Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe
Resource
win7-20240708-en
General
-
Target
d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe
-
Size
65KB
-
MD5
c117e647fd185573c5a8d039a4fb48d0
-
SHA1
5e6ada561a339e0f6b25584d84d7e5c42dbf3f60
-
SHA256
d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992
-
SHA512
8fc0b601a481f8a64d12d0350789fba03b77d9f419979ec29076c799f7d1c793f3e7da1d462073841c5fb68dff6716c84e99c61ffd831669b3928e8a358093d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxw:ymb3NkkiQ3mdBjF0y7kbW
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/948-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5060 nhhbth.exe 1152 jvpvv.exe 5020 xxfxllf.exe 2716 flxlxrl.exe 2056 bththb.exe 4636 vpjvp.exe 868 xxxfllr.exe 4224 nhhnbb.exe 316 pjdpv.exe 4100 dpvpp.exe 3264 fffrfrf.exe 232 lrxrfxr.exe 2080 nntbnt.exe 2208 jdvjj.exe 3608 1rxlxrf.exe 1696 tbnhbt.exe 1636 vdvdp.exe 4216 btbtbt.exe 3096 ttnhtn.exe 2940 7vvjv.exe 4376 xlfrrlf.exe 2380 hnnnbt.exe 4124 nbbbnb.exe 928 pjjvd.exe 4752 jvpdp.exe 468 lxxlxlf.exe 852 tnnntn.exe 4592 htbttn.exe 1868 pjdvd.exe 3784 lfxlxrf.exe 3996 rrllxrf.exe 4320 nhhtth.exe 4420 1vjdd.exe 1500 9jdjv.exe 4288 lfrfrlf.exe 4488 rllrxfx.exe 2892 httnnh.exe 3644 pjpjp.exe 3112 9dvpv.exe 2500 fxfrrlf.exe 4600 xxfllfx.exe 1996 5tnbnt.exe 1720 hntnhb.exe 1076 jjdvd.exe 3552 rrfrlfl.exe 4616 tnnhbt.exe 5028 ttnbnh.exe 3672 djdjd.exe 960 vjdvd.exe 5068 xrlxxrl.exe 4884 lxlfrlx.exe 880 1nhbnn.exe 4864 hthbnh.exe 2152 1ddpj.exe 2284 3dvpd.exe 1260 rffxrll.exe 3368 rrfxrfx.exe 1928 nthhnt.exe 4744 pjdvj.exe 2956 3ddvv.exe 652 xfrlffx.exe 1632 xrlxlrl.exe 2312 bnhbnh.exe 3860 pjddp.exe -
resource yara_rule behavioral2/memory/948-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 5060 948 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 82 PID 948 wrote to memory of 5060 948 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 82 PID 948 wrote to memory of 5060 948 d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe 82 PID 5060 wrote to memory of 1152 5060 nhhbth.exe 83 PID 5060 wrote to memory of 1152 5060 nhhbth.exe 83 PID 5060 wrote to memory of 1152 5060 nhhbth.exe 83 PID 1152 wrote to memory of 5020 1152 jvpvv.exe 84 PID 1152 wrote to memory of 5020 1152 jvpvv.exe 84 PID 1152 wrote to memory of 5020 1152 jvpvv.exe 84 PID 5020 wrote to memory of 2716 5020 xxfxllf.exe 85 PID 5020 wrote to memory of 2716 5020 xxfxllf.exe 85 PID 5020 wrote to memory of 2716 5020 xxfxllf.exe 85 PID 2716 wrote to memory of 2056 2716 flxlxrl.exe 86 PID 2716 wrote to memory of 2056 2716 flxlxrl.exe 86 PID 2716 wrote to memory of 2056 2716 flxlxrl.exe 86 PID 2056 wrote to memory of 4636 2056 bththb.exe 87 PID 2056 wrote to memory of 4636 2056 bththb.exe 87 PID 2056 wrote to memory of 4636 2056 bththb.exe 87 PID 4636 wrote to memory of 868 4636 vpjvp.exe 88 PID 4636 wrote to memory of 868 4636 vpjvp.exe 88 PID 4636 wrote to memory of 868 4636 vpjvp.exe 88 PID 868 wrote to memory of 4224 868 xxxfllr.exe 89 PID 868 wrote to memory of 4224 868 xxxfllr.exe 89 PID 868 wrote to memory of 4224 868 xxxfllr.exe 89 PID 4224 wrote to memory of 316 4224 