Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40bbdb923856f2f0102acdef46ee8590N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
40bbdb923856f2f0102acdef46ee8590N.exe
-
Size
67KB
-
MD5
40bbdb923856f2f0102acdef46ee8590
-
SHA1
72257640e3b2bac86ff17cb91db5691961d0859e
-
SHA256
6a8a543a6a1dc056191b87d2a2c35d62315104cb09199a81feb1e990a303a58a
-
SHA512
54db672061107414e520b021f95199c62f401436da3751b2dd2dc42eb900231fa5e988a27b65076e737b96dfc7975c3f57db1327bfc5ab4b8d7a06233c773a7b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B5QF:ymb3NkkiQ3mdBjFI9c+F
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4256-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4452 vddvp.exe 4036 lrrfxxr.exe 4048 7rrlflx.exe 396 hthbhb.exe 3688 vpjdj.exe 3200 lflfxlf.exe 2888 tnttbb.exe 4556 jpjdp.exe 3068 flrlffx.exe 5044 ppjvp.exe 4044 flfrllf.exe 5056 tbnbnb.exe 2376 nbhthb.exe 4404 3rffrfr.exe 3968 llxxrxx.exe 1812 ththtn.exe 3348 bhbnbt.exe 636 lffrrff.exe 3748 rfxrfxl.exe 4348 hhbhnb.exe 1068 vdpvp.exe 2076 fxfrfxl.exe 2796 rffxffl.exe 3552 hthnbt.exe 2320 jvdpp.exe 3120 vvdpd.exe 1420 lxfrllx.exe 4828 nhtbtb.exe 2696 nhbthh.exe 2348 vvdvd.exe 2424 rllfrrf.exe 1192 lxrfrlf.exe 3828 bbbbtt.exe 2704 pdvjv.exe 2268 djdvp.exe 4824 xxlxrrf.exe 4284 xxrlffx.exe 1688 rflflff.exe 4256 ttbthh.exe 2244 vvvjv.exe 1016 djpjd.exe 3020 lffrfxr.exe 2260 fxllrrf.exe 4700 5thbhb.exe 4696 dpvvv.exe 3688 pdjvd.exe 3260 3rlfxxx.exe 4952 xlrrxfr.exe 5116 thnnhh.exe 2888 thtnhh.exe 4948 jvdvp.exe 1412 rrfrffx.exe 1400 rflfllr.exe 3676 hnttnn.exe 4364 bhhbtt.exe 928 pvvpp.exe 1448 jddjd.exe 5032 llllffx.exe 512 3nntnn.exe 4336 bbbttt.exe 1108 jvvpj.exe 4536 5dddp.exe 4744 rxxrlll.exe 2584 tbbbnn.exe -
resource yara_rule behavioral2/memory/4256-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 4452 4256 40bbdb923856f2f0102acdef46ee8590N.exe 83 PID 4256 wrote to memory of 4452 4256 40bbdb923856f2f0102acdef46ee8590N.exe 83 PID 4256 wrote to memory of 4452 4256 40bbdb923856f2f0102acdef46ee8590N.exe 83 PID 4452 wrote to memory of 4036 4452 vddvp.exe 84 PID 4452 wrote to memory of 4036 4452 vddvp.exe 84 PID 4452 wrote to memory of 4036 4452 vddvp.exe 84 PID 4036 wrote to memory of 4048 4036 lrrfxxr.exe 85 PID 4036 wrote to memory of 4048 4036 lrrfxxr.exe 85 PID 4036 wrote to memory of 4048 4036 lrrfxxr.exe 85 PID 4048 wrote to memory of 396 4048 7rrlflx.exe 86 PID 4048 wrote to memory of 396 4048 7rrlflx.exe 86 PID 4048 wrote to memory of 396 4048 7rrlflx.exe 86 PID 396 wrote to memory of 3688 396 hthbhb.exe 87 PID 396 wrote to memory of 3688 396 hthbhb.exe 87 PID 396 wrote to memory of 3688 396 hthbhb.exe 87 PID 3688 wrote to memory of 3200 3688 vpjdj.exe 89 PID 3688 wrote to memory of 3200 3688 vpjdj.exe 89 PID 3688 wrote to memory of 3200 3688 vpjdj.exe 89 PID 3200 wrote to memory of 2888 3200 lflfxlf.exe 90 PID 3200 wrote to memory of 2888 3200 lflfxlf.exe 90 PID 3200 wrote to memory of 2888 3200 lflfxlf.exe 90 PID 2888 wrote to memory of 4556 2888 tnttbb.exe 91 PID 2888 wrote to memory of 4556 2888 tnttbb.exe 91 PID 2888 wrote to memory of 4556 2888 tnttbb.exe 91 PID 4556 wrote to memory