Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe
Resource
win7-20240903-en
General
-
Target
37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe
-
Size
72KB
-
MD5
809e38221a4bb4e38ad053ebbe345500
-
SHA1
255e7190d3fe610373c7110c3b46dbe033112d37
-
SHA256
37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37
-
SHA512
ff1c0e1c5272596dbc4169646d632840307684f07ee127535c64a58feef90348cab1691c1d88cf1da47a1084e42334c7b0aa3298de6b5e8e8af247d692906cc0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjfg6:ymb3NkkiQ3mdBjFI4Vvg6
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4976-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1060 vppdd.exe 640 3ddpv.exe 2168 xxfxxrx.exe 988 xlxrfxl.exe 3356 htthnh.exe 732 5hhtnb.exe 4692 ppvpv.exe 4908 xlllffx.exe 2208 btttnh.exe 3832 pjpjd.exe 3432 lfxllrr.exe 960 fxxrfxl.exe 1508 ntbnht.exe 1840 jpjdp.exe 3720 pvpdp.exe 4472 3rfrlxf.exe 4056 7tbbhh.exe 4892 vddvj.exe 1280 lrrlffx.exe 5028 tnhhhh.exe 8 bbbbhh.exe 2732 xfflxrl.exe 3172 hhbbbb.exe 2376 vvdpj.exe 4136 fxrlfff.exe 4048 ttntbt.exe 1800 nnhbtt.exe 5060 jjjvj.exe 4272 7jvpp.exe 3660 frxrllf.exe 1480 rlfxffr.exe 2920 nhhnhh.exe 4064 dvdpj.exe 1528 xlfxxfx.exe 3608 3xflffx.exe 4540 btnntt.exe 3468 vdddv.exe 4132 1vvpd.exe 2896 xfrlffx.exe 1128 nhttbb.exe 4240 9tbthh.exe 2960 3vjdv.exe 4036 jpvdj.exe 2772 lllfrrr.exe 2148 nbhhbb.exe 4608 3tthbb.exe 2144 vjpjd.exe 2028 dvdpd.exe 2856 xlrlfxf.exe 3116 fxxrrrl.exe 1060 nbnttt.exe 540 hnhbnh.exe 1084 vppjj.exe 2580 rxlfxxr.exe 676 rffxrrl.exe 2816 btnnbt.exe 3128 nhnnhh.exe 5000 vvdvp.exe 1148 vpjdv.exe 2792 rxffxxr.exe 2776 9nbhhh.exe 5016 thnnbb.exe 2552 djvvp.exe 3936 pvvvp.exe -
resource yara_rule behavioral2/memory/4976-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 1060 4976 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 82 PID 4976 wrote to memory of 1060 4976 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 82 PID 4976 wrote to memory of 1060 4976 37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe 82 PID 1060 wrote to memory of 640 1060 vppdd.exe 83 PID 1060 wrote to memory of 640 1060 vppdd.exe 83 PID 1060 wrote to memory of 640 1060 vppdd.exe 83 PID 640 wrote to memory of 2168 640 3ddpv.exe 84 PID 640 wrote to memory of 2168 640 3ddpv.exe 84 PID 640 wrote to memory of 2168 640 3ddpv.exe 84 PID 2168 wrote to memory of 988 2168 xxfxxrx.exe 85 PID 2168 wrote to memory of 988 2168 xxfxxrx.exe 85 PID 2168 wrote to memory of 988 2168 xxfxxrx.exe 85 PID 988 wrote to memory of 3356 988 xlxrfxl.exe 86 PID 988 wrote to memory of 3356 988 xlxrfxl.exe 86 PID 988 wrote to memory of 3356 988 xlxrfxl.exe 86 PID 3356 wrote to memory of 732 3356 htthnh.exe 87 PID 3356 wrote to memory of 732 3356 htthnh.exe 87 PID 3356 wrote to memory of 732 3356 htthnh.exe 87 PID 732 wrote to memory of 4692 732 5hhtnb.exe 88 PID 732 wrote to memory of 4692 732 5hhtnb.exe 88 PID 732 wrote to memory of 4692 732 5hhtnb.exe 88 PID 4692 wrote to memory of 4908 4692 ppvpv.exe 89 PID 4692 wrote to memory of 4908 4692 ppvpv.exe 89 PID 4692 wrote to memory of 4908 4692 ppvpv.exe 89 PID 4908 wrote to memory of 2208 4908 xlllffx.exe 90 PID 4908 wrote