Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 13:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a142998fca9c12f4160eb2e36e2f5f10N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
a142998fca9c12f4160eb2e36e2f5f10N.exe
-
Size
80KB
-
MD5
a142998fca9c12f4160eb2e36e2f5f10
-
SHA1
16734c7c7c1df4c5fdab6271ae99675f85796566
-
SHA256
a7015d10f6b924f00acac405507a811ed462ecf4348cd37478f90e18185aa66b
-
SHA512
6da9003e499e9d93ac8f9b33d4c1c547c53210fb4b13709ad6dbe755c8c1f554adb12bdf20e1f0cd6c0b6ef6a1577509d681aadba023d0111ed99c2449d3052d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC52v:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCm
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/3416-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3664 bbhnnt.exe 1172 vjjvp.exe 3228 btbnnn.exe 2728 vdjdv.exe 2016 nhnnnn.exe 2408 bntnhb.exe 3864 dpvvj.exe 2064 xrrfxxr.exe 4476 3hnbtt.exe 1832 vpddj.exe 4444 frrfxrl.exe 4020 3thbnn.exe 4828 ntbttb.exe 1444 dpdjd.exe 4420 5lrrfff.exe 4672 ttbtbb.exe 3772 jdpjj.exe 1876 vpddv.exe 4852 rlxrrfx.exe 928 frlfxxr.exe 3172 nhbbtb.exe 1928 vpvpj.exe 452 pjpjd.exe 1440 xlrxrxx.exe 3752 tbnhnh.exe 1684 tnhhtt.exe 3568 ddvpv.exe 3152 fxffxxr.exe 2536 tnhbnn.exe 3060 bnnnnn.exe 4376 jvjdv.exe 3708 lfxlflf.exe 2032 frrlrlf.exe 2588 hnnntt.exe 2256 nbbhtb.exe 3220 ppvvp.exe 1620 rlfxrrl.exe 1236 lfffxxf.exe 4292 3bhhbb.exe 4392 hnbtnt.exe 3112 vdvjp.exe 3652 rllflfr.exe 4652 fxxrllf.exe 2224 ttbhhh.exe 4696 jdddv.exe 4532 pjpvv.exe 3884 llffrxx.exe 4528 9lxfxff.exe 4416 ttbbtb.exe 464 hbnhth.exe 3864 vjddj.exe 3596 xrrlffx.exe 3508 rxxrrrr.exe 1604 tthbbb.exe 4476 bhnhbb.exe 4536 pdvjd.exe 2760 lxlrfxx.exe 2448 1flfxxr.exe 1616 nhtnbb.exe 4804 3tnhbb.exe 3620 pjpjv.exe 1308 pvppj.exe 2124 rllrllf.exe 2120 lffxrrr.exe -
resource yara_rule behavioral2/memory/3416-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 3664 3416 a142998fca9c12f4160eb2e36e2f5f10N.exe 83 PID 3416 wrote to memory of 3664 3416 a142998fca9c12f4160eb2e36e2f5f10N.exe 83 PID 3416 wrote to memory of 3664 3416 a142998fca9c12f4160eb2e36e2f5f10N.exe 83 PID 3664 wrote to memory of 1172 3664 bbhnnt.exe 84 PID 3664 wrote to memory of 1172 3664 bbhnnt.exe 84 PID 3664 wrote to memory of 1172 3664 bbhnnt.exe 84 PID 1172 wrote to memory of 3228 1172 vjjvp.exe 85 PID 1172 wrote to memory of 3228 1172 vjjvp.exe 85 PID 1172 wrote to memory of 3228 1172 vjjvp.exe 85 PID 3228 wrote to memory of 2728 3228 btbnnn.exe 87 PID 3228 wrote to memory of 2728 3228 btbnnn.exe 87 PID 3228 wrote to memory of 2728 3228 btbnnn.exe 87 PID 2728 wrote to memory of 2016 2728 vdjdv.exe 88 PID 2728 wrote to memory of 2016 2728 vdjdv.exe 88 PID 2728 wrote to memory of 2016 2728 vdjdv.exe 88 PID 2016 wrote to memory of 2408 2016 nhnnnn.exe 89 PID 2016 wrote to memory of 2408 2016 nhnnnn.exe 89 PID 2016 wrote to memory of 2408 2016 nhnnnn.exe 89 PID 2408 wrote to memory of 3864 2408 bntnhb.exe 91 PID 2408 wrote to memory of 3864 2408 bntnhb.exe 91 PID 2408 wrote to memory of 3864 2408 bntnhb.exe 91 PID 3864 wrote to memory of 2064 3864 dpvvj.exe 92 PID 3864 wrote to memory of 2064 3864 dpvvj.exe 92 PID 3864 wrote to memory