Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 03:00
Static task
static1
Behavioral task
behavioral1
Sample
d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe
Resource
win7-20240903-en
General
-
Target
d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe
-
Size
71KB
-
MD5
a4673542dd6d0e4ac70ea604f3a3f08c
-
SHA1
8e0fd2b5ad6bcf355fc81943b1924396d531c724
-
SHA256
d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee
-
SHA512
9a57b62249a2e758322b146deb733b45e8d0dad1ae1c33d549c1aad59d334f04de2c8cbf81d20252acf80608e0d56f1dc165fb21ad80ec3c20e2ef1decfb407e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj5hq:ymb3NkkiQ3mdBjFI4Vq
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4740-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/796-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3656 bhtnnn.exe 5112 vvdvp.exe 4012 1rlfrrr.exe 904 rlrlrrl.exe 1892 ntthth.exe 1080 pjpjd.exe 3208 jpvdv.exe 4632 xxxxrrr.exe 2860 nntnhh.exe 4508 pvjdv.exe 4180 rxfxrfl.exe 4236 3bbttb.exe 2456 jjjvv.exe 4224 rrxrrrr.exe 2024 3ffxxxr.exe 2416 hbhhbt.exe 3252 pddvj.exe 3716 hntnnn.exe 1044 pdvpj.exe 4152 dpdjv.exe 1192 rrllflf.exe 2440 ttbtbb.exe 1244 hhnnbb.exe 544 7dppj.exe 796 lxxrrfx.exe 908 fxxrllf.exe 2572 nhthbb.exe 3192 pjvpp.exe 4456 vpdvj.exe 4496 lxlfffl.exe 2428 5bhhhh.exe 2608 bbbttt.exe 2712 jdjjd.exe 664 rfllrrr.exe 3364 rlxfffx.exe 4392 bnttnt.exe 4540 hbhbnt.exe 3720 nnnhhn.exe 2348 9jpjd.exe 3884 lxllxfx.exe 1500 rfffxxr.exe 4536 tnntht.exe 1736 dvppp.exe 3480 dvpjv.exe 1968 1frfrrl.exe 3656 tnnnhh.exe 2376 hbtnnt.exe 2148 jvdpj.exe 4140 fxxxrrr.exe 4664 xrxxrxx.exe 1896 5bhhnt.exe 748 nnnhhh.exe 1988 tnnhbh.exe 4228 1dddp.exe 4900 rrxrllf.exe 4656 7lfxrrl.exe 3052 nbbbnn.exe 4904 nhnhnb.exe 4508 ppjdd.exe 2388 rrllxxx.exe 4320 7xfffll.exe 3464 nhhbbb.exe 4024 vvvvp.exe 2696 dvdpp.exe -
resource yara_rule behavioral2/memory/4740-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/796-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4740 wrote to memory of 3656 4740 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 82 PID 4740 wrote to memory of 3656 4740 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 82 PID 4740 wrote to memory of 3656 4740 d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe 82 PID 3656 wrote to memory of 5112 3656 bhtnnn.exe 83 PID 3656 wrote to memory of 5112 3656 bhtnnn.exe 83 PID 3656 wrote to memory of 5112 3656 bhtnnn.exe 83 PID 5112 wrote to memory of 4012 5112 vvdvp.exe 84 PID 5112 wrote to memory of 4012 5112 vvdvp.exe 84 PID 5112 wrote to memory of 4012 5112 vvdvp.exe 84 PID 4012 wrote to memory of 904 4012 1rlfrrr.exe 85 PID 4012 wrote to memory of 904 4012 1rlfrrr.exe 85 PID 4012 wrote to memory of 904 4012 1rlfrrr.exe 85 PID 904 wrote to memory of 1892 904 rlrlrrl.exe 86 PID 904 wrote to memory of 1892 904 rlrlrrl.exe 86 PID 904 wrote to memory of 1892 904 rlrlrrl.exe 86 PID 1892 wrote to memory of 1080 1892 ntthth.exe 87 PID 1892 wrote to memory of 1080 1892 ntthth.exe 87 PID 1892 wrote to memory of 1080 1892 ntthth.exe 87 PID 1080 wrote to memory of 3208 1080 pjpjd.exe 88 PID 1080 wrote to memory of 3208 1080 pjpjd.exe 88 PID 1080 wrote to memory of 3208 1080 