Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 07:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8909118b94826c1f1950bc522142bca0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
8909118b94826c1f1950bc522142bca0N.exe
-
Size
72KB
-
MD5
8909118b94826c1f1950bc522142bca0
-
SHA1
8debb3db493793d567055da751c77922c32cbc6b
-
SHA256
3337be7ed44a48a7c6391bfdb96e50258a5ef6d262cf179b7b63013b0b9cbc8b
-
SHA512
c943e0b1b1fe2d9b24dd3cd9e811d649d96203538c355db13bcc81018f816d49cfddddb358881b880d901848644ba23babb28ae31ea6c3accce9fa81979eb050
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJUn:ymb3NkkiQ3mdBjFI3eF4
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1624-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 hthbtt.exe 2612 vjpdp.exe 2248 fxrlfxr.exe 3316 xlxrrxr.exe 3672 btbbtt.exe 1320 pdvdd.exe 944 lfxxrrr.exe 1396 lfflfff.exe 2408 htnbtb.exe 4192 dvpdp.exe 3680 xrffxfl.exe 3232 hbtnhh.exe 3708 dppdv.exe 4732 dvjjv.exe 4932 rlxrrxf.exe 4668 xlxxxxf.exe 4852 btbbhh.exe 2700 jdvpd.exe 2556 vppjd.exe 2292 lflrlxl.exe 864 hbhbhh.exe 1592 hbnhtb.exe 4744 jvpjd.exe 3296 xllxlff.exe 3756 rllffff.exe 3168 nnbtht.exe 3504 thbnhb.exe 1636 9ddvj.exe 4976 djvpd.exe 5068 lfxrrlf.exe 3812 tnnbtt.exe 3548 dddvj.exe 4532 dvvjv.exe 1376 lxrlfrr.exe 5064 lrxrlfl.exe 1488 rfxrrlr.exe 5092 hnhbnt.exe 1624 nbnbhb.exe 2680 vppvv.exe 3208 xrlxlff.exe 2612 rlxrfxl.exe 3692 1htnbn.exe 4908 hhnhtt.exe 724 jdddp.exe 4656 pvvpj.exe 3056 xxrlxrl.exe 4792 rrlfxxl.exe 1812 tnnbtt.exe 4984 9nbtbb.exe 1396 jppdp.exe 2168 jpjdp.exe 1860 pvpvd.exe 4048 lxxrflf.exe 4040 llflffr.exe 116 hhhbnb.exe 3972 nththt.exe 2384 jdjdv.exe 3416 jdvvj.exe 1788 lffxrlf.exe 4324 frxrrff.exe 4668 nbbnbt.exe 4556 hbbtbt.exe 3224 pvjdv.exe 4476 ddvpd.exe -
resource yara_rule behavioral2/memory/1624-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2520 1624 8909118b94826c1f1950bc522142bca0N.exe 86 PID 1624 wrote to memory of 2520 1624 8909118b94826c1f1950bc522142bca0N.exe 86 PID 1624 wrote to memory of 2520 1624 8909118b94826c1f1950bc522142bca0N.exe 86 PID 2520 wrote to memory of 2612 2520 hthbtt.exe 87 PID 2520 wrote to memory of 2612 2520 hthbtt.exe 87 PID 2520 wrote to memory of 2612 2520 hthbtt.exe 87 PID 2612 wrote to memory of 2248 2612 vjpdp.exe 88 PID 2612 wrote to memory of 2248 2612 vjpdp.exe 88 PID 2612 wrote to memory of 2248 2612 vjpdp.exe 88 PID 2248 wrote to memory of 3316 2248 fxrlfxr.exe 89 PID 2248 wrote to memory of 3316 2248 fxrlfxr.exe 89 PID 2248 wrote to memory of 3316 2248 fxrlfxr.exe 89 PID 3316 wrote to memory of 3672 3316 xlxrrxr.exe 90 PID 3316 wrote to memory of 3672 3316 xlxrrxr.exe 90 PID 3316 wrote to memory of 3672 3316 xlxrrxr.exe 90 PID 3672 wrote to memory of 1320 3672 btbbtt.exe 91 PID 3672 wrote to memory of 1320 3672 btbbtt.exe 91 PID 3672 wrote to memory of 1320 3672 btbbtt.exe 91 PID 1320 wrote to memory of 944 1320 pdvdd.exe 92 PID 1320 wrote to memory of 944 1320 pdvdd.exe 92 PID 1320 wrote to memory of 944 1320 pdvdd.exe 92 PID 944 wrote to memory of 1396 944 lfxxrrr.exe 93 PID 944 wrote to memory of 1396 944 lfxxrrr.exe 93 PID 944 wrote to