Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a70452c242e05c369eaea355195d600N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
8a70452c242e05c369eaea355195d600N.exe
-
Size
445KB
-
MD5
8a70452c242e05c369eaea355195d600
-
SHA1
b69b7cce0137fe213088af52cd702fc8e5a4139c
-
SHA256
5b3c04c6d97746fd514c2be784aabce7af36049d41fee7e0927107b8228a3d33
-
SHA512
23f8a5a116661aea008dc8b8a238d1fbee340c326263966738641780b1542361894035602af5bb548d810aea7792a0d05574722319a777a1a192395f42d8ceb0
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09Jg:n3C9ytvn8whkb4i3e3GFO6Jg
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3580-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3696 bttbth.exe 4248 dpjvj.exe 2660 7dvjd.exe 3720 lxxllxx.exe 1192 tnnhbb.exe 2720 dvpjd.exe 2336 ffffflf.exe 1052 1htthb.exe 1996 dpvdd.exe 996 ddjvv.exe 5008 ddjdd.exe 2248 jjjdp.exe 392 lffxrrl.exe 2444 nhnbhb.exe 1380 vjjdp.exe 3168 frffrlf.exe 4736 tnnbtn.exe 3164 fxfxrrr.exe 2180 bttnhh.exe 3520 jdddv.exe 3504 xrxrlff.exe 4048 nhhhhh.exe 4040 jjpjd.exe 4184 xxxrlfx.exe 4852 ddjdp.exe 3508 vpjdd.exe 1404 xfxlxrl.exe 1420 ttnhbb.exe 1160 dvpjd.exe 184 flfxxxr.exe 4264 xxxrrrx.exe 4472 htnhtb.exe 4204 vpjdv.exe 1264 dvvvv.exe 3580 rrfrlfx.exe 2688 tnhbtt.exe 3556 vdvvp.exe 3112 rlrlllf.exe 2952 tnbttn.exe 5088 bbnnhh.exe 1288 dvjdv.exe 5104 frflrrx.exe 2196 fflfxrr.exe 5020 tnhtnn.exe 3680 djddj.exe 5012 3vdvd.exe 4484 rfxlfrl.exe 5032 nnhbtb.exe 4660 9tbthh.exe 2120 jdvvp.exe 2248 5rrlflf.exe 460 rrxrlll.exe 2444 nhntnh.exe 3432 pppjv.exe 3060 5jpjj.exe 5036 lffxfxr.exe 4572 fffrfxf.exe 1080 bhhbnh.exe 1704 vdvvv.exe 3248 rxxrrrr.exe 4064 9xllffx.exe 1848 bthtbb.exe 4528 pjvvd.exe 4412 vpjjp.exe -
resource yara_rule behavioral2/memory/3580-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-88-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3580 wrote to memory of 3696 3580 8a70452c242e05c369eaea355195d600N.exe 84 PID 3580 wrote to memory of 3696 3580 8a70452c242e05c369eaea355195d600N.exe 84 PID 3580 wrote to memory of 3696 3580 8a70452c242e05c369eaea355195d600N.exe 84 PID 3696 wrote to memory of 4248 3696 bttbth.exe 85 PID 3696 wrote to memory of 4248 3696 bttbth.exe 85 PID 3696 wrote to memory of 4248 3696 bttbth.exe 85 PID 4248 wrote to memory of 2660 4248 dpjvj.exe 86 PID 4248 wrote to memory of 2660 4248 dpjvj.exe 86 PID 4248 wrote to memory of 2660 4248 dpjvj.exe 86 PID 2660 wrote to memory of 3720 2660 7dvjd.exe 87 PID 2660 wrote to memory of 3720 2660 7dvjd.exe 87 PID 2660 wrote to memory of 3720 2660 7dvjd.exe 87 PID 3720 wrote to memory of 1192 3720 lxxllxx.exe 88 PID 3720 wrote to memory of 1192 3720 lxxllxx.exe 88 PID 3720 wrote to memory of 1192 3720 lxxllxx.exe 88 PID 1192 wrote to memory of 2720 1192 tnnhbb.exe 89 PID 1192 wrote to memory of 2720 1192 tnnhbb.exe 89 PID 1192 wrote to memory of 2720 1192 tnnhbb.exe 89 PID 2720 wrote to memory of 2336 2720 dvpjd.exe 90 PID 2720 wrote to memory of 2336 2720 dvpjd.exe 90 PID 2720 wrote to memory of 2336 2720 dvpjd.exe 90 PID 2336 wrote to memory of 1052 2336 ffffflf.exe 92 PID 2336 wrote to memory of 1052 2336 ffffflf.exe 92 PID 2336 wrote to