nhhnbb.exe 90 PID 4224 wrote to memory of 316 4224 nhhnbb.exe 90 PID 4224 wrote to memory of 316 4224 nhhnbb.exe 90 PID 316 wrote to memory of 4100 316 pjdpv.exe 91 PID 316 wrote to memory of 4100 316 pjdpv.exe 91 PID 316 wrote to memory of 4100 316 pjdpv.exe 91 PID 4100 wrote to memory of 3264 4100 dpvpp.exe 92 PID 4100 wrote to memory of 3264 4100 dpvpp.exe 92 PID 4100 wrote to memory of 3264 4100 dpvpp.exe 92 PID 3264 wrote to memory of 232 3264 fffrfrf.exe 93 PID 3264 wrote to memory of 232 3264 fffrfrf.exe 93 PID 3264 wrote to memory of 232 3264 fffrfrf.exe 93 PID 232 wrote to memory of 2080 232 lrxrfxr.exe 94 PID 232 wrote to memory of 2080 232 lrxrfxr.exe 94 PID 232 wrote to memory of 2080 232 lrxrfxr.exe 94 PID 2080 wrote to memory of 2208 2080 nntbnt.exe 95 PID 2080 wrote to memory of 2208 2080 nntbnt.exe 95 PID 2080 wrote to memory of 2208 2080 nntbnt.exe 95 PID 2208 wrote to memory of 3608 2208 jdvjj.exe 96 PID 2208 wrote to memory of 3608 2208 jdvjj.exe 96 PID 2208 wrote to memory of 3608 2208 jdvjj.exe 96 PID 3608 wrote to memory of 1696 3608 1rxlxrf.exe 97 PID 3608 wrote to memory of 1696 3608 1rxlxrf.exe 97 PID 3608 wrote to memory of 1696 3608 1rxlxrf.exe 97 PID 1696 wrote to memory of 1636 1696 tbnhbt.exe 98 PID 1696 wrote to memory of 1636 1696 tbnhbt.exe 98 PID 1696 wrote to memory of 1636 1696 tbnhbt.exe 98 PID 1636 wrote to memory of 4216 1636 vdvdp.exe 99 PID 1636 wrote to memory of 4216 1636 vdvdp.exe 99 PID 1636 wrote to memory of 4216 1636 vdvdp.exe 99 PID 4216 wrote to memory of 3096 4216 btbtbt.exe 100 PID 4216 wrote to memory of 3096 4216 btbtbt.exe 100 PID 4216 wrote to memory of 3096 4216 btbtbt.exe 100 PID 3096 wrote to memory of 2940 3096 ttnhtn.exe 101 PID 3096 wrote to memory of 2940 3096 ttnhtn.exe 101 PID 3096 wrote to memory of 2940 3096 ttnhtn.exe 101 PID 2940 wrote to memory of 4376 2940 7vvjv.exe 102 PID 2940 wrote to memory of 4376 2940 7vvjv.exe 102 PID 2940 wrote to memory of 4376 2940 7vvjv.exe 102 PID 4376 wrote to memory of 2380 4376 xlfrrlf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe"C:\Users\Admin\AppData\Local\Temp\d99b458469d6872d89c6291210233143e983fdd4e7c4f8242610e30ecfc3c992N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\nhhbth.exec:\nhhbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\jvpvv.exec:\jvpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\xxfxllf.exec:\xxfxllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\flxlxrl.exec:\flxlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bththb.exec:\bththb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\vpjvp.exec:\vpjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\xxxfllr.exec:\xxxfllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\nhhnbb.exec:\nhhnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\pjdpv.exec:\pjdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\dpvpp.exec:\dpvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\fffrfrf.exec:\fffrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\lrxrfxr.exec:\lrxrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\nntbnt.exec:\nntbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