Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 13:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
637d90a79bcf421348e02d8abe5e5200N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
637d90a79bcf421348e02d8abe5e5200N.exe
-
Size
71KB
-
MD5
637d90a79bcf421348e02d8abe5e5200
-
SHA1
34fae86eba14be7a4a4fd54379998e98a6d1dfda
-
SHA256
3eddd37a7962fb6d4e6ab24d84a80e81ad2559cee743a97e1c77fcf6c13be6ae
-
SHA512
cceced0e43da9e74d3c2d449c9c8ff05205c13913a6ed7ad998d6cd8c493edbbf47957b1d44e33d465079a342a024aa01f42fdca89f54fb9c8a56ddd773474c2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjp:ymb3NkkiQ3mdBjFI4VZ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3676-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/564-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4336 hbhnhn.exe 516 hnthtn.exe 564 dddvj.exe 2620 jpvpj.exe 3920 hhtnbt.exe 520 tntbnn.exe 3572 pjdvj.exe 3588 fxxrlfx.exe 4552 9rxxxxf.exe 2944 5nhbtn.exe 4716 7nnbtn.exe 3904 djdvp.exe 2788 jddpd.exe 4768 frrlfxl.exe 3232 tnhbth.exe 3160 hhhtnh.exe 932 jvjdp.exe 1176 djddp.exe 3840 frrfrlf.exe 4824 ttbnbt.exe 1868 hbtthh.exe 4208 9nhthb.exe 4708 1jjdj.exe 4496 rffrlfx.exe 2856 fxrrxrx.exe 3124 bnnhbt.exe 1388 nthbnn.exe 5020 djvpp.exe 4544 vvddp.exe 5048 xfllxrf.exe 2032 fllxrlf.exe 4004 rllfxfx.exe 488 hhbthb.exe 4220 7hhthh.exe 764 vvjvv.exe 1360 vdjvd.exe 1416 rfrlfxl.exe 2792 xlxrrll.exe 4436 ntnnhb.exe 3324 nhhbnh.exe 2912 vdjdj.exe 1724 jdvvj.exe 968 rrlrxxr.exe 3448 bhbbth.exe 4576 5jvpj.exe 884 ppdjv.exe 1212 rrflxfx.exe 4724 bhnhbt.exe 524 bnhthb.exe 3148 dvjdj.exe 2844 9fffxxr.exe 2016 5ppjd.exe 1576 fllfrrf.exe 4268 rxxlxrl.exe 3832 1jjdv.exe 3892 lxfxlff.exe 4188 1btnhn.exe 4976 9btntn.exe 4528 bnnhtn.exe 5008 hntbtt.exe 812 htbtht.exe 2088 1bhbnb.exe 2268 pjvjd.exe 2560 thhhbb.exe -
resource yara_rule behavioral2/memory/3676-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-62-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 4336 3676 637d90a79bcf421348e02d8abe5e5200N.exe 85 PID 3676 wrote to memory of 4336 3676 637d90a79bcf421348e02d8abe5e5200N.exe 85 PID 3676 wrote to memory of 4336 3676 637d90a79bcf421348e02d8abe5e5200N.exe 85 PID 4336 wrote to memory of 516 4336 hbhnhn.exe 86 PID 4336 wrote to memory of 516 4336 hbhnhn.exe 86 PID 4336 wrote to memory of 516 4336 hbhnhn.exe 86 PID 516 wrote to memory of 564 516 hnthtn.exe 87 PID 516 wrote to memory of 564 516 hnthtn.exe 87 PID 516 wrote to memory of 564 516 hnthtn.exe 87 PID 564 wrote to memory of 2620 564 dddvj.exe 88 PID 564 wrote to memory of 2620 564 dddvj.exe 88 PID 564 wrote to memory of 2620 564 dddvj.exe 88 PID 2620 wrote to memory of 3920 2620 jpvpj.exe 89 PID 2620 wrote to memory of 3920 2620 jpvpj.exe 89 PID 2620 wrote to memory of 3920 2620 jpvpj.exe 89 PID 3920 wrote to memory of 520 3920 hhtnbt.exe 91 PID 3920 wrote to memory of 520 3920 hhtnbt.exe 91 PID 3920 wrote to memory of 520 3920 hhtnbt.exe 91 PID 520 wrote to memory of 3572 520 tntbnn.exe 92 PID 520 wrote to memory of 3572 520 tntbnn.exe 92 PID 520 wrote to memory of 3572 520 tntbnn.exe 92 PID 3572 wrote to memory of 3588 3572 pjdvj.exe 93 PID 3572 wrote to memory of 3588 