Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe
Resource
win7-20240729-en
General
-
Target
ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe
-
Size
69KB
-
MD5
8ab920a4be80e78e61422fabfbf471e0
-
SHA1
598d2f8209797d3f2cf49e716d1dc82208227101
-
SHA256
ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dad
-
SHA512
600da159ed3c40b947be99dfedcbb7881105e5fdf4a49556a3ca351a11b4eeece371d8a3dc5397d8822f66b97a7612b7122b89b081d32f2295a2940a5c18414d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdy:ymb3NkkiQ3mdBjF0yMliy
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/784-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3432 vpppj.exe 2984 7vdvp.exe 4884 fxlfxfr.exe 3400 tbbbbn.exe 2208 tnthht.exe 1740 pjdvj.exe 2888 rrxrrxx.exe 700 rrffrrr.exe 1708 nhnnhn.exe 4632 pdpjp.exe 3368 lrxfffr.exe 1816 bntthn.exe 784 nhnhnn.exe 1156 ddvvd.exe 4836 rxfxffr.exe 2676 5htttb.exe 2496 bbtnbt.exe 4308 jvjpj.exe 1540 lffxrfr.exe 4536 5frlllf.exe 3936 hhbbbh.exe 872 vvddv.exe 3336 1dddv.exe 3440 lfffrxr.exe 980 fxxfffl.exe 4272 vpppp.exe 2192 rllllrx.exe 1216 xxflllx.exe 4572 hhnnnn.exe 3196 pjjdd.exe 3436 rlrfxff.exe 2860 llllflr.exe 3068 hhbnnn.exe 2020 hbtttb.exe 640 jdjjp.exe 4652 ddvpp.exe 4656 lllrlrl.exe 4356 fxxxrrr.exe 4784 1nnttt.exe 2352 djjdd.exe 3404 pvjjd.exe 2148 pjjjj.exe 1152 flrrllr.exe 4000 tntbtt.exe 3400 jdjjj.exe 764 jvdvv.exe 4764 flxrrrx.exe 1012 ffxxrxf.exe 1388 tttbbh.exe 220 nhnnhn.exe 1964 7dppp.exe 1724 vvddj.exe 3908 lxrrrxr.exe 768 llfxlrx.exe 4012 5bbhhh.exe 4844 pdpdp.exe 5004 flflxfr.exe 3104 xxxxxff.exe 2444 1bhnnh.exe 2676 5bhbtt.exe 2632 djvvp.exe 620 xrffrrf.exe 3944 lflllrr.exe 2432 7btnnn.exe -
resource yara_rule behavioral2/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3432 2352 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 84 PID 2352 wrote to memory of 3432 2352 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 84 PID 2352 wrote to memory of 3432 2352 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 84 PID 3432 wrote to memory of 2984 3432 vpppj.exe 85 PID 3432 wrote to memory of 2984 3432 vpppj.exe 85 PID 3432 wrote to memory of 2984 3432 vpppj.exe 85 PID 2984 wrote to memory of 4884 2984 7vdvp.exe 86 PID 2984 wrote to memory of 4884 2984 7vdvp.exe 86 PID 2984 wrote to memory of 4884 2984 7vdvp.exe 86 PID 4884 wrote to memory of 3400 4884 fxlfxfr.exe 87 PID 4884 wrote to memory of 3400 4884 fxlfxfr.exe 87 PID 4884 wrote to memory of 3400 4884 fxlfxfr.exe 87 PID 3400 wrote to memory of 2208 3400 tbbbbn.exe 88 PID 3400 wrote to memory of 2208 3400 tbbbbn.exe 88 PID 3400 wrote to memory of 2208 3400 tbbbbn.exe 88 PID 2208 wrote to memory of 1740 2208 tnthht.exe 89 PID 2208 wrote to memory of 1740 2208 tnthht.exe 89 PID 2208 wrote to memory of 1740 2208 tnthht.exe 89 PID 1740 wrote to memory of 2888 1740 pjdvj.exe 90 PID 1740 wrote to memory of 2888 1740 pjdvj.exe 90 PID 1740 wrote to memory of 2888 1740 pjdvj.exe 90 PID 2888 wrote to memory of 700 2888 rrxrrxx.exe 91 PID 2888 wrote to memory of 700 2888 rrxrrxx.exe 91 PID 2888 wrote to memory of 700 2888 rrxrrxx.exe 91 PID 700 wrote to