of 2064 3864 dpvvj.exe 92 PID 2064 wrote to memory of 4476 2064 xrrfxxr.exe 93 PID 2064 wrote to memory of 4476 2064 xrrfxxr.exe 93 PID 2064 wrote to memory of 4476 2064 xrrfxxr.exe 93 PID 4476 wrote to memory of 1832 4476 3hnbtt.exe 94 PID 4476 wrote to memory of 1832 4476 3hnbtt.exe 94 PID 4476 wrote to memory of 1832 4476 3hnbtt.exe 94 PID 1832 wrote to memory of 4444 1832 vpddj.exe 95 PID 1832 wrote to memory of 4444 1832 vpddj.exe 95 PID 1832 wrote to memory of 4444 1832 vpddj.exe 95 PID 4444 wrote to memory of 4020 4444 frrfxrl.exe 96 PID 4444 wrote to memory of 4020 4444 frrfxrl.exe 96 PID 4444 wrote to memory of 4020 4444 frrfxrl.exe 96 PID 4020 wrote to memory of 4828 4020 3thbnn.exe 97 PID 4020 wrote to memory of 4828 4020 3thbnn.exe 97 PID 4020 wrote to memory of 4828 4020 3thbnn.exe 97 PID 4828 wrote to memory of 1444 4828 ntbttb.exe 98 PID 4828 wrote to memory of 1444 4828 ntbttb.exe 98 PID 4828 wrote to memory of 1444 4828 ntbttb.exe 98 PID 1444 wrote to memory of 4420 1444 dpdjd.exe 100 PID 1444 wrote to memory of 4420 1444 dpdjd.exe 100 PID 1444 wrote to memory of 4420 1444 dpdjd.exe 100 PID 4420 wrote to memory of 4672 4420 5lrrfff.exe 101 PID 4420 wrote to memory of 4672 4420 5lrrfff.exe 101 PID 4420 wrote to memory of 4672 4420 5lrrfff.exe 101 PID 4672 wrote to memory of 3772 4672 ttbtbb.exe 102 PID 4672 wrote to memory of 3772 4672 ttbtbb.exe 102 PID 4672 wrote to memory of 3772 4672 ttbtbb.exe 102 PID 3772 wrote to memory of 1876 3772 jdpjj.exe 103 PID 3772 wrote to memory of 1876 3772 jdpjj.exe 103 PID 3772 wrote to memory of 1876 3772 jdpjj.exe 103 PID 1876 wrote to memory of 4852 1876 vpddv.exe 104 PID 1876 wrote to memory of 4852 1876 vpddv.exe 104 PID 1876 wrote to memory of 4852 1876 vpddv.exe 104 PID 4852 wrote to memory of 928 4852 rlxrrfx.exe 105 PID 4852 wrote to memory of 928 4852 rlxrrfx.exe 105 PID 4852 wrote to memory of 928 4852 rlxrrfx.exe 105 PID 928 wrote to memory of 3172 928 frlfxxr.exe 106 PID 928 wrote to memory of 3172 928 frlfxxr.exe 106 PID 928 wrote to memory of 3172 928 frlfxxr.exe 106 PID 3172 wrote to memory of 1928 3172 nhbbtb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a142998fca9c12f4160eb2e36e2f5f10N.exe"C:\Users\Admin\AppData\Local\Temp\a142998fca9c12f4160eb2e36e2f5f10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\bbhnnt.exec:\bbhnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\vjjvp.exec:\vjjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\btbnnn.exec:\btbnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\vdjdv.exec:\vdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhnnnn.exec:\nhnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bntnhb.exec:\bntnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\dpvvj.exec:\dpvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\3hnbtt.exec:\3hnbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\vpddj.exec:\vpddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\frrfxrl.exec:\frrfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\3thbnn.exec:\3thbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\ntbttb.exec:\ntbttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