pjpjd.exe 88 PID 3208 wrote to memory of 4632 3208 jpvdv.exe 89 PID 3208 wrote to memory of 4632 3208 jpvdv.exe 89 PID 3208 wrote to memory of 4632 3208 jpvdv.exe 89 PID 4632 wrote to memory of 2860 4632 xxxxrrr.exe 90 PID 4632 wrote to memory of 2860 4632 xxxxrrr.exe 90 PID 4632 wrote to memory of 2860 4632 xxxxrrr.exe 90 PID 2860 wrote to memory of 4508 2860 nntnhh.exe 91 PID 2860 wrote to memory of 4508 2860 nntnhh.exe 91 PID 2860 wrote to memory of 4508 2860 nntnhh.exe 91 PID 4508 wrote to memory of 4180 4508 pvjdv.exe 92 PID 4508 wrote to memory of 4180 4508 pvjdv.exe 92 PID 4508 wrote to memory of 4180 4508 pvjdv.exe 92 PID 4180 wrote to memory of 4236 4180 rxfxrfl.exe 93 PID 4180 wrote to memory of 4236 4180 rxfxrfl.exe 93 PID 4180 wrote to memory of 4236 4180 rxfxrfl.exe 93 PID 4236 wrote to memory of 2456 4236 3bbttb.exe 94 PID 4236 wrote to memory of 2456 4236 3bbttb.exe 94 PID 4236 wrote to memory of 2456 4236 3bbttb.exe 94 PID 2456 wrote to memory of 4224 2456 jjjvv.exe 95 PID 2456 wrote to memory of 4224 2456 jjjvv.exe 95 PID 2456 wrote to memory of 4224 2456 jjjvv.exe 95 PID 4224 wrote to memory of 2024 4224 rrxrrrr.exe 96 PID 4224 wrote to memory of 2024 4224 rrxrrrr.exe 96 PID 4224 wrote to memory of 2024 4224 rrxrrrr.exe 96 PID 2024 wrote to memory of 2416 2024 3ffxxxr.exe 97 PID 2024 wrote to memory of 2416 2024 3ffxxxr.exe 97 PID 2024 wrote to memory of 2416 2024 3ffxxxr.exe 97 PID 2416 wrote to memory of 3252 2416 hbhhbt.exe 98 PID 2416 wrote to memory of 3252 2416 hbhhbt.exe 98 PID 2416 wrote to memory of 3252 2416 hbhhbt.exe 98 PID 3252 wrote to memory of 3716 3252 pddvj.exe 99 PID 3252 wrote to memory of 3716 3252 pddvj.exe 99 PID 3252 wrote to memory of 3716 3252 pddvj.exe 99 PID 3716 wrote to memory of 1044 3716 hntnnn.exe 100 PID 3716 wrote to memory of 1044 3716 hntnnn.exe 100 PID 3716 wrote to memory of 1044 3716 hntnnn.exe 100 PID 1044 wrote to memory of 4152 1044 pdvpj.exe 101 PID 1044 wrote to memory of 4152 1044 pdvpj.exe 101 PID 1044 wrote to memory of 4152 1044 pdvpj.exe 101 PID 4152 wrote to memory of 1192 4152 dpdjv.exe 102 PID 4152 wrote to memory of 1192 4152 dpdjv.exe 102 PID 4152 wrote to memory of 1192 4152 dpdjv.exe 102 PID 1192 wrote to memory of 2440 1192 rrllflf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe"C:\Users\Admin\AppData\Local\Temp\d8686a5b1a4688c2253ae793ca949389c425466a74150a90b1d5fb0887dc4fee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\bhtnnn.exec:\bhtnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\vvdvp.exec:\vvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\1rlfrrr.exec:\1rlfrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rlrlrrl.exec:\rlrlrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\ntthth.exec:\ntthth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\pjpjd.exec:\pjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\jpvdv.exec:\jpvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\nntnhh.exec:\nntnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pvjdv.exec:\pvjdv.