memory of 1708 700 rrffrrr.exe 92 PID 700 wrote to memory of 1708 700 rrffrrr.exe 92 PID 700 wrote to memory of 1708 700 rrffrrr.exe 92 PID 1708 wrote to memory of 4632 1708 nhnnhn.exe 93 PID 1708 wrote to memory of 4632 1708 nhnnhn.exe 93 PID 1708 wrote to memory of 4632 1708 nhnnhn.exe 93 PID 4632 wrote to memory of 3368 4632 pdpjp.exe 94 PID 4632 wrote to memory of 3368 4632 pdpjp.exe 94 PID 4632 wrote to memory of 3368 4632 pdpjp.exe 94 PID 3368 wrote to memory of 1816 3368 lrxfffr.exe 95 PID 3368 wrote to memory of 1816 3368 lrxfffr.exe 95 PID 3368 wrote to memory of 1816 3368 lrxfffr.exe 95 PID 1816 wrote to memory of 784 1816 bntthn.exe 96 PID 1816 wrote to memory of 784 1816 bntthn.exe 96 PID 1816 wrote to memory of 784 1816 bntthn.exe 96 PID 784 wrote to memory of 1156 784 nhnhnn.exe 98 PID 784 wrote to memory of 1156 784 nhnhnn.exe 98 PID 784 wrote to memory of 1156 784 nhnhnn.exe 98 PID 1156 wrote to memory of 4836 1156 ddvvd.exe 99 PID 1156 wrote to memory of 4836 1156 ddvvd.exe 99 PID 1156 wrote to memory of 4836 1156 ddvvd.exe 99 PID 4836 wrote to memory of 2676 4836 rxfxffr.exe 100 PID 4836 wrote to memory of 2676 4836 rxfxffr.exe 100 PID 4836 wrote to memory of 2676 4836 rxfxffr.exe 100 PID 2676 wrote to memory of 2496 2676 5htttb.exe 101 PID 2676 wrote to memory of 2496 2676 5htttb.exe 101 PID 2676 wrote to memory of 2496 2676 5htttb.exe 101 PID 2496 wrote to memory of 4308 2496 bbtnbt.exe 102 PID 2496 wrote to memory of 4308 2496 bbtnbt.exe 102 PID 2496 wrote to memory of 4308 2496 bbtnbt.exe 102 PID 4308 wrote to memory of 1540 4308 jvjpj.exe 103 PID 4308 wrote to memory of 1540 4308 jvjpj.exe 103 PID 4308 wrote to memory of 1540 4308 jvjpj.exe 103 PID 1540 wrote to memory of 4536 1540 lffxrfr.exe 104 PID 1540 wrote to memory of 4536 1540 lffxrfr.exe 104 PID 1540 wrote to memory of 4536 1540 lffxrfr.exe 104 PID 4536 wrote to memory of 3936 4536 5frlllf.exe 106 PID 4536 wrote to memory of 3936 4536 5frlllf.exe 106 PID 4536 wrote to memory of 3936 4536 5frlllf.exe 106 PID 3936 wrote to memory of 872 3936 hhbbbh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe"C:\Users\Admin\AppData\Local\Temp\ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vpppj.exec:\vpppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\7vdvp.exec:\7vdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tbbbbn.exec:\tbbbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\tnthht.exec:\tnthht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pjdvj.exec:\pjdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\rrxrrxx.exec:\rrxrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rrffrrr.exec:\rrffrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\nhnnhn.exec:\nhnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\pdpjp.exec:\pdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\lrxfffr.exec:\lrxfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\bntthn.exec:\bntthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\nhnhnn.exec:\nhnhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\ddvvd.exec:\ddvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