Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
Resource
win7-20240903-en
General
-
Target
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
-
Size
83KB
-
MD5
cc843f29569041b4c5f5cfbda3acbbba
-
SHA1
00f60f53883096623fd59c71beebb5dd172f2e03
-
SHA256
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f
-
SHA512
95c7f249f15992a059ba2e5c43f201ffa5319267ab2563cef62ed43654f4899bc0ff2eff4040fb23d602a8b20524684c18cb8d49c2f8f2b8a915e47b6eb6ca18
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QR:ymb3NkkiQ3mdBjFIIp9L9QrrA8m
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/516-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2032 ttttbb.exe 2132 ddppp.exe 1704 rrrrlrl.exe 2216 ttttnn.exe 4308 dvpjj.exe 1952 xrxrrrx.exe 4240 llfxxfx.exe 2796 htnnbb.exe 712 vvvpj.exe 1892 tnnthh.exe 700 nnhbtt.exe 4672 ddjvp.exe 1452 jdjdp.exe 5104 xrxxrxr.exe 2488 lfffxxr.exe 1352 bttnhb.exe 2384 pddvp.exe 732 nbbbtt.exe 5108 dvvjd.exe 1188 lxffxxr.exe 4232 xrrrfrx.exe 884 9bbbtb.exe 3244 5jpjp.exe 2036 xrrfxxr.exe 2968 hbtnnn.exe 4792 vpppd.exe 920 ddvpj.exe 3616 frxrrxx.exe 4908 nttbtb.exe 2888 1pddp.exe 1612 pjdvp.exe 1844 9lrrlll.exe 4340 bbbbhh.exe 4464 tnnnhb.exe 3120 ppvvj.exe 4600 fflrffr.exe 1416 lfffffl.exe 4936 thtnnn.exe 2096 bthhtt.exe 3412 vdvpd.exe 1640 jdvpj.exe 1972 fxxrllf.exe 1628 fxxxrrx.exe 3996 9bhhbb.exe 4364 dvppp.exe 2628 dvvpd.exe 2860 fxllfxx.exe 3464 rxlfxfx.exe 4468 9nhnhh.exe 2292 httbbn.exe 2836 dpvvp.exe 4428 dppjv.exe 4560 fxxrxrx.exe 764 rrffllf.exe 4840 7ntnbb.exe 3740 jvvpj.exe 2288 jvjdv.exe 4624 pvpdv.exe 1320 xrfrllx.exe 4144 thnnhn.exe 3644 thnhnn.exe 2308 bhhnbb.exe 1892 jppdp.exe 3088 rlxxrrx.exe -
resource yara_rule behavioral2/memory/516-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 2032 516 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 85 PID 516 wrote to memory of 2032 516 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 85 PID 516 wrote to memory of 2032 516 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 85 PID 2032 wrote to memory of 2132 2032 ttttbb.exe 86 PID 2032 wrote to memory of 2132 2032 ttttbb.exe 86 PID 2032 wrote to memory of 2132 2032 ttttbb.exe 86 PID 2132 wrote to memory of 1704 2132 ddppp.exe 87 PID 2132 wrote to memory of 1704 2132 ddppp.exe 87 PID 2132 wrote to memory of 1704 2132 ddppp.exe 87 PID 1704 wrote to memory of 2216 1704 rrrrlrl.exe 88 PID 1704 wrote to memory of 2216 1704 rrrrlrl.exe 88 PID 1704 wrote to memory of 2216 1704 rrrrlrl.exe 88 PID 2216 wrote to memory of 4308 2216 ttttnn.exe 89 PID 2216 wrote to memory of 4308 2216 ttttnn.exe 89 PID 2216 wrote to memory of 4308 2216 ttttnn.exe 89 PID 4308 wrote to memory of 1952 4308 dvpjj.exe 90 PID 4308 wrote to memory of 1952 4308 dvpjj.exe 90 PID 4308 wrote to memory of 1952 4308 dvpjj.exe 90 PID 1952 wrote to memory of 4240 1952 xrxrrrx.exe 91 PID 1952 wrote to memory of 4240 1952 xrxrrrx.exe 91 PID 1952 wrote to memory of 4240 1952 xrxrrrx.exe 91 PID 4240 wrote to memory of 2796 4240 llfxxfx.exe 92 PID 4240 wrote to memory of 2796 4240 llfxxfx.exe 92 PID 4240 wrote to memory of 