Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe
Resource
win7-20240708-en
General
-
Target
b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe
-
Size
79KB
-
MD5
5bf3d85491ed0bb928281b5d7381a0af
-
SHA1
c0b66e5d9d4cd6ecfb090f15417da0ce710512f0
-
SHA256
b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916
-
SHA512
fbe1757fd1d78341d9250bb771efaeca74e36e8880e1e462588e5e5b0e8e59ee4eed3be0c8ee4ceb7bbc3036c028949f2c7922495c1f6ad13bcc7b0a6b03d9b9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeq:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4n
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2572 vjdvv.exe 1604 bnnbtt.exe 4248 bbhbtn.exe 2964 pdvpj.exe 1700 9jddd.exe 612 xrrxxrr.exe 4556 djvvd.exe 3076 vjjjd.exe 4284 rlrlrrr.exe 396 hntttb.exe 1872 7tnhtt.exe 3332 3dvvj.exe 2232 ffxxffx.exe 640 hbbbbh.exe 1156 dvjpv.exe 2336 xlffllr.exe 872 tntbbb.exe 1900 hbtnbb.exe 2476 7vvpp.exe 3572 lfxrlfx.exe 4440 rllfxxx.exe 3600 jvvvp.exe 3304 7lxrrrf.exe 4472 9rfxlrx.exe 3092 btbhtt.exe 4368 5vpdd.exe 4512 jpvpv.exe 948 lflfffx.exe 1936 xrfxrrr.exe 2224 5nnnhn.exe 2420 jdpjp.exe 3720 pjdjd.exe 4436 rrrfllx.exe 1632 tthnbn.exe 4888 3hbtnn.exe 4360 vpppp.exe 2244 xrxrlll.exe 4568 xrllffx.exe 2804 bhbbtt.exe 2964 bhhhbh.exe 2520 5pvpj.exe 2740 jjppp.exe 3772 7rrlffx.exe 3412 lfffflf.exe 4648 nnbbbt.exe 1368 7thbtt.exe 3140 ddvpj.exe 4952 vppjv.exe 5024 llllflx.exe 3192 fflrrrl.exe 3732 ttnhht.exe 4448 bnnnnn.exe 4224 dvvjp.exe 1984 jvdvd.exe 1372 frrrfxx.exe 4956 xflxllf.exe 3360 bhhtnt.exe 3820 ttnhtt.exe 4712 pjjpj.exe 3208 xxrrrrr.exe 1436 3xllrlr.exe 3440 3bhbbb.exe 4700 nnnhnn.exe 1948 ddjjp.exe -
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 2572 212 b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe 83 PID 212 wrote to memory of 2572 212 b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe 83 PID 212 wrote to memory of 2572 212 b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe 83 PID 2572 wrote to memory of 1604 2572 vjdvv.exe 84 PID 2572 wrote to memory of 1604 2572 vjdvv.exe 84 PID 2572 wrote to memory of 1604 2572 vjdvv.exe 84 PID 1604 wrote to memory of 4248 1604 bnnbtt.exe 85 PID 1604 wrote to memory of 4248 1604 bnnbtt.exe 85 PID 1604 wrote to memory of 4248 1604 bnnbtt.exe 85 PID 4248 wrote to memory of 2964 4248 bbhbtn.exe 86 PID 4248 wrote to memory of 2964 4248 bbhbtn.exe 86 PID 4248 wrote to memory of 2964 4248 bbhbtn.exe 86 PID 2964 wrote to memory of 1700 2964 pdvpj.exe 87 PID 2964 wrote to memory of 1700 2964 pdvpj.exe 87 PID 2964 wrote to memory of 1700 2964 pdvpj.exe 87 PID 1700 wrote to memory of 612 1700 9jddd.exe 88 PID 1700 wrote to memory of 612 1700 9jddd.exe 88 PID 1700 wrote to memory of 612 1700 9jddd.exe 88 PID 612 wrote to memory of 4556 612 xrrxxrr.exe 89 PID 612 wrote to memory of 4556 612 xrrxxrr.exe 89 PID 612 wrote to memory of 4556 612 xrrxxrr.exe 89 PID 4556 wrote to memory of 3076 4556 djvvd.exe 90 PID 4556 wrote to memory of 3076 4556 djvvd.exe 90 PID 4556 wrote to memory of 3076 4556 djvvd.exe 90 PID 3076 wrote to memory of 4284 3076 vjjjd.exe 91 PID 3076 wrote to memory