Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe
Resource
win7-20240903-en
General
-
Target
030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe
-
Size
230KB
-
MD5
3a03bfb307412678a42bf2f212534f30
-
SHA1
30aabe93d127ae7e4505ab0084d55170e36454e4
-
SHA256
030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597
-
SHA512
73dc41108453acad827bddf39188d73d0d291885b115adb4b2c93a114fe2eb3a4ed1d102e495cbc0996ed734d51b5e5e901dc666c1ad4eab5832327e20b31e9f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1f7:n3C9BRo7MlrWKo+lxKk1f7
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2976-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2976 djpjd.exe 1068 5ffxrxr.exe 1904 vvppp.exe 2840 xllfxxr.exe 4796 bbbbnn.exe 2952 pdddj.exe 3532 xfrlxxr.exe 4876 vpppd.exe 1448 9fffxll.exe 4668 vdpvd.exe 5020 vvjdp.exe 396 7fllfll.exe 3088 thhnhb.exe 1860 xlxxxrl.exe 3688 jvvpj.exe 1064 bttnth.exe 220 nnbhbn.exe 4580 7ddpd.exe 2556 1xfrxrr.exe 4384 3thbnn.exe 3504 vjjdp.exe 4448 3xlfllx.exe 1608 rrxrrrr.exe 944 jvvpj.exe 2128 ffffrrl.exe 4860 7lrffxf.exe 4184 7nhthb.exe 1364 7vpjv.exe 1300 5ppjv.exe 2144 tbhthb.exe 2388 pvpdp.exe 3264 nbnbtn.exe 1720 pppvj.exe 4996 thhbbt.exe 3488 5ddpj.exe 2460 hthttb.exe 2404 pddpd.exe 2576 dpppj.exe 3100 lxxlxxl.exe 2500 hhnbnh.exe 3528 9btnbt.exe 2228 dpvjj.exe 1800 3rxrlfx.exe 4564 hnhtht.exe 2648 htbthh.exe 652 ppjpd.exe 4172 ddvpd.exe 4496 xlxlxrl.exe 4004 bnhbtn.exe 4740 ppdpd.exe 3536 jppjp.exe 1404 3llflfl.exe 392 1hhhnn.exe 2464 1bbnhb.exe 2792 ddvpp.exe 4892 1rxllff.exe 2064 xxrlfxr.exe 3976 hhnbht.exe 4808 djdvv.exe 1288 lfxrxrr.exe 2032 xrxrrlf.exe 928 ttnbth.exe 4848 3dpjd.exe 2480 rlxlxrl.exe -
resource yara_rule behavioral2/memory/2976-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2976 4920 030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe 82 PID 4920 wrote to memory of 2976 4920 030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe 82 PID 4920 wrote to memory of 2976 4920 030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe 82 PID 2976 wrote to memory of 1068 2976 djpjd.exe 83 PID 2976 wrote to memory of 1068 2976 djpjd.exe 83 PID 2976 wrote to memory of 1068 2976 djpjd.exe 83 PID 1068 wrote to memory of 1904 1068 5ffxrxr.exe 84 PID 1068 wrote to memory of 1904 1068 5ffxrxr.exe 84 PID 1068 wrote to memory of 1904 1068 5ffxrxr.exe 84 PID 1904 wrote to memory of 2840 1904 vvppp.exe 85 PID 1904 wrote to memory of 2840 1904 vvppp.exe 85 PID 1904 wrote to memory of 2840 1904 vvppp.exe 85 PID 2840 wrote to memory of 4796 2840 xllfxxr.exe 86 PID 2840 wrote to memory of 4796 2840 xllfxxr.exe 86 PID 2840 wrote to memory of 4796 2840 xllfxxr.exe 86 PID 4796 wrote to memory of 2952 4796 bbbbnn.exe 87 PID 4796 wrote to memory of 2952 4796 bbbbnn.exe 87 PID 4796 wrote to memory of 2952 4796 bbbbnn.exe 87 PID 2952 wrote to memory of 3532 2952 pdddj.exe 88 PID 2952 wrote to memory of 3532 2952 pdddj.exe 88 PID 2952 wrote to memory of 3532 2952 pdddj.exe 88 PID 3532 wrote to memory of 4876 3532 xfrlxxr.exe 89 PID 3532 wrote to memory of 4876 3532 xfrlxxr.exe 89 PID 3532 wrote to memory of 4876 3532 xfrlxxr.exe 89 PID 4876 