2796 4240 llfxxfx.exe 92 PID 2796 wrote to memory of 712 2796 htnnbb.exe 93 PID 2796 wrote to memory of 712 2796 htnnbb.exe 93 PID 2796 wrote to memory of 712 2796 htnnbb.exe 93 PID 712 wrote to memory of 1892 712 vvvpj.exe 94 PID 712 wrote to memory of 1892 712 vvvpj.exe 94 PID 712 wrote to memory of 1892 712 vvvpj.exe 94 PID 1892 wrote to memory of 700 1892 tnnthh.exe 95 PID 1892 wrote to memory of 700 1892 tnnthh.exe 95 PID 1892 wrote to memory of 700 1892 tnnthh.exe 95 PID 700 wrote to memory of 4672 700 nnhbtt.exe 96 PID 700 wrote to memory of 4672 700 nnhbtt.exe 96 PID 700 wrote to memory of 4672 700 nnhbtt.exe 96 PID 4672 wrote to memory of 1452 4672 ddjvp.exe 97 PID 4672 wrote to memory of 1452 4672 ddjvp.exe 97 PID 4672 wrote to memory of 1452 4672 ddjvp.exe 97 PID 1452 wrote to memory of 5104 1452 jdjdp.exe 98 PID 1452 wrote to memory of 5104 1452 jdjdp.exe 98 PID 1452 wrote to memory of 5104 1452 jdjdp.exe 98 PID 5104 wrote to memory of 2488 5104 xrxxrxr.exe 99 PID 5104 wrote to memory of 2488 5104 xrxxrxr.exe 99 PID 5104 wrote to memory of 2488 5104 xrxxrxr.exe 99 PID 2488 wrote to memory of 1352 2488 lfffxxr.exe 100 PID 2488 wrote to memory of 1352 2488 lfffxxr.exe 100 PID 2488 wrote to memory of 1352 2488 lfffxxr.exe 100 PID 1352 wrote to memory of 2384 1352 bttnhb.exe 101 PID 1352 wrote to memory of 2384 1352 bttnhb.exe 101 PID 1352 wrote to memory of 2384 1352 bttnhb.exe 101 PID 2384 wrote to memory of 732 2384 pddvp.exe 102 PID 2384 wrote to memory of 732 2384 pddvp.exe 102 PID 2384 wrote to memory of 732 2384 pddvp.exe 102 PID 732 wrote to memory of 5108 732 nbbbtt.exe 103 PID 732 wrote to memory of 5108 732 nbbbtt.exe 103 PID 732 wrote to memory of 5108 732 nbbbtt.exe 103 PID 5108 wrote to memory of 1188 5108 dvvjd.exe 104 PID 5108 wrote to memory of 1188 5108 dvvjd.exe 104 PID 5108 wrote to memory of 1188 5108 dvvjd.exe 104 PID 1188 wrote to memory of 4232 1188 lxffxxr.exe 105 PID 1188 wrote to memory of 4232 1188 lxffxxr.exe 105 PID 1188 wrote to memory of 4232 1188 lxffxxr.exe 105 PID 4232 wrote to memory of 884 4232 xrrrfrx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\ttttbb.exec:\ttttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\ddppp.exec:\ddppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ttttnn.exec:\ttttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\dvpjj.exec:\dvpjj.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\llfxxfx.exec:\llfxxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\htnnbb.exec:\htnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vvvpj.exec:\vvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\tnnthh.exec:\tnnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\nnhbtt.exec:\nnhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\ddjvp.exec:\ddjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\jdjdp.exec:\jdjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\lfffxxr.exec:\lfffxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\bttnhb.exec:\bttnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\pddvp.exec:\pddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nbbbtt.exec:\nbbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\dvvjd.exec:\dvvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\lxffxxr.exec:\lxffxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xrrrfrx.exec:\xrrrfrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\9bbbtb.exec:\9bbbtb.exe23⤵