of 4284 3076 vjjjd.exe 91 PID 3076 wrote to memory of 4284 3076 vjjjd.exe 91 PID 4284 wrote to memory of 396 4284 rlrlrrr.exe 92 PID 4284 wrote to memory of 396 4284 rlrlrrr.exe 92 PID 4284 wrote to memory of 396 4284 rlrlrrr.exe 92 PID 396 wrote to memory of 1872 396 hntttb.exe 94 PID 396 wrote to memory of 1872 396 hntttb.exe 94 PID 396 wrote to memory of 1872 396 hntttb.exe 94 PID 1872 wrote to memory of 3332 1872 7tnhtt.exe 95 PID 1872 wrote to memory of 3332 1872 7tnhtt.exe 95 PID 1872 wrote to memory of 3332 1872 7tnhtt.exe 95 PID 3332 wrote to memory of 2232 3332 3dvvj.exe 96 PID 3332 wrote to memory of 2232 3332 3dvvj.exe 96 PID 3332 wrote to memory of 2232 3332 3dvvj.exe 96 PID 2232 wrote to memory of 640 2232 ffxxffx.exe 97 PID 2232 wrote to memory of 640 2232 ffxxffx.exe 97 PID 2232 wrote to memory of 640 2232 ffxxffx.exe 97 PID 640 wrote to memory of 1156 640 hbbbbh.exe 98 PID 640 wrote to memory of 1156 640 hbbbbh.exe 98 PID 640 wrote to memory of 1156 640 hbbbbh.exe 98 PID 1156 wrote to memory of 2336 1156 dvjpv.exe 99 PID 1156 wrote to memory of 2336 1156 dvjpv.exe 99 PID 1156 wrote to memory of 2336 1156 dvjpv.exe 99 PID 2336 wrote to memory of 872 2336 xlffllr.exe 101 PID 2336 wrote to memory of 872 2336 xlffllr.exe 101 PID 2336 wrote to memory of 872 2336 xlffllr.exe 101 PID 872 wrote to memory of 1900 872 tntbbb.exe 102 PID 872 wrote to memory of 1900 872 tntbbb.exe 102 PID 872 wrote to memory of 1900 872 tntbbb.exe 102 PID 1900 wrote to memory of 2476 1900 hbtnbb.exe 103 PID 1900 wrote to memory of 2476 1900 hbtnbb.exe 103 PID 1900 wrote to memory of 2476 1900 hbtnbb.exe 103 PID 2476 wrote to memory of 3572 2476 7vvpp.exe 104 PID 2476 wrote to memory of 3572 2476 7vvpp.exe 104 PID 2476 wrote to memory of 3572 2476 7vvpp.exe 104 PID 3572 wrote to memory of 4440 3572 lfxrlfx.exe 105 PID 3572 wrote to memory of 4440 3572 lfxrlfx.exe 105 PID 3572 wrote to memory of 4440 3572 lfxrlfx.exe 105 PID 4440 wrote to memory of 3600 4440 rllfxxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe"C:\Users\Admin\AppData\Local\Temp\b631c5c66bef2e77934162d152b05ae5576830fc4cf3f3e25bbb2903663a9916.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\vjdvv.exec:\vjdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bnnbtt.exec:\bnnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\bbhbtn.exec:\bbhbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\pdvpj.exec:\pdvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\9jddd.exec:\9jddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\xrrxxrr.exec:\xrrxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\djvvd.exec:\djvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\vjjjd.exec:\vjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\hntttb.exec:\hntttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\7tnhtt.exec:\7tnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\3dvvj.exec:\3dvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\ffxxffx.exec:\ffxxffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hbbbbh.exec:\hbbbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\dvjpv.exec:\dvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\xlffllr.exec:\xlffllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tntbbb.exec:\tntbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\hbtnbb.exec:\hbtnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\7vvpp.exec:\7vvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\rllfxxx.exec:\rllfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\jvvvp.exec:\jvvvp.exe23⤵
