Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
d96492f7933435b573680c264d6676e0N.exe
Resource
win7-20240729-en
General
-
Target
d96492f7933435b573680c264d6676e0N.exe
-
Size
74KB
-
MD5
d96492f7933435b573680c264d6676e0
-
SHA1
bf425d2e8b9500741a476b0f0e40f2f8d1e62e5c
-
SHA256
5c054451956f81dedea6d77164709751925e7002e8e7624f1dc202d239e7b3b9
-
SHA512
b01c7b95672ef27be28427696e8a8b51aa1afaea9d32e8865586b8f364d0b0e51d7a7f4502b4d65ec15d18f3fae8653c06c083c2dce2b4d9e62f006656510e97
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPV:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHw
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1128-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/588-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3492 5flfffx.exe 2272 nnhbtt.exe 3020 vpvpj.exe 4804 3lxrrrr.exe 3032 flxrxxr.exe 4852 nnhnbt.exe 1544 dppdv.exe 588 llxxxxf.exe 4600 nnttnn.exe 4948 5vddp.exe 3972 lflrxrr.exe 1548 3nnhbb.exe 4572 dvdvp.exe 1952 9pdvv.exe 4692 bnbttt.exe 1600 dddvv.exe 1492 9rrlxxr.exe 2932 tnbtnt.exe 1248 5pdpd.exe 3764 rxlfrrl.exe 1940 rlfxrll.exe 2640 7hhbnh.exe 1464 7pjdp.exe 2328 3vpjv.exe 2548 xlxrrrx.exe 2000 nnnnhh.exe 664 djjvj.exe 4448 vjddv.exe 2132 rflxxxr.exe 4752 nnbttb.exe 2992 1ddjv.exe 864 jvvpv.exe 4908 rlxrrrx.exe 1740 bnthnh.exe 5016 nhbthh.exe 1524 vpjvp.exe 4060 7llfrrx.exe 3432 fflfrrx.exe 4440 nhnhbb.exe 2352 pjppv.exe 368 jjpvp.exe 2216 fxxfxxf.exe 1404 9xfxllr.exe 2380 7btttt.exe 4804 jvdvp.exe 3208 1ppjv.exe 4064 3ppjv.exe 4508 lxfrfff.exe 2068 tbhnhn.exe 1544 7ntbnb.exe 64 5dvpp.exe 5024 1djdp.exe 2064 xfxrlrl.exe 1020 fxxxrfx.exe 3880 hbbbtt.exe 5072 5nnhbb.exe 2452 ppjvd.exe 3564 7xfxlll.exe 4984 rllfxll.exe 4684 bhnhbt.exe 4800 7jvpd.exe 2960 vpvpp.exe 1400 3rflfff.exe 2932 hhbbtt.exe -
resource yara_rule behavioral2/memory/1128-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/588-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/588-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/588-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1128 wrote to memory of 3492 1128 d96492f7933435b573680c264d6676e0N.exe 83 PID 1128 wrote to memory of 3492 1128 d96492f7933435b573680c264d6676e0N.exe 83 PID 1128 wrote to memory of 3492 1128 d96492f7933435b573680c264d6676e0N.exe 83 PID 3492 wrote to memory of 2272 3492 5flfffx.exe 84 PID 3492 wrote to memory of 2272 3492 5flfffx.exe 84 PID 3492 wrote to memory of 2272 3492 5flfffx.exe 84 PID 2272 wrote to memory of 3020 2272 nnhbtt.exe 85 PID 2272 wrote to memory of 3020 2272 nnhbtt.exe 85 PID 2272 wrote to memory of 3020 2272 nnhbtt.exe 85 PID 3020 wrote to memory of 4804 3020 vpvpj.exe 86 PID 3020 wrote to memory of 4804 3020 vpvpj.exe 86 PID 3020 wrote to memory of 4804 3020 vpvpj.exe 86 PID 4804 wrote to memory of 3032 4804 3lxrrrr.exe 87 PID 4804 wrote to memory of 3032 4804 3lxrrrr.exe 87 PID 4804 wrote to memory of 3032 4804 3lxrrrr.exe 87 PID 3032 wrote to memory of 4852 3032 flxrxxr.exe 88 PID 3032 wrote to memory of 4852 3032 flxrxxr.exe 88 PID 3032 wrote to memory of 4852 3032 flxrxxr.exe 88 PID 4852 wrote to memory of 1544 4852 nnhnbt.exe 89 PID 4852 wrote to memory of 1544 4852 nnhnbt.exe 89 PID 4852 wrote to memory of 