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\rxfxrfl.exec:\rxfxrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\3bbttb.exec:\3bbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\jjjvv.exec:\jjjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\3ffxxxr.exec:\3ffxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\hbhhbt.exec:\hbhhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pddvj.exec:\pddvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\hntnnn.exec:\hntnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\pdvpj.exec:\pdvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\dpdjv.exec:\dpdjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\rrllflf.exec:\rrllflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\ttbtbb.exec:\ttbtbb.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hhnnbb.exec:\hhnnbb.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\7dppj.exec:\7dppj.exe25⤵
- Executes dropped EXE
PID:544 -
\??\c:\lxxrrfx.exec:\lxxrrfx.exe26⤵
- Executes dropped EXE
PID:796 -
\??\c:\fxxrllf.exec:\fxxrllf.exe27⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhthbb.exec:\nhthbb.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pjvpp.exec:\pjvpp.exe29⤵
- Executes dropped EXE
PID:3192 -
\??\c:\vpdvj.exec:\vpdvj.exe30⤵
- Executes dropped EXE
PID:4456 -
\??\c:\lxlfffl.exec:\lxlfffl.exe31⤵
- Executes dropped EXE
PID:4496 -
\??\c:\5bhhhh.exec:\5bhhhh.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bbbttt.exec:\bbbttt.exe33⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jdjjd.exec:\jdjjd.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rfllrrr.exec:\rfllrrr.exe35⤵
- Executes dropped EXE
PID:664 -
\??\c:\rlxfffx.exec:\rlxfffx.exe36⤵
- Executes dropped EXE
PID:3364 -
\??\c:\bnttnt.exec:\bnttnt.exe37⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hbhbnt.exec:\hbhbnt.exe38⤵
- Executes dropped EXE
PID:4540 -
\??\c:\nnnhhn.exec:\nnnhhn.exe39⤵
- Executes dropped EXE
PID:3720 -
\??\c:\9jpjd.exec:\9jpjd.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lxllxfx.exec:\lxllxfx.exe41⤵
- Executes dropped EXE
PID:3884 -
\??\c:\rfffxxr.exec:\rfffxxr.exe42⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnntht.exec:\tnntht.exe43⤵
- Executes dropped EXE
PID:4536 -
\??\c:\dvppp.exec:\dvppp.exe44⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvpjv.exec:\dvpjv.exe45⤵
- Executes dropped EXE
PID:3480 -
\??\c:\1frfrrl.exec:\1frfrrl.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tnnnhh.exec:\tnnnhh.exe47⤵
- Executes dropped EXE
PID:3656 -
\??\c:\hbtnnt.exec:\hbtnnt.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jvdpj.exec:\jvdpj.exe49⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe50⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe51⤵
- Executes dropped EXE
PID:4664 -
\??\c:\5bhhnt.exec:\5bhhnt.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nnnhhh.exec:\nnnhhh.exe53⤵
- Executes dropped EXE
PID:748 -
\??\c:\tnnhbh.exec:\tnnhbh.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1dddp.exec:\1dddp.exe55⤵
- Executes dropped EXE
PID:4228 -
\??\c:\rrxrllf.exec:\rrxrllf.exe56⤵
- Executes dropped EXE
PID:4900 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656 -
\??\c:\nbbbnn.exec:\nbbbnn.exe58⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nhnhnb.exec:\nhnhnb.exe59⤵
- Executes dropped EXE
PID:4904 -