- Executes dropped EXE
PID:3600 -
\??\c:\7lxrrrf.exec:\7lxrrrf.exe24⤵
- Executes dropped EXE
PID:3304 -
\??\c:\9rfxlrx.exec:\9rfxlrx.exe25⤵
- Executes dropped EXE
PID:4472 -
\??\c:\btbhtt.exec:\btbhtt.exe26⤵
- Executes dropped EXE
PID:3092 -
\??\c:\5vpdd.exec:\5vpdd.exe27⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jpvpv.exec:\jpvpv.exe28⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lflfffx.exec:\lflfffx.exe29⤵
- Executes dropped EXE
PID:948 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5nnnhn.exec:\5nnnhn.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jdpjp.exec:\jdpjp.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjdjd.exec:\pjdjd.exe33⤵
- Executes dropped EXE
PID:3720 -
\??\c:\rrrfllx.exec:\rrrfllx.exe34⤵
- Executes dropped EXE
PID:4436 -
\??\c:\tthnbn.exec:\tthnbn.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3hbtnn.exec:\3hbtnn.exe36⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vpppp.exec:\vpppp.exe37⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xrxrlll.exec:\xrxrlll.exe38⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrllffx.exec:\xrllffx.exe39⤵
- Executes dropped EXE
PID:4568 -
\??\c:\bhbbtt.exec:\bhbbtt.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bhhhbh.exec:\bhhhbh.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5pvpj.exec:\5pvpj.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jjppp.exec:\jjppp.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7rrlffx.exec:\7rrlffx.exe44⤵
- Executes dropped EXE
PID:3772 -
\??\c:\lfffflf.exec:\lfffflf.exe45⤵
- Executes dropped EXE
PID:3412 -
\??\c:\nnbbbt.exec:\nnbbbt.exe46⤵
- Executes dropped EXE
PID:4648 -
\??\c:\7thbtt.exec:\7thbtt.exe47⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ddvpj.exec:\ddvpj.exe48⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vppjv.exec:\vppjv.exe49⤵
- Executes dropped EXE
PID:4952 -
\??\c:\llllflx.exec:\llllflx.exe50⤵
- Executes dropped EXE
PID:5024 -
\??\c:\fflrrrl.exec:\fflrrrl.exe51⤵
- Executes dropped EXE
PID:3192 -
\??\c:\ttnhht.exec:\ttnhht.exe52⤵
- Executes dropped EXE
PID:3732 -
\??\c:\bnnnnn.exec:\bnnnnn.exe53⤵
- Executes dropped EXE
PID:4448 -
\??\c:\dvvjp.exec:\dvvjp.exe54⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jvdvd.exec:\jvdvd.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\frrrfxx.exec:\frrrfxx.exe56⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xflxllf.exec:\xflxllf.exe57⤵
- Executes dropped EXE
PID:4956 -
\??\c:\bhhtnt.exec:\bhhtnt.exe58⤵
- Executes dropped EXE
PID:3360 -
\??\c:\ttnhtt.exec:\ttnhtt.exe59⤵
- Executes dropped EXE
PID:3820 -