- Executes dropped EXE
PID:884 -
\??\c:\5jpjp.exec:\5jpjp.exe24⤵
- Executes dropped EXE
PID:3244 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe25⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hbtnnn.exec:\hbtnnn.exe26⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vpppd.exec:\vpppd.exe27⤵
- Executes dropped EXE
PID:4792 -
\??\c:\ddvpj.exec:\ddvpj.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\frxrrxx.exec:\frxrrxx.exe29⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nttbtb.exec:\nttbtb.exe30⤵
- Executes dropped EXE
PID:4908 -
\??\c:\1pddp.exec:\1pddp.exe31⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjdvp.exec:\pjdvp.exe32⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9lrrlll.exec:\9lrrlll.exe33⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bbbbhh.exec:\bbbbhh.exe34⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tnnnhb.exec:\tnnnhb.exe35⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ppvvj.exec:\ppvvj.exe36⤵
- Executes dropped EXE
PID:3120 -
\??\c:\fflrffr.exec:\fflrffr.exe37⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lfffffl.exec:\lfffffl.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\thtnnn.exec:\thtnnn.exe39⤵
- Executes dropped EXE
PID:4936 -
\??\c:\bthhtt.exec:\bthhtt.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vdvpd.exec:\vdvpd.exe41⤵
- Executes dropped EXE
PID:3412 -
\??\c:\jdvpj.exec:\jdvpj.exe42⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fxxrllf.exec:\fxxrllf.exe43⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxxxrrx.exec:\fxxxrrx.exe44⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9bhhbb.exec:\9bhhbb.exe45⤵
- Executes dropped EXE
PID:3996 -
\??\c:\dvppp.exec:\dvppp.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\dvvpd.exec:\dvvpd.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxllfxx.exec:\fxllfxx.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rxlfxfx.exec:\rxlfxfx.exe49⤵
- Executes dropped EXE
PID:3464 -
\??\c:\9nhnhh.exec:\9nhnhh.exe50⤵
- Executes dropped EXE
PID:4468 -
\??\c:\httbbn.exec:\httbbn.exe51⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dpvvp.exec:\dpvvp.exe52⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dppjv.exec:\dppjv.exe53⤵
- Executes dropped EXE
PID:4428 -
\??\c:\fxxrxrx.exec:\fxxrxrx.exe54⤵
- Executes dropped EXE
PID:4560 -
\??\c:\rrffllf.exec:\rrffllf.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\7ntnbb.exec:\7ntnbb.exe56⤵
- Executes dropped EXE
PID:4840 -
\??\c:\jvvpj.exec:\jvvpj.exe57⤵
- Executes dropped EXE
PID:3740 -
\??\c:\jvjdv.exec:\jvjdv.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pvpdv.exec:\pvpdv.exe59⤵
- Executes dropped EXE
PID:4624 -
\??\c:\xrfrllx.exec:\xrfrllx.exe60⤵
- Executes dropped EXE
