Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 02:22
Static task
static1
Behavioral task
behavioral1
Sample
846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe
Resource
win7-20240903-en
General
-
Target
846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe
-
Size
66KB
-
MD5
a9a296070c202d7b11972db746be6b70
-
SHA1
4eb07e5f467464b7b7b20279520556b61f1d351c
-
SHA256
846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0
-
SHA512
52d1433fe4aa712771831b27edc6e43e0a04c788e5a91a7539c00ff3cc615db38d477d83799ee0d6bc2db90f4a6ea453f8078bc0966761a1163928a54314d5de
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfo4l:ymb3NkkiQ3mdBjFI9cqfVl
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3628-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2272 frxlflf.exe 4284 5flfxfx.exe 4420 nhttbb.exe 1652 nntbbt.exe 2644 bhbnhb.exe 2752 9bbthh.exe 2832 jddvp.exe 880 vpjjd.exe 928 fxfxffl.exe 3488 3nhbtt.exe 3444 htbbtb.exe 1444 jvvpj.exe 372 xlrlxxx.exe 896 1lxlrrx.exe 4080 bnbttn.exe 4232 jvdpv.exe 2116 pjjdv.exe 3184 7xxxrrx.exe 2696 httbtt.exe 3116 tbnthn.exe 4432 xxrrfff.exe 4576 llrrxfx.exe 4956 vpvpd.exe 1472 dvpjd.exe 1720 lxxrlfx.exe 3984 5nhtnh.exe 1232 btnhtt.exe 5068 dvjvj.exe 2768 xrrlrll.exe 4912 9bhbbb.exe 3276 bbhtbt.exe 552 frrlrll.exe 1624 3bbbbh.exe 1556 djjvj.exe 912 xlrlllr.exe 1172 frrlffx.exe 228 nhtnnb.exe 2744 jvdpd.exe 512 lffxxxr.exe 2344 lrrlrlf.exe 4828 nbhbbb.exe 3032 pvdvp.exe 1772 tnhthb.exe 3800 jvpjv.exe 4792 fflxrrl.exe 3484 hhtnhb.exe 4684 bbnhhb.exe 4376 9pvvd.exe 4440 5xlfxxf.exe 3628 hbthbb.exe 2388 jdvpj.exe 3076 dpdvp.exe 1200 lxxrflf.exe 1708 bhttnn.exe 4312 1nnhbb.exe 2524 jddvv.exe 1988 rlrrrxf.exe 2752 xxxxfxf.exe 3944 bbhhnt.exe 932 nhbtbt.exe 4292 jjvpd.exe 3220 lfxrlfx.exe 2440 xlrrllr.exe 2432 nhhhbh.exe -
resource yara_rule behavioral2/memory/3628-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3628 wrote to memory of 2272 3628 846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe 83 PID 3628 wrote to memory of 2272 3628 846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe 83 PID 3628 wrote to memory of 2272 3628 846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe 83 PID 2272 wrote to memory of 4284 2272 frxlflf.exe 84 PID 2272 wrote to memory of 4284 2272 frxlflf.exe 84 PID 2272 wrote to memory of 4284 2272 frxlflf.exe 84 PID 4284 wrote to memory of 4420 4284 5flfxfx.exe 85 PID 4284 wrote to memory of 4420 4284 5flfxfx.exe 85 PID 4284 wrote to memory of 4420 4284 5flfxfx.exe 85 PID 4420 wrote to memory of 1652 4420 nhttbb.exe 86 PID 4420 wrote to memory of 1652 4420 nhttbb.exe 86 PID 4420 wrote to memory of 1652 4420 nhttbb.exe 86 PID 1652 wrote to memory of 2644 1652 nntbbt.exe 87 PID 1652 wrote to memory of 2644 1652 nntbbt.exe 87 PID 1652 wrote to memory of 2644 1652 nntbbt.exe 87 PID 2644 wrote to memory of 2752 2644 bhbnhb.exe 88 PID 2644 wrote to memory of 2752 2644 bhbnhb.exe 88 PID 2644 wrote to memory of 2752 2644 bhbnhb.exe 88 PID 2752 wrote to memory of 2832 2752 9bbthh.exe 89 PID 2752 wrote to memory of 2832 2752 9bbthh.exe 89 PID 2752 wrote to memory of 2832 2752 9bbthh.exe 89 PID 2832 wrote to memory of 880 2832 