Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe
Resource
win7-20240708-en
General
-
Target
cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe
-
Size
107KB
-
MD5
38ba27bd886286588fb072673d34f0cb
-
SHA1
836ca398172fd7c8f1f3669a83f905db374c6729
-
SHA256
cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581
-
SHA512
db4cb2783db74e218247d13ad47dcb8769457e19d5b03daade4ae48d43e505acdedfa7453cff53c97965b8ff82ad560eb000a876b50839634db9c66a77098490
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNXZmJ:ymb3NkkiQ3mdBjFo5KDe88g1fDg
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3624-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/564-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1256 1hbnht.exe 1432 pvjjd.exe 2416 pddpj.exe 3688 xrxlfxr.exe 1420 bbbthh.exe 564 7pvpd.exe 5080 rxrxlrf.exe 4408 9nnhnh.exe 3640 vjdvp.exe 4632 bntntt.exe 5108 ppvjd.exe 2640 rlfrfxr.exe 2188 tthtnn.exe 2840 1ddvp.exe 4560 xllfxrl.exe 1852 ffxlffx.exe 3752 bbthbb.exe 2276 vjpdp.exe 2312 jdpdv.exe 5000 rfflffx.exe 4856 bhhbtn.exe 4960 jpdpj.exe 4776 lxxrlfl.exe 1136 lrrfllf.exe 5024 nbtnnt.exe 428 hhhnhh.exe 1524 9ddvp.exe 8 lrlllll.exe 3040 bhtnnt.exe 1700 dddvj.exe 1472 rlfxrll.exe 2088 5dpvj.exe 3248 1rxlfxr.exe 4964 xffxrlf.exe 936 rlrlffx.exe 4480 9flfrrl.exe 3500 9jddd.exe 1596 xlxrlll.exe 1196 rllrlxr.exe 1320 tbbbhb.exe 1432 htnhbt.exe 892 jdjvp.exe 3032 9jpjp.exe 3688 lfxrlfx.exe 3432 xxfxxfr.exe 1816 hbbbth.exe 4596 3ddvj.exe 5072 pvpvj.exe 4992 9rlfxrl.exe 1384 fffrlfx.exe 4016 tnhbtt.exe 4660 bnhtht.exe 3924 vpjjd.exe 2596 7pjdp.exe 3116 rfffrrr.exe 4800 hbthnh.exe 1920 vppjp.exe 1204 pdpdp.exe 3380 5llfrrl.exe 4916 lfxxlrl.exe 2100 hbnhbt.exe 4928 nhhhbb.exe 2156 pjpdv.exe 1884 frrlfxr.exe -
resource yara_rule behavioral2/memory/3624-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3624 wrote to memory of 1256 3624 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 81 PID 3624 wrote to memory of 1256 3624 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 81 PID 3624 wrote to memory of 1256 3624 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 81 PID 1256 wrote to memory of 1432 1256 1hbnht.exe 82 PID 1256 wrote to memory of 1432 1256 1hbnht.exe 82 PID 1256 wrote to memory of 1432 1256 1hbnht.exe 82 PID 1432 wrote to memory of 2416 1432 pvjjd.exe 84 PID 1432 wrote to memory of 2416 1432 pvjjd.exe 84 PID 1432 wrote to memory of 2416 1432 pvjjd.exe 84 PID 2416 wrote to memory of 3688 2416 pddpj.exe 85 PID 2416 wrote to memory of 3688 2416 pddpj.exe 85 PID 2416 wrote to memory of 3688 2416 pddpj.exe 85 PID 3688 wrote to memory of 1420 3688 xrxlfxr.exe 86 PID 3688 wrote to memory of 1420 3688 xrxlfxr.exe 86 PID 3688 wrote to memory of 1420 3688 xrxlfxr.exe 86 PID 1420 wrote to memory of 564 1420 bbbthh.exe 87 PID 1420 wrote to memory of 564 1420 bbbthh.exe 87 PID 1420 wrote to memory of 564 1420 bbbthh.exe 87 PID 564 wrote to memory of 5080 564 7pvpd.exe 89 PID 564 wrote to memory of 5080 564 7pvpd.exe 89 PID 564 wrote to memory of 5080 564 7pvpd.exe 89 PID 5080 wrote to memory of 4408 5080 rxrxlrf.exe 90 PID 5080 wrote to memory of 