memory of 1396 944 lfxxrrr.exe 93 PID 1396 wrote to memory of 2408 1396 lfflfff.exe 94 PID 1396 wrote to memory of 2408 1396 lfflfff.exe 94 PID 1396 wrote to memory of 2408 1396 lfflfff.exe 94 PID 2408 wrote to memory of 4192 2408 htnbtb.exe 95 PID 2408 wrote to memory of 4192 2408 htnbtb.exe 95 PID 2408 wrote to memory of 4192 2408 htnbtb.exe 95 PID 4192 wrote to memory of 3680 4192 dvpdp.exe 96 PID 4192 wrote to memory of 3680 4192 dvpdp.exe 96 PID 4192 wrote to memory of 3680 4192 dvpdp.exe 96 PID 3680 wrote to memory of 3232 3680 xrffxfl.exe 97 PID 3680 wrote to memory of 3232 3680 xrffxfl.exe 97 PID 3680 wrote to memory of 3232 3680 xrffxfl.exe 97 PID 3232 wrote to memory of 3708 3232 hbtnhh.exe 98 PID 3232 wrote to memory of 3708 3232 hbtnhh.exe 98 PID 3232 wrote to memory of 3708 3232 hbtnhh.exe 98 PID 3708 wrote to memory of 4732 3708 dppdv.exe 99 PID 3708 wrote to memory of 4732 3708 dppdv.exe 99 PID 3708 wrote to memory of 4732 3708 dppdv.exe 99 PID 4732 wrote to memory of 4932 4732 dvjjv.exe 100 PID 4732 wrote to memory of 4932 4732 dvjjv.exe 100 PID 4732 wrote to memory of 4932 4732 dvjjv.exe 100 PID 4932 wrote to memory of 4668 4932 rlxrrxf.exe 101 PID 4932 wrote to memory of 4668 4932 rlxrrxf.exe 101 PID 4932 wrote to memory of 4668 4932 rlxrrxf.exe 101 PID 4668 wrote to memory of 4852 4668 xlxxxxf.exe 102 PID 4668 wrote to memory of 4852 4668 xlxxxxf.exe 102 PID 4668 wrote to memory of 4852 4668 xlxxxxf.exe 102 PID 4852 wrote to memory of 2700 4852 btbbhh.exe 103 PID 4852 wrote to memory of 2700 4852 btbbhh.exe 103 PID 4852 wrote to memory of 2700 4852 btbbhh.exe 103 PID 2700 wrote to memory of 2556 2700 jdvpd.exe 104 PID 2700 wrote to memory of 2556 2700 jdvpd.exe 104 PID 2700 wrote to memory of 2556 2700 jdvpd.exe 104 PID 2556 wrote to memory of 2292 2556 vppjd.exe 105 PID 2556 wrote to memory of 2292 2556 vppjd.exe 105 PID 2556 wrote to memory of 2292 2556 vppjd.exe 105 PID 2292 wrote to memory of 864 2292 lflrlxl.exe 106 PID 2292 wrote to memory of 864 2292 lflrlxl.exe 106 PID 2292 wrote to memory of 864 2292 lflrlxl.exe 106 PID 864 wrote to memory of 1592 864 hbhbhh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8909118b94826c1f1950bc522142bca0N.exe"C:\Users\Admin\AppData\Local\Temp\8909118b94826c1f1950bc522142bca0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\hthbtt.exec:\hthbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjpdp.exec:\vjpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\xlxrrxr.exec:\xlxrrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\btbbtt.exec:\btbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\pdvdd.exec:\pdvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\lfflfff.exec:\lfflfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\htnbtb.exec:\htnbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\dvpdp.exec:\dvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\xrffxfl.exec:\xrffxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\hbtnhh.exec:\hbtnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\dppdv.exec:\dppdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\dvjjv.exec:\dvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\rlxrrxf.exec:\rlxrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\btbbhh.exec:\btbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\jdvpd.exec:\jdvpd.