Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe
Resource
win7-20240903-en
General
-
Target
8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe
-
Size
67KB
-
MD5
df8b88fb741ef858f4868d7e64e878d5
-
SHA1
89abebe428318bdc93cafae3f4696da2ed37e873
-
SHA256
8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9
-
SHA512
f98dd9a45af3ce11ae87b70bba0aff668ce62beeca6168703c6847fd84f5bbb3ceac88b16389257efd315eeef66d332513e1778e37e587941df814ce30ef8e6e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeu:ymb3NkkiQ3mdBjF0y7kbUu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4388-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4672 jvjjd.exe 3556 httnht.exe 3236 jddvp.exe 4756 lxfxllf.exe 552 flrlfxr.exe 4968 nhtnhb.exe 696 pdvpd.exe 3756 fxrlxxr.exe 440 bnhbnn.exe 1392 pjpjp.exe 4036 rlrrlll.exe 1604 btbbhh.exe 2632 nhhbtt.exe 2372 pdvpj.exe 4700 9jpdd.exe 4560 bbtnnn.exe 4640 ttnhhh.exe 2728 dvdvv.exe 1232 xxxlffr.exe 3192 5tnnnn.exe 3080 1tthbb.exe 4400 pvdvj.exe 460 pvdvp.exe 1284 7lxrlff.exe 376 bhhbnn.exe 4332 jdppp.exe 3888 jpppp.exe 3040 xlxxrrr.exe 1420 9bbbhh.exe 2756 jvvpd.exe 1212 rxxrfrl.exe 4448 1xlrrff.exe 1452 nhhnhn.exe 1352 pppjd.exe 1468 dvjvd.exe 5008 fxxrllf.exe 4864 bhttbb.exe 2652 1jpjd.exe 4508 vjjdp.exe 1632 lffrllf.exe 3832 jpvvj.exe 2572 jjjpd.exe 1648 hbbttt.exe 1120 flxlffx.exe 4380 rlrxrfx.exe 2072 hbbtnh.exe 1836 hbhhbb.exe 3460 dddvv.exe 2132 9pjdp.exe 5044 frxrfxx.exe 2324 nnnhnh.exe 4756 hntthh.exe 5004 vppjj.exe 3640 flrlffr.exe 3320 xlrrrrl.exe 1736 3nnnht.exe 3012 tntttb.exe 4652 jvddv.exe 4796 rlrflfl.exe 4688 7rrfxxx.exe 768 tnttnn.exe 3988 ntbbnn.exe 2776 jdpjj.exe 4972 3pdvv.exe -
resource yara_rule behavioral2/memory/4388-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4388 wrote to memory of 4672 4388 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 83 PID 4388 wrote to memory of 4672 4388 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 83 PID 4388 wrote to memory of 4672 4388 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 83 PID 4672 wrote to memory of 3556 4672 jvjjd.exe 84 PID 4672 wrote to memory of 3556 4672 jvjjd.exe 84 PID 4672 wrote to memory of 3556 4672 jvjjd.exe 84 PID 3556 wrote to memory of 3236 3556 httnht.exe 85 PID 3556 wrote to memory of 3236 3556 httnht.exe 85 PID 3556 wrote to memory of 3236 3556 httnht.exe 85 PID 3236 wrote to memory of 4756 3236 jddvp.exe 86 PID 3236 wrote to memory of 4756 3236 jddvp.exe 86 PID 3236 wrote to memory of 4756 3236 jddvp.exe 86 PID 4756 wrote to memory of 552 4756 lxfxllf.exe 87 PID 4756 wrote to memory of 552 4756 lxfxllf.exe 87 PID 4756 wrote to memory of 552 4756 lxfxllf.exe 87 PID 552 wrote to memory of 4968 552 flrlfxr.exe 88 PID 552 wrote to memory of 4968 552 flrlfxr.exe 88 PID 552 wrote to memory of 4968 552 flrlfxr.exe 88 PID 4968 wrote to memory of 696 4968 nhtnhb.exe 89 PID 4968 wrote to memory of 696 4968 nhtnhb.exe 89 PID 4968 wrote to memory of 696 4968 nhtnhb.exe 89 PID 696 wrote to memory of 3756 696 pdvpd.exe 90 PID 696 wrote to memory of 3756 696 pdvpd.exe 90 PID 696 wrote to memory of 3756 696 pdvpd.exe 90 PID 3756 wrote to memory