Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe
Resource
win7-20240903-en
General
-
Target
d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe
-
Size
124KB
-
MD5
d76ffc4a45ebdc52e58b8a72354c76d6
-
SHA1
392a3eac1f5d8cc812d4d222df51c2e1916cf79e
-
SHA256
d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251
-
SHA512
e616f2b27b5153b065f0167df2c8835c7c87949b52c22ffafe07230ec8f5f2dcea35301075aa677fa2d7ee6c888c2f0e6a4373207c1cf1a0c60c76279bba5bcb
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0GsgcD2:n3C9BRomRph+0GsgcK
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/656-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4992 dvppj.exe 1048 rrlxxrl.exe 744 bbbtnn.exe 4008 bnnhbt.exe 2052 1dpjp.exe 3836 rxxlxrf.exe 2008 nbhthb.exe 3092 vjdvj.exe 5044 rrxxfrx.exe 2984 thbtnh.exe 4576 dppjv.exe 4004 frxlrll.exe 1244 ntthbt.exe 316 dpjpd.exe 3464 lxxrfxr.exe 2892 lxfxfxx.exe 1580 hhbthh.exe 2648 rflfrrl.exe 964 frffffx.exe 708 tnttnn.exe 620 dpjdv.exe 3532 ppjpd.exe 2212 xllfxxx.exe 916 tbhbtt.exe 4200 vvdvp.exe 4860 7rfrlfx.exe 2036 tnnhbt.exe 4892 bntnhh.exe 1904 vpvjp.exe 1956 rxrlxxr.exe 1044 llllxxr.exe 3588 thnhbb.exe 3136 hthbtn.exe 1556 3ddvv.exe 4392 pvpjv.exe 4016 xlffrll.exe 4996 lrrrllf.exe 2216 ttbtbt.exe 4340 htbnhh.exe 1188 jppjd.exe 744 dvpjd.exe 1488 lxfrxrl.exe 3664 bnhtnh.exe 2280 hhhbnn.exe 3948 5ppjv.exe 2044 pjjdv.exe 3572 rxfxlll.exe 2364 flfxrll.exe 3096 bttnbt.exe 1908 dpvpv.exe 4660 3jdpj.exe 4588 fxxlfxr.exe 4724 bbhhbn.exe 3508 btnnhb.exe 4424 jppjv.exe 1756 1dvpd.exe 3464 3xxrfll.exe 4556 lfxxrrx.exe 3060 hbhtbb.exe 4468 ddjvv.exe 4232 7lfxlfx.exe 1620 xlffxrl.exe 2896 hbnhnh.exe 1012 jvvpj.exe -
resource yara_rule behavioral2/memory/656-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-177-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 656 wrote to memory of 4992 656 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 83 PID 656 wrote to memory of 4992 656 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 83 PID 656 wrote to memory of 4992 656 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 83 PID 4992 wrote to memory of 1048 4992 dvppj.exe 84 PID 4992 wrote to memory of 1048 4992 dvppj.exe 84 PID 4992 wrote to memory of 1048 4992 dvppj.exe 84 PID 1048 wrote to memory of 744 1048 rrlxxrl.exe 85 PID 1048 wrote to memory of 744 1048 rrlxxrl.exe 85 PID 1048 wrote to memory of 744 1048 rrlxxrl.exe 85 PID 744 wrote to memory of 4008 744 bbbtnn.exe 86 PID 744 wrote to memory of 4008 744 bbbtnn.exe 86 PID 744 wrote to memory of 4008 744 bbbtnn.exe 86 PID 4008 wrote to memory of 2052 4008 bnnhbt.exe 87 PID 4008 wrote to memory of 2052 4008 bnnhbt.exe 87 PID 4008 wrote to memory of 2052 4008 bnnhbt.exe 87 PID 2052 wrote to memory of 3836 2052 1dpjp.exe 88 PID 2052 wrote to memory of 3836 2052 1dpjp.exe 88 PID 2052 wrote to memory of 3836 2052 1dpjp.exe 88 PID 3836 wrote to memory of 2008 3836 rxxlxrf.exe 89 PID 3836 wrote to memory of 2008 3836 rxxlxrf.exe 89 PID 3836 wrote to memory of 2008 3836 rxxlxrf.exe 89 PID 2008 wrote to memory of 3092 2008 nbhthb.exe 91 PID 2008 wrote to memory of 3092 2008 nbhthb.exe 91 PID 