Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe
Resource
win7-20240903-en
General
-
Target
90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe
-
Size
81KB
-
MD5
d2b4f6f679f26d1c45f59bc6ddfe0258
-
SHA1
310c393478aee3411b866c49861b17787e27e736
-
SHA256
90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b
-
SHA512
087e3ac22285a33527cf975a86442837e9e371826a2594e3d562dc1eebcc72b6113db98c338eb8aafd53bc3b5115224f8ee7c54432647a8943804511cef5cfcf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqT:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/436-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4492 pjjdp.exe 3872 ffxxxff.exe 2232 bntnnt.exe 4864 dvddv.exe 212 dvdvd.exe 3576 tntnth.exe 4332 rrfxxxl.exe 2544 3llfflf.exe 2512 3pddj.exe 2776 lfxxxff.exe 2116 nthhhh.exe 1564 vdvpp.exe 1072 lfrlfxr.exe 4540 hnbbtt.exe 2364 ddpvp.exe 2800 rrlfffx.exe 3408 btthbb.exe 2016 vvddp.exe 3044 1xrffrr.exe 2448 fxrlfrr.exe 2524 pvppp.exe 2788 vdppv.exe 3768 frflfrf.exe 4216 htttnn.exe 1892 vpvpj.exe 432 rxrrxfl.exe 3948 ntnnnn.exe 2736 5htttt.exe 972 vdvvp.exe 1404 rxxrrxx.exe 2556 htnhbh.exe 2172 tttbtb.exe 4208 dpjdd.exe 4280 vvvjd.exe 1516 lffffff.exe 3964 hbttnn.exe 3516 jjjdv.exe 4708 1rlfffx.exe 2720 vjjjj.exe 568 dpvdd.exe 2384 xxrrlll.exe 928 1rfxrxf.exe 3720 hnhhbh.exe 4364 vvddd.exe 2220 1ppdd.exe 1340 xxxrrll.exe 4492 lllrrxr.exe 3884 bhntnn.exe 1224 pdddd.exe 4908 lrfxrrr.exe 4884 ntttbt.exe 1232 1pdvj.exe 4960 flrxffr.exe 320 xfrrxfx.exe 5060 htbbht.exe 860 1jjdv.exe 3092 rxlllrx.exe 4100 hbhhhh.exe 3812 bbhntt.exe 4148 ddjjd.exe 4568 nhhnht.exe 1492 vjdvv.exe 2116 5rlllrl.exe 4156 rrfxrrl.exe -
resource yara_rule behavioral2/memory/436-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 4492 436 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 83 PID 436 wrote to memory of 4492 436 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 83 PID 436 wrote to memory of 4492 436 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 83 PID 4492 wrote to memory of 3872 4492 pjjdp.exe 84 PID 4492 wrote to memory of 3872 4492 pjjdp.exe 84 PID 4492 wrote to memory of 3872 4492 pjjdp.exe 84 PID 3872 wrote to memory of 2232 3872 ffxxxff.exe 85 PID 3872 wrote to memory of 2232 3872 ffxxxff.exe 85 PID 3872 wrote to memory of 2232 3872 ffxxxff.exe 85 PID 2232 wrote to memory of 4864 2232 bntnnt.exe 86 PID 2232 wrote to memory of 4864 2232 bntnnt.exe 86 PID 2232 wrote to memory of 4864 2232 bntnnt.exe 86 PID 4864 wrote to memory of 212 4864 dvddv.exe 87 PID 4864 wrote to memory of 212 4864 dvddv.exe 87 PID 4864 wrote to memory of 212 4864 dvddv.exe 87 PID 212 wrote to memory of 3576 212 dvdvd.exe 88 PID 212 wrote to memory of 3576 212 dvdvd.exe 88 PID 212 wrote to memory of 3576 212 dvdvd.exe 88 PID 3576 wrote to memory of 4332 3576 tntnth.exe 89 PID 3576 wrote to memory of 4332 3576 tntnth.exe 89 PID 3576 wrote to memory of 4332 3576 tntnth.exe 89 PID 4332 wrote to memory of 2544 4332 rrfxxxl.exe 90 PID 4332 wrote to memory of 2544 4332 rrfxxxl.exe 90 PID 4332 wrote to memory of 2544 4332 rrfxxxl.exe 90 PID 2544 wrote to memory of 2512 2544 3llfflf.exe 