\dpdjd.exec:\dpdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\5lrrfff.exec:\5lrrfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\ttbtbb.exec:\ttbtbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\jdpjj.exec:\jdpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\vpddv.exec:\vpddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rlxrrfx.exec:\rlxrrfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\frlfxxr.exec:\frlfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\nhbbtb.exec:\nhbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\vpvpj.exec:\vpvpj.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pjpjd.exec:\pjpjd.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\xlrxrxx.exec:\xlrxrxx.exe25⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tbnhnh.exec:\tbnhnh.exe26⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tnhhtt.exec:\tnhhtt.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\ddvpv.exec:\ddvpv.exe28⤵
- Executes dropped EXE
PID:3568 -
\??\c:\fxffxxr.exec:\fxffxxr.exe29⤵
- Executes dropped EXE
PID:3152 -
\??\c:\tnhbnn.exec:\tnhbnn.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bnnnnn.exec:\bnnnnn.exe31⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jvjdv.exec:\jvjdv.exe32⤵
- Executes dropped EXE
PID:4376 -
\??\c:\lfxlflf.exec:\lfxlflf.exe33⤵
- Executes dropped EXE
PID:3708 -
\??\c:\frrlrlf.exec:\frrlrlf.exe34⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hnnntt.exec:\hnnntt.exe35⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nbbhtb.exec:\nbbhtb.exe36⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ppvvp.exec:\ppvvp.exe37⤵
- Executes dropped EXE
PID:3220 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe38⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lfffxxf.exec:\lfffxxf.exe39⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3bhhbb.exec:\3bhhbb.exe40⤵
- Executes dropped EXE
PID:4292 -
\??\c:\hnbtnt.exec:\hnbtnt.exe41⤵
- Executes dropped EXE
PID:4392 -
\??\c:\vdvjp.exec:\vdvjp.exe42⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rllflfr.exec:\rllflfr.exe43⤵
- Executes dropped EXE
PID:3652 -
\??\c:\fxxrllf.exec:\fxxrllf.exe44⤵
- Executes dropped EXE
PID:4652 -
\??\c:\ttbhhh.exec:\ttbhhh.exe45⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jdddv.exec:\jdddv.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pjpvv.exec:\pjpvv.exe47⤵
- Executes dropped EXE
PID:4532 -
\??\c:\llffrxx.exec:\llffrxx.exe48⤵
- Executes dropped EXE
PID:3884 -
\??\c:\9lxfxff.exec:\9lxfxff.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ttbbtb.exec:\ttbbtb.exe50⤵
- Executes dropped EXE
PID:4416 -
\??\c:\hbnhth.exec:\hbnhth.exe51⤵
- Executes dropped EXE
PID:464 -
\??\c:\vjddj.exec:\vjddj.exe52⤵
- Executes dropped EXE
PID:3864 -
\??\c:\xrrlffx.exec:\xrrlffx.exe53⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe54⤵
- Executes dropped EXE
PID:3508 -
\??\c:\tthbbb.exec:\tthbbb.exe55⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bhnhbb.exec:\bhnhbb.exe56⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pdvjd.exec:\pdvjd.exe57⤵
- Executes dropped EXE
PID:4536 -