\jdvjj.exec:\jdvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\1rxlxrf.exec:\1rxlxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\tbnhbt.exec:\tbnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\vdvdp.exec:\vdvdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\btbtbt.exec:\btbtbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\ttnhtn.exec:\ttnhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\7vvjv.exec:\7vvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xlfrrlf.exec:\xlfrrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\hnnnbt.exec:\hnnnbt.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nbbbnb.exec:\nbbbnb.exe24⤵
- Executes dropped EXE
PID:4124 -
\??\c:\pjjvd.exec:\pjjvd.exe25⤵
- Executes dropped EXE
PID:928 -
\??\c:\jvpdp.exec:\jvpdp.exe26⤵
- Executes dropped EXE
PID:4752 -
\??\c:\lxxlxlf.exec:\lxxlxlf.exe27⤵
- Executes dropped EXE
PID:468 -
\??\c:\tnnntn.exec:\tnnntn.exe28⤵
- Executes dropped EXE
PID:852 -
\??\c:\htbttn.exec:\htbttn.exe29⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pjdvd.exec:\pjdvd.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe31⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rrllxrf.exec:\rrllxrf.exe32⤵
- Executes dropped EXE
PID:3996 -
\??\c:\nhhtth.exec:\nhhtth.exe33⤵
- Executes dropped EXE
PID:4320 -
\??\c:\1vjdd.exec:\1vjdd.exe34⤵
- Executes dropped EXE
PID:4420 -
\??\c:\9jdjv.exec:\9jdjv.exe35⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe36⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rllrxfx.exec:\rllrxfx.exe37⤵
- Executes dropped EXE
PID:4488 -
\??\c:\httnnh.exec:\httnnh.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjpjp.exec:\pjpjp.exe39⤵
- Executes dropped EXE
PID:3644 -
\??\c:\9dvpv.exec:\9dvpv.exe40⤵
- Executes dropped EXE
PID:3112 -
\??\c:\fxfrrlf.exec:\fxfrrlf.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xxfllfx.exec:\xxfllfx.exe42⤵
- Executes dropped EXE
PID:4600 -
\??\c:\5tnbnt.exec:\5tnbnt.exe43⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hntnhb.exec:\hntnhb.exe44⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjdvd.exec:\jjdvd.exe45⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rrfrlfl.exec:\rrfrlfl.exe46⤵
- Executes dropped EXE
PID:3552 -
\??\c:\tnnhbt.exec:\tnnhbt.exe47⤵
- Executes dropped EXE
PID:4616 -
\??\c:\ttnbnh.exec:\ttnbnh.exe48⤵
- Executes dropped EXE
PID:5028 -
\??\c:\djdjd.exec:\djdjd.exe49⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vjdvd.exec:\vjdvd.exe50⤵
- Executes dropped EXE
PID:960 -
\??\c:\xrlxxrl.exec:\xrlxxrl.exe51⤵
- Executes dropped EXE
PID:5068 -
\??\c:\lxlfrlx.exec:\lxlfrlx.exe52⤵
- Executes dropped EXE
PID:4884 -
\??\c:\1nhbnn.exec:\1nhbnn.exe53⤵
- Executes dropped EXE
PID:880 -
\??\c:\hthbnh.exec:\hthbnh.exe54⤵
- Executes dropped EXE
PID:4864 -
\??\c:\1ddpj.exec:\1ddpj.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3dvpd.exec:\3dvpd.exe56⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rffxrll.exec:\rffxrll.exe57⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rrfxrfx.exec:\rrfxrfx.exe58⤵
- Executes dropped EXE
PID:3368 -
