Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe
Resource
win7-20240729-en
General
-
Target
899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe
-
Size
82KB
-
MD5
f4f8241fc9d81bfd489ebead911bd6bb
-
SHA1
33500321b4f7a3fa6d059f6df286434dac12320f
-
SHA256
899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106
-
SHA512
dc09e95e0a13011ad9255c39f5ea1ee6abf6a10072b520990f77b2bd108c89e04fc62e35f489acb72469d4ef568e03314fafea261223629d08b6c17ec33757a5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q1:ymb3NkkiQ3mdBjFIIp9L9QrrA82
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2420-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2736 pdvpj.exe 4828 9fllffx.exe 4612 hntnhb.exe 4284 dvvpj.exe 1336 fflfrfx.exe 4636 ttnhtn.exe 4872 pdvdv.exe 4464 fxrfxrl.exe 3656 jpvpv.exe 1912 3lrlffr.exe 1848 nhnttb.exe 2212 1bbnhb.exe 4708 vjpvv.exe 4032 flxllxl.exe 2904 bhbbhb.exe 1708 dpjvp.exe 2588 xlrfrfx.exe 3152 tntntb.exe 3944 3nhbtb.exe 2936 7ddvp.exe 1368 vddjv.exe 3444 fxlxlxr.exe 5008 nhhhhh.exe 3244 9ttnnn.exe 4780 7vvvv.exe 224 vdjpj.exe 4880 rllfxxx.exe 4604 lxrllll.exe 4892 3tbbhn.exe 436 hhbttt.exe 4220 jjppj.exe 3476 jpjvp.exe 3148 lllrfff.exe 1920 7nhbtn.exe 1572 nthhbb.exe 840 ppdvp.exe 984 pjjdv.exe 3352 rlrxxll.exe 4900 bnbbbb.exe 3928 nbtttt.exe 2736 vjppj.exe 3924 frfxxll.exe 1076 xflllll.exe 3344 1nhbtt.exe 404 pjpvp.exe 4460 1dvdv.exe 716 fxfxrrl.exe 3292 xlxrllf.exe 2424 hbbhbb.exe 1544 nnhhtt.exe 1256 dpvdv.exe 1892 xfflxrr.exe 784 lrffxff.exe 640 bnhhhh.exe 1832 1tnnhb.exe 4336 ppdvp.exe 1848 xxrrrrr.exe 4692 5nnnnn.exe 1548 jdddv.exe 3524 xrxrrlf.exe 1736 7tbtnn.exe 4488 tntnhh.exe 3004 dvjdp.exe 4256 pdvvp.exe -
resource yara_rule behavioral2/memory/2420-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-217-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2736 2420 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 84 PID 2420 wrote to memory of 2736 2420 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 84 PID 2420 wrote to memory of 2736 2420 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 84 PID 2736 wrote to memory of 4828 2736 pdvpj.exe 85 PID 2736 wrote to memory of 4828 2736 pdvpj.exe 85 PID 2736 wrote to memory of 4828 2736 pdvpj.exe 85 PID 4828 wrote to memory of 4612 4828 9fllffx.exe 86 PID 4828 wrote to memory of 4612 4828 9fllffx.exe 86 PID 4828 wrote to memory of 4612 4828 9fllffx.exe 86 PID 4612 wrote to memory of 4284 4612 hntnhb.exe 87 PID 4612 wrote to memory of 4284 4612 hntnhb.exe 87 PID 4612 wrote to memory of 4284 4612 hntnhb.exe 87 PID 4284 wrote to memory of 1336 4284 dvvpj.exe 88 PID 4284 wrote to memory of 1336 4284 dvvpj.exe 88 PID 4284 wrote to memory of 1336 4284 dvvpj.exe 88 PID 1336 wrote to memory of 4636 1336 fflfrfx.exe 90 PID 1336 wrote to memory of 4636 1336 fflfrfx.exe 90 PID 1336 wrote to memory of 4636 1336 fflfrfx.exe 90 PID 4636 wrote to memory of 4872 4636 ttnhtn.exe 91 PID 4636 wrote to memory of 4872 4636 ttnhtn.exe 91 PID 4636 wrote to memory of 4872 4636 ttnhtn.exe 91 PID 4872 wrote to memory of 4464 4872 pdvdv.exe 92 PID 4872 wrote to memory of 4464 4872 