Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe
Resource
win7-20240903-en
General
-
Target
a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe
-
Size
75KB
-
MD5
0f284cb2d33de3b5fd265fd6e882f3c8
-
SHA1
4ac82842e54bdda8d3e971d9eb8dcd4c5c9dc21f
-
SHA256
a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd
-
SHA512
91edf24e98e3622c2ac50b272a73cc74a63e0a9d21b0230e7ab08c434124b04f4fa189a8ce5ccbc6e1ecbbc83b9594809e3aeb8bf6ebc8a7f50ef29d992f1a24
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmg:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHb
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3580-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3336 5vdjd.exe 1444 rffrxfr.exe 2212 tbhbbt.exe 2520 ppvpj.exe 3704 3rxrflr.exe 4488 llxxrlf.exe 2516 tbhbtt.exe 4772 rllflff.exe 4936 fxrlfff.exe 4452 pjppv.exe 2508 1vjdv.exe 1136 lfflrfr.exe 4476 ppjjd.exe 3916 pjvpp.exe 640 rrrxxxr.exe 3400 5bbbbh.exe 948 dvvpp.exe 3720 1xllflf.exe 3348 btbbtt.exe 4404 tbhhtt.exe 2404 jdjdv.exe 1704 rflfrrl.exe 1688 rrffxff.exe 3504 nhhhhh.exe 748 ppjdv.exe 4780 9xxrfff.exe 4040 lfxxrrr.exe 2332 htbhbn.exe 552 jdddp.exe 1972 llfxffx.exe 1352 1xllfxx.exe 4900 xrfxffx.exe 4416 tnnnhn.exe 2908 dvvvv.exe 4508 vppjd.exe 4056 1pvpd.exe 4552 frrlffx.exe 3124 rfrrrrx.exe 2928 thhhhh.exe 4440 hntthh.exe 1644 pjppv.exe 2148 pjvvv.exe 4868 lflffff.exe 3612 lxllfff.exe 2212 hthbtt.exe 1192 nnhttn.exe 3704 1vjdj.exe 4224 pjjjj.exe 1640 llxrlll.exe 2644 frrfrlr.exe 2516 hbhbbn.exe 5048 tnnnnn.exe 3048 9jvpv.exe 2504 9pdvd.exe 3924 lflllff.exe 4140 hhhbtt.exe 4500 bhhbtt.exe 2220 dvpjv.exe 3324 3rrlffx.exe 2136 rlllffx.exe 4456 bbhhhh.exe 1828 bthhbb.exe 1676 ppvvp.exe 396 3vjdd.exe -
resource yara_rule behavioral2/memory/3580-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlffx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3580 wrote to memory of 3336 3580 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 83 PID 3580 wrote to memory of 3336 3580 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 83 PID 3580 wrote to memory of 3336 3580 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 83 PID 3336 wrote to memory of 1444 3336 5vdjd.exe 84 PID 3336 wrote to memory of 1444 3336 5vdjd.exe 84 PID 3336 wrote to memory of 1444 3336 5vdjd.exe 84 PID 1444 wrote to memory of 2212 1444 rffrxfr.exe 85 PID 1444 wrote to memory of 2212 1444 rffrxfr.exe 85 PID 1444 wrote to memory of 2212 1444 rffrxfr.exe 85 PID 2212 wrote to memory of 2520 2212 tbhbbt.exe 86 PID 2212 wrote to memory of 2520 2212 tbhbbt.exe 86 PID 2212 wrote to memory of 2520 2212 tbhbbt.exe 86 PID 2520 wrote to memory of 3704 2520 ppvpj.exe 87 PID 2520 wrote to memory of 3704 2520 ppvpj.exe 87 PID 2520 wrote to memory of 3704 2520 ppvpj.exe 87 PID 3704 wrote to memory of 4488 3704 3rxrflr.exe 88 PID 3704 wrote to memory of 4488 3704 3rxrflr.exe 88 PID 3704 wrote to memory of 4488 3704 3rxrflr.exe 88 PID 4488 wrote to memory of 2516 4488 llxxrlf.exe 89 PID 4488 wrote to memory of 2516 4488 llxxrlf.exe 89 PID 4488 wrote to memory of 2516 4488 llxxrlf.exe 89 PID 2516 wrote to memory of 4772 2516 tbhbtt.exe 91 PID 2516 wrote to memory of 4772 2516 tbhbtt.exe 91 PID 