\??\c:\pjjpj.exec:\pjjpj.exe60⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe61⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3xllrlr.exec:\3xllrlr.exe62⤵
- Executes dropped EXE
PID:1436 -
\??\c:\3bhbbb.exec:\3bhbbb.exe63⤵
- Executes dropped EXE
PID:3440 -
\??\c:\nnnhnn.exec:\nnnhnn.exe64⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ddjjp.exec:\ddjjp.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rxxflxf.exec:\rxxflxf.exe66⤵PID:3908
-
\??\c:\frffrxf.exec:\frffrxf.exe67⤵PID:2796
-
\??\c:\ttttnn.exec:\ttttnn.exe68⤵PID:4664
-
\??\c:\httnhh.exec:\httnhh.exe69⤵PID:4852
-
\??\c:\jjvvp.exec:\jjvvp.exe70⤵PID:2180
-
\??\c:\dvdvd.exec:\dvdvd.exe71⤵PID:2436
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe72⤵PID:540
-
\??\c:\tthbnh.exec:\tthbnh.exe73⤵PID:1052
-
\??\c:\7hnbnt.exec:\7hnbnt.exe74⤵PID:2360
-
\??\c:\1pjjv.exec:\1pjjv.exe75⤵PID:1936
-
\??\c:\7dvjp.exec:\7dvjp.exe76⤵PID:4656
-
\??\c:\lfxxfxr.exec:\lfxxfxr.exe77⤵PID:404
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe78⤵PID:3252
-
\??\c:\ntnhtb.exec:\ntnhtb.exe79⤵PID:3448
-
\??\c:\vvvpj.exec:\vvvpj.exe80⤵PID:4436
-
\??\c:\jjdjd.exec:\jjdjd.exe81⤵PID:2692
-
\??\c:\xrllfff.exec:\xrllfff.exe82⤵PID:2572
-
\??\c:\7hhbtt.exec:\7hhbtt.exe83⤵PID:4080
-
\??\c:\pddvj.exec:\pddvj.exe84⤵PID:4148
-
\??\c:\xlxrffx.exec:\xlxrffx.exe85⤵PID:2804
-
\??\c:\rllxrxl.exec:\rllxrxl.exe86⤵PID:372
-
\??\c:\1hnhnn.exec:\1hnhnn.exe87⤵PID:2520
-
\??\c:\jdvjj.exec:\jdvjj.exe88⤵PID:2740
-
\??\c:\vjpdj.exec:\vjpdj.exe89⤵PID:3772
-
\??\c:\lrrrfxl.exec:\lrrrfxl.exe90⤵PID:3412
-
\??\c:\hnhhhh.exec:\hnhhhh.exe91⤵PID:2516
-
\??\c:\9hnbnh.exec:\9hnbnh.exe92⤵PID:4284
-
\??\c:\djvvp.exec:\djvvp.exe93⤵PID:2268
-
\??\c:\pdvpd.exec:\pdvpd.exe94⤵PID:4056
-
\??\c:\xlxrlxr.exec:\xlxrlxr.exe95⤵PID:4188
-
\??\c:\9xrfrlf.exec:\9xrfrlf.exe96⤵PID:3200
-
\??\c:\9hhhtb.exec:\9hhhtb.exe97⤵PID:5072
-
\??\c:\ddvpd.exec:\ddvpd.exe98⤵PID:2164
-
\??\c:\vjdvj.exec:\vjdvj.exe99⤵PID:4224
-
\??\c:\xxffxfx.exec:\xxffxfx.exe100⤵PID:2248
-
\??\c:\5fxxrrl.exec:\5fxxrrl.exe101⤵
- System Location Discovery: System Language Discovery
PID:3564 -
\??\c:\tbthbt.exec:\tbthbt.exe102⤵PID:4792
-
\??\c:\9vpjd.exec:\9vpjd.exe103⤵PID:512
-
\??\c:\vjpjd.exec:\vjpjd.exe104⤵PID:1900
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe105⤵PID:4040
-
\??\c:\thtnnt.exec:\thtnnt.exe106⤵PID:3208
-
\??\c:\9tbnth.exec:\9tbnth.exe107⤵PID:760
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe108⤵PID:2388
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe109⤵PID:1888
-
\??\c:\nbnhbt.exec:\nbnhbt.exe110⤵PID:4192
-
\??\c:\nhnnnb.exec:\nhnnnb.exe111⤵PID:3016
-
\??\c:\7jpjd.exec:\7jpjd.exe112⤵PID:912
-
\??\c:\9djdp.exec:\9djdp.exe113⤵PID:4672
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe114⤵PID:804
-
\??\c:\bnnbnh.exec:\bnnbnh.exe115⤵PID:4720
-
\??\c:\1hhbhh.exec:\1hhbhh.exe116⤵PID:2708
-
\??\c:\dvvpj.exec:\dvvpj.exe117⤵PID:1904
-
\??\c:\ppjdv.exec:\ppjdv.exe118⤵PID:1880
-
\??\c:\ffrlfxl.exec:\ffrlfxl.exe119⤵PID:376
-
\??\c:\llllfxr.exec:\llllfxr.exe120⤵PID:1936
-
\??\c:\nbbbnt.exec:\nbbbnt.exe121⤵PID:4656
-
\??\c:\bnnhnh.exec:\bnnhnh.exe122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-