jddvp.exe 90 PID 2832 wrote to memory of 880 2832 jddvp.exe 90 PID 2832 wrote to memory of 880 2832 jddvp.exe 90 PID 880 wrote to memory of 928 880 vpjjd.exe 91 PID 880 wrote to memory of 928 880 vpjjd.exe 91 PID 880 wrote to memory of 928 880 vpjjd.exe 91 PID 928 wrote to memory of 3488 928 fxfxffl.exe 92 PID 928 wrote to memory of 3488 928 fxfxffl.exe 92 PID 928 wrote to memory of 3488 928 fxfxffl.exe 92 PID 3488 wrote to memory of 3444 3488 3nhbtt.exe 93 PID 3488 wrote to memory of 3444 3488 3nhbtt.exe 93 PID 3488 wrote to memory of 3444 3488 3nhbtt.exe 93 PID 3444 wrote to memory of 1444 3444 htbbtb.exe 94 PID 3444 wrote to memory of 1444 3444 htbbtb.exe 94 PID 3444 wrote to memory of 1444 3444 htbbtb.exe 94 PID 1444 wrote to memory of 372 1444 jvvpj.exe 95 PID 1444 wrote to memory of 372 1444 jvvpj.exe 95 PID 1444 wrote to memory of 372 1444 jvvpj.exe 95 PID 372 wrote to memory of 896 372 xlrlxxx.exe 96 PID 372 wrote to memory of 896 372 xlrlxxx.exe 96 PID 372 wrote to memory of 896 372 xlrlxxx.exe 96 PID 896 wrote to memory of 4080 896 1lxlrrx.exe 97 PID 896 wrote to memory of 4080 896 1lxlrrx.exe 97 PID 896 wrote to memory of 4080 896 1lxlrrx.exe 97 PID 4080 wrote to memory of 4232 4080 bnbttn.exe 98 PID 4080 wrote to memory of 4232 4080 bnbttn.exe 98 PID 4080 wrote to memory of 4232 4080 bnbttn.exe 98 PID 4232 wrote to memory of 2116 4232 jvdpv.exe 99 PID 4232 wrote to memory of 2116 4232 jvdpv.exe 99 PID 4232 wrote to memory of 2116 4232 jvdpv.exe 99 PID 2116 wrote to memory of 3184 2116 pjjdv.exe 100 PID 2116 wrote to memory of 3184 2116 pjjdv.exe 100 PID 2116 wrote to memory of 3184 2116 pjjdv.exe 100 PID 3184 wrote to memory of 2696 3184 7xxxrrx.exe 101 PID 3184 wrote to memory of 2696 3184 7xxxrrx.exe 101 PID 3184 wrote to memory of 2696 3184 7xxxrrx.exe 101 PID 2696 wrote to memory of 3116 2696 httbtt.exe 102 PID 2696 wrote to memory of 3116 2696 httbtt.exe 102 PID 2696 wrote to memory of 3116 2696 httbtt.exe 102 PID 3116 wrote to memory of 4432 3116 tbnthn.exe 103 PID 3116 wrote to memory of 4432 3116 tbnthn.exe 103 PID 3116 wrote to memory of 4432 3116 tbnthn.exe 103 PID 4432 wrote to memory of 4576 4432 xxrrfff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe"C:\Users\Admin\AppData\Local\Temp\846b91540e8cc22610c6ddb4db1ad05c281fc0a25cf53ebde54232f021726fc0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\frxlflf.exec:\frxlflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\5flfxfx.exec:\5flfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\nhttbb.exec:\nhttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\nntbbt.exec:\nntbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\bhbnhb.exec:\bhbnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9bbthh.exec:\9bbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jddvp.exec:\jddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vpjjd.exec:\vpjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\fxfxffl.exec:\fxfxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\3nhbtt.exec:\3nhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\htbbtb.exec:\htbbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\jvvpj.exec