Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa91fbb58bf1690e6c17a8f6849ae300N.exe
Resource
win7-20240903-en
3 signatures
120 seconds
General
-
Target
aa91fbb58bf1690e6c17a8f6849ae300N.exe
-
Size
366KB
-
MD5
aa91fbb58bf1690e6c17a8f6849ae300
-
SHA1
8a23e5a2e6fdcfd6f33ee1162a52a28cb95a66be
-
SHA256
d6edd4c3fff2e8b29ee6709e21fa0c124a33508f412a47da2f5a4d93e4c2d7df
-
SHA512
31b6a1947dc768fbf3db1ad37cf34349113ad4f97e37cd24a049fae7a308f488ae865cb3c3891c30c34d8b1a356f5dcb5e071103ae60a7075c2619faa8f47c06
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBu+:n3C9ytvngQj429nnzeZhBv
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/556-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3032 bttbtb.exe 3120 xlrfflr.exe 2928 hbnnbb.exe 1856 thnhht.exe 2332 7lrxxlr.exe 2764 flfxxfr.exe 4556 bnntth.exe 4104 pjjpd.exe 2640 vvddd.exe 3052 vjvdd.exe 3524 flrfflf.exe 3864 flflllf.exe 4928 jdvdd.exe 2276 bbthtt.exe 2772 tbnbth.exe 3672 vdvpp.exe 4856 hnbnhb.exe 2472 ffxxlrf.exe 4712 5lxlrlr.exe 4776 pdppd.exe 4364 lflrlll.exe 404 5rrrxrr.exe 3772 ttbbhh.exe 2732 rlxflff.exe 2436 nhttnn.exe 4564 hbhbtn.exe 3576 hnbbtn.exe 1624 lflxxxx.exe 5020 1bnnnn.exe 4788 rrrxxll.exe 4680 tnbbbb.exe 4932 9vdpd.exe 2112 xfrxfxx.exe 4032 lffxxrl.exe 3156 bttnbn.exe 4988 pvdjv.exe 4548 xfxfllf.exe 4252 ntnhbb.exe 3676 lxrrrrr.exe 4512 jjpvp.exe 3168 hthhhh.exe 3120 fxllxrr.exe 1240 djjvv.exe 644 lxllflr.exe 4048 bnhtth.exe 4660 dpjdd.exe 1812 nhthth.exe 3780 dvvpd.exe 1992 nnthnb.exe 3924 dvjvj.exe 884 xffrxfl.exe 3436 ttnhth.exe 5068 djvvv.exe 4760 frxxfrl.exe 3376 djvpj.exe 3052 xrrrrxl.exe 4916 pppvp.exe 1236 lffxlfr.exe 4000 djjdd.exe 1760 fllxrrl.exe 1876 lxlrrff.exe 1860 nhnbbb.exe 1848 rxxfrrx.exe 5064 vjppv.exe -
resource yara_rule behavioral2/memory/556-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 556 wrote to memory of 3032 556 aa91fbb58bf1690e6c17a8f6849ae300N.exe 83 PID 556 wrote to memory of 3032 556 aa91fbb58bf1690e6c17a8f6849ae300N.exe 83 PID 556 wrote to memory of 3032 556 aa91fbb58bf1690e6c17a8f6849ae300N.exe 83 PID 3032 wrote to memory of 3120 3032 bttbtb.exe 127 PID 3032 wrote to memory of 3120 3032 bttbtb.exe 127 PID 3032 wrote to memory of 3120 3032 bttbtb.exe 127 PID 3120 wrote to memory of 2928 3120 xlrfflr.exe 86 PID 3120 wrote to memory of 2928 3120 xlrfflr.exe 86 PID 3120 wrote to memory of 2928 3120 xlrfflr.exe 86 PID 2928 wrote to memory of 1856 2928 hbnnbb.exe 181 PID 2928 wrote to memory of 1856 2928 hbnnbb.exe 181 PID 2928 wrote to memory of 1856 2928 hbnnbb.exe 181 PID 1856 wrote to memory of 2332 1856 thnhht.exe 88 PID 1856 wrote to memory of 2332 1856 thnhht.exe 88 PID 1856 wrote to memory of 2332 1856 thnhht.exe 88 PID 2332 wrote to memory of 2764 2332 7lrxxlr.exe 90 PID 2332 wrote to memory of 2764 2332 7lrxxlr.exe 90 PID 2332 wrote to memory of 2764 2332 7lrxxlr.exe 90 PID 2764 wrote to memory of 4556 2764 flfxxfr.exe 91 PID 2764 wrote to memory of 4556 2764 flfxxfr.exe 91 PID 2764 wrote to memory of 4556 2764 flfxxfr.exe 91 PID 4556 wrote to memory of 4104 4556 bnntth.exe 92 PID 4556 wrote to memory of 4104 4556 bnntth.exe 92 PID 4556 wrote to memory of 4104 4556 bnntth.exe 92 PID 4104 