memory of 1052 2336 ffffflf.exe 92 PID 1052 wrote to memory of 1996 1052 1htthb.exe 181 PID 1052 wrote to memory of 1996 1052 1htthb.exe 181 PID 1052 wrote to memory of 1996 1052 1htthb.exe 181 PID 1996 wrote to memory of 996 1996 dpvdd.exe 94 PID 1996 wrote to memory of 996 1996 dpvdd.exe 94 PID 1996 wrote to memory of 996 1996 dpvdd.exe 94 PID 996 wrote to memory of 5008 996 ddjvv.exe 96 PID 996 wrote to memory of 5008 996 ddjvv.exe 96 PID 996 wrote to memory of 5008 996 ddjvv.exe 96 PID 5008 wrote to memory of 2248 5008 ddjdd.exe 97 PID 5008 wrote to memory of 2248 5008 ddjdd.exe 97 PID 5008 wrote to memory of 2248 5008 ddjdd.exe 97 PID 2248 wrote to memory of 392 2248 jjjdp.exe 98 PID 2248 wrote to memory of 392 2248 jjjdp.exe 98 PID 2248 wrote to memory of 392 2248 jjjdp.exe 98 PID 392 wrote to memory of 2444 392 lffxrrl.exe 99 PID 392 wrote to memory of 2444 392 lffxrrl.exe 99 PID 392 wrote to memory of 2444 392 lffxrrl.exe 99 PID 2444 wrote to memory of 1380 2444 nhnbhb.exe 100 PID 2444 wrote to memory of 1380 2444 nhnbhb.exe 100 PID 2444 wrote to memory of 1380 2444 nhnbhb.exe 100 PID 1380 wrote to memory of 3168 1380 vjjdp.exe 101 PID 1380 wrote to memory of 3168 1380 vjjdp.exe 101 PID 1380 wrote to memory of 3168 1380 vjjdp.exe 101 PID 3168 wrote to memory of 4736 3168 frffrlf.exe 102 PID 3168 wrote to memory of 4736 3168 frffrlf.exe 102 PID 3168 wrote to memory of 4736 3168 frffrlf.exe 102 PID 4736 wrote to memory of 3164 4736 tnnbtn.exe 103 PID 4736 wrote to memory of 3164 4736 tnnbtn.exe 103 PID 4736 wrote to memory of 3164 4736 tnnbtn.exe 103 PID 3164 wrote to memory of 2180 3164 fxfxrrr.exe 104 PID 3164 wrote to memory of 2180 3164 fxfxrrr.exe 104 PID 3164 wrote to memory of 2180 3164 fxfxrrr.exe 104 PID 2180 wrote to memory of 3520 2180 bttnhh.exe 105 PID 2180 wrote to memory of 3520 2180 bttnhh.exe 105 PID 2180 wrote to memory of 3520 2180 bttnhh.exe 105 PID 3520 wrote to memory of 3504 3520 jdddv.exe 106 PID 3520 wrote to memory of 3504 3520 jdddv.exe 106 PID 3520 wrote to memory of 3504 3520 jdddv.exe 106 PID 3504 wrote to memory of 4048 3504 xrxrlff.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a70452c242e05c369eaea355195d600N.exe"C:\Users\Admin\AppData\Local\Temp\8a70452c242e05c369eaea355195d600N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\bttbth.exec:\bttbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\dpjvj.exec:\dpjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\7dvjd.exec:\7dvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lxxllxx.exec:\lxxllxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\tnnhbb.exec:\tnnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\dvpjd.exec:\dvpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\ffffflf.exec:\ffffflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\1htthb.exec:\1htthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\dpvdd.exec:\dpvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ddjvv.exec:\ddjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\ddjdd.exec:\ddjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\jjjdp.exec:\jjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\lffxrrl.exec:\lffxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\nhnbhb.exec:\nhnbhb.