wrote to memory of 1448 4876 vpppd.exe 90 PID 4876 wrote to memory of 1448 4876 vpppd.exe 90 PID 4876 wrote to memory of 1448 4876 vpppd.exe 90 PID 1448 wrote to memory of 4668 1448 9fffxll.exe 91 PID 1448 wrote to memory of 4668 1448 9fffxll.exe 91 PID 1448 wrote to memory of 4668 1448 9fffxll.exe 91 PID 4668 wrote to memory of 5020 4668 vdpvd.exe 92 PID 4668 wrote to memory of 5020 4668 vdpvd.exe 92 PID 4668 wrote to memory of 5020 4668 vdpvd.exe 92 PID 5020 wrote to memory of 396 5020 vvjdp.exe 93 PID 5020 wrote to memory of 396 5020 vvjdp.exe 93 PID 5020 wrote to memory of 396 5020 vvjdp.exe 93 PID 396 wrote to memory of 3088 396 7fllfll.exe 94 PID 396 wrote to memory of 3088 396 7fllfll.exe 94 PID 396 wrote to memory of 3088 396 7fllfll.exe 94 PID 3088 wrote to memory of 1860 3088 thhnhb.exe 95 PID 3088 wrote to memory of 1860 3088 thhnhb.exe 95 PID 3088 wrote to memory of 1860 3088 thhnhb.exe 95 PID 1860 wrote to memory of 3688 1860 xlxxxrl.exe 96 PID 1860 wrote to memory of 3688 1860 xlxxxrl.exe 96 PID 1860 wrote to memory of 3688 1860 xlxxxrl.exe 96 PID 3688 wrote to memory of 1064 3688 jvvpj.exe 97 PID 3688 wrote to memory of 1064 3688 jvvpj.exe 97 PID 3688 wrote to memory of 1064 3688 jvvpj.exe 97 PID 1064 wrote to memory of 220 1064 bttnth.exe 98 PID 1064 wrote to memory of 220 1064 bttnth.exe 98 PID 1064 wrote to memory of 220 1064 bttnth.exe 98 PID 220 wrote to memory of 4580 220 nnbhbn.exe 99 PID 220 wrote to memory of 4580 220 nnbhbn.exe 99 PID 220 wrote to memory of 4580 220 nnbhbn.exe 99 PID 4580 wrote to memory of 2556 4580 7ddpd.exe 100 PID 4580 wrote to memory of 2556 4580 7ddpd.exe 100 PID 4580 wrote to memory of 2556 4580 7ddpd.exe 100 PID 2556 wrote to memory of 4384 2556 1xfrxrr.exe 101 PID 2556 wrote to memory of 4384 2556 1xfrxrr.exe 101 PID 2556 wrote to memory of 4384 2556 1xfrxrr.exe 101 PID 4384 wrote to memory of 3504 4384 3thbnn.exe 102 PID 4384 wrote to memory of 3504 4384 3thbnn.exe 102 PID 4384 wrote to memory of 3504 4384 3thbnn.exe 102 PID 3504 wrote to memory of 4448 3504 vjjdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe"C:\Users\Admin\AppData\Local\Temp\030fb7428718f9a4169468ee9aabd9ec2a6514b57ecf202c7b9840a57b034597N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\djpjd.exec:\djpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5ffxrxr.exec:\5ffxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\vvppp.exec:\vvppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\xllfxxr.exec:\xllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\bbbbnn.exec:\bbbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\pdddj.exec:\pdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\vpppd.exec:\vpppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\9fffxll.exec:\9fffxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\vdpvd.exec:\vdpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\vvjdp.exec:\vvjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\7fllfll.exec:\7fllfll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\thhnhb.exec:\thhnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xlxxxrl.exec:\xlxxxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\bttnth.exec:\bttnth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\nnbhbn.exec:\nnbhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\7ddpd.exec:\7ddpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\1xfrxrr.exec:\1xfrxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3thbnn.exec:\3thbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\vjjdp.exec:\vjjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\3xlfllx.exec:\3xlfllx.exe23⤵
- Executes dropped EXE
PID:4448 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe24⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jvvpj.exec:\jvvpj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\ffffrrl.exec:\ffffrrl.exe26⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7lrffxf.exec:\7lrffxf.exe27⤵
- Executes dropped EXE
PID:4860 -
\??\c:\7nhthb.exec:\7nhthb.exe28⤵
- Executes dropped EXE
PID:4184 -
\??\c:\7vpjv.exec:\7vpjv.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\5ppjv.exec:\5ppjv.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tbhthb.exec:\tbhthb.exe31⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pvpdp.exec:\pvpdp.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nbnbtn.exec:\nbnbtn.exe33⤵
- Executes dropped EXE
PID:3264 -
\??\c:\pppvj.exec:\pppvj.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\thhbbt.exec:\thhbbt.exe35⤵
- Executes dropped EXE
PID:4996 -
\??\c:\5ddpj.exec:\5ddpj.exe36⤵
- Executes dropped EXE
PID:3488 -
\??\c:\hthttb.exec:\hthttb.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pddpd.exec:\pddpd.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dpppj.exec:\dpppj.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lxxlxxl.exec:\lxxlxxl.exe40⤵
- Executes dropped EXE
PID:3100 -
\??\c:\hhnbnh.exec:\hhnbnh.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9btnbt.exec:\9btnbt.exe42⤵
- Executes dropped EXE
PID:3528 -
\??\c:\dpvjj.exec:\dpvjj.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3rxrlfx.exec:\3rxrlfx.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hnhtht.exec:\hnhtht.exe45⤵
- Executes dropped EXE
PID:4564 -
\??\c:\htbthh.exec:\htbthh.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ppjpd.exec:\ppjpd.exe47⤵
- Executes dropped EXE
PID:652 -
\??\c:\ddvpd.exec:\ddvpd.exe48⤵
- Executes dropped EXE
PID:4172 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe49⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bnhbtn.exec:\bnhbtn.exe50⤵
- Executes dropped EXE
PID:4004 -
\??\c:\ppdpd.exec:\ppdpd.exe51⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jppjp.exec:\jppjp.exe52⤵
- Executes dropped EXE
PID:3536 -
\??\c:\3llflfl.exec:\3llflfl.exe53⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1hhhnn.exec:\1hhhnn.exe54⤵
- Executes dropped EXE
PID:392 -
\??\c:\1bbnhb.exec:\1bbnhb.exe55⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ddvpp.exec:\ddvpp.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1rxllff.exec:\1rxllff.exe57⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hhnbht.exec:\hhnbht.exe59⤵
- Executes dropped EXE
PID:3976 -
\??\c:\djdvv.exec:\djdvv.exe60⤵
- Executes dropped EXE