wrote to memory of 2640 4104 pjjpd.exe 93 PID 4104 wrote to memory of 2640 4104 pjjpd.exe 93 PID 4104 wrote to memory of 2640 4104 pjjpd.exe 93 PID 2640 wrote to memory of 3052 2640 vvddd.exe 141 PID 2640 wrote to memory of 3052 2640 vvddd.exe 141 PID 2640 wrote to memory of 3052 2640 vvddd.exe 141 PID 3052 wrote to memory of 3524 3052 vjvdd.exe 96 PID 3052 wrote to memory of 3524 3052 vjvdd.exe 96 PID 3052 wrote to memory of 3524 3052 vjvdd.exe 96 PID 3524 wrote to memory of 3864 3524 flrfflf.exe 97 PID 3524 wrote to memory of 3864 3524 flrfflf.exe 97 PID 3524 wrote to memory of 3864 3524 flrfflf.exe 97 PID 3864 wrote to memory of 4928 3864 flflllf.exe 98 PID 3864 wrote to memory of 4928 3864 flflllf.exe 98 PID 3864 wrote to memory of 4928 3864 flflllf.exe 98 PID 4928 wrote to memory of 2276 4928 jdvdd.exe 99 PID 4928 wrote to memory of 2276 4928 jdvdd.exe 99 PID 4928 wrote to memory of 2276 4928 jdvdd.exe 99 PID 2276 wrote to memory of 2772 2276 bbthtt.exe 100 PID 2276 wrote to memory of 2772 2276 bbthtt.exe 100 PID 2276 wrote to memory of 2772 2276 bbthtt.exe 100 PID 2772 wrote to memory of 3672 2772 tbnbth.exe 101 PID 2772 wrote to memory of 3672 2772 tbnbth.exe 101 PID 2772 wrote to memory of 3672 2772 tbnbth.exe 101 PID 3672 wrote to memory of 4856 3672 vdvpp.exe 102 PID 3672 wrote to memory of 4856 3672 vdvpp.exe 102 PID 3672 wrote to memory of 4856 3672 vdvpp.exe 102 PID 4856 wrote to memory of 2472 4856 hnbnhb.exe 103 PID 4856 wrote to memory of 2472 4856 hnbnhb.exe 103 PID 4856 wrote to memory of 2472 4856 hnbnhb.exe 103 PID 2472 wrote to memory of 4712 2472 ffxxlrf.exe 104 PID 2472 wrote to memory of 4712 2472 ffxxlrf.exe 104 PID 2472 wrote to memory of 4712 2472 ffxxlrf.exe 104 PID 4712 wrote to memory of 4776 4712 5lxlrlr.exe 105 PID 4712 wrote to memory of 4776 4712 5lxlrlr.exe 105 PID 4712 wrote to memory of 4776 4712 5lxlrlr.exe 105 PID 4776 wrote to memory of 4364 4776 pdppd.exe 106 PID 4776 wrote to memory of 4364 4776 pdppd.exe 106 PID 4776 wrote to memory of 4364 4776 pdppd.exe 106 PID 4364 wrote to memory of 404 4364 lflrlll.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa91fbb58bf1690e6c17a8f6849ae300N.exe"C:\Users\Admin\AppData\Local\Temp\aa91fbb58bf1690e6c17a8f6849ae300N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\bttbtb.exec:\bttbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xlrfflr.exec:\xlrfflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\hbnnbb.exec:\hbnnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\thnhht.exec:\thnhht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\7lrxxlr.exec:\7lrxxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\flfxxfr.exec:\flfxxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bnntth.exec:\bnntth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\pjjpd.exec:\pjjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\vvddd.exec:\vvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vjvdd.exec:\vjvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\flrfflf.exec:\flrfflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\flflllf.exec:\flflllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\jdvdd.exec:\jdvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\bbthtt.exec:\bbthtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\tbnbth.exec:\tbnbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vdvpp.exec:\vdvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\hnbnhb.exec:\hnbnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\5lxlrlr.exec:\5lxlrlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\pdppd.exec:\pdppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\lflrlll.exec:\lflrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\5rrrxrr.exec:\5rrrxrr.exe23⤵
- Executes dropped EXE
PID:404 -
\??\c:\ttbbhh.exec:\ttbbhh.exe24⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rlxflff.exec:\rlxflff.exe25⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhttnn.exec:\nhttnn.exe26⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbhbtn.exec:\hbhbtn.exe27⤵
- Executes dropped EXE
PID:4564 -
\??\c:\hnbbtn.exec:\hnbbtn.exe28⤵
- Executes dropped EXE
PID:3576 -
\??\c:\lflxxxx.exec:\lflxxxx.exe29⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1bnnnn.exec:\1bnnnn.exe30⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rrrxxll.exec:\rrrxxll.exe31⤵
- Executes dropped EXE
PID:4788 -
\??\c:\tnbbbb.exec:\tnbbbb.exe32⤵
- Executes dropped EXE
PID:4680 -
\??\c:\9vdpd.exec:\9vdpd.exe33⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xfrxfxx.exec:\xfrxfxx.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lffxxrl.exec:\lffxxrl.exe35⤵
- Executes dropped EXE
PID:4032 -
\??\c:\bttnbn.exec:\bttnbn.exe36⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pvdjv.exec:\pvdjv.exe37⤵
- Executes dropped EXE
PID:4988 -
\??\c:\xfxfllf.exec:\xfxfllf.exe38⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ntnhbb.exec:\ntnhbb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4252 -
\??\c:\lxrrrrr.exec:\lxrrrrr.exe40⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jjpvp.exec:\jjpvp.exe41⤵
- Executes dropped EXE
PID:4512 -
\??\c:\hthhhh.exec:\hthhhh.exe42⤵
- Executes dropped EXE
PID:3168 -
\??\c:\fxllxrr.exec:\fxllxrr.exe43⤵
- Executes dropped EXE
PID:3120 -
\??\c:\djjvv.exec:\djjvv.exe44⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lxllflr.exec:\lxllflr.exe45⤵
- Executes dropped EXE
PID:644 -
\??\c:\bnhtth.exec:\bnhtth.exe46⤵
- Executes dropped EXE
PID:4048 -
\??\c:\dpjdd.exec:\dpjdd.exe47⤵
- Executes dropped EXE
PID:4660 -
\??\c:\nhthth.exec:\nhthth.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dvvpd.exec:\dvvpd.exe49⤵
- Executes dropped EXE
PID:3780 -
\??\c:\nnthnb.exec:\nnthnb.exe50⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dvjvj.exec:\dvjvj.exe51⤵
- Executes dropped EXE
PID:3924 -
\??\c:\xffrxfl.exec:\xffrxfl.exe52⤵
- Executes dropped EXE
PID:884 -
\??\c:\ttnhth.exec:\ttnhth.exe53⤵
- Executes dropped EXE
PID:3436 -
\??\c:\djvvv.exec:\djvvv.exe54⤵
- Executes dropped EXE
PID:5068 -
\??\c:\frxxfrl.exec:\frxxfrl.exe55⤵
- Executes dropped EXE
PID:4760 -
\??\c:\djvpj.exec:\djvpj.exe56⤵
- Executes dropped EXE
PID:3376 -
\??\c:\xrrrrxl.exec:\xrrrrxl.exe57⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pppvp.exec:\pppvp.exe58⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lffxlfr.exec:\lffxlfr.exe59⤵