2008 wrote to memory of 3092 2008 nbhthb.exe 91 PID 3092 wrote to memory of 5044 3092 vjdvj.exe 92 PID 3092 wrote to memory of 5044 3092 vjdvj.exe 92 PID 3092 wrote to memory of 5044 3092 vjdvj.exe 92 PID 5044 wrote to memory of 2984 5044 rrxxfrx.exe 93 PID 5044 wrote to memory of 2984 5044 rrxxfrx.exe 93 PID 5044 wrote to memory of 2984 5044 rrxxfrx.exe 93 PID 2984 wrote to memory of 4576 2984 thbtnh.exe 94 PID 2984 wrote to memory of 4576 2984 thbtnh.exe 94 PID 2984 wrote to memory of 4576 2984 thbtnh.exe 94 PID 4576 wrote to memory of 4004 4576 dppjv.exe 95 PID 4576 wrote to memory of 4004 4576 dppjv.exe 95 PID 4576 wrote to memory of 4004 4576 dppjv.exe 95 PID 4004 wrote to memory of 1244 4004 frxlrll.exe 96 PID 4004 wrote to memory of 1244 4004 frxlrll.exe 96 PID 4004 wrote to memory of 1244 4004 frxlrll.exe 96 PID 1244 wrote to memory of 316 1244 ntthbt.exe 98 PID 1244 wrote to memory of 316 1244 ntthbt.exe 98 PID 1244 wrote to memory of 316 1244 ntthbt.exe 98 PID 316 wrote to memory of 3464 316 dpjpd.exe 99 PID 316 wrote to memory of 3464 316 dpjpd.exe 99 PID 316 wrote to memory of 3464 316 dpjpd.exe 99 PID 3464 wrote to memory of 2892 3464 lxxrfxr.exe 100 PID 3464 wrote to memory of 2892 3464 lxxrfxr.exe 100 PID 3464 wrote to memory of 2892 3464 lxxrfxr.exe 100 PID 2892 wrote to memory of 1580 2892 lxfxfxx.exe 101 PID 2892 wrote to memory of 1580 2892 lxfxfxx.exe 101 PID 2892 wrote to memory of 1580 2892 lxfxfxx.exe 101 PID 1580 wrote to memory of 2648 1580 hhbthh.exe 102 PID 1580 wrote to memory of 2648 1580 hhbthh.exe 102 PID 1580 wrote to memory of 2648 1580 hhbthh.exe 102 PID 2648 wrote to memory of 964 2648 rflfrrl.exe 103 PID 2648 wrote to memory of 964 2648 rflfrrl.exe 103 PID 2648 wrote to memory of 964 2648 rflfrrl.exe 103 PID 964 wrote to memory of 708 964 frffffx.exe 104 PID 964 wrote to memory of 708 964 frffffx.exe 104 PID 964 wrote to memory of 708 964 frffffx.exe 104 PID 708 wrote to memory of 620 708 tnttnn.exe 106 PID 708 wrote to memory of 620 708 tnttnn.exe 106 PID 708 wrote to memory of 620 708 tnttnn.exe 106 PID 620 wrote to memory of 3532 620 dpjdv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe"C:\Users\Admin\AppData\Local\Temp\d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\dvppj.exec:\dvppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\rrlxxrl.exec:\rrlxxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\bbbtnn.exec:\bbbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\bnnhbt.exec:\bnnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\1dpjp.exec:\1dpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\nbhthb.exec:\nbhthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vjdvj.exec:\vjdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\rrxxfrx.exec:\rrxxfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\thbtnh.exec:\thbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\dppjv.exec:\dppjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\frxlrll.exec:\frxlrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\ntthbt.exec:\ntthbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\dpjpd.exec:\dpjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\lxfxfxx.exec:\lxfxfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hhbthh.exec:\hhbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\rflfrrl.exec:\rflfrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\frffffx.exec:\frffffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\tnttnn.exec:\tnttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\dpjdv.exec:\dpjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\ppjpd.exec:\ppjpd.exe23⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xllfxxx.exec:\xllfxxx.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbhbtt.exec:\tbhbtt.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\vvdvp.exec:\vvdvp.exe26⤵
- Executes dropped EXE
PID:4200 -
\??\c:\7rfrlfx.exec:\7rfrlfx.exe27⤵
- Executes dropped EXE
PID:4860 -
\??\c:\tnnhbt.exec:\tnnhbt.exe28⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bntnhh.exec:\bntnhh.exe29⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vpvjp.exec:\vpvjp.exe30⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe31⤵
- Executes dropped EXE
PID:1956 -
\??\c:\llllxxr.exec:\llllxxr.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\thnhbb.exec:\thnhbb.exe33⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hthbtn.exec:\hthbtn.exe34⤵
- Executes dropped EXE
PID:3136 -
\??\c:\3ddvv.exec:\3ddvv.exe35⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pvpjv.exec:\pvpjv.exe36⤵
- Executes dropped EXE
PID:4392 -
\??\c:\xlffrll.exec:\xlffrll.exe37⤵
- Executes dropped EXE
PID:4016 -
\??\c:\lrrrllf.exec:\lrrrllf.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\ttbtbt.exec:\ttbtbt.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\htbnhh.exec:\htbnhh.exe40⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jppjd.exec:\jppjd.exe41⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dvpjd.exec:\dvpjd.exe42⤵
- Executes dropped EXE
PID:744 -
\??\c:\lxfrxrl.exec:\lxfrxrl.exe43⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bnhtnh.exec:\bnhtnh.exe44⤵
- Executes dropped EXE
PID:3664 -
\??\c:\hhhbnn.exec:\hhhbnn.exe45⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5ppjv.exec:\5ppjv.exe46⤵
- Executes dropped EXE
PID:3948 -
\??\c:\pjjdv.exec:\pjjdv.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rxfxlll.exec:\rxfxlll.exe48⤵
- Executes dropped EXE
PID:3572 -
\??\c:\flfxrll.exec:\flfxrll.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\bttnbt.exec:\bttnbt.exe50⤵
- Executes dropped EXE
PID:3096 -
\??\c:\dpvpv.exec:\dpvpv.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3jdpj.exec:\3jdpj.exe52⤵
- Executes dropped EXE
PID:4660 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe53⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bbhhbn.exec:\bbhhbn.exe54⤵
- Executes dropped EXE
PID:4724 -
\??\c:\btnnhb.exec:\btnnhb.exe55⤵
- Executes dropped EXE
PID:3508 -
\??\c:\jppjv.exec:\jppjv.exe56⤵
- Executes dropped EXE
PID:4424 -
\??\c:\1dvpd.exec:\1dvpd.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3xxrfll.exec:\3xxrfll.exe58⤵
- Executes dropped EXE
PID:3464 -
\??\c:\lfxxrrx.exec:\lfxxrrx.exe59⤵
- Executes dropped EXE
PID:4556 -