of 3068 4556 jpjdp.exe 92 PID 4556 wrote to memory of 3068 4556 jpjdp.exe 92 PID 4556 wrote to memory of 3068 4556 jpjdp.exe 92 PID 3068 wrote to memory of 5044 3068 flrlffx.exe 93 PID 3068 wrote to memory of 5044 3068 flrlffx.exe 93 PID 3068 wrote to memory of 5044 3068 flrlffx.exe 93 PID 5044 wrote to memory of 4044 5044 ppjvp.exe 94 PID 5044 wrote to memory of 4044 5044 ppjvp.exe 94 PID 5044 wrote to memory of 4044 5044 ppjvp.exe 94 PID 4044 wrote to memory of 5056 4044 flfrllf.exe 95 PID 4044 wrote to memory of 5056 4044 flfrllf.exe 95 PID 4044 wrote to memory of 5056 4044 flfrllf.exe 95 PID 5056 wrote to memory of 2376 5056 tbnbnb.exe 97 PID 5056 wrote to memory of 2376 5056 tbnbnb.exe 97 PID 5056 wrote to memory of 2376 5056 tbnbnb.exe 97 PID 2376 wrote to memory of 4404 2376 nbhthb.exe 98 PID 2376 wrote to memory of 4404 2376 nbhthb.exe 98 PID 2376 wrote to memory of 4404 2376 nbhthb.exe 98 PID 4404 wrote to memory of 3968 4404 3rffrfr.exe 99 PID 4404 wrote to memory of 3968 4404 3rffrfr.exe 99 PID 4404 wrote to memory of 3968 4404 3rffrfr.exe 99 PID 3968 wrote to memory of 1812 3968 llxxrxx.exe 100 PID 3968 wrote to memory of 1812 3968 llxxrxx.exe 100 PID 3968 wrote to memory of 1812 3968 llxxrxx.exe 100 PID 1812 wrote to memory of 3348 1812 ththtn.exe 101 PID 1812 wrote to memory of 3348 1812 ththtn.exe 101 PID 1812 wrote to memory of 3348 1812 ththtn.exe 101 PID 3348 wrote to memory of 636 3348 bhbnbt.exe 102 PID 3348 wrote to memory of 636 3348 bhbnbt.exe 102 PID 3348 wrote to memory of 636 3348 bhbnbt.exe 102 PID 636 wrote to memory of 3748 636 lffrrff.exe 104 PID 636 wrote to memory of 3748 636 lffrrff.exe 104 PID 636 wrote to memory of 3748 636 lffrrff.exe 104 PID 3748 wrote to memory of 4348 3748 rfxrfxl.exe 105 PID 3748 wrote to memory of 4348 3748 rfxrfxl.exe 105 PID 3748 wrote to memory of 4348 3748 rfxrfxl.exe 105 PID 4348 wrote to memory of 1068 4348 hhbhnb.exe 106 PID 4348 wrote to memory of 1068 4348 hhbhnb.exe 106 PID 4348 wrote to memory of 1068 4348 hhbhnb.exe 106 PID 1068 wrote to memory of 2076 1068 vdpvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\40bbdb923856f2f0102acdef46ee8590N.exe"C:\Users\Admin\AppData\Local\Temp\40bbdb923856f2f0102acdef46ee8590N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\vddvp.exec:\vddvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\lrrfxxr.exec:\lrrfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\7rrlflx.exec:\7rrlflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\hthbhb.exec:\hthbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\vpjdj.exec:\vpjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\lflfxlf.exec:\lflfxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jpjdp.exec:\jpjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\flrlffx.exec:\flrlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ppjvp.exec:\ppjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\flfrllf.exec:\flfrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\tbnbnb.exec:\tbnbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\nbhthb.exec:\nbhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