:\jvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\1lxlrrx.exec:\1lxlrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\bnbttn.exec:\bnbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\jvdpv.exec:\jvdpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\pjjdv.exec:\pjjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7xxxrrx.exec:\7xxxrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\httbtt.exec:\httbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tbnthn.exec:\tbnthn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\xxrrfff.exec:\xxrrfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\llrrxfx.exec:\llrrxfx.exe23⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vpvpd.exec:\vpvpd.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dvpjd.exec:\dvpjd.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe26⤵
- Executes dropped EXE
PID:1720 -
\??\c:\5nhtnh.exec:\5nhtnh.exe27⤵
- Executes dropped EXE
PID:3984 -
\??\c:\btnhtt.exec:\btnhtt.exe28⤵
- Executes dropped EXE
PID:1232 -
\??\c:\dvjvj.exec:\dvjvj.exe29⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xrrlrll.exec:\xrrlrll.exe30⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9bhbbb.exec:\9bhbbb.exe31⤵
- Executes dropped EXE
PID:4912 -
\??\c:\bbhtbt.exec:\bbhtbt.exe32⤵
- Executes dropped EXE
PID:3276 -
\??\c:\frrlrll.exec:\frrlrll.exe33⤵
- Executes dropped EXE
PID:552 -
\??\c:\3bbbbh.exec:\3bbbbh.exe34⤵
- Executes dropped EXE
PID:1624 -
\??\c:\djjvj.exec:\djjvj.exe35⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xlrlllr.exec:\xlrlllr.exe36⤵
- Executes dropped EXE
PID:912 -
\??\c:\frrlffx.exec:\frrlffx.exe37⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nhtnnb.exec:\nhtnnb.exe38⤵
- Executes dropped EXE
PID:228 -
\??\c:\jvdpd.exec:\jvdpd.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lffxxxr.exec:\lffxxxr.exe40⤵
- Executes dropped EXE
PID:512 -
\??\c:\lrrlrlf.exec:\lrrlrlf.exe41⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nbhbbb.exec:\nbhbbb.exe42⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnhthb.exec:\tnhthb.exe44⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jvpjv.exec:\jvpjv.exe45⤵
- Executes dropped EXE
PID:3800 -
\??\c:\fflxrrl.exec:\fflxrrl.exe46⤵
- Executes dropped EXE
PID:4792 -
\??\c:\hhtnhb.exec:\hhtnhb.exe47⤵
- Executes dropped EXE
PID:3484 -
\??\c:\bbnhhb.exec:\bbnhhb.exe48⤵
- Executes dropped EXE
PID:4684 -
\??\c:\9pvvd.exec:\9pvvd.exe49⤵
- Executes dropped EXE
PID:4376 -
\??\c:\5xlfxxf.exec:\5xlfxxf.exe50⤵
- Executes dropped EXE
PID:4440 -
\??\c:\hbthbb.exec:\hbthbb.exe51⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jdvpj.exec:\jdvpj.exe52⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dpdvp.exec:\dpdvp.exe53⤵
- Executes dropped EXE
PID:3076 -
\??\c:\lxxrflf.exec:\lxxrflf.exe54⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bhttnn.exec:\bhttnn.exe55⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1nnhbb.exec:\1nnhbb.exe56⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jddvv.exec:\jddvv.exe57⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xxxxfxf.exec:\xxxxfxf.exe59⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bbhhnt.exec:\bbhhnt.exe60⤵