to memory of 2208 4908 xlllffx.exe 90 PID 4908 wrote to memory of 2208 4908 xlllffx.exe 90 PID 2208 wrote to memory of 3832 2208 btttnh.exe 91 PID 2208 wrote to memory of 3832 2208 btttnh.exe 91 PID 2208 wrote to memory of 3832 2208 btttnh.exe 91 PID 3832 wrote to memory of 3432 3832 pjpjd.exe 92 PID 3832 wrote to memory of 3432 3832 pjpjd.exe 92 PID 3832 wrote to memory of 3432 3832 pjpjd.exe 92 PID 3432 wrote to memory of 960 3432 lfxllrr.exe 93 PID 3432 wrote to memory of 960 3432 lfxllrr.exe 93 PID 3432 wrote to memory of 960 3432 lfxllrr.exe 93 PID 960 wrote to memory of 1508 960 fxxrfxl.exe 94 PID 960 wrote to memory of 1508 960 fxxrfxl.exe 94 PID 960 wrote to memory of 1508 960 fxxrfxl.exe 94 PID 1508 wrote to memory of 1840 1508 ntbnht.exe 95 PID 1508 wrote to memory of 1840 1508 ntbnht.exe 95 PID 1508 wrote to memory of 1840 1508 ntbnht.exe 95 PID 1840 wrote to memory of 3720 1840 jpjdp.exe 96 PID 1840 wrote to memory of 3720 1840 jpjdp.exe 96 PID 1840 wrote to memory of 3720 1840 jpjdp.exe 96 PID 3720 wrote to memory of 4472 3720 pvpdp.exe 97 PID 3720 wrote to memory of 4472 3720 pvpdp.exe 97 PID 3720 wrote to memory of 4472 3720 pvpdp.exe 97 PID 4472 wrote to memory of 4056 4472 3rfrlxf.exe 98 PID 4472 wrote to memory of 4056 4472 3rfrlxf.exe 98 PID 4472 wrote to memory of 4056 4472 3rfrlxf.exe 98 PID 4056 wrote to memory of 4892 4056 7tbbhh.exe 99 PID 4056 wrote to memory of 4892 4056 7tbbhh.exe 99 PID 4056 wrote to memory of 4892 4056 7tbbhh.exe 99 PID 4892 wrote to memory of 1280 4892 vddvj.exe 100 PID 4892 wrote to memory of 1280 4892 vddvj.exe 100 PID 4892 wrote to memory of 1280 4892 vddvj.exe 100 PID 1280 wrote to memory of 5028 1280 lrrlffx.exe 101 PID 1280 wrote to memory of 5028 1280 lrrlffx.exe 101 PID 1280 wrote to memory of 5028 1280 lrrlffx.exe 101 PID 5028 wrote to memory of 8 5028 tnhhhh.exe 102 PID 5028 wrote to memory of 8 5028 tnhhhh.exe 102 PID 5028 wrote to memory of 8 5028 tnhhhh.exe 102 PID 8 wrote to memory of 2732 8 bbbbhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe"C:\Users\Admin\AppData\Local\Temp\37918be0fce9a8b5054840faac9bdd0b4bc30291652e6097dd0a2173b2caec37N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\vppdd.exec:\vppdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\3ddpv.exec:\3ddpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\xxfxxrx.exec:\xxfxxrx.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xlxrfxl.exec:\xlxrfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\htthnh.exec:\htthnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\5hhtnb.exec:\5hhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\ppvpv.exec:\ppvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\xlllffx.exec:\xlllffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\btttnh.exec:\btttnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pjpjd.exec:\pjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\lfxllrr.exec:\lfxllrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\ntbnht.exec:\ntbnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\jpjdp.exec:\jpjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\pvpdp.exec:\pvpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\3rfrlxf.exec:\3rfrlxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\7tbbhh.exec:\7tbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\vddvj.exec:\vddvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\lrrlffx.exec:\lrrlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\tnhhhh.exec:\tnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\bbbbhh.exec:\bbbbhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xfflxrl.exec:\xfflxrl.exe23⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhbbbb.exec:\hhbbbb.exe24⤵
- Executes dropped EXE
PID:3172 -
\??\c:\vvdpj.exec:\vvdpj.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxrlfff.exec:\fxrlfff.exe26⤵
- Executes dropped EXE
PID:4136 -
\??\c:\ttntbt.exec:\ttntbt.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nnhbtt.exec:\nnhbtt.exe28⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jjjvj.exec:\jjjvj.exe29⤵
- Executes dropped EXE
PID:5060 -
\??\c:\7jvpp.exec:\7jvpp.exe30⤵
- Executes dropped EXE
PID:4272 -
\??\c:\frxrllf.exec:\frxrllf.exe31⤵
- Executes dropped EXE
PID:3660 -
\??\c:\rlfxffr.exec:\rlfxffr.exe32⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhhnhh.exec:\nhhnhh.exe33⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dvdpj.exec:\dvdpj.exe34⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xlfxxfx.exec:\xlfxxfx.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3xflffx.exec:\3xflffx.exe36⤵
- Executes dropped EXE
PID:3608 -
\??\c:\btnntt.exec:\btnntt.exe37⤵
- Executes dropped EXE
PID:4540 -
\??\c:\vdddv.exec:\vdddv.exe38⤵
- Executes dropped EXE
PID:3468 -
\??\c:\1vvpd.exec:\1vvpd.exe39⤵
- Executes dropped EXE
PID:4132 -
\??\c:\xfrlffx.exec:\xfrlffx.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhttbb.exec:\nhttbb.exe41⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9tbthh.exec:\9tbthh.exe42⤵
- Executes dropped EXE
PID:4240 -
\??\c:\3vjdv.exec:\3vjdv.exe43⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jpvdj.exec:\jpvdj.exe44⤵
- Executes dropped EXE
PID:4036 -
\??\c:\lllfrrr.exec:\lllfrrr.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nbhhbb.exec:\nbhhbb.exe46⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3tthbb.exec:\3tthbb.exe47⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vjpjd.exec:\vjpjd.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dvdpd.exec:\dvdpd.exe49⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe51⤵
- Executes dropped EXE
PID:3116 -
\??\c:\nbnttt.exec:\nbnttt.exe52⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hnhbnh.exec:\hnhbnh.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:540 -
\??\c:\vppjj.exec:\vppjj.exe54⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe55⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rffxrrl.exec:\rffxrrl.exe56⤵
- Executes dropped EXE
PID:676 -
\??\c:\btnnbt.exec:\btnnbt.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhnnhh.exec:\nhnnhh.exe58⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vvdvp.exec:\vvdvp.exe59⤵
- Executes dropped EXE
PID:5000 -