1544 4852 nnhnbt.exe 89 PID 1544 wrote to memory of 588 1544 dppdv.exe 90 PID 1544 wrote to memory of 588 1544 dppdv.exe 90 PID 1544 wrote to memory of 588 1544 dppdv.exe 90 PID 588 wrote to memory of 4600 588 llxxxxf.exe 91 PID 588 wrote to memory of 4600 588 llxxxxf.exe 91 PID 588 wrote to memory of 4600 588 llxxxxf.exe 91 PID 4600 wrote to memory of 4948 4600 nnttnn.exe 92 PID 4600 wrote to memory of 4948 4600 nnttnn.exe 92 PID 4600 wrote to memory of 4948 4600 nnttnn.exe 92 PID 4948 wrote to memory of 3972 4948 5vddp.exe 93 PID 4948 wrote to memory of 3972 4948 5vddp.exe 93 PID 4948 wrote to memory of 3972 4948 5vddp.exe 93 PID 3972 wrote to memory of 1548 3972 lflrxrr.exe 94 PID 3972 wrote to memory of 1548 3972 lflrxrr.exe 94 PID 3972 wrote to memory of 1548 3972 lflrxrr.exe 94 PID 1548 wrote to memory of 4572 1548 3nnhbb.exe 95 PID 1548 wrote to memory of 4572 1548 3nnhbb.exe 95 PID 1548 wrote to memory of 4572 1548 3nnhbb.exe 95 PID 4572 wrote to memory of 1952 4572 dvdvp.exe 96 PID 4572 wrote to memory of 1952 4572 dvdvp.exe 96 PID 4572 wrote to memory of 1952 4572 dvdvp.exe 96 PID 1952 wrote to memory of 4692 1952 9pdvv.exe 98 PID 1952 wrote to memory of 4692 1952 9pdvv.exe 98 PID 1952 wrote to memory of 4692 1952 9pdvv.exe 98 PID 4692 wrote to memory of 1600 4692 bnbttt.exe 99 PID 4692 wrote to memory of 1600 4692 bnbttt.exe 99 PID 4692 wrote to memory of 1600 4692 bnbttt.exe 99 PID 1600 wrote to memory of 1492 1600 dddvv.exe 101 PID 1600 wrote to memory of 1492 1600 dddvv.exe 101 PID 1600 wrote to memory of 1492 1600 dddvv.exe 101 PID 1492 wrote to memory of 2932 1492 9rrlxxr.exe 102 PID 1492 wrote to memory of 2932 1492 9rrlxxr.exe 102 PID 1492 wrote to memory of 2932 1492 9rrlxxr.exe 102 PID 2932 wrote to memory of 1248 2932 tnbtnt.exe 103 PID 2932 wrote to memory of 1248 2932 tnbtnt.exe 103 PID 2932 wrote to memory of 1248 2932 tnbtnt.exe 103 PID 1248 wrote to memory of 3764 1248 5pdpd.exe 104 PID 1248 wrote to memory of 3764 1248 5pdpd.exe 104 PID 1248 wrote to memory of 3764 1248 5pdpd.exe 104 PID 3764 wrote to memory of 1940 3764 rxlfrrl.exe 105 PID 3764 wrote to memory of 1940 3764 rxlfrrl.exe 105 PID 3764 wrote to memory of 1940 3764 rxlfrrl.exe 105 PID 1940 wrote to memory of 2640 1940 rlfxrll.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d96492f7933435b573680c264d6676e0N.exe"C:\Users\Admin\AppData\Local\Temp\d96492f7933435b573680c264d6676e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\5flfffx.exec:\5flfffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\nnhbtt.exec:\nnhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\vpvpj.exec:\vpvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\3lxrrrr.exec:\3lxrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\flxrxxr.exec:\flxrxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nnhnbt.exec:\nnhnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\dppdv.exec:\dppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\llxxxxf.exec:\llxxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\nnttnn.exec:\nnttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\5vddp.exec:\5vddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\lflrxrr.exec:\lflrxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\3nnhbb.exec:\3nnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\dvdvp.exec:\dvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\9pdvv.exec:\9pdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\bnbttt.exec:\bnbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\dddvv.exec:\dddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\9rrlxxr.exec:\9rrlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\tnbtnt.exec:\tnbtnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5pdpd.exec:\5pdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\rlfxrll.exec:\rlfxrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\7hhbnh.exec:\7hhbnh.exe23⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7pjdp.exec:\7pjdp.exe24⤵
- Executes dropped EXE
PID:1464 -
\??\c:\3vpjv.exec:\3vpjv.exe25⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe26⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nnnnhh.exec:\nnnnhh.exe27⤵
- Executes dropped EXE
PID:2000 -
\??\c:\djjvj.exec:\djjvj.exe28⤵
- Executes dropped EXE
PID:664 -
\??\c:\vjddv.exec:\vjddv.exe29⤵
- Executes dropped EXE
PID:4448 -
\??\c:\rflxxxr.exec:\rflxxxr.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnbttb.exec:\nnbttb.exe31⤵
- Executes dropped EXE
PID:4752 -
\??\c:\1ddjv.exec:\1ddjv.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992 -
\??\c:\jvvpv.exec:\jvvpv.exe33⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe34⤵
- Executes dropped EXE
PID:4908 -
\??\c:\bnthnh.exec:\bnthnh.exe35⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhbthh.exec:\nhbthh.exe36⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vpjvp.exec:\vpjvp.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7llfrrx.exec:\7llfrrx.exe38⤵
- Executes dropped EXE
PID:4060 -
\??\c:\fflfrrx.exec:\fflfrrx.exe39⤵
- Executes dropped EXE
PID:3432 -
\??\c:\nhnhbb.exec:\nhnhbb.exe40⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pjppv.exec:\pjppv.exe41⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jjpvp.exec:\jjpvp.exe42⤵
- Executes dropped EXE
PID:368 -
\??\c:\fxxfxxf.exec:\fxxfxxf.exe43⤵
- Executes dropped EXE
PID:2216 -
\??\c:\9xfxllr.exec:\9xfxllr.exe44⤵
- Executes dropped EXE
PID:1404 -
\??\c:\7btttt.exec:\7btttt.exe45⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jvdvp.exec:\jvdvp.exe46⤵
- Executes dropped EXE
PID:4804 -
\??\c:\1ppjv.exec:\1ppjv.exe47⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3ppjv.exec:\3ppjv.exe48⤵
- Executes dropped EXE
PID:4064 -
\??\c:\lxfrfff.exec:\lxfrfff.exe49⤵
- Executes dropped EXE
PID:4508 -
\??\c:\tbhnhn.exec:\tbhnhn.exe50⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7ntbnb.exec:\7ntbnb.exe51⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5dvpp.exec:\5dvpp.exe52⤵
- Executes dropped EXE
PID:64 -
\??\c:\1djdp.exec:\1djdp.exe53⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe54⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fxxxrfx.exec:\fxxxrfx.exe55⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hbbbtt.exec:\hbbbtt.exe56⤵
- Executes dropped EXE
PID:3880 -
\??\c:\5nnhbb.exec:\5nnhbb.exe57⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ppjvd.exec:\ppjvd.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7xfxlll.exec:\7xfxlll.exe59⤵