3rffrfr.exec:\3rffrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\llxxrxx.exec:\llxxrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\ththtn.exec:\ththtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bhbnbt.exec:\bhbnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\lffrrff.exec:\lffrrff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\hhbhnb.exec:\hhbhnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\vdpvp.exec:\vdpvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\fxfrfxl.exec:\fxfrfxl.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rffxffl.exec:\rffxffl.exe24⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hthnbt.exec:\hthnbt.exe25⤵
- Executes dropped EXE
PID:3552 -
\??\c:\jvdpp.exec:\jvdpp.exe26⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vvdpd.exec:\vvdpd.exe27⤵
- Executes dropped EXE
PID:3120 -
\??\c:\lxfrllx.exec:\lxfrllx.exe28⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nhtbtb.exec:\nhtbtb.exe29⤵
- Executes dropped EXE
PID:4828 -
\??\c:\nhbthh.exec:\nhbthh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696 -
\??\c:\vvdvd.exec:\vvdvd.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rllfrrf.exec:\rllfrrf.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe33⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bbbbtt.exec:\bbbbtt.exe34⤵
- Executes dropped EXE
PID:3828 -
\??\c:\pdvjv.exec:\pdvjv.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\djdvp.exec:\djdvp.exe36⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxlxrrf.exec:\xxlxrrf.exe37⤵
- Executes dropped EXE
PID:4824 -
\??\c:\xxrlffx.exec:\xxrlffx.exe38⤵
- Executes dropped EXE
PID:4284 -
\??\c:\rflflff.exec:\rflflff.exe39⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ttbthh.exec:\ttbthh.exe40⤵
- Executes dropped EXE
PID:4256 -
\??\c:\vvvjv.exec:\vvvjv.exe41⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djpjd.exec:\djpjd.exe42⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lffrfxr.exec:\lffrfxr.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxllrrf.exec:\fxllrrf.exe44⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5thbhb.exec:\5thbhb.exe45⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dpvvv.exec:\dpvvv.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pdjvd.exec:\pdjvd.exe47⤵
- Executes dropped EXE
PID:3688 -
\??\c:\3rlfxxx.exec:\3rlfxxx.exe48⤵
- Executes dropped EXE
PID:3260 -
\??\c:\xlrrxfr.exec:\xlrrxfr.exe49⤵
- Executes dropped EXE
PID:4952 -
\??\c:\thnnhh.exec:\thnnhh.exe50⤵
- Executes dropped EXE
PID:5116 -
\??\c:\thtnhh.exec:\thtnhh.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jvdvp.exec:\jvdvp.exe52⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rrfrffx.exec:\rrfrffx.exe53⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rflfllr.exec:\rflfllr.exe54⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hnttnn.exec:\hnttnn.exe55⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bhhbtt.exec:\bhhbtt.exe56⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pvvpp.exec:\pvvpp.exe57⤵
- Executes dropped EXE
PID:928 -