- Executes dropped EXE
PID:3944 -
\??\c:\nhbtbt.exec:\nhbtbt.exe61⤵
- Executes dropped EXE
PID:932 -
\??\c:\jjvpd.exec:\jjvpd.exe62⤵
- Executes dropped EXE
PID:4292 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe63⤵
- Executes dropped EXE
PID:3220 -
\??\c:\xlrrllr.exec:\xlrrllr.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nhhhbh.exec:\nhhhbh.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bttnnn.exec:\bttnnn.exe66⤵PID:3592
-
\??\c:\djvjj.exec:\djvjj.exe67⤵PID:2936
-
\??\c:\pjjdp.exec:\pjjdp.exe68⤵PID:3700
-
\??\c:\lffrlff.exec:\lffrlff.exe69⤵PID:2384
-
\??\c:\bnbhbb.exec:\bnbhbb.exe70⤵PID:896
-
\??\c:\vvdpd.exec:\vvdpd.exe71⤵PID:872
-
\??\c:\pvddv.exec:\pvddv.exe72⤵PID:772
-
\??\c:\fxffrrf.exec:\fxffrrf.exe73⤵PID:3504
-
\??\c:\hbhbtt.exec:\hbhbtt.exe74⤵PID:2092
-
\??\c:\hbnhbb.exec:\hbnhbb.exe75⤵PID:2128
-
\??\c:\jjdpp.exec:\jjdpp.exe76⤵PID:1092
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe77⤵PID:2180
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe78⤵PID:4708
-
\??\c:\ttnhnn.exec:\ttnhnn.exe79⤵PID:3620
-
\??\c:\htbhtt.exec:\htbhtt.exe80⤵PID:3568
-
\??\c:\vppjv.exec:\vppjv.exe81⤵PID:4432
-
\??\c:\5lfxrxr.exec:\5lfxrxr.exe82⤵PID:2552
-
\??\c:\lfxxffl.exec:\lfxxffl.exe83⤵PID:4064
-
\??\c:\bnhbtt.exec:\bnhbtt.exe84⤵PID:1524
-
\??\c:\ppvpp.exec:\ppvpp.exe85⤵PID:1828
-
\??\c:\vpjdp.exec:\vpjdp.exe86⤵PID:464
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe87⤵PID:460
-
\??\c:\httnhh.exec:\httnhh.exe88⤵PID:1232
-
\??\c:\3pppd.exec:\3pppd.exe89⤵PID:4392
-
\??\c:\dddvp.exec:\dddvp.exe90⤵PID:2712
-
\??\c:\vpjdd.exec:\vpjdd.exe91⤵PID:4764
-
\??\c:\fxllllx.exec:\fxllllx.exe92⤵PID:3732
-
\??\c:\3hbhtb.exec:\3hbhtb.exe93⤵PID:2968
-
\??\c:\bntnhh.exec:\bntnhh.exe94⤵PID:2748
-
\??\c:\pddvv.exec:\pddvv.exe95⤵PID:1800
-
\??\c:\vpdvp.exec:\vpdvp.exe96⤵PID:1348
-
\??\c:\7rlfrrr.exec:\7rlfrrr.exe97⤵PID:1484
-
\??\c:\xxlllll.exec:\xxlllll.exe98⤵PID:1892
-
\??\c:\nhnntb.exec:\nhnntb.exe99⤵PID:2976
-
\??\c:\djjjd.exec:\djjjd.exe100⤵PID:1620
-
\??\c:\pjjjj.exec:\pjjjj.exe101⤵PID:936
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe102⤵PID:2992
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe103⤵PID:3304
-
\??\c:\hbttbb.exec:\hbttbb.exe104⤵PID:3032
-
\??\c:\dvddv.exec:\dvddv.exe105⤵PID:3300
-
\??\c:\pjdvp.exec:\pjdvp.exe106⤵PID:4092
-
\??\c:\ffrlffx.exec:\ffrlffx.exe107⤵PID:4792
-
\??\c:\llffffx.exec:\llffffx.exe108⤵PID:1372
-
\??\c:\nbbtbh.exec:\nbbtbh.exe109⤵PID:4444
-
\??\c:\ddvjd.exec:\ddvjd.exe110⤵PID:3876
-
\??\c:\dvpjp.exec:\dvpjp.exe111⤵PID:2208
-
\??\c:\rrxrllx.exec:\rrxrllx.exe112⤵PID:2984
-
\??\c:\7xxlfff.exec:\7xxlfff.exe113⤵PID:3472
-
\??\c:\hbbbtt.exec:\hbbbtt.exe114⤵PID:4172
-
\??\c:\pjpjd.exec:\pjpjd.exe115⤵PID:2888
-
\??\c:\xrrllrx.exec:\xrrllrx.exe116⤵PID:3368
-
\??\c:\lxflffx.exec:\lxflffx.exe117⤵PID:1088
-
\??\c:\bnntnn.exec:\bnntnn.exe118⤵
- System Location Discovery: System Language Discovery
PID:60 -
\??\c:\1dddv.exec:\1dddv.exe119⤵PID:736
-
\??\c:\dpddv.exec:\dpddv.exe120⤵PID:1760
-
\??\c:\rxllflf.exec:\rxllflf.exe121⤵PID:3804
-
\??\c:\flxxffx.exec:\flxxffx.exe122⤵PID:932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-