4408 5080 rxrxlrf.exe 90 PID 5080 wrote to memory of 4408 5080 rxrxlrf.exe 90 PID 4408 wrote to memory of 3640 4408 9nnhnh.exe 91 PID 4408 wrote to memory of 3640 4408 9nnhnh.exe 91 PID 4408 wrote to memory of 3640 4408 9nnhnh.exe 91 PID 3640 wrote to memory of 4632 3640 vjdvp.exe 92 PID 3640 wrote to memory of 4632 3640 vjdvp.exe 92 PID 3640 wrote to memory of 4632 3640 vjdvp.exe 92 PID 4632 wrote to memory of 5108 4632 bntntt.exe 94 PID 4632 wrote to memory of 5108 4632 bntntt.exe 94 PID 4632 wrote to memory of 5108 4632 bntntt.exe 94 PID 5108 wrote to memory of 2640 5108 ppvjd.exe 95 PID 5108 wrote to memory of 2640 5108 ppvjd.exe 95 PID 5108 wrote to memory of 2640 5108 ppvjd.exe 95 PID 2640 wrote to memory of 2188 2640 rlfrfxr.exe 96 PID 2640 wrote to memory of 2188 2640 rlfrfxr.exe 96 PID 2640 wrote to memory of 2188 2640 rlfrfxr.exe 96 PID 2188 wrote to memory of 2840 2188 tthtnn.exe 97 PID 2188 wrote to memory of 2840 2188 tthtnn.exe 97 PID 2188 wrote to memory of 2840 2188 tthtnn.exe 97 PID 2840 wrote to memory of 4560 2840 1ddvp.exe 98 PID 2840 wrote to memory of 4560 2840 1ddvp.exe 98 PID 2840 wrote to memory of 4560 2840 1ddvp.exe 98 PID 4560 wrote to memory of 1852 4560 xllfxrl.exe 99 PID 4560 wrote to memory of 1852 4560 xllfxrl.exe 99 PID 4560 wrote to memory of 1852 4560 xllfxrl.exe 99 PID 1852 wrote to memory of 3752 1852 ffxlffx.exe 100 PID 1852 wrote to memory of 3752 1852 ffxlffx.exe 100 PID 1852 wrote to memory of 3752 1852 ffxlffx.exe 100 PID 3752 wrote to memory of 2276 3752 bbthbb.exe 101 PID 3752 wrote to memory of 2276 3752 bbthbb.exe 101 PID 3752 wrote to memory of 2276 3752 bbthbb.exe 101 PID 2276 wrote to memory of 2312 2276 vjpdp.exe 102 PID 2276 wrote to memory of 2312 2276 vjpdp.exe 102 PID 2276 wrote to memory of 2312 2276 vjpdp.exe 102 PID 2312 wrote to memory of 5000 2312 jdpdv.exe 103 PID 2312 wrote to memory of 5000 2312 jdpdv.exe 103 PID 2312 wrote to memory of 5000 2312 jdpdv.exe 103 PID 5000 wrote to memory of 4856 5000 rfflffx.exe 104 PID 5000 wrote to memory of 4856 5000 rfflffx.exe 104 PID 5000 wrote to memory of 4856 5000 rfflffx.exe 104 PID 4856 wrote to memory of 4960 4856 bhhbtn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe"C:\Users\Admin\AppData\Local\Temp\cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\1hbnht.exec:\1hbnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pvjjd.exec:\pvjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\pddpj.exec:\pddpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\bbbthh.exec:\bbbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\7pvpd.exec:\7pvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\9nnhnh.exec:\9nnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\vjdvp.exec:\vjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\bntntt.exec:\bntntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\ppvjd.exec:\ppvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tthtnn.exec:\tthtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1ddvp.exec:\1ddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xllfxrl.exec:\xllfxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