\??\c:\nthhnt.exec:\nthhnt.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pjdvj.exec:\pjdvj.exe60⤵
- Executes dropped EXE
PID:4744 -
\??\c:\3ddvv.exec:\3ddvv.exe61⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xfrlffx.exec:\xfrlffx.exe62⤵
- Executes dropped EXE
PID:652 -
\??\c:\xrlxlrl.exec:\xrlxlrl.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bnhbnh.exec:\bnhbnh.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjddp.exec:\pjddp.exe65⤵
- Executes dropped EXE
PID:3860 -
\??\c:\rrlllxf.exec:\rrlllxf.exe66⤵PID:3948
-
\??\c:\frrlfxx.exec:\frrlfxx.exe67⤵PID:3000
-
\??\c:\tnnhhh.exec:\tnnhhh.exe68⤵PID:4504
-
\??\c:\jvvpd.exec:\jvvpd.exe69⤵PID:2760
-
\??\c:\jppjd.exec:\jppjd.exe70⤵PID:3420
-
\??\c:\rrrflfr.exec:\rrrflfr.exe71⤵PID:2208
-
\??\c:\frflxrl.exec:\frflxrl.exe72⤵PID:5112
-
\??\c:\9btnbn.exec:\9btnbn.exe73⤵PID:2452
-
\??\c:\9ttntn.exec:\9ttntn.exe74⤵PID:384
-
\??\c:\1vpdp.exec:\1vpdp.exe75⤵PID:2448
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe76⤵PID:3588
-
\??\c:\nbbnbn.exec:\nbbnbn.exe77⤵PID:4472
-
\??\c:\nhhbtt.exec:\nhhbtt.exe78⤵PID:3524
-
\??\c:\dvpvv.exec:\dvpvv.exe79⤵PID:1156
-
\??\c:\llffrlf.exec:\llffrlf.exe80⤵PID:2236
-
\??\c:\lrxlxlx.exec:\lrxlxlx.exe81⤵PID:3712
-
\??\c:\nbbtnh.exec:\nbbtnh.exe82⤵PID:3540
-
\??\c:\lxfrlfl.exec:\lxfrlfl.exe83⤵PID:888
-
\??\c:\xlfxllx.exec:\xlfxllx.exe84⤵
- System Location Discovery: System Language Discovery
PID:928 -
\??\c:\bhnhtn.exec:\bhnhtn.exe85⤵PID:1732
-
\??\c:\ntthtn.exec:\ntthtn.exe86⤵PID:2868
-
\??\c:\9vpdp.exec:\9vpdp.exe87⤵PID:3536
-
\??\c:\vppjd.exec:\vppjd.exe88⤵PID:3788
-
\??\c:\dpvvd.exec:\dpvvd.exe89⤵PID:3068
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe90⤵PID:4532
-
\??\c:\tnhbtt.exec:\tnhbtt.exe91⤵PID:4712
-
\??\c:\bhhtbb.exec:\bhhtbb.exe92⤵PID:2944
-
\??\c:\jdvjv.exec:\jdvjv.exe93⤵PID:1728
-
\??\c:\vjdpd.exec:\vjdpd.exe94⤵PID:4320
-
\??\c:\frrlfxr.exec:\frrlfxr.exe95⤵PID:440
-
\??\c:\frrfrff.exec:\frrfrff.exe96⤵PID:1428
-
\??\c:\btbbbt.exec:\btbbbt.exe97⤵PID:4288
-
\??\c:\tnthbt.exec:\tnthbt.exe98⤵PID:2736
-
\??\c:\dvvpd.exec:\dvvpd.exe99⤵PID:3268
-
\??\c:\dvvvp.exec:\dvvvp.exe100⤵PID:4948
-
\??\c:\xllxrrr.exec:\xllxrrr.exe101⤵PID:3716
-
\??\c:\hhhbtt.exec:\hhhbtt.exe102⤵PID:4128
-
\??\c:\hbthbt.exec:\hbthbt.exe103⤵PID:3808
-
\??\c:\9dvpv.exec:\9dvpv.exe104⤵PID:3156
-
\??\c:\vjjvd.exec:\vjjvd.exe105⤵PID:2408
-
\??\c:\ffflxxl.exec:\ffflxxl.exe106⤵PID:4644
-
\??\c:\xxflrxl.exec:\xxflrxl.exe107⤵PID:3552
-
\??\c:\bbthbt.exec:\bbthbt.exe108⤵PID:4616
-
\??\c:\vpppd.exec:\vpppd.exe109⤵PID:2232
-
\??\c:\jvpjp.exec:\jvpjp.exe110⤵PID:332
-
\??\c:\rfrllll.exec:\rfrllll.exe111⤵PID:5060
-
\??\c:\xxxxlll.exec:\xxxxlll.exe112⤵PID:2876
-
\??\c:\lxrrflf.exec:\lxrrflf.exe113⤵PID:4884
-
\??\c:\tnnnhh.exec:\tnnnhh.exe114⤵PID:880
-
\??\c:\7jpvd.exec:\7jpvd.exe115⤵PID:4864
-
\??\c:\jdjdd.exec:\jdjdd.exe116⤵PID:2296
-
\??\c:\rxrfrlx.exec:\rxrfrlx.exe117⤵PID:2308
-
\??\c:\hhnhbb.exec:\hhnhbb.exe118⤵PID:4040
-
\??\c:\hbhbnn.exec:\hbhbnn.exe119⤵PID:3312
-
\??\c:\hnnhnn.exec:\hnnhnn.exe120⤵PID:1504
-
\??\c:\jdjjp.exec:\jdjjp.exe121⤵PID:4588
-
\??\c:\jdvpv.exec:\jdvpv.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-