\??\c:\hbhtbb.exec:\hbhtbb.exe60⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ddjvv.exec:\ddjvv.exe61⤵
- Executes dropped EXE
PID:4468 -
\??\c:\7lfxlfx.exec:\7lfxlfx.exe62⤵
- Executes dropped EXE
PID:4232 -
\??\c:\xlffxrl.exec:\xlffxrl.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hbnhnh.exec:\hbnhnh.exe64⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jvvpj.exec:\jvvpj.exe65⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pvdvp.exec:\pvdvp.exe66⤵PID:4068
-
\??\c:\rxrlxrf.exec:\rxrlxrf.exe67⤵PID:2316
-
\??\c:\nhhbbt.exec:\nhhbbt.exe68⤵PID:4932
-
\??\c:\ddjjp.exec:\ddjjp.exe69⤵PID:4972
-
\??\c:\pdpjj.exec:\pdpjj.exe70⤵PID:3704
-
\??\c:\frxxrlf.exec:\frxxrlf.exe71⤵PID:1176
-
\??\c:\xrllllf.exec:\xrllllf.exe72⤵PID:816
-
\??\c:\bnhbth.exec:\bnhbth.exe73⤵PID:2592
-
\??\c:\1vjdp.exec:\1vjdp.exe74⤵PID:2080
-
\??\c:\fxxlfxf.exec:\fxxlfxf.exe75⤵PID:624
-
\??\c:\tntnhh.exec:\tntnhh.exe76⤵PID:3512
-
\??\c:\7pjjj.exec:\7pjjj.exe77⤵PID:1404
-
\??\c:\frxxrrl.exec:\frxxrrl.exe78⤵PID:2408
-
\??\c:\rlxxffl.exec:\rlxxffl.exe79⤵PID:1044
-
\??\c:\ntbthh.exec:\ntbthh.exe80⤵PID:968
-
\??\c:\btbttt.exec:\btbttt.exe81⤵PID:1732
-
\??\c:\vpjdd.exec:\vpjdd.exe82⤵PID:4276
-
\??\c:\lrxxlll.exec:\lrxxlll.exe83⤵PID:2680
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵PID:2560
-
\??\c:\3bnhhn.exec:\3bnhhn.exe85⤵PID:4992
-
\??\c:\dpvpd.exec:\dpvpd.exe86⤵PID:1168
-
\??\c:\pvjjv.exec:\pvjjv.exe87⤵PID:4340
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe88⤵PID:3996
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe89⤵PID:4140
-
\??\c:\nhbtnn.exec:\nhbtnn.exe90⤵PID:4636
-
\??\c:\7htntb.exec:\7htntb.exe91⤵PID:4008
-
\??\c:\3dvpj.exec:\3dvpj.exe92⤵PID:3240
-
\??\c:\jdppd.exec:\jdppd.exe93⤵PID:5092
-
\??\c:\lxrlfff.exec:\lxrlfff.exe94⤵PID:2044
-
\??\c:\xfrxffx.exec:\xfrxffx.exe95⤵PID:3572
-
\??\c:\bbbbbb.exec:\bbbbbb.exe96⤵PID:2364
-
\??\c:\ppddd.exec:\ppddd.exe97⤵PID:3096
-
\??\c:\jjdvp.exec:\jjdvp.exe98⤵PID:2128
-
\??\c:\lfrlxxx.exec:\lfrlxxx.exe99⤵PID:452
-
\??\c:\nbhbbb.exec:\nbhbbb.exe100⤵PID:2260
-
\??\c:\jjjdv.exec:\jjjdv.exe101⤵PID:940
-
\??\c:\dvpjj.exec:\dvpjj.exe102⤵PID:2652
-
\??\c:\xrrlffx.exec:\xrrlffx.exe103⤵PID:4432
-
\??\c:\hbbthh.exec:\hbbthh.exe104⤵PID:5096
-
\??\c:\tnttnn.exec:\tnttnn.exe105⤵PID:3752
-
\??\c:\vvvpj.exec:\vvvpj.exe106⤵PID:4592
-
\??\c:\7jjvp.exec:\7jjvp.exe107⤵PID:3020
-
\??\c:\lffxlrl.exec:\lffxlrl.exe108⤵
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\3llffxx.exec:\3llffxx.exe109⤵PID:4236
-
\??\c:\9hhhhh.exec:\9hhhhh.exe110⤵PID:4088
-
\??\c:\ntntnt.exec:\ntntnt.exe111⤵PID:1964
-
\??\c:\jppdv.exec:\jppdv.exe112⤵PID:3008
-
\??\c:\rfffxxx.exec:\rfffxxx.exe113⤵PID:2232
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe114⤵PID:2316
-
\??\c:\tbbbtt.exec:\tbbbtt.exe115⤵PID:4440
-
\??\c:\5htnnn.exec:\5htnnn.exe116⤵PID:424
-
\??\c:\dvjdd.exec:\dvjdd.exe117⤵PID:3704
-
\??\c:\dvppd.exec:\dvppd.exe118⤵PID:4348
-
\??\c:\7flfrrr.exec:\7flfrrr.exe119⤵PID:1340
-
\??\c:\hbbtnn.exec:\hbbtnn.exe120⤵PID:2592
-
\??\c:\5hhtnn.exec:\5hhtnn.exe121⤵PID:2080
-
\??\c:\jdddv.exec:\jdddv.exe122⤵PID:624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-