\??\c:\lxlrfxx.exec:\lxlrfxx.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
\??\c:\1flfxxr.exec:\1flfxxr.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nhtnbb.exec:\nhtnbb.exe60⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3tnhbb.exec:\3tnhbb.exe61⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjpjv.exec:\pjpjv.exe62⤵
- Executes dropped EXE
PID:3620 -
\??\c:\pvppj.exec:\pvppj.exe63⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rllrllf.exec:\rllrllf.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lffxrrr.exec:\lffxrrr.exe65⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hbnhbt.exec:\hbnhbt.exe66⤵PID:4420
-
\??\c:\vddvp.exec:\vddvp.exe67⤵PID:1672
-
\??\c:\7jpjv.exec:\7jpjv.exe68⤵PID:3680
-
\??\c:\xrlfllf.exec:\xrlfllf.exe69⤵PID:228
-
\??\c:\nnnhhh.exec:\nnnhhh.exe70⤵PID:2452
-
\??\c:\1nbbbb.exec:\1nbbbb.exe71⤵PID:1748
-
\??\c:\pjddv.exec:\pjddv.exe72⤵PID:2228
-
\??\c:\ffxxlll.exec:\ffxxlll.exe73⤵PID:4764
-
\??\c:\frlfrlf.exec:\frlfrlf.exe74⤵PID:3812
-
\??\c:\nnhbnn.exec:\nnhbnn.exe75⤵PID:2304
-
\??\c:\9ntnbb.exec:\9ntnbb.exe76⤵PID:4160
-
\??\c:\5vvvj.exec:\5vvvj.exe77⤵PID:3412
-
\??\c:\lllffff.exec:\lllffff.exe78⤵PID:1896
-
\??\c:\nnhntb.exec:\nnhntb.exe79⤵PID:1836
-
\??\c:\hnnhbb.exec:\hnnhbb.exe80⤵PID:1492
-
\??\c:\frxxrrl.exec:\frxxrrl.exe81⤵PID:5092
-
\??\c:\xrffxfr.exec:\xrffxfr.exe82⤵PID:4996
-
\??\c:\nttttt.exec:\nttttt.exe83⤵PID:4056
-
\??\c:\vjjdv.exec:\vjjdv.exe84⤵PID:3188
-
\??\c:\ppddd.exec:\ppddd.exe85⤵PID:1040
-
\??\c:\rlrllll.exec:\rlrllll.exe86⤵PID:4068
-
\??\c:\7bhbnn.exec:\7bhbnn.exe87⤵PID:2412
-
\??\c:\7bbtnh.exec:\7bbtnh.exe88⤵PID:4700
-
\??\c:\jvjvj.exec:\jvjvj.exe89⤵PID:1572
-
\??\c:\xllxxrx.exec:\xllxxrx.exe90⤵PID:2508
-
\??\c:\xrrlfff.exec:\xrrlfff.exe91⤵PID:2044
-
\??\c:\bbnbht.exec:\bbnbht.exe92⤵PID:3816
-
\??\c:\thnttt.exec:\thnttt.exe93⤵PID:432
-
\??\c:\dvpdp.exec:\dvpdp.exe94⤵PID:1044
-
\??\c:\9dvpj.exec:\9dvpj.exe95⤵PID:4952
-
\??\c:\fffrllf.exec:\fffrllf.exe96⤵PID:216
-
\??\c:\9bbbbb.exec:\9bbbbb.exe97⤵PID:1332
-
\??\c:\btbbnh.exec:\btbbnh.exe98⤵PID:4284
-
\??\c:\ddvjv.exec:\ddvjv.exe99⤵PID:3228
-
\??\c:\1jjvd.exec:\1jjvd.exe100⤵PID:1168
-
\??\c:\lffxllf.exec:\lffxllf.exe101⤵PID:3980
-
\??\c:\thbthh.exec:\thbthh.exe102⤵PID:2016
-
\??\c:\bnnbth.exec:\bnnbth.exe103⤵PID:4384
-
\??\c:\vvjdp.exec:\vvjdp.exe104⤵PID:2236
-
\??\c:\vvddv.exec:\vvddv.exe105⤵PID:2976
-
\??\c:\lffxlrl.exec:\lffxlrl.exe106⤵PID:1136
-
\??\c:\thhbnh.exec:\thhbnh.exe107⤵PID:1716
-
\??\c:\1vpvj.exec:\1vpvj.exe108⤵PID:3372
-
\??\c:\9fxlrrr.exec:\9fxlrrr.exe109⤵PID:404
-
\??\c:\1ttnhb.exec:\1ttnhb.exe110⤵PID:2440
-
\??\c:\bnnhhh.exec:\bnnhhh.exe111⤵PID:3572
-
\??\c:\djdpj.exec:\djdpj.exe112⤵PID:5060
-
\??\c:\rrxlrrx.exec:\rrxlrrx.exe113⤵PID:820
-
\??\c:\thnnhb.exec:\thnnhb.exe114⤵PID:3516
-
\??\c:\7bbttn.exec:\7bbttn.exe115⤵PID:3620
-
\??\c:\ppvvp.exec:\ppvvp.exe116⤵PID:1308
-
\??\c:\5vvpd.exec:\5vvpd.exe117⤵PID:1184
-
\??\c:\1flfllf.exec:\1flfllf.exe118⤵PID:2120
-
\??\c:\1btnnh.exec:\1btnnh.exe119⤵PID:3860
-
\??\c:\pjvjj.exec:\pjvjj.exe120⤵PID:3772
-
\??\c:\7vdvj.exec:\7vdvj.exe121⤵PID:3680
-
\??\c:\1xrfxxr.exec:\1xrfxxr.exe122⤵PID:228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-