3572 pjdvj.exe 93 PID 3572 wrote to memory of 3588 3572 pjdvj.exe 93 PID 3588 wrote to memory of 4552 3588 fxxrlfx.exe 94 PID 3588 wrote to memory of 4552 3588 fxxrlfx.exe 94 PID 3588 wrote to memory of 4552 3588 fxxrlfx.exe 94 PID 4552 wrote to memory of 2944 4552 9rxxxxf.exe 95 PID 4552 wrote to memory of 2944 4552 9rxxxxf.exe 95 PID 4552 wrote to memory of 2944 4552 9rxxxxf.exe 95 PID 2944 wrote to memory of 4716 2944 5nhbtn.exe 96 PID 2944 wrote to memory of 4716 2944 5nhbtn.exe 96 PID 2944 wrote to memory of 4716 2944 5nhbtn.exe 96 PID 4716 wrote to memory of 3904 4716 7nnbtn.exe 97 PID 4716 wrote to memory of 3904 4716 7nnbtn.exe 97 PID 4716 wrote to memory of 3904 4716 7nnbtn.exe 97 PID 3904 wrote to memory of 2788 3904 djdvp.exe 98 PID 3904 wrote to memory of 2788 3904 djdvp.exe 98 PID 3904 wrote to memory of 2788 3904 djdvp.exe 98 PID 2788 wrote to memory of 4768 2788 jddpd.exe 99 PID 2788 wrote to memory of 4768 2788 jddpd.exe 99 PID 2788 wrote to memory of 4768 2788 jddpd.exe 99 PID 4768 wrote to memory of 3232 4768 frrlfxl.exe 100 PID 4768 wrote to memory of 3232 4768 frrlfxl.exe 100 PID 4768 wrote to memory of 3232 4768 frrlfxl.exe 100 PID 3232 wrote to memory of 3160 3232 tnhbth.exe 101 PID 3232 wrote to memory of 3160 3232 tnhbth.exe 101 PID 3232 wrote to memory of 3160 3232 tnhbth.exe 101 PID 3160 wrote to memory of 932 3160 hhhtnh.exe 102 PID 3160 wrote to memory of 932 3160 hhhtnh.exe 102 PID 3160 wrote to memory of 932 3160 hhhtnh.exe 102 PID 932 wrote to memory of 1176 932 jvjdp.exe 103 PID 932 wrote to memory of 1176 932 jvjdp.exe 103 PID 932 wrote to memory of 1176 932 jvjdp.exe 103 PID 1176 wrote to memory of 3840 1176 djddp.exe 104 PID 1176 wrote to memory of 3840 1176 djddp.exe 104 PID 1176 wrote to memory of 3840 1176 djddp.exe 104 PID 3840 wrote to memory of 4824 3840 frrfrlf.exe 105 PID 3840 wrote to memory of 4824 3840 frrfrlf.exe 105 PID 3840 wrote to memory of 4824 3840 frrfrlf.exe 105 PID 4824 wrote to memory of 1868 4824 ttbnbt.exe 106 PID 4824 wrote to memory of 1868 4824 ttbnbt.exe 106 PID 4824 wrote to memory of 1868 4824 ttbnbt.exe 106 PID 1868 wrote to memory of 4208 1868 hbtthh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\637d90a79bcf421348e02d8abe5e5200N.exe"C:\Users\Admin\AppData\Local\Temp\637d90a79bcf421348e02d8abe5e5200N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\hbhnhn.exec:\hbhnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\hnthtn.exec:\hnthtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\dddvj.exec:\dddvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\jpvpj.exec:\jpvpj.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hhtnbt.exec:\hhtnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\tntbnn.exec:\tntbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\pjdvj.exec:\pjdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\9rxxxxf.exec:\9rxxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\5nhbtn.exec:\5nhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\7nnbtn.exec:\7nnbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\djdvp.exec:\djdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\jddpd.exec