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vppjd.exec:\vppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\lflrlxl.exec:\lflrlxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\hbhbhh.exec:\hbhbhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\hbnhtb.exec:\hbnhtb.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jvpjd.exec:\jvpjd.exe24⤵
- Executes dropped EXE
PID:4744 -
\??\c:\xllxlff.exec:\xllxlff.exe25⤵
- Executes dropped EXE
PID:3296 -
\??\c:\rllffff.exec:\rllffff.exe26⤵
- Executes dropped EXE
PID:3756 -
\??\c:\nnbtht.exec:\nnbtht.exe27⤵
- Executes dropped EXE
PID:3168 -
\??\c:\thbnhb.exec:\thbnhb.exe28⤵
- Executes dropped EXE
PID:3504 -
\??\c:\9ddvj.exec:\9ddvj.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\djvpd.exec:\djvpd.exe30⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe31⤵
- Executes dropped EXE
PID:5068 -
\??\c:\tnnbtt.exec:\tnnbtt.exe32⤵
- Executes dropped EXE
PID:3812 -
\??\c:\dddvj.exec:\dddvj.exe33⤵
- Executes dropped EXE
PID:3548 -
\??\c:\dvvjv.exec:\dvvjv.exe34⤵
- Executes dropped EXE
PID:4532 -
\??\c:\lxrlfrr.exec:\lxrlfrr.exe35⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lrxrlfl.exec:\lrxrlfl.exe36⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rfxrrlr.exec:\rfxrrlr.exe37⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hnhbnt.exec:\hnhbnt.exe38⤵
- Executes dropped EXE
PID:5092 -
\??\c:\nbnbhb.exec:\nbnbhb.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vppvv.exec:\vppvv.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrlxlff.exec:\xrlxlff.exe41⤵
- Executes dropped EXE
PID:3208 -
\??\c:\rlxrfxl.exec:\rlxrfxl.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1htnbn.exec:\1htnbn.exe43⤵
- Executes dropped EXE
PID:3692 -
\??\c:\hhnhtt.exec:\hhnhtt.exe44⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jdddp.exec:\jdddp.exe45⤵
- Executes dropped EXE
PID:724 -
\??\c:\pvvpj.exec:\pvvpj.exe46⤵
- Executes dropped EXE
PID:4656 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe47⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rrlfxxl.exec:\rrlfxxl.exe48⤵
- Executes dropped EXE
PID:4792 -
\??\c:\tnnbtt.exec:\tnnbtt.exe49⤵
- Executes dropped EXE
PID:1812 -
\??\c:\9nbtbb.exec:\9nbtbb.exe50⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jppdp.exec:\jppdp.exe51⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jpjdp.exec:\jpjdp.exe52⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pvpvd.exec:\pvpvd.exe53⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxxrflf.exec:\lxxrflf.exe54⤵
- Executes dropped EXE
PID:4048 -
\??\c:\llflffr.exec:\llflffr.exe55⤵
- Executes dropped EXE
PID:4040 -
\??\c:\hhhbnb.exec:\hhhbnb.exe56⤵
- Executes dropped EXE
PID:116 -
\??\c:\nththt.exec:\nththt.exe57⤵
- Executes dropped EXE
PID:3972 -
\??\c:\jdjdv.exec:\jdjdv.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jdvvj.exec:\jdvvj.exe59⤵