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vjjdp.exec:\vjjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\frffrlf.exec:\frffrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\tnnbtn.exec:\tnnbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\bttnhh.exec:\bttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jdddv.exec:\jdddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\xrxrlff.exec:\xrxrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\nhhhhh.exec:\nhhhhh.exe23⤵
- Executes dropped EXE
PID:4048 -
\??\c:\jjpjd.exec:\jjpjd.exe24⤵
- Executes dropped EXE
PID:4040 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe25⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ddjdp.exec:\ddjdp.exe26⤵
- Executes dropped EXE
PID:4852 -
\??\c:\vpjdd.exec:\vpjdd.exe27⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ttnhbb.exec:\ttnhbb.exe29⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dvpjd.exec:\dvpjd.exe30⤵
- Executes dropped EXE
PID:1160 -
\??\c:\flfxxxr.exec:\flfxxxr.exe31⤵
- Executes dropped EXE
PID:184 -
\??\c:\xxxrrrx.exec:\xxxrrrx.exe32⤵
- Executes dropped EXE
PID:4264 -
\??\c:\htnhtb.exec:\htnhtb.exe33⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vpjdv.exec:\vpjdv.exe34⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dvvvv.exec:\dvvvv.exe35⤵
- Executes dropped EXE
PID:1264 -
\??\c:\xrffxxx.exec:\xrffxxx.exe36⤵PID:4828
-
\??\c:\rrfrlfx.exec:\rrfrlfx.exe37⤵
- Executes dropped EXE
PID:3580 -
\??\c:\tnhbtt.exec:\tnhbtt.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vdvvp.exec:\vdvvp.exe39⤵
- Executes dropped EXE
PID:3556 -
\??\c:\rlrlllf.exec:\rlrlllf.exe40⤵
- Executes dropped EXE
PID:3112 -
\??\c:\tnbttn.exec:\tnbttn.exe41⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bbnnhh.exec:\bbnnhh.exe42⤵
- Executes dropped EXE
PID:5088 -
\??\c:\dvjdv.exec:\dvjdv.exe43⤵
- Executes dropped EXE
PID:1288 -
\??\c:\frflrrx.exec:\frflrrx.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\fflfxrr.exec:\fflfxrr.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnhtnn.exec:\tnhtnn.exe46⤵
- Executes dropped EXE
PID:5020 -
\??\c:\djddj.exec:\djddj.exe47⤵
- Executes dropped EXE
PID:3680 -
\??\c:\3vdvd.exec:\3vdvd.exe48⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rfxlfrl.exec:\rfxlfrl.exe49⤵
- Executes dropped EXE
PID:4484 -
\??\c:\nnhbtb.exec:\nnhbtb.exe50⤵
- Executes dropped EXE
PID:5032 -
\??\c:\9tbthh.exec:\9tbthh.exe51⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jdvvp.exec:\jdvvp.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5rrlflf.exec:\5rrlflf.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rrxrlll.exec:\rrxrlll.exe54⤵
- Executes dropped EXE
PID:460 -
\??\c:\nhntnh.exec:\nhntnh.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pppjv.exec:\pppjv.exe56⤵
- Executes dropped EXE
PID:3432 -
\??\c:\5jpjj.exec:\5jpjj.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lffxfxr.exec:\lffxfxr.exe58⤵
- Executes dropped EXE
PID:5036 -
\??\c:\fffrfxf.exec:\fffrfxf.exe59⤵
- Executes dropped EXE