:\jddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\frrlfxl.exec:\frrlfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\tnhbth.exec:\tnhbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\hhhtnh.exec:\hhhtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\jvjdp.exec:\jvjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\djddp.exec:\djddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\frrfrlf.exec:\frrfrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\ttbnbt.exec:\ttbnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\hbtthh.exec:\hbtthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\9nhthb.exec:\9nhthb.exe23⤵
- Executes dropped EXE
PID:4208 -
\??\c:\1jjdj.exec:\1jjdj.exe24⤵
- Executes dropped EXE
PID:4708 -
\??\c:\rffrlfx.exec:\rffrlfx.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe26⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bnnhbt.exec:\bnnhbt.exe27⤵
- Executes dropped EXE
PID:3124 -
\??\c:\nthbnn.exec:\nthbnn.exe28⤵
- Executes dropped EXE
PID:1388 -
\??\c:\djvpp.exec:\djvpp.exe29⤵
- Executes dropped EXE
PID:5020 -
\??\c:\vvddp.exec:\vvddp.exe30⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xfllxrf.exec:\xfllxrf.exe31⤵
- Executes dropped EXE
PID:5048 -
\??\c:\fllxrlf.exec:\fllxrlf.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rllfxfx.exec:\rllfxfx.exe33⤵
- Executes dropped EXE
PID:4004 -
\??\c:\hhbthb.exec:\hhbthb.exe34⤵
- Executes dropped EXE
PID:488 -
\??\c:\7hhthh.exec:\7hhthh.exe35⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vvjvv.exec:\vvjvv.exe36⤵
- Executes dropped EXE
PID:764 -
\??\c:\vdjvd.exec:\vdjvd.exe37⤵
- Executes dropped EXE
PID:1360 -
\??\c:\rfrlfxl.exec:\rfrlfxl.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xlxrrll.exec:\xlxrrll.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ntnnhb.exec:\ntnnhb.exe40⤵
- Executes dropped EXE
PID:4436 -
\??\c:\nhhbnh.exec:\nhhbnh.exe41⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vdjdj.exec:\vdjdj.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jdvvj.exec:\jdvvj.exe43⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrlrxxr.exec:\rrlrxxr.exe44⤵
- Executes dropped EXE
PID:968 -
\??\c:\bhbbth.exec:\bhbbth.exe45⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5jvpj.exec:\5jvpj.exe46⤵
- Executes dropped EXE
PID:4576 -
\??\c:\ppdjv.exec:\ppdjv.exe47⤵
- Executes dropped EXE
PID:884 -
\??\c:\rrflxfx.exec:\rrflxfx.exe48⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bhnhbt.exec:\bhnhbt.exe49⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bnhthb.exec:\bnhthb.exe50⤵
- Executes dropped EXE
PID:524 -
\??\c:\dvjdj.exec:\dvjdj.exe51⤵
- Executes dropped EXE
PID:3148 -
\??\c:\9fffxxr.exec:\9fffxxr.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5ppjd.exec:\5ppjd.exe53⤵
- Executes dropped EXE
PID:2016 -
\??\c:\fllfrrf.exec:\fllfrrf.exe54⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe55⤵
- Executes dropped EXE
PID:4268 -
\??\c:\1jjdv.exec:\1jjdv.exe56⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lxfxlff.exec:\lxfxlff.exe57⤵
- Executes dropped EXE
PID:3892 -
\??\c:\1btnhn.exec:\1btnhn.exe58⤵
- Executes dropped EXE