\??\c:\vpjdv.exec:\vpjdv.exe60⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rxffxxr.exec:\rxffxxr.exe61⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9nbhhh.exec:\9nbhhh.exe62⤵
- Executes dropped EXE
PID:2776 -
\??\c:\thnnbb.exec:\thnnbb.exe63⤵
- Executes dropped EXE
PID:5016 -
\??\c:\djvvp.exec:\djvvp.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pvvvp.exec:\pvvvp.exe65⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xrxflrx.exec:\xrxflrx.exe66⤵PID:4244
-
\??\c:\lfxlfff.exec:\lfxlfff.exe67⤵PID:4928
-
\??\c:\tnttnt.exec:\tnttnt.exe68⤵PID:232
-
\??\c:\9dvpj.exec:\9dvpj.exe69⤵PID:1560
-
\??\c:\vpvvj.exec:\vpvvj.exe70⤵PID:728
-
\??\c:\rxxrllf.exec:\rxxrllf.exe71⤵PID:100
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe72⤵PID:2864
-
\??\c:\ntttnn.exec:\ntttnn.exe73⤵PID:3920
-
\??\c:\thtbtt.exec:\thtbtt.exe74⤵PID:1432
-
\??\c:\vpdvv.exec:\vpdvv.exe75⤵PID:4968
-
\??\c:\pjddj.exec:\pjddj.exe76⤵PID:1072
-
\??\c:\rllxrrr.exec:\rllxrrr.exe77⤵PID:4892
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe78⤵PID:1300
-
\??\c:\nnhnth.exec:\nnhnth.exe79⤵PID:4576
-
\??\c:\7jjjv.exec:\7jjjv.exe80⤵PID:1524
-
\??\c:\ppvdd.exec:\ppvdd.exe81⤵PID:2948
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe82⤵PID:4640
-
\??\c:\rllfxxr.exec:\rllfxxr.exe83⤵PID:2860
-
\??\c:\bttbbb.exec:\bttbbb.exe84⤵PID:2640
-
\??\c:\tbbthh.exec:\tbbthh.exe85⤵PID:1092
-
\??\c:\jdpdd.exec:\jdpdd.exe86⤵PID:4136
-
\??\c:\5bnnbb.exec:\5bnnbb.exe87⤵PID:1392
-
\??\c:\thnthh.exec:\thnthh.exe88⤵PID:3228
-
\??\c:\vdpjp.exec:\vdpjp.exe89⤵PID:4248
-
\??\c:\dppjj.exec:\dppjj.exe90⤵PID:4816
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe91⤵PID:4272
-
\??\c:\rlllllf.exec:\rlllllf.exe92⤵PID:3100
-
\??\c:\bttnhb.exec:\bttnhb.exe93⤵PID:2980
-
\??\c:\httthh.exec:\httthh.exe94⤵PID:896
-
\??\c:\dpjjd.exec:\dpjjd.exe95⤵PID:2504
-
\??\c:\5jjdd.exec:\5jjdd.exe96⤵PID:4212
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe97⤵PID:1632
-
\??\c:\1nnhnh.exec:\1nnhnh.exe98⤵PID:4728
-
\??\c:\7jpjv.exec:\7jpjv.exe99⤵PID:4732
-
\??\c:\rllrfff.exec:\rllrfff.exe100⤵PID:1860
-
\??\c:\rrrxrxx.exec:\rrrxrxx.exe101⤵PID:4252
-
\??\c:\bhhbtt.exec:\bhhbtt.exe102⤵PID:3944
-
\??\c:\dvvpj.exec:\dvvpj.exe103⤵PID:1596
-
\??\c:\djpjd.exec:\djpjd.exe104⤵PID:3632
-
\??\c:\xllfxxx.exec:\xllfxxx.exe105⤵PID:3732
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe106⤵PID:2772
-
\??\c:\bhnhbb.exec:\bhnhbb.exe107⤵
- System Location Discovery: System Language Discovery
PID:1768 -
\??\c:\vjppj.exec:\vjppj.exe108⤵PID:5024
-
\??\c:\jdppv.exec:\jdppv.exe109⤵PID:4364
-
\??\c:\llxxllf.exec:\llxxllf.exe110⤵PID:2372
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe111⤵PID:1052
-
\??\c:\thnnhn.exec:\thnnhn.exe112⤵PID:1216
-
\??\c:\djvpv.exec:\djvpv.exe113⤵PID:2540
-
\??\c:\jdjdv.exec:\jdjdv.exe114⤵PID:4864
-
\??\c:\rlrlllx.exec:\rlrlllx.exe115⤵PID:1588
-
\??\c:\lxxrrrf.exec:\lxxrrrf.exe116⤵PID:2168
-
\??\c:\ththhb.exec:\ththhb.exe117⤵PID:528
-
\??\c:\nhnhhb.exec:\nhnhhb.exe118⤵PID:988
-
\??\c:\jdvvj.exec:\jdvvj.exe119⤵PID:3284
-
\??\c:\jvpvj.exec:\jvpvj.exe120⤵PID:4092
-
\??\c:\rffrfff.exec:\rffrfff.exe121⤵PID:664
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe122⤵PID:1492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-