pdvdv.exe 92 PID 4872 wrote to memory of 4464 4872 pdvdv.exe 92 PID 4464 wrote to memory of 3656 4464 fxrfxrl.exe 94 PID 4464 wrote to memory of 3656 4464 fxrfxrl.exe 94 PID 4464 wrote to memory of 3656 4464 fxrfxrl.exe 94 PID 3656 wrote to memory of 1912 3656 jpvpv.exe 95 PID 3656 wrote to memory of 1912 3656 jpvpv.exe 95 PID 3656 wrote to memory of 1912 3656 jpvpv.exe 95 PID 1912 wrote to memory of 1848 1912 3lrlffr.exe 96 PID 1912 wrote to memory of 1848 1912 3lrlffr.exe 96 PID 1912 wrote to memory of 1848 1912 3lrlffr.exe 96 PID 1848 wrote to memory of 2212 1848 nhnttb.exe 97 PID 1848 wrote to memory of 2212 1848 nhnttb.exe 97 PID 1848 wrote to memory of 2212 1848 nhnttb.exe 97 PID 2212 wrote to memory of 4708 2212 1bbnhb.exe 98 PID 2212 wrote to memory of 4708 2212 1bbnhb.exe 98 PID 2212 wrote to memory of 4708 2212 1bbnhb.exe 98 PID 4708 wrote to memory of 4032 4708 vjpvv.exe 99 PID 4708 wrote to memory of 4032 4708 vjpvv.exe 99 PID 4708 wrote to memory of 4032 4708 vjpvv.exe 99 PID 4032 wrote to memory of 2904 4032 flxllxl.exe 100 PID 4032 wrote to memory of 2904 4032 flxllxl.exe 100 PID 4032 wrote to memory of 2904 4032 flxllxl.exe 100 PID 2904 wrote to memory of 1708 2904 bhbbhb.exe 101 PID 2904 wrote to memory of 1708 2904 bhbbhb.exe 101 PID 2904 wrote to memory of 1708 2904 bhbbhb.exe 101 PID 1708 wrote to memory of 2588 1708 dpjvp.exe 102 PID 1708 wrote to memory of 2588 1708 dpjvp.exe 102 PID 1708 wrote to memory of 2588 1708 dpjvp.exe 102 PID 2588 wrote to memory of 3152 2588 xlrfrfx.exe 103 PID 2588 wrote to memory of 3152 2588 xlrfrfx.exe 103 PID 2588 wrote to memory of 3152 2588 xlrfrfx.exe 103 PID 3152 wrote to memory of 3944 3152 tntntb.exe 104 PID 3152 wrote to memory of 3944 3152 tntntb.exe 104 PID 3152 wrote to memory of 3944 3152 tntntb.exe 104 PID 3944 wrote to memory of 2936 3944 3nhbtb.exe 105 PID 3944 wrote to memory of 2936 3944 3nhbtb.exe 105 PID 3944 wrote to memory of 2936 3944 3nhbtb.exe 105 PID 2936 wrote to memory of 1368 2936 7ddvp.exe 106 PID 2936 wrote to memory of 1368 2936 7ddvp.exe 106 PID 2936 wrote to memory of 1368 2936 7ddvp.exe 106 PID 1368 wrote to memory of 3444 1368 vddjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe"C:\Users\Admin\AppData\Local\Temp\899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\pdvpj.exec:\pdvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9fllffx.exec:\9fllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\hntnhb.exec:\hntnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\dvvpj.exec:\dvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\fflfrfx.exec:\fflfrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\ttnhtn.exec:\ttnhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\pdvdv.exec:\pdvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\jpvpv.exec:\jpvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\3lrlffr.exec:\3lrlffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\nhnttb.exec:\nhnttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\1bbnhb.exec:\1bbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vjpvv.exec:\vjpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\flxllxl.exec:\flxllxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\bhbbhb.exec:\bhbbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dpjvp.exec:\dpjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xlrfrfx.exec:\xlrfrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tntntb.exec:\tntntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\3nhbtb.exec:\3nhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\7ddvp.exec:\7ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vddjv.exec:\vddjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\fxlxlxr.exec:\fxlxlxr.exe23⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nhhhhh.exec:\nhhhhh.exe24⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9ttnnn.exec:\9ttnnn.exe25⤵
- Executes dropped EXE
PID:3244 -
\??\c:\7vvvv.exec:\7vvvv.exe26⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vdjpj.exec:\vdjpj.exe27⤵
- Executes dropped EXE
PID:224 -
\??\c:\rllfxxx.exec:\rllfxxx.exe28⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lxrllll.exec:\lxrllll.exe29⤵
- Executes dropped EXE
PID:4604 -
\??\c:\3tbbhn.exec:\3tbbhn.exe30⤵
- Executes dropped EXE
PID:4892 -
\??\c:\hhbttt.exec:\hhbttt.exe31⤵
- Executes dropped EXE
PID:436 -
\??\c:\jjppj.exec:\jjppj.exe32⤵
- Executes dropped EXE
PID:4220 -
\??\c:\jpjvp.exec:\jpjvp.exe33⤵
- Executes dropped EXE
PID:3476 -
\??\c:\lllrfff.exec:\lllrfff.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3148 -
\??\c:\7nhbtn.exec:\7nhbtn.exe35⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nthhbb.exec:\nthhbb.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ppdvp.exec:\ppdvp.exe37⤵
- Executes dropped EXE
PID:840 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:984 -
\??\c:\rlrxxll.exec:\rlrxxll.exe39⤵
- Executes dropped EXE
PID:3352 -
\??\c:\bnbbbb.exec:\bnbbbb.exe40⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nbtttt.exec:\nbtttt.exe41⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vjppj.exec:\vjppj.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\frfxxll.exec:\frfxxll.exe43⤵
- Executes dropped EXE
PID:3924 -
\??\c:\xflllll.exec:\xflllll.exe44⤵
- Executes dropped EXE
PID:1076 -
\??\c:\1nhbtt.exec:\1nhbtt.exe45⤵
- Executes dropped EXE
PID:3344 -
\??\c:\pjpvp.exec:\pjpvp.exe46⤵
- Executes dropped EXE
PID:404 -
\??\c:\1dvdv.exec:\1dvdv.exe47⤵
- Executes dropped EXE
PID:4460 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe48⤵
- Executes dropped EXE
PID:716 -
\??\c:\xlxrllf.exec:\xlxrllf.exe49⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hbbhbb.exec:\hbbhbb.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nnhhtt.exec:\nnhhtt.exe51⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dpvdv.exec:\dpvdv.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xfflxrr.exec:\xfflxrr.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lrffxff.exec:\lrffxff.exe54⤵
- Executes dropped EXE
PID:784 -
\??\c:\bnhhhh.exec:\bnhhhh.exe55⤵
- Executes dropped EXE
PID:640 -
\??\c:\1tnnhb.exec:\1tnnhb.exe56⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ppdvp.exec:\ppdvp.exe57⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5nnnnn.exec:\5nnnnn.exe59⤵