PID:4572 -
\??\c:\bhhbnh.exec:\bhhbnh.exe60⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vdvvv.exec:\vdvvv.exe61⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe62⤵
- Executes dropped EXE
PID:3248 -
\??\c:\9xllffx.exec:\9xllffx.exe63⤵
- Executes dropped EXE
PID:4064 -
\??\c:\bthtbb.exec:\bthtbb.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pjvvd.exec:\pjvvd.exe65⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vpjjp.exec:\vpjjp.exe66⤵
- Executes dropped EXE
PID:4412 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe67⤵PID:2848
-
\??\c:\fxxrlll.exec:\fxxrlll.exe68⤵
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\hbtnhb.exec:\hbtnhb.exe69⤵PID:1428
-
\??\c:\vvppd.exec:\vvppd.exe70⤵PID:4964
-
\??\c:\pjppv.exec:\pjppv.exe71⤵PID:2832
-
\??\c:\1xrlxrf.exec:\1xrlxrf.exe72⤵PID:1420
-
\??\c:\rxrxlrx.exec:\rxrxlrx.exe73⤵PID:4568
-
\??\c:\bntnhb.exec:\bntnhb.exe74⤵PID:4088
-
\??\c:\jvdvp.exec:\jvdvp.exe75⤵PID:3672
-
\??\c:\3djjd.exec:\3djjd.exe76⤵PID:2528
-
\??\c:\xxlfllr.exec:\xxlfllr.exe77⤵PID:4472
-
\??\c:\rxxrllf.exec:\rxxrllf.exe78⤵PID:4360
-
\??\c:\pjppv.exec:\pjppv.exe79⤵PID:4316
-
\??\c:\dvdvp.exec:\dvdvp.exe80⤵PID:616
-
\??\c:\rflrrrr.exec:\rflrrrr.exe81⤵PID:3372
-
\??\c:\1bhhnh.exec:\1bhhnh.exe82⤵PID:2404
-
\??\c:\tthbtn.exec:\tthbtn.exe83⤵PID:504
-
\??\c:\vjjdp.exec:\vjjdp.exe84⤵PID:3556
-
\??\c:\xxffxff.exec:\xxffxff.exe85⤵PID:1280
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe86⤵PID:3536
-
\??\c:\3tnnnn.exec:\3tnnnn.exe87⤵PID:1968
-
\??\c:\hnhhbh.exec:\hnhhbh.exe88⤵PID:2132
-
\??\c:\pjppj.exec:\pjppj.exe89⤵PID:3984
-
\??\c:\vjjvp.exec:\vjjvp.exe90⤵PID:4784
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe91⤵PID:116
-
\??\c:\hnnbbt.exec:\hnnbbt.exe92⤵PID:2648
-
\??\c:\bbnhbt.exec:\bbnhbt.exe93⤵PID:2220
-
\??\c:\vjdpd.exec:\vjdpd.exe94⤵PID:1996
-
\??\c:\jvdpp.exec:\jvdpp.exe95⤵PID:4144
-
\??\c:\rllfrll.exec:\rllfrll.exe96⤵PID:1548
-
\??\c:\tnbtnh.exec:\tnbtnh.exe97⤵PID:232
-
\??\c:\3hhbnn.exec:\3hhbnn.exe98⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\jddvp.exec:\jddvp.exe99⤵PID:1480
-
\??\c:\5jppp.exec:\5jppp.exe100⤵PID:2732
-
\??\c:\lfrlfff.exec:\lfrlfff.exe101⤵PID:1380
-
\??\c:\ttnnnt.exec:\ttnnnt.exe102⤵PID:960
-
\??\c:\nntnnn.exec:\nntnnn.exe103⤵PID:3016
-
\??\c:\9jdvp.exec:\9jdvp.exe104⤵PID:3920
-
\??\c:\9lfrxxl.exec:\9lfrxxl.exe105⤵PID:4168
-
\??\c:\llfllrx.exec:\llfllrx.exe106⤵PID:244
-
\??\c:\3tnhbt.exec:\3tnhbt.exe107⤵PID:3300
-
\??\c:\pvvpp.exec:\pvvpp.exe108⤵PID:4392
-
\??\c:\3xfxrrf.exec:\3xfxrrf.exe109⤵PID:3208
-
\??\c:\hntnnn.exec:\hntnnn.exe110⤵PID:4208
-
\??\c:\jjdvj.exec:\jjdvj.exe111⤵PID:1016
-
\??\c:\nbbthb.exec:\nbbthb.exe112⤵PID:2728
-
\??\c:\jjjpp.exec:\jjjpp.exe113⤵PID:2020
-
\??\c:\lxrfrxr.exec:\lxrfrxr.exe114⤵PID:3712
-
\??\c:\lrllrxl.exec:\lrllrxl.exe115⤵PID:4192
-
\??\c:\hnnhhh.exec:\hnnhhh.exe116⤵PID:2748
-
\??\c:\pjppj.exec:\pjppj.exe117⤵PID:2528
-
\??\c:\7btbht.exec:\7btbht.exe118⤵PID:4472
-
\??\c:\5pppj.exec:\5pppj.exe119⤵PID:4360
-
\??\c:\vvvpd.exec:\vvvpd.exe120⤵PID:4316
-
\??\c:\xfrlffx.exec:\xfrlffx.exe121⤵PID:616
-
\??\c:\7bnhtt.exec:\7bnhtt.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-