PID:4808 -
\??\c:\lfxrxrr.exec:\lfxrxrr.exe61⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ttnbth.exec:\ttnbth.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\3dpjd.exec:\3dpjd.exe64⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rlxlxrl.exec:\rlxlxrl.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xffxrlf.exec:\xffxrlf.exe66⤵PID:4668
-
\??\c:\bhhbhb.exec:\bhhbhb.exe67⤵PID:2608
-
\??\c:\1nhthh.exec:\1nhthh.exe68⤵PID:672
-
\??\c:\9jdvj.exec:\9jdvj.exe69⤵PID:2828
-
\??\c:\jpvpd.exec:\jpvpd.exe70⤵PID:4756
-
\??\c:\fflxlfx.exec:\fflxlfx.exe71⤵PID:1636
-
\??\c:\nbthbn.exec:\nbthbn.exe72⤵PID:884
-
\??\c:\ppvpd.exec:\ppvpd.exe73⤵PID:4076
-
\??\c:\vpvjj.exec:\vpvjj.exe74⤵
- System Location Discovery: System Language Discovery
PID:3316 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe75⤵PID:640
-
\??\c:\htnhtn.exec:\htnhtn.exe76⤵
- System Location Discovery: System Language Discovery
PID:772 -
\??\c:\jdjdv.exec:\jdjdv.exe77⤵PID:1688
-
\??\c:\rrrfrll.exec:\rrrfrll.exe78⤵PID:1668
-
\??\c:\tttnbb.exec:\tttnbb.exe79⤵PID:3492
-
\??\c:\vpvdj.exec:\vpvdj.exe80⤵PID:2344
-
\??\c:\5ffrrff.exec:\5ffrrff.exe81⤵PID:1980
-
\??\c:\9hbtnh.exec:\9hbtnh.exe82⤵PID:4500
-
\??\c:\tttbnn.exec:\tttbnn.exe83⤵PID:4416
-
\??\c:\vjjdp.exec:\vjjdp.exe84⤵PID:944
-
\??\c:\vjdvp.exec:\vjdvp.exe85⤵PID:4788
-
\??\c:\xrrrlxr.exec:\xrrrlxr.exe86⤵PID:2128
-
\??\c:\9nbtht.exec:\9nbtht.exe87⤵PID:880
-
\??\c:\ppvvd.exec:\ppvvd.exe88⤵PID:4184
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe89⤵PID:1772
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe90⤵PID:4856
-
\??\c:\5hnbhh.exec:\5hnbhh.exe91⤵PID:4764
-
\??\c:\pppjv.exec:\pppjv.exe92⤵PID:1552
-
\??\c:\jppvd.exec:\jppvd.exe93⤵PID:1916
-
\??\c:\frxlfxl.exec:\frxlfxl.exe94⤵PID:536
-
\??\c:\1rrfxlr.exec:\1rrfxlr.exe95⤵PID:3620
-
\??\c:\btbhth.exec:\btbhth.exe96⤵PID:4048
-
\??\c:\7bthtn.exec:\7bthtn.exe97⤵PID:2192
-
\??\c:\9jpjp.exec:\9jpjp.exe98⤵PID:1884
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe99⤵PID:5060
-
\??\c:\hhnhtt.exec:\hhnhtt.exe100⤵PID:1376
-
\??\c:\7hhbtn.exec:\7hhbtn.exe101⤵PID:1480
-
\??\c:\jddvp.exec:\jddvp.exe102⤵PID:5112
-
\??\c:\5jjpj.exec:\5jjpj.exe103⤵PID:1192
-
\??\c:\1rlxlfx.exec:\1rlxlfx.exe104⤵PID:1732
-
\??\c:\3bthtb.exec:\3bthtb.exe105⤵PID:3952
-
\??\c:\1ddpv.exec:\1ddpv.exe106⤵PID:664
-
\??\c:\vpppd.exec:\vpppd.exe107⤵PID:2836
-
\??\c:\llrlxfr.exec:\llrlxfr.exe108⤵
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\3nbtnh.exec:\3nbtnh.exe109⤵PID:244
-
\??\c:\vjppd.exec:\vjppd.exe110⤵PID:4172
-
\??\c:\vpdvd.exec:\vpdvd.exe111⤵PID:4964
-
\??\c:\fllxlfx.exec:\fllxlfx.exe112⤵PID:1536
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe113⤵PID:4740
-
\??\c:\hbbnhn.exec:\hbbnhn.exe114⤵PID:3856
-
\??\c:\hhhbth.exec:\hhhbth.exe115⤵PID:4832
-
\??\c:\dvjvj.exec:\dvjvj.exe116⤵PID:3016
-
\??\c:\xlfrlfx.exec:\xlfrlfx.exe117⤵PID:2856
-
\??\c:\nbnhbt.exec:\nbnhbt.exe118⤵PID:2904
-
\??\c:\pjpvd.exec:\pjpvd.exe119⤵PID:2956
-
\??\c:\fxxfllf.exec:\fxxfllf.exe120⤵PID:3532
-
\??\c:\tnbtbb.exec:\tnbtbb.exe121⤵PID:3484
-
\??\c:\1btnbt.exec:\1btnbt.exe122⤵PID:1828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-