\rxfxffr.exec:\rxfxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\5htttb.exec:\5htttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bbtnbt.exec:\bbtnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\jvjpj.exec:\jvjpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\lffxrfr.exec:\lffxrfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\5frlllf.exec:\5frlllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\hhbbbh.exec:\hhbbbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vvddv.exec:\vvddv.exe23⤵
- Executes dropped EXE
PID:872 -
\??\c:\1dddv.exec:\1dddv.exe24⤵
- Executes dropped EXE
PID:3336 -
\??\c:\lfffrxr.exec:\lfffrxr.exe25⤵
- Executes dropped EXE
PID:3440 -
\??\c:\fxxfffl.exec:\fxxfffl.exe26⤵
- Executes dropped EXE
PID:980 -
\??\c:\vpppp.exec:\vpppp.exe27⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rllllrx.exec:\rllllrx.exe28⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxflllx.exec:\xxflllx.exe29⤵
- Executes dropped EXE
PID:1216 -
\??\c:\hhnnnn.exec:\hhnnnn.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pjjdd.exec:\pjjdd.exe31⤵
- Executes dropped EXE
PID:3196 -
\??\c:\rlrfxff.exec:\rlrfxff.exe32⤵
- Executes dropped EXE
PID:3436 -
\??\c:\llllflr.exec:\llllflr.exe33⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hhbnnn.exec:\hhbnnn.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbtttb.exec:\hbtttb.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:640 -
\??\c:\ddvpp.exec:\ddvpp.exe37⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lllrlrl.exec:\lllrlrl.exe38⤵
- Executes dropped EXE
PID:4656 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1nnttt.exec:\1nnttt.exe40⤵
- Executes dropped EXE
PID:4784 -
\??\c:\djjdd.exec:\djjdd.exe41⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pvjjd.exec:\pvjjd.exe42⤵
- Executes dropped EXE
PID:3404 -
\??\c:\pjjjj.exec:\pjjjj.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\flrrllr.exec:\flrrllr.exe44⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tntbtt.exec:\tntbtt.exe45⤵
- Executes dropped EXE
PID:4000 -
\??\c:\jdjjj.exec:\jdjjj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400 -
\??\c:\jvdvv.exec:\jvdvv.exe47⤵
- Executes dropped EXE
PID:764 -
\??\c:\flxrrrx.exec:\flxrrrx.exe48⤵
- Executes dropped EXE
PID:4764 -
\??\c:\ffxxrxf.exec:\ffxxrxf.exe49⤵
- Executes dropped EXE
PID:1012 -
\??\c:\tttbbh.exec:\tttbbh.exe50⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nhnnhn.exec:\nhnnhn.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\7dppp.exec:\7dppp.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvddj.exec:\vvddj.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lxrrrxr.exec:\lxrrrxr.exe54⤵
- Executes dropped EXE
PID:3908 -
\??\c:\llfxlrx.exec:\llfxlrx.exe55⤵
- Executes dropped EXE
PID:768 -
\??\c:\5bbhhh.exec:\5bbhhh.exe56⤵
- Executes dropped EXE
PID:4012 -
\??\c:\pdpdp.exec:\pdpdp.exe57⤵
- Executes dropped EXE
PID:4844 -
\??\c:\flflxfr.exec:\flflxfr.exe58⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xxxxxff.exec:\xxxxxff.exe59⤵
- Executes dropped EXE
PID:3104 -
