Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 03:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c043c14644307d356a7cd5fff744fc0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
1c043c14644307d356a7cd5fff744fc0N.exe
-
Size
250KB
-
MD5
1c043c14644307d356a7cd5fff744fc0
-
SHA1
4cdc343158a046212ec6b509aba4935d3593e5d6
-
SHA256
37d229fad943ab342d039685018c9218b69eff13f38346cbd57b2c183ec01ae0
-
SHA512
139b44f932266739bb464383458122de630664a8281d41612a11e71bc4ef9befe21f91fc43e90fe1528900dd80bafb0acae67ad762a9f6f1116f070d934af68b
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRly8:n3C9uD6AUDCa4NYmRl
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1048-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3948 9xlllll.exe 3124 rxxrrxr.exe 2028 nhbhnt.exe 5004 ddjjp.exe 4336 jdjjd.exe 1488 nnhhhn.exe 2008 vjvvv.exe 4372 tthhnn.exe 3568 llxrxlr.exe 3716 9rrllrl.exe 832 ddjdv.exe 3184 xrxxrrr.exe 4596 nthhnn.exe 4004 pjpjj.exe 4592 rlxfxll.exe 704 xlfllll.exe 2944 ntnnnh.exe 3452 lrffxxl.exe 4992 hthhhn.exe 4784 pjdvd.exe 3836 ffxfrxl.exe 1552 rrfxxxx.exe 4620 bthhbb.exe 3068 ddddd.exe 4268 pvpjp.exe 2244 nhtnhn.exe 1320 pdppp.exe 1956 frfffff.exe 2248 llxlffl.exe 388 9pppj.exe 5044 jjjjp.exe 4300 xrfxxxx.exe 3888 pvpvv.exe 1788 dddvj.exe 1940 xrffxfl.exe 3436 hbhbtb.exe 3132 bnhtnt.exe 5116 jdvdd.exe 1628 1dvjj.exe 840 5fllxfl.exe 3516 rflxflr.exe 1920 nbttnn.exe 844 1jvvd.exe 4312 7jppj.exe 4372 5rfflrx.exe 4860 hhttbh.exe 3580 thttth.exe 5040 jvjjj.exe 3008 jdvdd.exe 2356 fllfflr.exe 4440 7bnhnn.exe 1504 hbhhnn.exe 1696 vppjv.exe 2724 5jjjj.exe 4012 frffxlf.exe 704 rfllfll.exe 916 ntbbbb.exe 4092 3ppjj.exe 3696 pjvvp.exe 4636 rlxxrxx.exe 4280 fflfffx.exe 4320 bnbbbh.exe 2416 vpvvd.exe 2932 ppddd.exe -
resource yara_rule behavioral2/memory/1048-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 3948 1048 1c043c14644307d356a7cd5fff744fc0N.exe 83 PID 1048 wrote to memory of 3948 1048 1c043c14644307d356a7cd5fff744fc0N.exe 83 PID 1048 wrote to memory of 3948 1048 1c043c14644307d356a7cd5fff744fc0N.exe 83 PID 3948 wrote to memory of 3124 3948 9xlllll.exe 84 PID 3948 wrote to memory of 3124 3948 9xlllll.exe 84 PID 3948 wrote to memory of 3124 3948 9xlllll.exe 84 PID 3124 wrote to memory of 2028 3124 rxxrrxr.exe 85 PID 3124 wrote to memory of 2028 3124 rxxrrxr.exe 85 PID 3124 wrote to memory of 2028 3124 rxxrrxr.exe 85 PID 2028 wrote to memory of 5004 2028 nhbhnt.exe 86 PID 2028 wrote to memory of 5004 2028 nhbhnt.exe 86 PID 2028 wrote to memory of 5004 2028 nhbhnt.exe 86 PID 5004 wrote to memory of 4336 5004 ddjjp.exe 88 PID 5004 wrote to memory of 4336 5004 ddjjp.exe 88 PID 5004 wrote to memory of 4336 5004 ddjjp.exe 88 PID 4336 wrote to memory of 1488 4336 jdjjd.exe 90 PID 4336 wrote to memory of 1488 4336 jdjjd.exe 90 PID 4336 wrote to memory of 1488 4336 jdjjd.exe 90 PID 1488 wrote to memory of 2008 1488 nnhhhn.exe 91 PID 1488 wrote to memory of 2008 1488 nnhhhn.exe 91 PID 1488 wrote to memory of 2008 1488 nnhhhn.exe 91 PID 2008 wrote to memory of 4372 2008 vjvvv.exe 93 PID 2008 wrote to memory of 4372 2008 vjvvv.exe 93 PID 2008 wrote to memory of 