91 PID 2544 wrote to memory of 2512 2544 3llfflf.exe 91 PID 2544 wrote to memory of 2512 2544 3llfflf.exe 91 PID 2512 wrote to memory of 2776 2512 3pddj.exe 92 PID 2512 wrote to memory of 2776 2512 3pddj.exe 92 PID 2512 wrote to memory of 2776 2512 3pddj.exe 92 PID 2776 wrote to memory of 2116 2776 lfxxxff.exe 93 PID 2776 wrote to memory of 2116 2776 lfxxxff.exe 93 PID 2776 wrote to memory of 2116 2776 lfxxxff.exe 93 PID 2116 wrote to memory of 1564 2116 nthhhh.exe 94 PID 2116 wrote to memory of 1564 2116 nthhhh.exe 94 PID 2116 wrote to memory of 1564 2116 nthhhh.exe 94 PID 1564 wrote to memory of 1072 1564 vdvpp.exe 95 PID 1564 wrote to memory of 1072 1564 vdvpp.exe 95 PID 1564 wrote to memory of 1072 1564 vdvpp.exe 95 PID 1072 wrote to memory of 4540 1072 lfrlfxr.exe 96 PID 1072 wrote to memory of 4540 1072 lfrlfxr.exe 96 PID 1072 wrote to memory of 4540 1072 lfrlfxr.exe 96 PID 4540 wrote to memory of 2364 4540 hnbbtt.exe 97 PID 4540 wrote to memory of 2364 4540 hnbbtt.exe 97 PID 4540 wrote to memory of 2364 4540 hnbbtt.exe 97 PID 2364 wrote to memory of 2800 2364 ddpvp.exe 98 PID 2364 wrote to memory of 2800 2364 ddpvp.exe 98 PID 2364 wrote to memory of 2800 2364 ddpvp.exe 98 PID 2800 wrote to memory of 3408 2800 rrlfffx.exe 99 PID 2800 wrote to memory of 3408 2800 rrlfffx.exe 99 PID 2800 wrote to memory of 3408 2800 rrlfffx.exe 99 PID 3408 wrote to memory of 2016 3408 btthbb.exe 100 PID 3408 wrote to memory of 2016 3408 btthbb.exe 100 PID 3408 wrote to memory of 2016 3408 btthbb.exe 100 PID 2016 wrote to memory of 3044 2016 vvddp.exe 101 PID 2016 wrote to memory of 3044 2016 vvddp.exe 101 PID 2016 wrote to memory of 3044 2016 vvddp.exe 101 PID 3044 wrote to memory of 2448 3044 1xrffrr.exe 102 PID 3044 wrote to memory of 2448 3044 1xrffrr.exe 102 PID 3044 wrote to memory of 2448 3044 1xrffrr.exe 102 PID 2448 wrote to memory of 2524 2448 fxrlfrr.exe 103 PID 2448 wrote to memory of 2524 2448 fxrlfrr.exe 103 PID 2448 wrote to memory of 2524 2448 fxrlfrr.exe 103 PID 2524 wrote to memory of 2788 2524 pvppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe"C:\Users\Admin\AppData\Local\Temp\90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\pjjdp.exec:\pjjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\ffxxxff.exec:\ffxxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\bntnnt.exec:\bntnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvddv.exec:\dvddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\dvdvd.exec:\dvdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\tntnth.exec:\tntnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\rrfxxxl.exec:\rrfxxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\3llfflf.exec:\3llfflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3pddj.exec:\3pddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\lfxxxff.exec:\lfxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nthhhh.exec:\nthhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vdvpp.exec:\vdvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\hnbbtt.exec:\hnbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\ddpvp.exec:\ddpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rrlfffx.exec:\rrlfffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\btthbb.exec:\btthbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\vvddp.exec:\vvddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1xrffrr.exec:\1xrffrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\fxrlfrr.exec:\fxrlfrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pvppp.exec:\pvppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vdppv.exec:\vdppv.exe23⤵
- Executes dropped EXE
PID:2788 -
\??\c:\frflfrf.exec:\frflfrf.exe24⤵
- Executes dropped EXE
PID:3768 -
\??\c:\htttnn.exec:\htttnn.exe25⤵
- Executes dropped EXE
PID:4216 -
\??\c:\vpvpj.exec:\vpvpj.exe26⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe27⤵
- Executes dropped EXE
PID:432 -
\??\c:\ntnnnn.exec:\ntnnnn.exe28⤵
- Executes dropped EXE
PID:3948 -
\??\c:\5htttt.exec:\5htttt.exe29⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vdvvp.exec:\vdvvp.exe30⤵
- Executes dropped EXE
PID:972 -
\??\c:\rxxrrxx.exec:\rxxrrxx.exe31⤵
- Executes dropped EXE
PID:1404 -
\??\c:\htnhbh.exec:\htnhbh.exe32⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tttbtb.exec:\tttbtb.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dpjdd.exec:\dpjdd.exe34⤵
- Executes dropped EXE
PID:4208 -
\??\c:\vvvjd.exec:\vvvjd.exe35⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lffffff.exec:\lffffff.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hbttnn.exec:\hbttnn.exe37⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jjjdv.exec:\jjjdv.exe38⤵
- Executes dropped EXE
PID:3516 -
\??\c:\1rlfffx.exec:\1rlfffx.exe39⤵
- Executes dropped EXE
PID:4708 -
\??\c:\vjjjj.exec:\vjjjj.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\dpvdd.exec:\dpvdd.exe41⤵
- Executes dropped EXE
PID:568 -
\??\c:\xxrrlll.exec:\xxrrlll.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1rfxrxf.exec:\1rfxrxf.exe43⤵
- Executes dropped EXE
PID:928 -
\??\c:\hnhhbh.exec:\hnhhbh.exe44⤵
- Executes dropped EXE
PID:3720 -
\??\c:\vvddd.exec:\vvddd.exe45⤵
- Executes dropped EXE
PID:4364 -
\??\c:\1ppdd.exec:\1ppdd.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xxxrrll.exec:\xxxrrll.exe47⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lllrrxr.exec:\lllrrxr.exe48⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bhntnn.exec:\bhntnn.exe49⤵
- Executes dropped EXE
PID:3884 -
\??\c:\pdddd.exec:\pdddd.exe50⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lrfxrrr.exec:\lrfxrrr.exe51⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ntttbt.exec:\ntttbt.exe52⤵
- Executes dropped EXE
PID:4884 -
\??\c:\1pdvj.exec:\1pdvj.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\flrxffr.exec:\flrxffr.exe54⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xfrrxfx.exec:\xfrrxfx.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\htbbht.exec:\htbbht.exe56⤵
- Executes dropped EXE
PID:5060 -
\??\c:\1jjdv.exec:\1jjdv.exe57⤵
- Executes dropped EXE
PID:860 -
\??\c:\rxlllrx.exec:\rxlllrx.exe58⤵
- Executes dropped EXE
PID:3092 -
\??\c:\hbhhhh.exec:\hbhhhh.exe59⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bbhntt.exec:\bbhntt.exe60⤵