\??\c:\1bhnnh.exec:\1bhnnh.exe60⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5bhbtt.exec:\5bhbtt.exe61⤵
- Executes dropped EXE
PID:2676 -
\??\c:\djvvp.exec:\djvvp.exe62⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrffrrf.exec:\xrffrrf.exe63⤵
- Executes dropped EXE
PID:620 -
\??\c:\lflllrr.exec:\lflllrr.exe64⤵
- Executes dropped EXE
PID:3944 -
\??\c:\7btnnn.exec:\7btnnn.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jpvjd.exec:\jpvjd.exe66⤵PID:4732
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe67⤵PID:4468
-
\??\c:\lllllll.exec:\lllllll.exe68⤵PID:1036
-
\??\c:\bntnnt.exec:\bntnnt.exe69⤵PID:4556
-
\??\c:\bhtttt.exec:\bhtttt.exe70⤵PID:944
-
\??\c:\3vpjd.exec:\3vpjd.exe71⤵PID:476
-
\??\c:\7vdpj.exec:\7vdpj.exe72⤵PID:3980
-
\??\c:\fxlfllx.exec:\fxlfllx.exe73⤵PID:4456
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe74⤵PID:1608
-
\??\c:\btbttt.exec:\btbttt.exe75⤵PID:1860
-
\??\c:\nbnntt.exec:\nbnntt.exe76⤵PID:4300
-
\??\c:\ttbttb.exec:\ttbttb.exe77⤵PID:1216
-
\??\c:\llrxxxx.exec:\llrxxxx.exe78⤵PID:1072
-
\??\c:\nnnnhh.exec:\nnnnhh.exe79⤵PID:3516
-
\??\c:\vpjdv.exec:\vpjdv.exe80⤵PID:3600
-
\??\c:\rrrxlfr.exec:\rrrxlfr.exe81⤵PID:4808
-
\??\c:\fflllxx.exec:\fflllxx.exe82⤵PID:2820
-
\??\c:\tnnnnt.exec:\tnnnnt.exe83⤵PID:3020
-
\??\c:\9vjjp.exec:\9vjjp.exe84⤵PID:640
-
\??\c:\ppppp.exec:\ppppp.exe85⤵PID:4652
-
\??\c:\ddppd.exec:\ddppd.exe86⤵PID:3756
-
\??\c:\ffrxlrr.exec:\ffrxlrr.exe87⤵PID:4432
-
\??\c:\lfffllx.exec:\lfffllx.exe88⤵PID:5052
-
\??\c:\tntttb.exec:\tntttb.exe89⤵PID:2352
-
\??\c:\ntbbbb.exec:\ntbbbb.exe90⤵PID:3404
-
\??\c:\3ddvp.exec:\3ddvp.exe91⤵PID:3964
-
\??\c:\pjjdd.exec:\pjjdd.exe92⤵PID:1152
-
\??\c:\xxxrlll.exec:\xxxrlll.exe93⤵PID:4840
-
\??\c:\ffrrffr.exec:\ffrrffr.exe94⤵PID:1536
-
\??\c:\nhhnnn.exec:\nhhnnn.exe95⤵PID:2504
-
\??\c:\5ntnhh.exec:\5ntnhh.exe96⤵PID:2648
-
\??\c:\3pjjp.exec:\3pjjp.exe97⤵PID:64
-
\??\c:\vvjpd.exec:\vvjpd.exe98⤵PID:236
-
\??\c:\ddppj.exec:\ddppj.exe99⤵PID:2492
-
\??\c:\9rrxxff.exec:\9rrxxff.exe100⤵PID:1452
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe101⤵PID:4988
-
\??\c:\ttbbtt.exec:\ttbbtt.exe102⤵PID:1428
-
\??\c:\tnbbnn.exec:\tnbbnn.exe103⤵PID:4460
-
\??\c:\pjpjd.exec:\pjpjd.exe104⤵PID:4940
-
\??\c:\rrrllrl.exec:\rrrllrl.exe105⤵PID:3552
-
\??\c:\llfffrr.exec:\llfffrr.exe106⤵PID:5004
-
\??\c:\nbhnnn.exec:\nbhnnn.exe107⤵PID:3104
-
\??\c:\9jppj.exec:\9jppj.exe108⤵PID:2916
-
\??\c:\ddvpv.exec:\ddvpv.exe109⤵PID:2676
-
\??\c:\rlrlffx.exec:\rlrlffx.exe110⤵PID:2376
-
\??\c:\ddvdd.exec:\ddvdd.exe111⤵PID:620
-
\??\c:\9jppp.exec:\9jppp.exe112⤵PID:1256
-
\??\c:\pjjdj.exec:\pjjdj.exe113⤵PID:4732
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe114⤵PID:3140
-
\??\c:\frlffff.exec:\frlffff.exe115⤵PID:892
-
\??\c:\9ttnhn.exec:\9ttnhn.exe116⤵PID:4556
-
\??\c:\pjpjd.exec:\pjpjd.exe117⤵PID:1656
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe118⤵PID:1200
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe119⤵PID:2624
-
\??\c:\9tthhb.exec:\9tthhb.exe120⤵PID:3940
-
\??\c:\vpjvp.exec:\vpjvp.exe121⤵PID:1608
-
\??\c:\frlxrlf.exec:\frlxrlf.exe122⤵PID:4744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-