- Executes dropped EXE
PID:1236 -
\??\c:\djjdd.exec:\djjdd.exe60⤵
- Executes dropped EXE
PID:4000 -
\??\c:\fllxrrl.exec:\fllxrrl.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lxlrrff.exec:\lxlrrff.exe62⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nhnbbb.exec:\nhnbbb.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rxxfrrx.exec:\rxxfrrx.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vjppv.exec:\vjppv.exe65⤵
- Executes dropped EXE
PID:5064 -
\??\c:\1xxxrxl.exec:\1xxxrxl.exe66⤵PID:4960
-
\??\c:\bbttbt.exec:\bbttbt.exe67⤵PID:3764
-
\??\c:\jdddd.exec:\jdddd.exe68⤵PID:3192
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe69⤵PID:1292
-
\??\c:\bhnbbn.exec:\bhnbbn.exe70⤵PID:5016
-
\??\c:\jpdvd.exec:\jpdvd.exe71⤵PID:3496
-
\??\c:\xrrllff.exec:\xrrllff.exe72⤵PID:1304
-
\??\c:\bttbhb.exec:\bttbhb.exe73⤵PID:428
-
\??\c:\vjvvd.exec:\vjvvd.exe74⤵PID:3536
-
\??\c:\fxxllxf.exec:\fxxllxf.exe75⤵PID:2284
-
\??\c:\bhbbht.exec:\bhbbht.exe76⤵PID:4972
-
\??\c:\jjjjv.exec:\jjjjv.exe77⤵PID:3040
-
\??\c:\rrlrlrr.exec:\rrlrlrr.exe78⤵PID:2576
-
\??\c:\nbhtnb.exec:\nbhtnb.exe79⤵PID:2292
-
\??\c:\dpjvp.exec:\dpjvp.exe80⤵PID:4684
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe81⤵PID:2828
-
\??\c:\nnnhhb.exec:\nnnhhb.exe82⤵PID:4368
-
\??\c:\5jjpj.exec:\5jjpj.exe83⤵PID:2956
-
\??\c:\rlfxllf.exec:\rlfxllf.exe84⤵PID:392
-
\??\c:\9bnnnh.exec:\9bnnnh.exe85⤵PID:936
-
\??\c:\jpvjp.exec:\jpvjp.exe86⤵PID:3420
-
\??\c:\rxrxxxl.exec:\rxrxxxl.exe87⤵PID:448
-
\??\c:\dpvvd.exec:\dpvvd.exe88⤵PID:4520
-
\??\c:\1pvpv.exec:\1pvpv.exe89⤵PID:4508
-
\??\c:\rxlfrlx.exec:\rxlfrlx.exe90⤵PID:3540
-
\??\c:\djpvj.exec:\djpvj.exe91⤵PID:892
-
\??\c:\lrxrlrf.exec:\lrxrlrf.exe92⤵PID:4692
-
\??\c:\nnhhbh.exec:\nnhhbh.exe93⤵PID:3204
-
\??\c:\jdpjp.exec:\jdpjp.exe94⤵PID:2700
-
\??\c:\lxffffl.exec:\lxffffl.exe95⤵PID:3560
-
\??\c:\7nbnnh.exec:\7nbnnh.exe96⤵PID:5088
-
\??\c:\xfffrxr.exec:\xfffrxr.exe97⤵PID:1856
-
\??\c:\nnhnnb.exec:\nnhnnb.exe98⤵PID:5072
-
\??\c:\jvvjj.exec:\jvvjj.exe99⤵PID:2892
-
\??\c:\hhhnht.exec:\hhhnht.exe100⤵PID:2148
-
\??\c:\vvddv.exec:\vvddv.exe101⤵PID:5052
-
\??\c:\xrllrxf.exec:\xrllrxf.exe102⤵PID:1828
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe103⤵PID:1668
-
\??\c:\nthbnt.exec:\nthbnt.exe104⤵PID:212
-
\??\c:\vvdjj.exec:\vvdjj.exe105⤵PID:5108
-
\??\c:\5xllxrf.exec:\5xllxrf.exe106⤵PID:2328
-
\??\c:\bnnbnb.exec:\bnnbnb.exe107⤵PID:2760
-
\??\c:\rxrrfff.exec:\rxrrfff.exe108⤵PID:4696
-
\??\c:\nnbbtn.exec:\nnbbtn.exe109⤵PID:5092
-
\??\c:\vddjj.exec:\vddjj.exe110⤵
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\tnbnth.exec:\tnbnth.exe111⤵PID:4440
-
\??\c:\djvdp.exec:\djvdp.exe112⤵PID:2632
-
\??\c:\lffxflx.exec:\lffxflx.exe113⤵PID:4808
-
\??\c:\jvpjd.exec:\jvpjd.exe114⤵PID:4872
-
\??\c:\tttnbt.exec:\tttnbt.exe115⤵PID:2256
-
\??\c:\thnbhh.exec:\thnbhh.exe116⤵PID:3160
-
\??\c:\pvdvj.exec:\pvdvj.exe117⤵PID:1848
-
\??\c:\7ppvv.exec:\7ppvv.exe118⤵PID:2644
-
\??\c:\rxlrllx.exec:\rxlrllx.exe119⤵PID:4960
-
\??\c:\tnbhnt.exec:\tnbhnt.exe120⤵PID:2192
-
\??\c:\9btbhb.exec:\9btbhb.exe121⤵PID:1344
-
\??\c:\ffxllrx.exec:\ffxllrx.exe122⤵PID:488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-