- Executes dropped EXE
PID:3812 -
\??\c:\ddjjd.exec:\ddjjd.exe61⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nhhnht.exec:\nhhnht.exe62⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vjdvv.exec:\vjdvv.exe63⤵
- Executes dropped EXE
PID:1492 -
\??\c:\5rlllrl.exec:\5rlllrl.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe65⤵
- Executes dropped EXE
PID:4156 -
\??\c:\3nbnnh.exec:\3nbnnh.exe66⤵PID:1412
-
\??\c:\vvpjv.exec:\vvpjv.exe67⤵PID:1788
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe68⤵PID:4876
-
\??\c:\ttnhtb.exec:\ttnhtb.exe69⤵PID:1172
-
\??\c:\bnhbnh.exec:\bnhbnh.exe70⤵PID:4480
-
\??\c:\vppjj.exec:\vppjj.exe71⤵PID:2216
-
\??\c:\ppdpj.exec:\ppdpj.exe72⤵PID:4120
-
\??\c:\1fxlllf.exec:\1fxlllf.exe73⤵PID:4356
-
\??\c:\7lrlflf.exec:\7lrlflf.exe74⤵PID:2084
-
\??\c:\nnnnhh.exec:\nnnnhh.exe75⤵PID:3600
-
\??\c:\vvjdv.exec:\vvjdv.exe76⤵PID:2128
-
\??\c:\frxxxxr.exec:\frxxxxr.exe77⤵PID:4592
-
\??\c:\fxfffff.exec:\fxfffff.exe78⤵PID:4664
-
\??\c:\7hhhbb.exec:\7hhhbb.exe79⤵PID:1316
-
\??\c:\jjjdd.exec:\jjjdd.exe80⤵PID:4524
-
\??\c:\1fffxxr.exec:\1fffxxr.exe81⤵PID:4436
-
\??\c:\9rrrrrl.exec:\9rrrrrl.exe82⤵PID:452
-
\??\c:\tttnhh.exec:\tttnhh.exe83⤵PID:2748
-
\??\c:\ttbbbb.exec:\ttbbbb.exe84⤵PID:864
-
\??\c:\vdpjv.exec:\vdpjv.exe85⤵PID:1760
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe86⤵PID:1468
-
\??\c:\lfrlflf.exec:\lfrlflf.exe87⤵PID:1652
-
\??\c:\5ttnnn.exec:\5ttnnn.exe88⤵PID:4832
-
\??\c:\jdjdj.exec:\jdjdj.exe89⤵PID:2172
-
\??\c:\5vvvv.exec:\5vvvv.exe90⤵PID:2452
-
\??\c:\lfrxxrr.exec:\lfrxxrr.exe91⤵PID:3232
-
\??\c:\xlfffll.exec:\xlfffll.exe92⤵PID:3700
-
\??\c:\nbbbtb.exec:\nbbbtb.exe93⤵PID:3608
-
\??\c:\ddddv.exec:\ddddv.exe94⤵PID:3828
-
\??\c:\vvvvv.exec:\vvvvv.exe95⤵PID:3100
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe96⤵PID:4260
-
\??\c:\bhhhhn.exec:\bhhhhn.exe97⤵PID:2308
-
\??\c:\5jppv.exec:\5jppv.exe98⤵PID:3624
-
\??\c:\jvddd.exec:\jvddd.exe99⤵PID:1984
-
\??\c:\lffxrrl.exec:\lffxrrl.exe100⤵PID:3668
-
\??\c:\bbhhhn.exec:\bbhhhn.exe101⤵PID:2812
-
\??\c:\7hhbtb.exec:\7hhbtb.exe102⤵PID:2992
-
\??\c:\3jpjv.exec:\3jpjv.exe103⤵PID:1480
-
\??\c:\vvdjj.exec:\vvdjj.exe104⤵PID:1332
-
\??\c:\rlllfrl.exec:\rlllfrl.exe105⤵PID:2468
-
\??\c:\bbbttb.exec:\bbbttb.exe106⤵PID:2568
-
\??\c:\dpppj.exec:\dpppj.exe107⤵PID:1648
-
\??\c:\xrlxflr.exec:\xrlxflr.exe108⤵PID:1400
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe109⤵PID:632
-
\??\c:\5bnhhn.exec:\5bnhhn.exe110⤵PID:212
-
\??\c:\5vpjd.exec:\5vpjd.exe111⤵PID:1992
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe112⤵PID:2852
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe113⤵PID:4332
-
\??\c:\3bhbbb.exec:\3bhbbb.exe114⤵PID:3716
-
\??\c:\dvdvj.exec:\dvdvj.exe115⤵PID:2544
-
\??\c:\5vddj.exec:\5vddj.exe116⤵PID:4712
-
\??\c:\rxxlxrr.exec:\rxxlxrr.exe117⤵PID:1220
-
\??\c:\bnnttn.exec:\bnnttn.exe118⤵PID:2440
-
\??\c:\9nthnh.exec:\9nthnh.exe119⤵PID:1500
-
\??\c:\pjdvp.exec:\pjdvp.exe120⤵PID:3272
-
\??\c:\lfffffx.exec:\lfffffx.exe121⤵PID:4004
-
\??\c:\lrxxrfx.exec:\lrxxrfx.exe122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-