of 440 3756 fxrlxxr.exe 91 PID 3756 wrote to memory of 440 3756 fxrlxxr.exe 91 PID 3756 wrote to memory of 440 3756 fxrlxxr.exe 91 PID 440 wrote to memory of 1392 440 bnhbnn.exe 92 PID 440 wrote to memory of 1392 440 bnhbnn.exe 92 PID 440 wrote to memory of 1392 440 bnhbnn.exe 92 PID 1392 wrote to memory of 4036 1392 pjpjp.exe 93 PID 1392 wrote to memory of 4036 1392 pjpjp.exe 93 PID 1392 wrote to memory of 4036 1392 pjpjp.exe 93 PID 4036 wrote to memory of 1604 4036 rlrrlll.exe 94 PID 4036 wrote to memory of 1604 4036 rlrrlll.exe 94 PID 4036 wrote to memory of 1604 4036 rlrrlll.exe 94 PID 1604 wrote to memory of 2632 1604 btbbhh.exe 95 PID 1604 wrote to memory of 2632 1604 btbbhh.exe 95 PID 1604 wrote to memory of 2632 1604 btbbhh.exe 95 PID 2632 wrote to memory of 2372 2632 nhhbtt.exe 96 PID 2632 wrote to memory of 2372 2632 nhhbtt.exe 96 PID 2632 wrote to memory of 2372 2632 nhhbtt.exe 96 PID 2372 wrote to memory of 4700 2372 pdvpj.exe 97 PID 2372 wrote to memory of 4700 2372 pdvpj.exe 97 PID 2372 wrote to memory of 4700 2372 pdvpj.exe 97 PID 4700 wrote to memory of 4560 4700 9jpdd.exe 98 PID 4700 wrote to memory of 4560 4700 9jpdd.exe 98 PID 4700 wrote to memory of 4560 4700 9jpdd.exe 98 PID 4560 wrote to memory of 4640 4560 bbtnnn.exe 99 PID 4560 wrote to memory of 4640 4560 bbtnnn.exe 99 PID 4560 wrote to memory of 4640 4560 bbtnnn.exe 99 PID 4640 wrote to memory of 2728 4640 ttnhhh.exe 100 PID 4640 wrote to memory of 2728 4640 ttnhhh.exe 100 PID 4640 wrote to memory of 2728 4640 ttnhhh.exe 100 PID 2728 wrote to memory of 1232 2728 dvdvv.exe 101 PID 2728 wrote to memory of 1232 2728 dvdvv.exe 101 PID 2728 wrote to memory of 1232 2728 dvdvv.exe 101 PID 1232 wrote to memory of 3192 1232 xxxlffr.exe 102 PID 1232 wrote to memory of 3192 1232 xxxlffr.exe 102 PID 1232 wrote to memory of 3192 1232 xxxlffr.exe 102 PID 3192 wrote to memory of 3080 3192 5tnnnn.exe 103 PID 3192 wrote to memory of 3080 3192 5tnnnn.exe 103 PID 3192 wrote to memory of 3080 3192 5tnnnn.exe 103 PID 3080 wrote to memory of 4400 3080 1tthbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe"C:\Users\Admin\AppData\Local\Temp\8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\jvjjd.exec:\jvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\httnht.exec:\httnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\jddvp.exec:\jddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\lxfxllf.exec:\lxfxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\flrlfxr.exec:\flrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\nhtnhb.exec:\nhtnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\pdvpd.exec:\pdvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\bnhbnn.exec:\bnhbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\pjpjp.exec:\pjpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\rlrrlll.exec:\rlrrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\btbbhh.exec:\btbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\nhhbtt.exec:\nhhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pdvpj.exec:\pdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\9jpdd.exec:\9jpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\bbtnnn.exec:\bbtnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\ttnhhh.exec:\ttnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\dvdvv.exec:\dvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xxxlffr.exec:\xxxlffr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\5tnnnn.exec:\5tnnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\1tthbb.exec:\1tthbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\pvdvj.exec:\pvdvj.exe23⤵
- Executes dropped EXE
PID:4400 -
\??\c:\pvdvp.exec:\pvdvp.exe24⤵
- Executes dropped EXE
PID:460 -
\??\c:\7lxrlff.exec:\7lxrlff.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bhhbnn.exec:\bhhbnn.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\jdppp.exec:\jdppp.exe27⤵
- Executes dropped EXE
PID:4332 -
\??\c:\jpppp.exec:\jpppp.exe28⤵
- Executes dropped EXE
PID:3888 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9bbbhh.exec:\9bbbhh.exe30⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jvvpd.exec:\jvvpd.exe31⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rxxrfrl.exec:\rxxrfrl.exe32⤵
- Executes dropped EXE
PID:1212 -
\??\c:\1xlrrff.exec:\1xlrrff.exe33⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nhhnhn.exec:\nhhnhn.exe34⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pppjd.exec:\pppjd.exe35⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dvjvd.exec:\dvjvd.exe36⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fxxrllf.exec:\fxxrllf.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\bhttbb.exec:\bhttbb.exe38⤵
- Executes dropped EXE
PID:4864 -
\??\c:\1jpjd.exec:\1jpjd.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vjjdp.exec:\vjjdp.exe40⤵
- Executes dropped EXE
PID:4508 -
\??\c:\lffrllf.exec:\lffrllf.exe41⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jpvvj.exec:\jpvvj.exe42⤵
- Executes dropped EXE
PID:3832 -
\??\c:\jjjpd.exec:\jjjpd.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hbbttt.exec:\hbbttt.exe44⤵
- Executes dropped EXE
PID:1648 -
\??\c:\flxlffx.exec:\flxlffx.exe45⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rlrxrfx.exec:\rlrxrfx.exe46⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hbbtnh.exec:\hbbtnh.exe47⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hbhhbb.exec:\hbhhbb.exe48⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dddvv.exec:\dddvv.exe49⤵
- Executes dropped EXE
PID:3460 -
\??\c:\9pjdp.exec:\9pjdp.exe50⤵
- Executes dropped EXE
PID:2132 -
\??\c:\frxrfxx.exec:\frxrfxx.exe51⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nnnhnh.exec:\nnnhnh.exe52⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hntthh.exec:\hntthh.exe53⤵
- Executes dropped EXE
PID:4756 -
\??\c:\vppjj.exec:\vppjj.exe54⤵
- Executes dropped EXE
PID:5004 -
\??\c:\flrlffr.exec:\flrlffr.exe55⤵
- Executes dropped EXE
PID:3640 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe56⤵
- Executes dropped EXE
PID:3320 -
\??\c:\3nnnht.exec:\3nnnht.exe57⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tntttb.exec:\tntttb.exe58⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jvddv.exec:\jvddv.exe59⤵
- Executes dropped EXE