PID:4188 -
\??\c:\9btntn.exec:\9btntn.exe59⤵
- Executes dropped EXE
PID:4976 -
\??\c:\bnnhtn.exec:\bnnhtn.exe60⤵
- Executes dropped EXE
PID:4528 -
\??\c:\hntbtt.exec:\hntbtt.exe61⤵
- Executes dropped EXE
PID:5008 -
\??\c:\htbtht.exec:\htbtht.exe62⤵
- Executes dropped EXE
PID:812 -
\??\c:\1bhbnb.exec:\1bhbnb.exe63⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pjvjd.exec:\pjvjd.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thhhbb.exec:\thhhbb.exe65⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pjjdp.exec:\pjjdp.exe66⤵PID:3688
-
\??\c:\rllfffx.exec:\rllfffx.exe67⤵PID:1636
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe68⤵PID:560
-
\??\c:\9xrlfxr.exec:\9xrlfxr.exe69⤵PID:2536
-
\??\c:\bthhth.exec:\bthhth.exe70⤵PID:4152
-
\??\c:\dppjv.exec:\dppjv.exe71⤵PID:3184
-
\??\c:\pdpjp.exec:\pdpjp.exe72⤵PID:2988
-
\??\c:\5rxlflx.exec:\5rxlflx.exe73⤵PID:768
-
\??\c:\lflffxf.exec:\lflffxf.exe74⤵PID:1460
-
\??\c:\tbhbtn.exec:\tbhbtn.exe75⤵PID:3336
-
\??\c:\5jjdp.exec:\5jjdp.exe76⤵PID:3124
-
\??\c:\jvvvj.exec:\jvvvj.exe77⤵PID:1388
-
\??\c:\lflxxrl.exec:\lflxxrl.exe78⤵PID:3736
-
\??\c:\xlxlfxl.exec:\xlxlfxl.exe79⤵PID:4080
-
\??\c:\nthnbb.exec:\nthnbb.exe80⤵PID:1424
-
\??\c:\nbbbhh.exec:\nbbbhh.exe81⤵PID:5048
-
\??\c:\5pjvp.exec:\5pjvp.exe82⤵PID:3552
-
\??\c:\pdpdd.exec:\pdpdd.exe83⤵PID:4052
-
\??\c:\vjdvj.exec:\vjdvj.exe84⤵PID:2472
-
\??\c:\lxlxlfr.exec:\lxlxlfr.exe85⤵PID:2644
-
\??\c:\xrfffrf.exec:\xrfffrf.exe86⤵PID:4220
-
\??\c:\7nnhhb.exec:\7nnhhb.exe87⤵PID:1568
-
\??\c:\hbtnhb.exec:\hbtnhb.exe88⤵PID:2300
-
\??\c:\dvvpd.exec:\dvvpd.exe89⤵PID:3512
-
\??\c:\jpvjv.exec:\jpvjv.exe90⤵PID:2876
-
\??\c:\jppjj.exec:\jppjj.exe91⤵PID:4428
-
\??\c:\rflffxf.exec:\rflffxf.exe92⤵PID:3716
-
\??\c:\fxlxxrr.exec:\fxlxxrr.exe93⤵PID:3240
-
\??\c:\thhbnn.exec:\thhbnn.exe94⤵PID:2872
-
\??\c:\1tbttn.exec:\1tbttn.exe95⤵PID:2056
-
\??\c:\htnnbh.exec:\htnnbh.exe96⤵PID:1836
-
\??\c:\ppjjd.exec:\ppjjd.exe97⤵
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\vpvjv.exec:\vpvjv.exe98⤵PID:2272
-
\??\c:\fffrffx.exec:\fffrffx.exe99⤵PID:4464
-
\??\c:\lrrrfxr.exec:\lrrrfxr.exe100⤵PID:4876
-
\??\c:\7jppj.exec:\7jppj.exe101⤵PID:1332
-
\??\c:\dpjvv.exec:\dpjvv.exe102⤵PID:2596
-
\??\c:\fflxxlf.exec:\fflxxlf.exe103⤵PID:2908
-
\??\c:\pdppd.exec:\pdppd.exe104⤵PID:2348
-
\??\c:\xllxxxr.exec:\xllxxxr.exe105⤵PID:1452
-
\??\c:\1xflfxr.exec:\1xflfxr.exe106⤵PID:1116
-
\??\c:\hntthb.exec:\hntthb.exe107⤵PID:1576
-
\??\c:\7dpjp.exec:\7dpjp.exe108⤵PID:3680
-
\??\c:\fxxlxxx.exec:\fxxlxxx.exe109⤵PID:2780
-
\??\c:\fxxrxrx.exec:\fxxrxrx.exe110⤵PID:3892
-
\??\c:\tbhhbh.exec:\tbhhbh.exe111⤵PID:2788
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe112⤵PID:5080
-
\??\c:\bnnhtn.exec:\bnnhtn.exe113⤵PID:4012
-
\??\c:\nhbnbt.exec:\nhbnbt.exe114⤵PID:5008
-
\??\c:\pvvvv.exec:\pvvvv.exe115⤵PID:812
-
\??\c:\dvpjj.exec:\dvpjj.exe116⤵PID:4804
-
\??\c:\xxxxrfx.exec:\xxxxrfx.exe117⤵PID:1912
-
\??\c:\1nnnnn.exec:\1nnnnn.exe118⤵PID:1176
-
\??\c:\5hhnnb.exec:\5hhnnb.exe119⤵PID:428
-
\??\c:\1dvpd.exec:\1dvpd.exe120⤵PID:3308
-
\??\c:\rrrrllf.exec:\rrrrllf.exe121⤵PID:540
-
\??\c:\9bbbnh.exec:\9bbbnh.exe122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-