- Executes dropped EXE
PID:3564 -
\??\c:\rllfxll.exec:\rllfxll.exe60⤵
- Executes dropped EXE
PID:4984 -
\??\c:\bhnhbt.exec:\bhnhbt.exe61⤵
- Executes dropped EXE
PID:4684 -
\??\c:\7jvpd.exec:\7jvpd.exe62⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vpvpp.exec:\vpvpp.exe63⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3rflfff.exec:\3rflfff.exe64⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hhbbtt.exec:\hhbbtt.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dvjdp.exec:\dvjdp.exe66⤵PID:1356
-
\??\c:\7ddvp.exec:\7ddvp.exe67⤵PID:1248
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe68⤵PID:1932
-
\??\c:\ntbbbb.exec:\ntbbbb.exe69⤵PID:4040
-
\??\c:\jjddv.exec:\jjddv.exe70⤵PID:3316
-
\??\c:\vdppp.exec:\vdppp.exe71⤵PID:4956
-
\??\c:\rrfxrll.exec:\rrfxrll.exe72⤵PID:5008
-
\??\c:\lxxrlfr.exec:\lxxrlfr.exe73⤵PID:740
-
\??\c:\nbhbbt.exec:\nbhbbt.exe74⤵PID:1540
-
\??\c:\jjpvv.exec:\jjpvv.exe75⤵PID:3796
-
\??\c:\rxxxfff.exec:\rxxxfff.exe76⤵PID:1004
-
\??\c:\nnbthb.exec:\nnbthb.exe77⤵PID:3572
-
\??\c:\1ddvp.exec:\1ddvp.exe78⤵PID:1712
-
\??\c:\pdvvj.exec:\pdvvj.exe79⤵PID:4412
-
\??\c:\xrrlfll.exec:\xrrlfll.exe80⤵PID:2720
-
\??\c:\nntbth.exec:\nntbth.exe81⤵PID:4252
-
\??\c:\thbtnb.exec:\thbtnb.exe82⤵PID:2864
-
\??\c:\vvvjj.exec:\vvvjj.exe83⤵PID:4924
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe84⤵PID:2236
-
\??\c:\bbbttt.exec:\bbbttt.exe85⤵PID:4884
-
\??\c:\9hbthh.exec:\9hbthh.exe86⤵PID:5080
-
\??\c:\dpppp.exec:\dpppp.exe87⤵PID:3532
-
\??\c:\jpvdp.exec:\jpvdp.exe88⤵PID:924
-
\??\c:\xxxrxxf.exec:\xxxrxxf.exe89⤵PID:3456
-
\??\c:\ffllxll.exec:\ffllxll.exe90⤵PID:3432
-
\??\c:\bbbbnn.exec:\bbbbnn.exe91⤵PID:4440
-
\??\c:\tbhbnn.exec:\tbhbnn.exe92⤵PID:3932
-
\??\c:\pjjjj.exec:\pjjjj.exe93⤵PID:368
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe94⤵PID:3204
-
\??\c:\lxrlllf.exec:\lxrlllf.exe95⤵PID:4264
-
\??\c:\hbhbtt.exec:\hbhbtt.exe96⤵PID:2380
-
\??\c:\3nthbn.exec:\3nthbn.exe97⤵PID:2800
-
\??\c:\btbttt.exec:\btbttt.exe98⤵PID:3208
-
\??\c:\dpdvp.exec:\dpdvp.exe99⤵PID:4064
-
\??\c:\7rrrrxx.exec:\7rrrrxx.exe100⤵PID:4508
-
\??\c:\fxffxxr.exec:\fxffxxr.exe101⤵PID:2108
-
\??\c:\bbhtbn.exec:\bbhtbn.exe102⤵PID:4400
-
\??\c:\nbtnbn.exec:\nbtnbn.exe103⤵PID:4980
-
\??\c:\rfxxrxr.exec:\rfxxrxr.exe104⤵PID:5024
-
\??\c:\rlrlffl.exec:\rlrlffl.exe105⤵PID:4896
-
\??\c:\nntbtn.exec:\nntbtn.exe106⤵PID:1020
-
\??\c:\nhtnnb.exec:\nhtnnb.exe107⤵PID:2900
-
\??\c:\5vdvv.exec:\5vdvv.exe108⤵PID:620
-
\??\c:\pjppj.exec:\pjppj.exe109⤵PID:2452
-
\??\c:\xxllfff.exec:\xxllfff.exe110⤵PID:3564
-
\??\c:\5xlxrrx.exec:\5xlxrrx.exe111⤵PID:4984
-
\??\c:\3bbtnt.exec:\3bbtnt.exe112⤵PID:4496
-
\??\c:\tntnbh.exec:\tntnbh.exe113⤵PID:4800
-
\??\c:\jdpjd.exec:\jdpjd.exe114⤵PID:2960
-
\??\c:\pjpdp.exec:\pjpdp.exe115⤵PID:1400
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe116⤵PID:460
-
\??\c:\flrxrff.exec:\flrxrff.exe117⤵PID:1000
-
\??\c:\lfflfrl.exec:\lfflfrl.exe118⤵PID:3764
-
\??\c:\tbhhnn.exec:\tbhhnn.exe119⤵PID:4652
-
\??\c:\vjdvd.exec:\vjdvd.exe120⤵PID:728
-
\??\c:\jjddv.exec:\jjddv.exe121⤵PID:1504
-
\??\c:\5ppjj.exec:\5ppjj.exe122⤵PID:4956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-