PID:4652 -
\??\c:\rlrflfl.exec:\rlrflfl.exe60⤵
- Executes dropped EXE
PID:4796 -
\??\c:\7rrfxxx.exec:\7rrfxxx.exe61⤵
- Executes dropped EXE
PID:4688 -
\??\c:\tnttnn.exec:\tnttnn.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\ntbbnn.exec:\ntbbnn.exe63⤵
- Executes dropped EXE
PID:3988 -
\??\c:\jdpjj.exec:\jdpjj.exe64⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3pdvv.exec:\3pdvv.exe65⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lffrllf.exec:\lffrllf.exe66⤵PID:1832
-
\??\c:\7xxrxrr.exec:\7xxrxrr.exe67⤵PID:3608
-
\??\c:\tnnhhh.exec:\tnnhhh.exe68⤵PID:4928
-
\??\c:\ppjdj.exec:\ppjdj.exe69⤵PID:2364
-
\??\c:\hthbhh.exec:\hthbhh.exe70⤵PID:3248
-
\??\c:\thnhtt.exec:\thnhtt.exe71⤵PID:1868
-
\??\c:\9jjjv.exec:\9jjjv.exe72⤵PID:4640
-
\??\c:\pdpjd.exec:\pdpjd.exe73⤵PID:4916
-
\??\c:\flllxfl.exec:\flllxfl.exe74⤵PID:432
-
\??\c:\5rxxrrr.exec:\5rxxrrr.exe75⤵PID:924
-
\??\c:\nhbhnn.exec:\nhbhnn.exe76⤵PID:4292
-
\??\c:\dpvpp.exec:\dpvpp.exe77⤵PID:4016
-
\??\c:\vvdvp.exec:\vvdvp.exe78⤵PID:4820
-
\??\c:\frxrfxr.exec:\frxrfxr.exe79⤵PID:2528
-
\??\c:\xxlllll.exec:\xxlllll.exe80⤵PID:1536
-
\??\c:\ttbnhh.exec:\ttbnhh.exe81⤵PID:312
-
\??\c:\9htnnn.exec:\9htnnn.exe82⤵PID:2280
-
\??\c:\pppjd.exec:\pppjd.exe83⤵PID:2844
-
\??\c:\jddvp.exec:\jddvp.exe84⤵PID:1964
-
\??\c:\7xfxrrr.exec:\7xfxrrr.exe85⤵PID:1204
-
\??\c:\9tnnhb.exec:\9tnnhb.exe86⤵PID:2768
-
\??\c:\thbtnn.exec:\thbtnn.exe87⤵PID:4072
-
\??\c:\vjpjd.exec:\vjpjd.exe88⤵PID:2396
-
\??\c:\jdjvp.exec:\jdjvp.exe89⤵PID:2592
-
\??\c:\9rxrffl.exec:\9rxrffl.exe90⤵PID:3448
-
\??\c:\lffxxxr.exec:\lffxxxr.exe91⤵PID:3508
-
\??\c:\thbbtn.exec:\thbbtn.exe92⤵PID:1796
-
\??\c:\jvvvp.exec:\jvvvp.exe93⤵PID:1352
-
\??\c:\vddpv.exec:\vddpv.exe94⤵PID:2896
-
\??\c:\fxxfrrx.exec:\fxxfrrx.exe95⤵PID:4460
-
\??\c:\bhhbhn.exec:\bhhbhn.exe96⤵PID:2540
-
\??\c:\vvpjj.exec:\vvpjj.exe97⤵PID:2040
-
\??\c:\dpjdv.exec:\dpjdv.exe98⤵PID:2788
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe99⤵PID:4768
-
\??\c:\thhbnt.exec:\thhbnt.exe100⤵PID:2572
-
\??\c:\bthbnh.exec:\bthbnh.exe101⤵PID:820
-
\??\c:\vjjdv.exec:\vjjdv.exe102⤵PID:1120
-
\??\c:\rllrlfr.exec:\rllrlfr.exe103⤵PID:4380
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe104⤵PID:2932
-
\??\c:\7nnhbb.exec:\7nnhbb.exe105⤵PID:5072
-
\??\c:\bttntn.exec:\bttntn.exe106⤵PID:5096
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:4220
-
\??\c:\7xfxxxf.exec:\7xfxxxf.exe108⤵PID:5044
-
\??\c:\lffxlff.exec:\lffxlff.exe109⤵PID:2088
-
\??\c:\nnhhbb.exec:\nnhhbb.exe110⤵PID:4756
-
\??\c:\ntbthh.exec:\ntbthh.exe111⤵PID:3540
-
\??\c:\vpddj.exec:\vpddj.exe112⤵PID:3640
-
\??\c:\9ppjd.exec:\9ppjd.exe113⤵PID:4456
-
\??\c:\lxrxrrr.exec:\lxrxrrr.exe114⤵PID:1736
-
\??\c:\bhhbtn.exec:\bhhbtn.exe115⤵
- System Location Discovery: System Language Discovery
PID:3012 -
\??\c:\hhnnbh.exec:\hhnnbh.exe116⤵PID:1916
-
\??\c:\vppjd.exec:\vppjd.exe117⤵PID:1316
-
\??\c:\pjpjd.exec:\pjpjd.exe118⤵PID:4688
-
\??\c:\flfxrll.exec:\flfxrll.exe119⤵PID:1920
-
\??\c:\nhnhnh.exec:\nhnhnh.exe120⤵PID:3612
-
\??\c:\bbhbhh.exec:\bbhbhh.exe121⤵PID:3300
-
\??\c:\vjjvj.exec:\vjjvj.exe122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-