\ffxlffx.exec:\ffxlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\bbthbb.exec:\bbthbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\vjpdp.exec:\vjpdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jdpdv.exec:\jdpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\rfflffx.exec:\rfflffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\bhhbtn.exec:\bhhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\jpdpj.exec:\jpdpj.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lxxrlfl.exec:\lxxrlfl.exe24⤵
- Executes dropped EXE
PID:4776 -
\??\c:\lrrfllf.exec:\lrrfllf.exe25⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nbtnnt.exec:\nbtnnt.exe26⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hhhnhh.exec:\hhhnhh.exe27⤵
- Executes dropped EXE
PID:428 -
\??\c:\9ddvp.exec:\9ddvp.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lrlllll.exec:\lrlllll.exe29⤵
- Executes dropped EXE
PID:8 -
\??\c:\bhtnnt.exec:\bhtnnt.exe30⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dddvj.exec:\dddvj.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rlfxrll.exec:\rlfxrll.exe32⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5dpvj.exec:\5dpvj.exe33⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1rxlfxr.exec:\1rxlfxr.exe34⤵
- Executes dropped EXE
PID:3248 -
\??\c:\xffxrlf.exec:\xffxrlf.exe35⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rlrlffx.exec:\rlrlffx.exe36⤵
- Executes dropped EXE
PID:936 -
\??\c:\9flfrrl.exec:\9flfrrl.exe37⤵
- Executes dropped EXE
PID:4480 -
\??\c:\9jddd.exec:\9jddd.exe38⤵
- Executes dropped EXE
PID:3500 -
\??\c:\xlxrlll.exec:\xlxrlll.exe39⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rllrlxr.exec:\rllrlxr.exe40⤵
- Executes dropped EXE
PID:1196 -
\??\c:\tbbbhb.exec:\tbbbhb.exe41⤵
- Executes dropped EXE
PID:1320 -
\??\c:\htnhbt.exec:\htnhbt.exe42⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jdjvp.exec:\jdjvp.exe43⤵
- Executes dropped EXE
PID:892 -
\??\c:\9jpjp.exec:\9jpjp.exe44⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe45⤵
- Executes dropped EXE
PID:3688 -
\??\c:\xxfxxfr.exec:\xxfxxfr.exe46⤵
- Executes dropped EXE
PID:3432 -
\??\c:\hbbbth.exec:\hbbbth.exe47⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3ddvj.exec:\3ddvj.exe48⤵
- Executes dropped EXE
PID:4596 -
\??\c:\pvpvj.exec:\pvpvj.exe49⤵
- Executes dropped EXE
PID:5072 -
\??\c:\9rlfxrl.exec:\9rlfxrl.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\fffrlfx.exec:\fffrlfx.exe51⤵
- Executes dropped EXE
PID:1384 -
\??\c:\tnhbtt.exec:\tnhbtt.exe52⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bnhtht.exec:\bnhtht.exe53⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vpjjd.exec:\vpjjd.exe54⤵
- Executes dropped EXE
PID:3924 -
\??\c:\7pjdp.exec:\7pjdp.exe55⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rfffrrr.exec:\rfffrrr.exe56⤵
- Executes dropped EXE
PID:3116 -
\??\c:\hbthnh.exec:\hbthnh.exe57⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vppjp.exec:\vppjp.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\pdpdp.exec:\pdpdp.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\5llfrrl.exec:\5llfrrl.exe60⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lfxxlrl.exec:\lfxxlrl.exe61⤵
