0738d2d1978146c51fb05c350
-
SHA512
b28fe28ac4cdb7b81e2063f5733bab128c5411cdb6a513a9426974e8c68ce306dd01aa1f3395b6da459b29057245b494d8b53d493ff133ef615b9d6b613d5374
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBl7F/8e+e:ymb3NkkiQ3mdBjFIi/REUZnKlD+e
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/5084-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2500 ppvvv.exe 4296 nhbbhh.exe 1976 jjdvp.exe 3504 xrrlffx.exe 1448 thnttt.exe 4532 1vdvd.exe 3868 rlfxrrl.exe 5004 btthhh.exe 4560 dvvpp.exe 3632 7dvpp.exe 4992 xrrfflf.exe 736 thbbbh.exe 3036 vpvjj.exe 3432 rrxrrrr.exe 3176 fxrlrrl.exe 3376 btnhbt.exe 4564 9ppjj.exe 2192 jpdvv.exe 4020 rlllfrl.exe 864 nhhhhb.exe 1464 thbbbb.exe 4444 vvvvd.exe 1884 vdvpp.exe 908 3xrrlll.exe 2236 7ttnbb.exe 1380 5djdd.exe 4836 rlxxfxf.exe 4692 bnnbhh.exe 1568 9pjdd.exe 4916 7pvpp.exe 4048 3llfxfr.exe 3780 lfrrxfl.exe 2672 bbtbtt.exe 4792 ppvjd.exe 5024 jdvvp.exe 448 rrlfxxr.exe 4592 9fxfxrr.exe 2384 tnbthh.exe 4500 pvpdv.exe 368 1lrlfll.exe 4540 5rxffll.exe 3940 nbttnn.exe 1172 htttnn.exe 4720 jjvpj.exe 3700 rrxrxxr.exe 1240 fxlflfl.exe 4976 nnnbbb.exe 3168 jvdjp.exe 1928 ddvdv.exe 1744 lflfffl.exe 4144 xrrlfff.exe 5004 nbbtnn.exe 3828 httnbb.exe 1068 dvddj.exe 396 7vvvp.exe 1552 9llrlxr.exe 3544 9flrxxx.exe 3036 nnhhht.exe 3432 tthbhh.exe 4572 dpddp.exe 1112 9dpvp.exe 2208 jppjd.exe 4496 llrrrlr.exe 2792 xxrrrrl.exe -
resource yara_rule behavioral2/memory/5084-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 2500 5084 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 84 PID 5084 wrote to memory of 2500 5084 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 84 PID 5084 wrote to memory of 2500 5084 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 84 PID 2500 wrote to memory of 4296 2500 ppvvv.exe 85 PID 2500 wrote to memory of 4296 2500 ppvvv.exe 85 PID 2500 wrote to memory of 4296 2500 ppvvv.exe 85 PID 4296 wrote to memory of 1976 4296 nhbbhh.exe 86 PID 4296 wrote to memory of 1976 4296 nhbbhh.exe 86 PID 4296 wrote to memory of 1976 4296 nhbbhh.exe 86 PID 1976 wrote to memory of 3504 1976 jjdvp.exe 87 PID 1976 wrote to memory of 3504 1976 jjdvp.exe 87 PID 1976 wrote to memory of 3504 1976 jjdvp.exe 87 PID 3504 wrote to memory of 1448 3504 xrrlffx.exe 88 PID 3504 wrote to memory of 1448 3504 xrrlffx.exe 88 PID 3504 wrote to memory of 1448 3504 xrrlffx.exe 88 PID 1448 wrote to memory of 4532 1448 thnttt.exe 89 PID 1448 wrote to memory of 4532 1448 thnttt.exe 89 PID 1448 wrote to memory of 4532 1448 thnttt.exe 89 PID 4532 wrote to memory of 3868 4532 1vdvd.exe 90 PID 4532 wrote to memory of 3868 4532 1vdvd.exe 90 PID 4532 wrote to memory of 3868 4532 1vdvd.exe 90 PID 3868 wrote to memory of 5004 3868 rlfxrrl.exe 91 PID 3868 wrote to memory of 5004 3868 rlfxrrl.exe 91 PID 3868 wrote to memory of 5004 3868 rlfxrrl.exe 91 PID 5004 wrote to memory of 4560 5004 btthhh.exe 92 PID 5004 wrote to memory of 4560 5004 btthhh.exe 92 PID 5004 wrote to memory of 4560 5004 btthhh.exe 92 PID 4560 wrote to memory of 3632 4560 dvvpp.exe 93 PID 4560 wrote to memory of 