2516 wrote to memory of 4772 2516 tbhbtt.exe 91 PID 4772 wrote to memory of 4936 4772 rllflff.exe 92 PID 4772 wrote to memory of 4936 4772 rllflff.exe 92 PID 4772 wrote to memory of 4936 4772 rllflff.exe 92 PID 4936 wrote to memory of 4452 4936 fxrlfff.exe 93 PID 4936 wrote to memory of 4452 4936 fxrlfff.exe 93 PID 4936 wrote to memory of 4452 4936 fxrlfff.exe 93 PID 4452 wrote to memory of 2508 4452 pjppv.exe 95 PID 4452 wrote to memory of 2508 4452 pjppv.exe 95 PID 4452 wrote to memory of 2508 4452 pjppv.exe 95 PID 2508 wrote to memory of 1136 2508 1vjdv.exe 96 PID 2508 wrote to memory of 1136 2508 1vjdv.exe 96 PID 2508 wrote to memory of 1136 2508 1vjdv.exe 96 PID 1136 wrote to memory of 4476 1136 lfflrfr.exe 97 PID 1136 wrote to memory of 4476 1136 lfflrfr.exe 97 PID 1136 wrote to memory of 4476 1136 lfflrfr.exe 97 PID 4476 wrote to memory of 3916 4476 ppjjd.exe 98 PID 4476 wrote to memory of 3916 4476 ppjjd.exe 98 PID 4476 wrote to memory of 3916 4476 ppjjd.exe 98 PID 3916 wrote to memory of 640 3916 pjvpp.exe 99 PID 3916 wrote to memory of 640 3916 pjvpp.exe 99 PID 3916 wrote to memory of 640 3916 pjvpp.exe 99 PID 640 wrote to memory of 3400 640 rrrxxxr.exe 100 PID 640 wrote to memory of 3400 640 rrrxxxr.exe 100 PID 640 wrote to memory of 3400 640 rrrxxxr.exe 100 PID 3400 wrote to memory of 948 3400 5bbbbh.exe 102 PID 3400 wrote to memory of 948 3400 5bbbbh.exe 102 PID 3400 wrote to memory of 948 3400 5bbbbh.exe 102 PID 948 wrote to memory of 3720 948 dvvpp.exe 103 PID 948 wrote to memory of 3720 948 dvvpp.exe 103 PID 948 wrote to memory of 3720 948 dvvpp.exe 103 PID 3720 wrote to memory of 3348 3720 1xllflf.exe 104 PID 3720 wrote to memory of 3348 3720 1xllflf.exe 104 PID 3720 wrote to memory of 3348 3720 1xllflf.exe 104 PID 3348 wrote to memory of 4404 3348 btbbtt.exe 105 PID 3348 wrote to memory of 4404 3348 btbbtt.exe 105 PID 3348 wrote to memory of 4404 3348 btbbtt.exe 105 PID 4404 wrote to memory of 2404 4404 tbhhtt.exe 106 PID 4404 wrote to memory of 2404 4404 tbhhtt.exe 106 PID 4404 wrote to memory of 2404 4404 tbhhtt.exe 106 PID 2404 wrote to memory of 1704 2404 jdjdv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe"C:\Users\Admin\AppData\Local\Temp\a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\5vdjd.exec:\5vdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\rffrxfr.exec:\rffrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\tbhbbt.exec:\tbhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ppvpj.exec:\ppvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3rxrflr.exec:\3rxrflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\llxxrlf.exec:\llxxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\tbhbtt.exec:\tbhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rllflff.exec:\rllflff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\fxrlfff.exec:\fxrlfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\pjppv.exec:\pjppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\1vjdv.exec:\1vjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lfflrfr.exec:\lfflrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\ppjjd.exec:\ppjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pjvpp.exec:\pjvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\rrrxxxr.exec:\rrrxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\5bbbbh.exec:\5bbbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\dvvpp.exec:\dvvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\1xllflf.exec:\1xllflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\btbbtt.exec:\btbbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\tbhhtt.exec:\tbhhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\jdjdv.exec:\jdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rflfrrl.exec:\rflfrrl.exe23⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rrffxff.exec:\rrffxff.exe24⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nhhhhh.exec:\nhhhhh.exe25⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ppjdv.exec:\ppjdv.exe26⤵
- Executes dropped EXE
PID:748 -
\??\c:\9xxrfff.exec:\9xxrfff.exe27⤵
- Executes dropped EXE
PID:4780 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe28⤵
- Executes dropped EXE
PID:4040 -
\??\c:\htbhbn.exec:\htbhbn.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdddp.exec:\jdddp.exe30⤵
- Executes dropped EXE
PID:552 -
\??\c:\llfxffx.exec:\llfxffx.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\1xllfxx.exec:\1xllfxx.exe32⤵
- Executes dropped EXE
PID:1352 -
\??\c:\xrfxffx.exec:\xrfxffx.exe33⤵
- Executes dropped EXE
PID:4900 -
\??\c:\tnnnhn.exec:\tnnnhn.exe34⤵
- Executes dropped EXE
PID:4416 -
\??\c:\dvvvv.exec:\dvvvv.exe35⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vppjd.exec:\vppjd.exe36⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1pvpd.exec:\1pvpd.exe37⤵
- Executes dropped EXE
PID:4056 -
\??\c:\frrlffx.exec:\frrlffx.exe38⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe39⤵
- Executes dropped EXE
PID:3124 -
\??\c:\thhhhh.exec:\thhhhh.exe40⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hntthh.exec:\hntthh.exe41⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pjppv.exec:\pjppv.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pjvvv.exec:\pjvvv.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lflffff.exec:\lflffff.exe44⤵
- Executes dropped EXE
PID:4868 -
\??\c:\lxllfff.exec:\lxllfff.exe45⤵
- Executes dropped EXE
PID:3612 -
\??\c:\hthbtt.exec:\hthbtt.exe46⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nnhttn.exec:\nnhttn.exe47⤵
- Executes dropped EXE
PID:1192 -
\??\c:\1vjdj.exec:\1vjdj.exe48⤵
- Executes dropped EXE
PID:3704 -
\??\c:\pjjjj.exec:\pjjjj.exe49⤵
- Executes dropped EXE
PID:4224 -
\??\c:\llxrlll.exec:\llxrlll.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\frrfrlr.exec:\frrfrlr.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbhbbn.exec:\hbhbbn.exe52⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tnnnnn.exec:\tnnnnn.exe53⤵
- Executes dropped EXE
PID:5048 -
\??\c:\9jvpv.exec:\9jvpv.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9pdvd.exec:\9pdvd.exe55⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lflllff.exec:\lflllff.exe56⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhhbtt.exec:\hhhbtt.exe57⤵
- Executes dropped EXE
PID:4140 -
\??\c:\bhhbtt.exec:\bhhbtt.exe58⤵
- Executes dropped EXE
PID:4500 -