4372 2008 vjvvv.exe 93 PID 4372 wrote to memory of 3568 4372 tthhnn.exe 94 PID 4372 wrote to memory of 3568 4372 tthhnn.exe 94 PID 4372 wrote to memory of 3568 4372 tthhnn.exe 94 PID 3568 wrote to memory of 3716 3568 llxrxlr.exe 95 PID 3568 wrote to memory of 3716 3568 llxrxlr.exe 95 PID 3568 wrote to memory of 3716 3568 llxrxlr.exe 95 PID 3716 wrote to memory of 832 3716 9rrllrl.exe 96 PID 3716 wrote to memory of 832 3716 9rrllrl.exe 96 PID 3716 wrote to memory of 832 3716 9rrllrl.exe 96 PID 832 wrote to memory of 3184 832 ddjdv.exe 97 PID 832 wrote to memory of 3184 832 ddjdv.exe 97 PID 832 wrote to memory of 3184 832 ddjdv.exe 97 PID 3184 wrote to memory of 4596 3184 xrxxrrr.exe 98 PID 3184 wrote to memory of 4596 3184 xrxxrrr.exe 98 PID 3184 wrote to memory of 4596 3184 xrxxrrr.exe 98 PID 4596 wrote to memory of 4004 4596 nthhnn.exe 99 PID 4596 wrote to memory of 4004 4596 nthhnn.exe 99 PID 4596 wrote to memory of 4004 4596 nthhnn.exe 99 PID 4004 wrote to memory of 4592 4004 pjpjj.exe 100 PID 4004 wrote to memory of 4592 4004 pjpjj.exe 100 PID 4004 wrote to memory of 4592 4004 pjpjj.exe 100 PID 4592 wrote to memory of 704 4592 rlxfxll.exe 101 PID 4592 wrote to memory of 704 4592 rlxfxll.exe 101 PID 4592 wrote to memory of 704 4592 rlxfxll.exe 101 PID 704 wrote to memory of 2944 704 xlfllll.exe 102 PID 704 wrote to memory of 2944 704 xlfllll.exe 102 PID 704 wrote to memory of 2944 704 xlfllll.exe 102 PID 2944 wrote to memory of 3452 2944 ntnnnh.exe 103 PID 2944 wrote to memory of 3452 2944 ntnnnh.exe 103 PID 2944 wrote to memory of 3452 2944 ntnnnh.exe 103 PID 3452 wrote to memory of 4992 3452 lrffxxl.exe 104 PID 3452 wrote to memory of 4992 3452 lrffxxl.exe 104 PID 3452 wrote to memory of 4992 3452 lrffxxl.exe 104 PID 4992 wrote to memory of 4784 4992 hthhhn.exe 105 PID 4992 wrote to memory of 4784 4992 hthhhn.exe 105 PID 4992 wrote to memory of 4784 4992 hthhhn.exe 105 PID 4784 wrote to memory of 3836 4784 pjdvd.exe 106 PID 4784 wrote to memory of 3836 4784 pjdvd.exe 106 PID 4784 wrote to memory of 3836 4784 pjdvd.exe 106 PID 3836 wrote to memory of 1552 3836 ffxfrxl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c043c14644307d356a7cd5fff744fc0N.exe"C:\Users\Admin\AppData\Local\Temp\1c043c14644307d356a7cd5fff744fc0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\9xlllll.exec:\9xlllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\rxxrrxr.exec:\rxxrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\nhbhnt.exec:\nhbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\ddjjp.exec:\ddjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\jdjjd.exec:\jdjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\nnhhhn.exec:\nnhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vjvvv.exec:\vjvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\tthhnn.exec:\tthhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\llxrxlr.exec:\llxrxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\9rrllrl.exec:\9rrllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\ddjdv.exec:\ddjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\nthhnn.exec:\nthhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\pjpjj.exec:\pjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\rlxfxll.exec:\rlxfxll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\xlfllll.exec:\xlfllll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\ntnnnh.exec:\ntnnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\lrffxxl.exec:\lrffxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\hthhhn.exec:\hthhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\pjdvd.exec:\pjdvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe23⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bthhbb.exec:\bthhbb.exe24⤵
- Executes dropped EXE
PID:4620 -
\??\c:\ddddd.exec:\ddddd.exe25⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvpjp.exec:\pvpjp.exe26⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nhtnhn.exec:\nhtnhn.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pdppp.exec:\pdppp.exe28⤵
- Executes dropped EXE
PID:1320 -
\??\c:\frfffff.exec:\frfffff.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\llxlffl.exec:\llxlffl.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9pppj.exec:\9pppj.exe31⤵
- Executes dropped EXE
PID:388 -
\??\c:\jjjjp.exec:\jjjjp.exe32⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe33⤵
- Executes dropped EXE
PID:4300 -
\??\c:\pvpvv.exec:\pvpvv.exe34⤵
- Executes dropped EXE
PID:3888 -
\??\c:\dddvj.exec:\dddvj.exe35⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xrffxfl.exec:\xrffxfl.exe36⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbhbtb.exec:\hbhbtb.exe37⤵
- Executes dropped EXE
PID:3436 -
\??\c:\bnhtnt.exec:\bnhtnt.exe38⤵
- Executes dropped EXE
PID:3132 -
\??\c:\jdvdd.exec:\jdvdd.exe39⤵
- Executes dropped EXE
PID:5116 -
\??\c:\1dvjj.exec:\1dvjj.exe40⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5fllxfl.exec:\5fllxfl.exe41⤵
- Executes dropped EXE
PID:840 -
\??\c:\rflxflr.exec:\rflxflr.exe42⤵
- Executes dropped EXE
PID:3516 -
\??\c:\nbttnn.exec:\nbttnn.exe43⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1jvvd.exec:\1jvvd.exe44⤵
- Executes dropped EXE
PID:844 -
\??\c:\7jppj.exec:\7jppj.exe45⤵
- Executes dropped EXE
PID:4312 -
\??\c:\5rfflrx.exec:\5rfflrx.exe46⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hhttbh.exec:\hhttbh.exe47⤵
- Executes dropped EXE
PID:4860 -
\??\c:\thttth.exec:\thttth.exe48⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jvjjj.exec:\jvjjj.exe49⤵
- Executes dropped EXE
PID:5040 -
\??\c:\jdvdd.exec:\jdvdd.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fllfflr.exec:\fllfflr.exe51⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7bnhnn.exec:\7bnhnn.exe52⤵
- Executes dropped EXE
PID:4440 -
\??\c:\hbhhnn.exec:\hbhhnn.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vppjv.exec:\vppjv.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\5jjjj.exec:\5jjjj.exe55⤵
- Executes dropped EXE
PID:2724 -
\??\c:\frffxlf.exec:\frffxlf.exe56⤵
- Executes dropped EXE
PID:4012 -
\??\c:\rfllfll.exec:\rfllfll.exe57⤵
- Executes dropped EXE
PID:704 -
\??\c:\ntbbbb.exec:\ntbbbb.exe58⤵
- Executes dropped EXE
PID:916 -
\??\c:\3ppjj.exec:\3ppjj.exe59⤵
- Executes dropped EXE