3632 4560 dvvpp.exe 93 PID 4560 wrote to memory of 3632 4560 dvvpp.exe 93 PID 3632 wrote to memory of 4992 3632 7dvpp.exe 94 PID 3632 wrote to memory of 4992 3632 7dvpp.exe 94 PID 3632 wrote to memory of 4992 3632 7dvpp.exe 94 PID 4992 wrote to memory of 736 4992 xrrfflf.exe 95 PID 4992 wrote to memory of 736 4992 xrrfflf.exe 95 PID 4992 wrote to memory of 736 4992 xrrfflf.exe 95 PID 736 wrote to memory of 3036 736 thbbbh.exe 96 PID 736 wrote to memory of 3036 736 thbbbh.exe 96 PID 736 wrote to memory of 3036 736 thbbbh.exe 96 PID 3036 wrote to memory of 3432 3036 vpvjj.exe 97 PID 3036 wrote to memory of 3432 3036 vpvjj.exe 97 PID 3036 wrote to memory of 3432 3036 vpvjj.exe 97 PID 3432 wrote to memory of 3176 3432 rrxrrrr.exe 98 PID 3432 wrote to memory of 3176 3432 rrxrrrr.exe 98 PID 3432 wrote to memory of 3176 3432 rrxrrrr.exe 98 PID 3176 wrote to memory of 3376 3176 fxrlrrl.exe 99 PID 3176 wrote to memory of 3376 3176 fxrlrrl.exe 99 PID 3176 wrote to memory of 3376 3176 fxrlrrl.exe 99 PID 3376 wrote to memory of 4564 3376 btnhbt.exe 100 PID 3376 wrote to memory of 4564 3376 btnhbt.exe 100 PID 3376 wrote to memory of 4564 3376 btnhbt.exe 100 PID 4564 wrote to memory of 2192 4564 9ppjj.exe 101 PID 4564 wrote to memory of 2192 4564 9ppjj.exe 101 PID 4564 wrote to memory of 2192 4564 9ppjj.exe 101 PID 2192 wrote to memory of 4020 2192 jpdvv.exe 102 PID 2192 wrote to memory of 4020 2192 jpdvv.exe 102 PID 2192 wrote to memory of 4020 2192 jpdvv.exe 102 PID 4020 wrote to memory of 864 4020 rlllfrl.exe 103 PID 4020 wrote to memory of 864 4020 rlllfrl.exe 103 PID 4020 wrote to memory of 864 4020 rlllfrl.exe 103 PID 864 wrote to memory of 1464 864 nhhhhb.exe 104 PID 864 wrote to memory of 1464 864 nhhhhb.exe 104 PID 864 wrote to memory of 1464 864 nhhhhb.exe 104 PID 1464 wrote to memory of 4444 1464 thbbbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df3ccb5f92fb2d201ab637d0d4e7140N.exe"C:\Users\Admin\AppData\Local\Temp\4df3ccb5f92fb2d201ab637d0d4e7140N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\ppvvv.exec:\ppvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nhbbhh.exec:\nhbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\jjdvp.exec:\jjdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\xrrlffx.exec:\xrrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\thnttt.exec:\thnttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\1vdvd.exec:\1vdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\btthhh.exec:\btthhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\dvvpp.exec:\dvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\7dvpp.exec:\7dvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\xrrfflf.exec:\xrrfflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\thbbbh.exec:\thbbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\vpvjj.exec:\vpvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\fxrlrrl.exec:\fxrlrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\btnhbt.exec:\btnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\9ppjj.exec:\9ppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\jpdvv.exec:\jpdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rlllfrl.exec:\rlllfrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\nhhhhb.exec:\nhhhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\thbbbb.exec:\thbbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\vvvvd.exec:\vvvvd.exe23⤵