\??\c:\ppjdd.exec:\ppjdd.exe60⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rrllxxx.exec:\rrllxxx.exe61⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7xfffll.exec:\7xfffll.exe62⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nhhbbb.exec:\nhhbbb.exe63⤵
- Executes dropped EXE
PID:3464 -
\??\c:\vvvvp.exec:\vvvvp.exe64⤵
- Executes dropped EXE
PID:4024 -
\??\c:\dvdpp.exec:\dvdpp.exe65⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxlfllf.exec:\fxlfllf.exe66⤵PID:948
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe67⤵PID:2024
-
\??\c:\tnhbbb.exec:\tnhbbb.exe68⤵PID:1216
-
\??\c:\7nbbbb.exec:\7nbbbb.exe69⤵PID:4608
-
\??\c:\dpvpp.exec:\dpvpp.exe70⤵PID:3732
-
\??\c:\rfllfxf.exec:\rfllfxf.exe71⤵PID:2036
-
\??\c:\lxfflll.exec:\lxfflll.exe72⤵PID:2896
-
\??\c:\nhhbhh.exec:\nhhbhh.exe73⤵PID:1412
-
\??\c:\ddjjv.exec:\ddjjv.exe74⤵PID:1752
-
\??\c:\vvpjd.exec:\vvpjd.exe75⤵PID:2808
-
\??\c:\xrllxlr.exec:\xrllxlr.exe76⤵PID:4832
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe77⤵PID:1244
-
\??\c:\bbhnhh.exec:\bbhnhh.exe78⤵PID:4736
-
\??\c:\btbbbb.exec:\btbbbb.exe79⤵PID:2976
-
\??\c:\pjpjv.exec:\pjpjv.exe80⤵PID:2380
-
\??\c:\vdjdv.exec:\vdjdv.exe81⤵PID:2244
-
\??\c:\xlrllfr.exec:\xlrllfr.exe82⤵PID:3328
-
\??\c:\vvddj.exec:\vvddj.exe83⤵PID:2232
-
\??\c:\jvdvp.exec:\jvdvp.exe84⤵PID:668
-
\??\c:\3lfxxxf.exec:\3lfxxxf.exe85⤵PID:1376
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe86⤵PID:1320
-
\??\c:\nttbhh.exec:\nttbhh.exe87⤵PID:3080
-
\??\c:\1nnnnb.exec:\1nnnnb.exe88⤵PID:4752
-
\??\c:\pdjvp.exec:\pdjvp.exe89⤵PID:5076
-
\??\c:\ppvpp.exec:\ppvpp.exe90⤵PID:1392
-
\??\c:\frrlffx.exec:\frrlffx.exe91⤵PID:1876
-
\??\c:\lxxfxlf.exec:\lxxfxlf.exe92⤵PID:2032
-
\??\c:\bthhbb.exec:\bthhbb.exe93⤵PID:8
-
\??\c:\7nhhbb.exec:\7nhhbb.exe94⤵PID:1608
-
\??\c:\pjppd.exec:\pjppd.exe95⤵PID:2060
-
\??\c:\jddvj.exec:\jddvj.exe96⤵PID:4980
-
\??\c:\fxxrrll.exec:\fxxrrll.exe97⤵
- System Location Discovery: System Language Discovery
PID:3296 -
\??\c:\rrfxlfl.exec:\rrfxlfl.exe98⤵PID:3132
-
\??\c:\7hhhbb.exec:\7hhhbb.exe99⤵PID:1736
-
\??\c:\7bttnb.exec:\7bttnb.exe100⤵PID:4220
-
\??\c:\jpdjj.exec:\jpdjj.exe101⤵PID:5112
-
\??\c:\ffflffx.exec:\ffflffx.exe102⤵PID:3580
-
\??\c:\rfrfffr.exec:\rfrfffr.exe103⤵PID:1276
-
\??\c:\htbbbb.exec:\htbbbb.exe104⤵PID:2148
-
\??\c:\jppjv.exec:\jppjv.exe105⤵PID:4140
-
\??\c:\jjpjv.exec:\jjpjv.exe106⤵PID:3772
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe107⤵PID:1896
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe108⤵PID:4372
-
\??\c:\bhtnhh.exec:\bhtnhh.exe109⤵PID:4960
-
\??\c:\nnhbtt.exec:\nnhbtt.exe110⤵PID:384
-
\??\c:\vvddd.exec:\vvddd.exe111⤵PID:4900
-
\??\c:\dvpjj.exec:\dvpjj.exe112⤵PID:1656
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe113⤵PID:1428
-
\??\c:\llfxfxf.exec:\llfxfxf.exe114⤵PID:1980
-
\??\c:\nhhhbb.exec:\nhhhbb.exe115⤵PID:1880
-
\??\c:\hhnhnn.exec:\hhnhnn.exe116⤵PID:3728
-
\??\c:\pddvv.exec:\pddvv.exe117⤵PID:4320
-
\??\c:\ppdvp.exec:\ppdvp.exe118⤵PID:4748
-
\??\c:\5ddvj.exec:\5ddvj.exe119⤵PID:2180
-
\??\c:\fxxrxxx.exec:\fxxrxxx.exe120⤵PID:2696
-
\??\c:\xfffxxr.exec:\xfffxxr.exe121⤵PID:376
-
\??\c:\nbbbtt.exec:\nbbbtt.exe122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-