\??\c:\jddjd.exec:\jddjd.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\llllffx.exec:\llllffx.exe59⤵
- Executes dropped EXE
PID:5032 -
\??\c:\3nntnn.exec:\3nntnn.exe60⤵
- Executes dropped EXE
PID:512 -
\??\c:\bbbttt.exec:\bbbttt.exe61⤵
- Executes dropped EXE
PID:4336 -
\??\c:\jvvpj.exec:\jvvpj.exe62⤵
- Executes dropped EXE
PID:1108 -
\??\c:\5dddp.exec:\5dddp.exe63⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rxxrlll.exec:\rxxrlll.exe64⤵
- Executes dropped EXE
PID:4744 -
\??\c:\tbbbnn.exec:\tbbbnn.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbbhbb.exec:\hbbhbb.exe66⤵PID:2360
-
\??\c:\djvpd.exec:\djvpd.exe67⤵PID:640
-
\??\c:\pdvpj.exec:\pdvpj.exe68⤵PID:1360
-
\??\c:\xrffffl.exec:\xrffffl.exe69⤵PID:548
-
\??\c:\rxlrrrr.exec:\rxlrrrr.exe70⤵PID:1704
-
\??\c:\tntnnn.exec:\tntnnn.exe71⤵PID:5020
-
\??\c:\thnntb.exec:\thnntb.exe72⤵PID:4348
-
\??\c:\vjpjj.exec:\vjpjj.exe73⤵PID:4892
-
\??\c:\dvdvd.exec:\dvdvd.exe74⤵PID:1924
-
\??\c:\rllfffr.exec:\rllfffr.exe75⤵PID:4200
-
\??\c:\lxrlfff.exec:\lxrlfff.exe76⤵PID:2388
-
\??\c:\ttbbhh.exec:\ttbbhh.exe77⤵PID:1228
-
\??\c:\1tnhtb.exec:\1tnhtb.exe78⤵PID:4072
-
\??\c:\7vddd.exec:\7vddd.exe79⤵PID:1864
-
\??\c:\pjjdd.exec:\pjjdd.exe80⤵PID:1880
-
\??\c:\flxrllf.exec:\flxrllf.exe81⤵PID:1888
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe82⤵PID:5100
-
\??\c:\nbntnn.exec:\nbntnn.exe83⤵PID:2412
-
\??\c:\dvjdd.exec:\dvjdd.exe84⤵PID:1508
-
\??\c:\3jjdv.exec:\3jjdv.exe85⤵PID:1416
-
\??\c:\xrllfff.exec:\xrllfff.exe86⤵PID:5004
-
\??\c:\lxxrllf.exec:\lxxrllf.exe87⤵PID:2144
-
\??\c:\nhntbb.exec:\nhntbb.exe88⤵PID:2456
-
\??\c:\jdvpj.exec:\jdvpj.exe89⤵PID:4820
-
\??\c:\rlrlllx.exec:\rlrlllx.exe90⤵PID:4352
-
\??\c:\frrrllf.exec:\frrrllf.exe91⤵PID:4384
-
\??\c:\fxxfffx.exec:\fxxfffx.exe92⤵PID:4284
-
\??\c:\tnnnhh.exec:\tnnnhh.exe93⤵PID:4832
-
\??\c:\tnbbbb.exec:\tnbbbb.exe94⤵PID:4256
-
\??\c:\vpjdv.exec:\vpjdv.exe95⤵PID:2244
-
\??\c:\jvvpj.exec:\jvvpj.exe96⤵PID:5040
-
\??\c:\ffxrrfr.exec:\ffxrrfr.exe97⤵PID:4048
-
\??\c:\lffxffr.exec:\lffxffr.exe98⤵PID:2260
-
\??\c:\flrrlll.exec:\flrrlll.exe99⤵PID:4700
-
\??\c:\nhhhbb.exec:\nhhhbb.exe100⤵PID:3788
-
\??\c:\5tbbnn.exec:\5tbbnn.exe101⤵PID:4496
-
\??\c:\pdjdv.exec:\pdjdv.exe102⤵PID:1168
-
\??\c:\jpjdv.exec:\jpjdv.exe103⤵PID:2008
-
\??\c:\xxxrffx.exec:\xxxrffx.exe104⤵PID:116
-
\??\c:\xrrffrl.exec:\xrrffrl.exe105⤵PID:2088
-
\??\c:\tbbtnn.exec:\tbbtnn.exe106⤵PID:2172
-
\??\c:\tnbbtb.exec:\tnbbtb.exe107⤵PID:1412
-
\??\c:\ppjdd.exec:\ppjdd.exe108⤵PID:4904
-
\??\c:\dvpjv.exec:\dvpjv.exe109⤵PID:2444
-
\??\c:\lxxrlrr.exec:\lxxrlrr.exe110⤵PID:2392
-
\??\c:\lffxrlf.exec:\lffxrlf.exe111⤵PID:928
-
\??\c:\rrrrfff.exec:\rrrrfff.exe112⤵PID:3940
-
\??\c:\3bhbtt.exec:\3bhbtt.exe113⤵PID:112
-
\??\c:\hhttbb.exec:\hhttbb.exe114⤵PID:1544
-
\??\c:\pdpjd.exec:\pdpjd.exe115⤵PID:1496
-
\??\c:\3lffrrr.exec:\3lffrrr.exe116⤵PID:4484
-
\??\c:\xxrrlff.exec:\xxrrlff.exe117⤵PID:1636
-
\??\c:\tnnhbb.exec:\tnnhbb.exe118⤵PID:3968
-
\??\c:\thbhth.exec:\thbhth.exe119⤵PID:716
-
\??\c:\hhnntn.exec:\hhnntn.exe120⤵PID:3224
-
\??\c:\jpddv.exec:\jpddv.exe121⤵PID:3532
-
\??\c:\llrlxxx.exec:\llrlxxx.exe122⤵PID:4704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-