- Executes dropped EXE
PID:4444 -
\??\c:\vdvpp.exec:\vdvpp.exe24⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3xrrlll.exec:\3xrrlll.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\7ttnbb.exec:\7ttnbb.exe26⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5djdd.exec:\5djdd.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe28⤵
- Executes dropped EXE
PID:4836 -
\??\c:\bnnbhh.exec:\bnnbhh.exe29⤵
- Executes dropped EXE
PID:4692 -
\??\c:\9pjdd.exec:\9pjdd.exe30⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7pvpp.exec:\7pvpp.exe31⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3llfxfr.exec:\3llfxfr.exe32⤵
- Executes dropped EXE
PID:4048 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe33⤵
- Executes dropped EXE
PID:3780 -
\??\c:\bbtbtt.exec:\bbtbtt.exe34⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppvjd.exec:\ppvjd.exe35⤵
- Executes dropped EXE
PID:4792 -
\??\c:\jdvvp.exec:\jdvvp.exe36⤵
- Executes dropped EXE
PID:5024 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe37⤵
- Executes dropped EXE
PID:448 -
\??\c:\9fxfxrr.exec:\9fxfxrr.exe38⤵
- Executes dropped EXE
PID:4592 -
\??\c:\tnbthh.exec:\tnbthh.exe39⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pvpdv.exec:\pvpdv.exe40⤵
- Executes dropped EXE
PID:4500 -
\??\c:\1lrlfll.exec:\1lrlfll.exe41⤵
- Executes dropped EXE
PID:368 -
\??\c:\5rxffll.exec:\5rxffll.exe42⤵
- Executes dropped EXE
PID:4540 -
\??\c:\nbttnn.exec:\nbttnn.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\htttnn.exec:\htttnn.exe44⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jjvpj.exec:\jjvpj.exe45⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rrxrxxr.exec:\rrxrxxr.exe46⤵
- Executes dropped EXE
PID:3700 -
\??\c:\fxlflfl.exec:\fxlflfl.exe47⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nnnbbb.exec:\nnnbbb.exe48⤵
- Executes dropped EXE
PID:4976 -
\??\c:\jvdjp.exec:\jvdjp.exe49⤵
- Executes dropped EXE
PID:3168 -
\??\c:\ddvdv.exec:\ddvdv.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lflfffl.exec:\lflfffl.exe51⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrrlfff.exec:\xrrlfff.exe52⤵
- Executes dropped EXE
PID:4144 -
\??\c:\nbbtnn.exec:\nbbtnn.exe53⤵
- Executes dropped EXE
PID:5004 -
\??\c:\httnbb.exec:\httnbb.exe54⤵
- Executes dropped EXE
PID:3828 -
\??\c:\dvddj.exec:\dvddj.exe55⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7vvvp.exec:\7vvvp.exe56⤵
- Executes dropped EXE
PID:396 -
\??\c:\9llrlxr.exec:\9llrlxr.exe57⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9flrxxx.exec:\9flrxxx.exe58⤵
- Executes dropped EXE
PID:3544 -
\??\c:\nnhhht.exec:\nnhhht.exe59⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tthbhh.exec:\tthbhh.exe60⤵
- Executes dropped EXE