PID:1320 -
\??\c:\thnnhn.exec:\thnnhn.exe61⤵
- Executes dropped EXE
PID:4144 -
\??\c:\thnhnn.exec:\thnhnn.exe62⤵
- Executes dropped EXE
PID:3644 -
\??\c:\bhhnbb.exec:\bhhnbb.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jppdp.exec:\jppdp.exe64⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe65⤵
- Executes dropped EXE
PID:3088 -
\??\c:\1rlffxx.exec:\1rlffxx.exe66⤵PID:1328
-
\??\c:\7nbbtt.exec:\7nbbtt.exe67⤵PID:4812
-
\??\c:\nbhbhh.exec:\nbhbhh.exe68⤵PID:5104
-
\??\c:\dpjdv.exec:\dpjdv.exe69⤵PID:2124
-
\??\c:\xrlxrrr.exec:\xrlxrrr.exe70⤵PID:2776
-
\??\c:\rfffxxr.exec:\rfffxxr.exe71⤵PID:4724
-
\??\c:\ntbbtt.exec:\ntbbtt.exe72⤵PID:3144
-
\??\c:\ddvvv.exec:\ddvvv.exe73⤵PID:4564
-
\??\c:\pjvpv.exec:\pjvpv.exe74⤵
- System Location Discovery: System Language Discovery
PID:3448 -
\??\c:\llxrlll.exec:\llxrlll.exe75⤵PID:644
-
\??\c:\tnnnhh.exec:\tnnnhh.exe76⤵PID:4892
-
\??\c:\btthtn.exec:\btthtn.exe77⤵PID:3304
-
\??\c:\jddvp.exec:\jddvp.exe78⤵PID:4620
-
\??\c:\xxlrflf.exec:\xxlrflf.exe79⤵PID:4540
-
\??\c:\xrffllr.exec:\xrffllr.exe80⤵PID:3524
-
\??\c:\dvdjv.exec:\dvdjv.exe81⤵PID:4884
-
\??\c:\5xrfrxf.exec:\5xrfrxf.exe82⤵PID:680
-
\??\c:\hbhbnh.exec:\hbhbnh.exe83⤵PID:4828
-
\??\c:\tnhbtt.exec:\tnhbtt.exe84⤵PID:2524
-
\??\c:\7jvjp.exec:\7jvjp.exe85⤵PID:3476
-
\??\c:\dppjv.exec:\dppjv.exe86⤵PID:2940
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe87⤵PID:1096
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe88⤵PID:4192
-
\??\c:\btntbb.exec:\btntbb.exe89⤵PID:2888
-
\??\c:\jpvpd.exec:\jpvpd.exe90⤵PID:1612
-
\??\c:\pppdv.exec:\pppdv.exe91⤵PID:3516
-
\??\c:\rrlfffl.exec:\rrlfffl.exe92⤵PID:2620
-
\??\c:\flrxxfx.exec:\flrxxfx.exe93⤵PID:3496
-
\??\c:\nnnttt.exec:\nnnttt.exe94⤵PID:4044
-
\??\c:\pjddp.exec:\pjddp.exe95⤵PID:4956
-
\??\c:\1vdvp.exec:\1vdvp.exe96⤵PID:4256
-
\??\c:\9jpjv.exec:\9jpjv.exe97⤵PID:1740
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe98⤵PID:2344
-
\??\c:\lrxrfrl.exec:\lrxrfrl.exe99⤵PID:3412
-
\??\c:\3jjdj.exec:\3jjdj.exe100⤵PID:684
-
\??\c:\pdpdv.exec:\pdpdv.exe101⤵PID:1980
-
\??\c:\lrffffl.exec:\lrffffl.exe102⤵PID:3960
-
\??\c:\3xfflrr.exec:\3xfflrr.exe103⤵PID:4364
-
\??\c:\tbnhbb.exec:\tbnhbb.exe104⤵PID:2628
-
\??\c:\ntnhnt.exec:\ntnhnt.exe105⤵PID:2172
-
\??\c:\vpvpv.exec:\vpvpv.exe106⤵PID:4880
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe107⤵PID:4448
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe108⤵PID:3248
-
\??\c:\bthhnn.exec:\bthhnn.exe109⤵PID:2836
-
\??\c:\djvdv.exec:\djvdv.exe110⤵PID:1736
-
\??\c:\ddjdd.exec:\ddjdd.exe111⤵PID:4560
-
\??\c:\flxlrlf.exec:\flxlrlf.exe112⤵PID:2624
-
\??\c:\ntbnht.exec:\ntbnht.exe113⤵PID:1744
-
\??\c:\vjjvp.exec:\vjjvp.exe114⤵PID:1604
-
\??\c:\jjdvj.exec:\jjdvj.exe115⤵PID:2892
-
\??\c:\llxlllr.exec:\llxlllr.exe116⤵PID:4420
-
\??\c:\xlxrlll.exec:\xlxrlll.exe117⤵PID:4136
-
\??\c:\9bnhth.exec:\9bnhth.exe118⤵PID:3656
-
\??\c:\nhbbbb.exec:\nhbbbb.exe119⤵PID:4416
-
\??\c:\vddvj.exec:\vddvj.exe120⤵PID:4104
-
\??\c:\rxllxxr.exec:\rxllxxr.exe121⤵PID:1632
-
\??\c:\xlrfrfx.exec:\xlrfrfx.exe122⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-