- Executes dropped EXE
PID:3416 -
\??\c:\lffxrlf.exec:\lffxrlf.exe60⤵
- Executes dropped EXE
PID:1788 -
\??\c:\frxrrff.exec:\frxrrff.exe61⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nbbnbt.exec:\nbbnbt.exe62⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hbbtbt.exec:\hbbtbt.exe63⤵
- Executes dropped EXE
PID:4556 -
\??\c:\pvjdv.exec:\pvjdv.exe64⤵
- Executes dropped EXE
PID:3224 -
\??\c:\ddvpd.exec:\ddvpd.exe65⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rflflfr.exec:\rflflfr.exe66⤵PID:2020
-
\??\c:\lllfxxl.exec:\lllfxxl.exe67⤵PID:2164
-
\??\c:\btntnb.exec:\btntnb.exe68⤵PID:4300
-
\??\c:\ppvjd.exec:\ppvjd.exe69⤵PID:1920
-
\??\c:\pjvpp.exec:\pjvpp.exe70⤵PID:3816
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe71⤵PID:3268
-
\??\c:\tttthh.exec:\tttthh.exe72⤵PID:4296
-
\??\c:\hbtnhb.exec:\hbtnhb.exe73⤵PID:4168
-
\??\c:\9jdvv.exec:\9jdvv.exe74⤵PID:4428
-
\??\c:\pjppv.exec:\pjppv.exe75⤵PID:2948
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe76⤵PID:1012
-
\??\c:\lxxfrlr.exec:\lxxfrlr.exe77⤵PID:680
-
\??\c:\nbbbbb.exec:\nbbbbb.exe78⤵PID:1636
-
\??\c:\tbbbtt.exec:\tbbbtt.exe79⤵PID:3664
-
\??\c:\9vdpd.exec:\9vdpd.exe80⤵PID:2232
-
\??\c:\jppjv.exec:\jppjv.exe81⤵PID:3124
-
\??\c:\rlxlfrl.exec:\rlxlfrl.exe82⤵PID:688
-
\??\c:\lffxrrl.exec:\lffxrrl.exe83⤵PID:4044
-
\??\c:\nbnbtn.exec:\nbnbtn.exe84⤵PID:1924
-
\??\c:\nbtnnb.exec:\nbtnnb.exe85⤵PID:2280
-
\??\c:\xfffrll.exec:\xfffrll.exe86⤵PID:2916
-
\??\c:\lxrlxrx.exec:\lxrlxrx.exe87⤵PID:4352
-
\??\c:\nbtnbt.exec:\nbtnbt.exe88⤵PID:3836
-
\??\c:\hnbnht.exec:\hnbnht.exe89⤵PID:4032
-
\??\c:\jdpjv.exec:\jdpjv.exe90⤵PID:4176
-
\??\c:\jddvj.exec:\jddvj.exe91⤵PID:2944
-
\??\c:\9lflfxr.exec:\9lflfxr.exe92⤵PID:4200
-
\??\c:\ffxlflx.exec:\ffxlflx.exe93⤵PID:1912
-
\??\c:\htnbtn.exec:\htnbtn.exe94⤵PID:1040
-
\??\c:\bbhhbt.exec:\bbhhbt.exe95⤵PID:2080
-
\??\c:\pddpd.exec:\pddpd.exe96⤵PID:4656
-
\??\c:\vjdpd.exec:\vjdpd.exe97⤵PID:3056
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe98⤵PID:4792
-
\??\c:\frxxrrr.exec:\frxxrrr.exe99⤵PID:2304
-
\??\c:\htbttn.exec:\htbttn.exe100⤵PID:4984
-
\??\c:\ntthbh.exec:\ntthbh.exe101⤵PID:4972
-
\??\c:\dpjvp.exec:\dpjvp.exe102⤵PID:2072
-
\??\c:\7xfxxrx.exec:\7xfxxrx.exe103⤵PID:3392
-
\??\c:\ttttbn.exec:\ttttbn.exe104⤵PID:3796
-
\??\c:\nhhtnn.exec:\nhhtnn.exe105⤵PID:3544
-
\??\c:\jpdpd.exec:\jpdpd.exe106⤵PID:972
-
\??\c:\xflrrxf.exec:\xflrrxf.exe107⤵PID:2216
-
\??\c:\llrlxxr.exec:\llrlxxr.exe108⤵PID:3464
-
\??\c:\htbtnh.exec:\htbtnh.exe109⤵PID:1032
-
\??\c:\btbnhh.exec:\btbnhh.exe110⤵PID:2496
-
\??\c:\vjjdp.exec:\vjjdp.exe111⤵PID:4088
-
\??\c:\vvpjj.exec:\vvpjj.exe112⤵PID:4452
-
\??\c:\1xlfrll.exec:\1xlfrll.exe113⤵PID:3924
-
\??\c:\frfxrrl.exec:\frfxrrl.exe114⤵PID:448
-
\??\c:\thbbtn.exec:\thbbtn.exe115⤵PID:2292
-
\??\c:\nthtnn.exec:\nthtnn.exe116⤵PID:4052
-
\??\c:\pjjdj.exec:\pjjdj.exe117⤵PID:764
-
\??\c:\pvpjd.exec:\pvpjd.exe118⤵PID:432
-
\??\c:\lrxllfl.exec:\lrxllfl.exe119⤵PID:3104
-
\??\c:\llrfrlr.exec:\llrfrlr.exe120⤵PID:3296
-
\??\c:\tbbtnh.exec:\tbbtnh.exe121⤵PID:1756
-
\??\c:\1hhbnh.exec:\1hhbnh.exe122⤵PID:1096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-