PID:4092 -
\??\c:\pjvvp.exec:\pjvvp.exe60⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe61⤵
- Executes dropped EXE
PID:4636 -
\??\c:\fflfffx.exec:\fflfffx.exe62⤵
- Executes dropped EXE
PID:4280 -
\??\c:\bnbbbh.exec:\bnbbbh.exe63⤵
- Executes dropped EXE
PID:4320 -
\??\c:\vpvvd.exec:\vpvvd.exe64⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppddd.exec:\ppddd.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1xxllll.exec:\1xxllll.exe66⤵PID:2268
-
\??\c:\bbbtbb.exec:\bbbtbb.exe67⤵PID:1296
-
\??\c:\nhbbbb.exec:\nhbbbb.exe68⤵PID:4268
-
\??\c:\7vddd.exec:\7vddd.exe69⤵PID:2492
-
\??\c:\llrffff.exec:\llrffff.exe70⤵PID:4584
-
\??\c:\pjdjv.exec:\pjdjv.exe71⤵PID:1612
-
\??\c:\vdvdp.exec:\vdvdp.exe72⤵PID:2024
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe73⤵PID:2700
-
\??\c:\bhbbnt.exec:\bhbbnt.exe74⤵PID:1784
-
\??\c:\5tttnt.exec:\5tttnt.exe75⤵PID:4648
-
\??\c:\ppddd.exec:\ppddd.exe76⤵PID:1544
-
\??\c:\jdvvp.exec:\jdvvp.exe77⤵PID:952
-
\??\c:\fffxllr.exec:\fffxllr.exe78⤵PID:4300
-
\??\c:\htbttb.exec:\htbttb.exe79⤵PID:1172
-
\??\c:\7jvvv.exec:\7jvvv.exe80⤵PID:3432
-
\??\c:\rfrllrr.exec:\rfrllrr.exe81⤵PID:2360
-
\??\c:\7bbttb.exec:\7bbttb.exe82⤵PID:3132
-
\??\c:\7ntnnt.exec:\7ntnnt.exe83⤵PID:4068
-
\??\c:\pjppp.exec:\pjppp.exe84⤵PID:4352
-
\??\c:\lrxxlrr.exec:\lrxxlrr.exe85⤵PID:5072
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe86⤵PID:2240
-
\??\c:\htbbnn.exec:\htbbnn.exe87⤵PID:1400
-
\??\c:\hthhhh.exec:\hthhhh.exe88⤵PID:4876
-
\??\c:\ddddv.exec:\ddddv.exe89⤵PID:4052
-
\??\c:\rxffxxr.exec:\rxffxxr.exe90⤵PID:4444
-
\??\c:\llxflrx.exec:\llxflrx.exe91⤵PID:2528
-
\??\c:\7ntbbh.exec:\7ntbbh.exe92⤵PID:3048
-
\??\c:\7jjpp.exec:\7jjpp.exe93⤵PID:900
-
\??\c:\dpddd.exec:\dpddd.exe94⤵PID:3580
-
\??\c:\rfxxflr.exec:\rfxxflr.exe95⤵PID:5068
-
\??\c:\tnhhbb.exec:\tnhhbb.exe96⤵PID:2776
-
\??\c:\5tbtnt.exec:\5tbtnt.exe97⤵PID:4408
-
\??\c:\ppddp.exec:\ppddp.exe98⤵PID:2152
-
\??\c:\fffxrxx.exec:\fffxrxx.exe99⤵PID:4440
-
\??\c:\rrxxxff.exec:\rrxxxff.exe100⤵PID:1504
-
\??\c:\tbtthn.exec:\tbtthn.exe101⤵PID:1620
-
\??\c:\ppjjd.exec:\ppjjd.exe102⤵PID:2468
-
\??\c:\3vvvp.exec:\3vvvp.exe103⤵PID:4964
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe104⤵PID:1100
-
\??\c:\lfrlllf.exec:\lfrlllf.exe105⤵PID:2352
-
\??\c:\btnnnn.exec:\btnnnn.exe106⤵PID:4996
-
\??\c:\bthbhn.exec:\bthbhn.exe107⤵PID:4060
-
\??\c:\5vjvj.exec:\5vjvj.exe108⤵PID:4332
-
\??\c:\3btthh.exec:\3btthh.exe109⤵PID:4280
-
\??\c:\7jppp.exec:\7jppp.exe110⤵PID:4320
-
\??\c:\pjvpj.exec:\pjvpj.exe111⤵PID:2416
-
\??\c:\5lrrrll.exec:\5lrrrll.exe112⤵PID:4868
-
\??\c:\hnnbbh.exec:\hnnbbh.exe113⤵PID:3552
-
\??\c:\tbhhnn.exec:\tbhhnn.exe114⤵PID:1328
-
\??\c:\dvjdj.exec:\dvjdj.exe115⤵PID:3380
-
\??\c:\vvjpp.exec:\vvjpp.exe116⤵PID:2016
-
\??\c:\llrlfff.exec:\llrlfff.exe117⤵PID:3280
-
\??\c:\rrllxxx.exec:\rrllxxx.exe118⤵PID:2332
-
\??\c:\3ntnnt.exec:\3ntnnt.exe119⤵PID:3884
-
\??\c:\7vddv.exec:\7vddv.exe120⤵PID:2872
-
\??\c:\djvvv.exec:\djvvv.exe121⤵
- System Location Discovery: System Language Discovery
PID:5060 -
\??\c:\rxxxxff.exec:\rxxxxff.exe122⤵PID:1404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-