- Executes dropped EXE
PID:4916 -
\??\c:\hbnhbt.exec:\hbnhbt.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nhhhbb.exec:\nhhhbb.exe63⤵
- Executes dropped EXE
PID:4928 -
\??\c:\pjpdv.exec:\pjpdv.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\frrlfxr.exec:\frrlfxr.exe65⤵
- Executes dropped EXE
PID:1884 -
\??\c:\lrlxrlx.exec:\lrlxrlx.exe66⤵PID:5040
-
\??\c:\xlflxlx.exec:\xlflxlx.exe67⤵PID:4280
-
\??\c:\5hbthb.exec:\5hbthb.exe68⤵
- System Location Discovery: System Language Discovery
PID:4444 -
\??\c:\nhtnhh.exec:\nhtnhh.exe69⤵PID:940
-
\??\c:\pdpdv.exec:\pdpdv.exe70⤵PID:1304
-
\??\c:\rfxrllf.exec:\rfxrllf.exe71⤵PID:1292
-
\??\c:\fllxrff.exec:\fllxrff.exe72⤵PID:5016
-
\??\c:\nttttn.exec:\nttttn.exe73⤵PID:2160
-
\??\c:\pjdpj.exec:\pjdpj.exe74⤵PID:1916
-
\??\c:\pjvpd.exec:\pjvpd.exe75⤵PID:2592
-
\??\c:\xxrlrll.exec:\xxrlrll.exe76⤵PID:3504
-
\??\c:\hnhhtt.exec:\hnhhtt.exe77⤵PID:1524
-
\??\c:\nbbnbt.exec:\nbbnbt.exe78⤵PID:180
-
\??\c:\9bbthb.exec:\9bbthb.exe79⤵PID:1364
-
\??\c:\vddvj.exec:\vddvj.exe80⤵PID:232
-
\??\c:\xflfrlf.exec:\xflfrlf.exe81⤵PID:4860
-
\??\c:\1xxlxrl.exec:\1xxlxrl.exe82⤵PID:1976
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe83⤵PID:4680
-
\??\c:\nnnhbb.exec:\nnnhbb.exe84⤵PID:1968
-
\??\c:\pvdvj.exec:\pvdvj.exe85⤵PID:4756
-
\??\c:\pvvpd.exec:\pvvpd.exe86⤵PID:4492
-
\??\c:\lxxlfxf.exec:\lxxlfxf.exe87⤵PID:1348
-
\??\c:\1lllfxr.exec:\1lllfxr.exe88⤵PID:2560
-
\??\c:\nttbnb.exec:\nttbnb.exe89⤵PID:3056
-
\??\c:\7dvvj.exec:\7dvvj.exe90⤵PID:1596
-
\??\c:\5dpjp.exec:\5dpjp.exe91⤵PID:4432
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe92⤵PID:4276
-
\??\c:\9tnnhh.exec:\9tnnhh.exe93⤵PID:1432
-
\??\c:\3bbhnb.exec:\3bbhnb.exe94⤵PID:892
-
\??\c:\ppdvp.exec:\ppdvp.exe95⤵PID:1740
-
\??\c:\rrxfxxr.exec:\rrxfxxr.exe96⤵PID:3688
-
\??\c:\xxlllff.exec:\xxlllff.exe97⤵PID:2116
-
\??\c:\1lfflfx.exec:\1lfflfx.exe98⤵PID:564
-
\??\c:\nbhthb.exec:\nbhthb.exe99⤵PID:2920
-
\??\c:\7ttnnh.exec:\7ttnnh.exe100⤵PID:1244
-
\??\c:\pjdvj.exec:\pjdvj.exe101⤵PID:2328
-
\??\c:\9fxrffx.exec:\9fxrffx.exe102⤵PID:2764
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe103⤵PID:3212
-
\??\c:\fllfxxf.exec:\fllfxxf.exe104⤵PID:2484
-
\??\c:\hhthbb.exec:\hhthbb.exe105⤵PID:768
-
\??\c:\pvdvj.exec:\pvdvj.exe106⤵PID:4656
-
\??\c:\5pjdv.exec:\5pjdv.exe107⤵PID:4196
-
\??\c:\7fffrrl.exec:\7fffrrl.exe108⤵PID:5096
-
\??\c:\hhhtnn.exec:\hhhtnn.exe109⤵PID:996
-
\??\c:\ddjdv.exec:\ddjdv.exe110⤵PID:3092
-
\??\c:\dvpdp.exec:\dvpdp.exe111⤵PID:4580
-
\??\c:\3jddp.exec:\3jddp.exe112⤵PID:2516
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe113⤵PID:3864
-
\??\c:\1bbtnn.exec:\1bbtnn.exe114⤵PID:4172
-
\??\c:\bnbhhn.exec:\bnbhhn.exe115⤵PID:4212
-
\??\c:\ppjdv.exec:\ppjdv.exe116⤵PID:2480
-
\??\c:\ppjvp.exec:\ppjvp.exe117⤵PID:4452
-
\??\c:\pjvvj.exec:\pjvvj.exe118⤵PID:2772
-
\??\c:\1lrflfl.exec:\1lrflfl.exe119⤵PID:2256
-
\??\c:\lffxrrx.exec:\lffxrrx.exe120⤵PID:1848
-
\??\c:\xlxrrlf.exec:\xlxrrlf.exe121⤵PID:2644
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-