- Executes dropped EXE
PID:4692 -
\??\c:\jdddv.exec:\jdddv.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe61⤵
- Executes dropped EXE
PID:3524 -
\??\c:\7tbtnn.exec:\7tbtnn.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tntnhh.exec:\tntnhh.exe63⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dvjdp.exec:\dvjdp.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdvvp.exec:\pdvvp.exe65⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe66⤵PID:1596
-
\??\c:\3tbbbh.exec:\3tbbbh.exe67⤵PID:3584
-
\??\c:\bnnbnb.exec:\bnnbnb.exe68⤵PID:1540
-
\??\c:\dvdvp.exec:\dvdvp.exe69⤵PID:3016
-
\??\c:\9pdvv.exec:\9pdvv.exe70⤵PID:924
-
\??\c:\fxxrllf.exec:\fxxrllf.exe71⤵PID:4112
-
\??\c:\djpjj.exec:\djpjj.exe72⤵PID:2876
-
\??\c:\xrrlffx.exec:\xrrlffx.exe73⤵PID:2944
-
\??\c:\xlxxflr.exec:\xlxxflr.exe74⤵PID:2512
-
\??\c:\thtnht.exec:\thtnht.exe75⤵PID:1804
-
\??\c:\dddvd.exec:\dddvd.exe76⤵PID:1532
-
\??\c:\xllxrlf.exec:\xllxrlf.exe77⤵PID:2224
-
\??\c:\hnhhbb.exec:\hnhhbb.exe78⤵PID:2880
-
\??\c:\vjdpj.exec:\vjdpj.exe79⤵PID:4604
-
\??\c:\3ppdp.exec:\3ppdp.exe80⤵PID:4892
-
\??\c:\bttnnn.exec:\bttnnn.exe81⤵PID:2872
-
\??\c:\thbtnh.exec:\thbtnh.exe82⤵PID:3688
-
\??\c:\jdddp.exec:\jdddp.exe83⤵PID:2036
-
\??\c:\1xlllfl.exec:\1xlllfl.exe84⤵PID:1324
-
\??\c:\flffffx.exec:\flffffx.exe85⤵PID:2548
-
\??\c:\nhhtnn.exec:\nhhtnn.exe86⤵PID:3684
-
\??\c:\5jjjd.exec:\5jjjd.exe87⤵PID:2460
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe88⤵PID:1980
-
\??\c:\9btnnn.exec:\9btnnn.exe89⤵PID:1972
-
\??\c:\3nbnbb.exec:\3nbnbb.exe90⤵PID:2420
-
\??\c:\ppjjp.exec:\ppjjp.exe91⤵PID:4912
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe92⤵PID:544
-
\??\c:\9fxrrll.exec:\9fxrrll.exe93⤵PID:4392
-
\??\c:\rfxlxxl.exec:\rfxlxxl.exe94⤵PID:1120
-
\??\c:\nhbnhb.exec:\nhbnhb.exe95⤵PID:4612
-
\??\c:\dpjdd.exec:\dpjdd.exe96⤵PID:1744
-
\??\c:\lfrlfff.exec:\lfrlfff.exe97⤵PID:4632
-
\??\c:\3nnnhh.exec:\3nnnhh.exe98⤵PID:2908
-
\??\c:\3pvjv.exec:\3pvjv.exe99⤵PID:2108
-
\??\c:\tntnbb.exec:\tntnbb.exe100⤵PID:2520
-
\??\c:\3dvpj.exec:\3dvpj.exe101⤵PID:396
-
\??\c:\xfxrrxr.exec:\xfxrrxr.exe102⤵PID:5040
-
\??\c:\hhnhtn.exec:\hhnhtn.exe103⤵PID:1528
-
\??\c:\7jjdv.exec:\7jjdv.exe104⤵PID:3276
-
\??\c:\xrrlffx.exec:\xrrlffx.exe105⤵PID:4464
-
\??\c:\bbtbbh.exec:\bbtbbh.exe106⤵PID:3076
-
\??\c:\9nhhbt.exec:\9nhhbt.exe107⤵PID:1056
-
\??\c:\pppdp.exec:\pppdp.exe108⤵PID:3760
-
\??\c:\lffxrrl.exec:\lffxrrl.exe109⤵PID:1900
-
\??\c:\ffxrffx.exec:\ffxrffx.exe110⤵PID:3652
-
\??\c:\thhntt.exec:\thhntt.exe111⤵PID:3396
-
\??\c:\bttthb.exec:\bttthb.exe112⤵PID:3232
-
\??\c:\lffrrrl.exec:\lffrrrl.exe113⤵PID:2672
-
\??\c:\7lffllf.exec:\7lffllf.exe114⤵PID:1364
-
\??\c:\tttnhb.exec:\tttnhb.exe115⤵PID:1140
-
\??\c:\tnnhhh.exec:\tnnhhh.exe116⤵PID:4844
-
\??\c:\jpvjj.exec:\jpvjj.exe117⤵PID:736
-
\??\c:\ffrlrlx.exec:\ffrlrlx.exe118⤵PID:3992
-
\??\c:\flfrfrl.exec:\flfrfrl.exe119⤵PID:2104
-
\??\c:\hhnnhh.exec:\hhnnhh.exe120⤵PID:2748
-
\??\c:\9nnhhh.exec:\9nnhhh.exe121⤵PID:2580
-
\??\c:\7vvjd.exec:\7vvjd.exe122⤵PID:3444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-