\??\c:\dvpjv.exec:\dvpjv.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3rrlffx.exec:\3rrlffx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3324 -
\??\c:\rlllffx.exec:\rlllffx.exe61⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bbhhhh.exec:\bbhhhh.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\bthhbb.exec:\bthhbb.exe63⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ppvvp.exec:\ppvvp.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\3vjdd.exec:\3vjdd.exe65⤵
- Executes dropped EXE
PID:396 -
\??\c:\3lfxxrr.exec:\3lfxxrr.exe66⤵PID:3968
-
\??\c:\hbtbbn.exec:\hbtbbn.exe67⤵PID:1588
-
\??\c:\tnthbh.exec:\tnthbh.exe68⤵PID:64
-
\??\c:\jjjjv.exec:\jjjjv.exe69⤵PID:4468
-
\??\c:\jdjdv.exec:\jdjdv.exe70⤵PID:5024
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe71⤵PID:3960
-
\??\c:\9dvjd.exec:\9dvjd.exe72⤵PID:1764
-
\??\c:\pppjd.exec:\pppjd.exe73⤵PID:1704
-
\??\c:\7rxrffx.exec:\7rxrffx.exe74⤵PID:548
-
\??\c:\bbthbt.exec:\bbthbt.exe75⤵PID:4436
-
\??\c:\tnhbbb.exec:\tnhbbb.exe76⤵PID:1984
-
\??\c:\dppjj.exec:\dppjj.exe77⤵PID:1760
-
\??\c:\9vvvp.exec:\9vvvp.exe78⤵PID:2040
-
\??\c:\5tbnhb.exec:\5tbnhb.exe79⤵PID:4492
-
\??\c:\pdpjd.exec:\pdpjd.exe80⤵PID:1304
-
\??\c:\jdjpv.exec:\jdjpv.exe81⤵PID:4448
-
\??\c:\7llfrrl.exec:\7llfrrl.exe82⤵PID:3652
-
\??\c:\bnbtnh.exec:\bnbtnh.exe83⤵
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\nhnnhn.exec:\nhnnhn.exe84⤵PID:3596
-
\??\c:\jjdvp.exec:\jjdvp.exe85⤵PID:3692
-
\??\c:\xflflfx.exec:\xflflfx.exe86⤵PID:3668
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe87⤵PID:2592
-
\??\c:\hbttnh.exec:\hbttnh.exe88⤵PID:1196
-
\??\c:\pdvvd.exec:\pdvvd.exe89⤵PID:3128
-
\??\c:\dvvpd.exec:\dvvpd.exe90⤵PID:1536
-
\??\c:\xlrrfff.exec:\xlrrfff.exe91⤵PID:468
-
\??\c:\lfllffl.exec:\lfllffl.exe92⤵PID:4024
-
\??\c:\nttbbn.exec:\nttbbn.exe93⤵PID:3688
-
\??\c:\hthhbb.exec:\hthhbb.exe94⤵PID:4832
-
\??\c:\vvjvv.exec:\vvjvv.exe95⤵PID:3856
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:3008
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe97⤵PID:4964
-
\??\c:\3llfxlf.exec:\3llfxlf.exe98⤵PID:208
-
\??\c:\tthhnh.exec:\tthhnh.exe99⤵PID:2520
-
\??\c:\jjvjj.exec:\jjvjj.exe100⤵PID:3892
-
\??\c:\xxlfxlf.exec:\xxlfxlf.exe101⤵PID:1980
-
\??\c:\3lrfffx.exec:\3lrfffx.exe102⤵PID:3704
-
\??\c:\3nntnn.exec:\3nntnn.exe103⤵PID:1540
-
\??\c:\hhttnn.exec:\hhttnn.exe104⤵PID:2256
-
\??\c:\vjvjv.exec:\vjvjv.exe105⤵PID:5112
-
\??\c:\ppvvp.exec:\ppvvp.exe106⤵PID:1532
-
\??\c:\rrlllxr.exec:\rrlllxr.exe107⤵PID:1356
-
\??\c:\3hhnhb.exec:\3hhnhb.exe108⤵PID:3048
-
\??\c:\tttnbb.exec:\tttnbb.exe109⤵PID:4812
-
\??\c:\nhttnb.exec:\nhttnb.exe110⤵PID:3924
-
\??\c:\ppvvj.exec:\ppvvj.exe111⤵PID:4324
-
\??\c:\pppjv.exec:\pppjv.exe112⤵PID:2196
-
\??\c:\9rlfrrf.exec:\9rlfrrf.exe113⤵PID:4476
-
\??\c:\flfllrr.exec:\flfllrr.exe114⤵PID:1784
-
\??\c:\ttttnt.exec:\ttttnt.exe115⤵PID:2136
-
\??\c:\7thbbb.exec:\7thbbb.exe116⤵PID:4292
-
\??\c:\3vpvp.exec:\3vpvp.exe117⤵PID:2284
-
\??\c:\djjdv.exec:\djjdv.exe118⤵PID:3424
-
\??\c:\hthtnb.exec:\hthtnb.exe119⤵PID:540
-
\??\c:\btnhtn.exec:\btnhtn.exe120⤵PID:2204
-
\??\c:\jjvjd.exec:\jjvjd.exe121⤵PID:5020
-
\??\c:\ppddp.exec:\ppddp.exe122⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-