PID:3432 -
\??\c:\dpddp.exec:\dpddp.exe61⤵
- Executes dropped EXE
PID:4572 -
\??\c:\9dpvp.exec:\9dpvp.exe62⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jppjd.exec:\jppjd.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llrrrlr.exec:\llrrrlr.exe64⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xxrrrrl.exec:\xxrrrrl.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhtnnh.exec:\nhtnnh.exe66⤵PID:2352
-
\??\c:\nnbbhh.exec:\nnbbhh.exe67⤵PID:2176
-
\??\c:\ddpjd.exec:\ddpjd.exe68⤵PID:1508
-
\??\c:\pvdjj.exec:\pvdjj.exe69⤵PID:4904
-
\??\c:\9rlxxrr.exec:\9rlxxrr.exe70⤵PID:1564
-
\??\c:\lrfffff.exec:\lrfffff.exe71⤵PID:2524
-
\??\c:\ttbbnn.exec:\ttbbnn.exe72⤵PID:748
-
\??\c:\tnnhtt.exec:\tnnhtt.exe73⤵PID:3080
-
\??\c:\hhtthh.exec:\hhtthh.exe74⤵PID:968
-
\??\c:\jpvpp.exec:\jpvpp.exe75⤵PID:2024
-
\??\c:\vppjj.exec:\vppjj.exe76⤵PID:4528
-
\??\c:\flfxrxx.exec:\flfxrxx.exe77⤵PID:2428
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe78⤵PID:3436
-
\??\c:\lxxrffl.exec:\lxxrffl.exe79⤵PID:3644
-
\??\c:\tnhbbt.exec:\tnhbbt.exe80⤵PID:1608
-
\??\c:\nbtntt.exec:\nbtntt.exe81⤵PID:3500
-
\??\c:\pvvdd.exec:\pvvdd.exe82⤵PID:1948
-
\??\c:\djppd.exec:\djppd.exe83⤵PID:2672
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe84⤵PID:2108
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe85⤵PID:4276
-
\??\c:\bnhhtt.exec:\bnhhtt.exe86⤵PID:448
-
\??\c:\ntttnb.exec:\ntttnb.exe87⤵PID:2112
-
\??\c:\7pvpj.exec:\7pvpj.exe88⤵PID:3116
-
\??\c:\dvjdv.exec:\dvjdv.exe89⤵PID:4984
-
\??\c:\rfllxxx.exec:\rfllxxx.exe90⤵PID:2500
-
\??\c:\5hhnhn.exec:\5hhnhn.exe91⤵PID:1820
-
\??\c:\nnnhhb.exec:\nnnhhb.exe92⤵PID:1912
-
\??\c:\1pppp.exec:\1pppp.exe93⤵PID:2740
-
\??\c:\7dpdp.exec:\7dpdp.exe94⤵PID:5076
-
\??\c:\lfffrrl.exec:\lfffrrl.exe95⤵PID:4720
-
\??\c:\fxxrlll.exec:\fxxrlll.exe96⤵PID:3700
-
\??\c:\thtnbb.exec:\thtnbb.exe97⤵PID:1240
-
\??\c:\1hhbtt.exec:\1hhbtt.exe98⤵PID:4976
-
\??\c:\jdpjp.exec:\jdpjp.exe99⤵PID:3168
-
\??\c:\rllfffx.exec:\rllfffx.exe100⤵PID:3672
-
\??\c:\nnthbn.exec:\nnthbn.exe101⤵PID:2708
-
\??\c:\hhnhbh.exec:\hhnhbh.exe102⤵PID:4144
-
\??\c:\jpvpd.exec:\jpvpd.exe103⤵PID:2784
-
\??\c:\1jppj.exec:\1jppj.exe104⤵PID:3632
-
\??\c:\7llllrx.exec:\7llllrx.exe105⤵PID:1068
-
\??\c:\ffflrrr.exec:\ffflrrr.exe106⤵PID:564
-
\??\c:\7nhbtb.exec:\7nhbtb.exe107⤵PID:4256
-
\??\c:\vjpjj.exec:\vjpjj.exe108⤵PID:3244
-
\??\c:\vpdjd.exec:\vpdjd.exe109⤵PID:3036
-
\??\c:\flrxlll.exec:\flrxlll.exe110⤵PID:3212
-
\??\c:\ttbtbb.exec:\ttbtbb.exe111⤵PID:1648
-
\??\c:\9bttbb.exec:\9bttbb.exe112⤵PID:2864
-
\??\c:\ddppd.exec:\ddppd.exe113⤵PID:3944
-
\??\c:\1dddd.exec:\1dddd.exe114⤵PID:864
-
\??\c:\ffrrffx.exec:\ffrrffx.exe115⤵
- System Location Discovery: System Language Discovery
PID:1464 -
\??\c:\rfrfxxr.exec:\rfrfxxr.exe116⤵PID:3948
-
\??\c:\bhnhhn.exec:\bhnhhn.exe117⤵PID:4444
-
\??\c:\7ntthb.exec:\7ntthb.exe118⤵PID:1884
-
\??\c:\dvddp.exec:\dvddp.exe119⤵PID:3040
-
\??\c:\1ppjd.exec:\1ppjd.exe120⤵PID:2324
-
\??\c:\lllxlll.exec:\lllxlll.exe121⤵PID:1444
-
\??\c:\xrrfffx.exec:\xrrfffx.exe122⤵PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-