Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe
Resource
win7-20240705-en
General
-
Target
67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe
-
Size
65KB
-
MD5
cfdd109062c1d059ce3905f8c669a45a
-
SHA1
d5596b1195489352c5fcb4a61ece3cd09ca14b8c
-
SHA256
67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144
-
SHA512
8d38f543294c69f45dacf5b9cd8a4e6e60dc562fffdbba62195231cc32523eb33b8c474f5cd864678b8d5e37dd317883c61955866c083755c80d0d00760bca46
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh1214aE:ymb3NkkiQ3mdBjFIFdJmdaE
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4124-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/592-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2944 dpjdv.exe 1492 fxfrlrl.exe 3596 hbhbtt.exe 1684 nbntht.exe 4312 1ppjd.exe 3460 frrrlll.exe 2532 nbhbbn.exe 2168 djppd.exe 2072 5xxxrrf.exe 4608 thtttt.exe 592 jdvpj.exe 3544 jdddv.exe 976 xrxfxfx.exe 4668 rxxfxxr.exe 468 tnhbtn.exe 3224 5jjdp.exe 2556 xrrlxll.exe 448 xflfxxx.exe 4128 7vvpj.exe 5080 xxlrrxr.exe 1864 frrlffx.exe 3292 bnhbtt.exe 3112 7ntnhh.exe 1012 1ddvp.exe 2280 lrxrfxx.exe 2444 xfxrfxr.exe 3928 tntttt.exe 4708 ppjdv.exe 4368 jvdvp.exe 3696 rllrfxr.exe 4532 lfxlxrl.exe 3212 hbtbnh.exe 932 dvdpv.exe 4080 fxxlxxf.exe 4672 thbtnh.exe 4284 jjjjv.exe 3208 fxxrllf.exe 4804 lxrrlxx.exe 3692 nhbthh.exe 2116 dpvpp.exe 440 jvpjd.exe 3752 fxfxrll.exe 208 httnnh.exe 1248 nhbhtn.exe 1556 dpvvj.exe 1332 1djdp.exe 1548 llrrrxf.exe 4048 xfffxxr.exe 4060 nbtttt.exe 3796 9pjpj.exe 4224 vppjj.exe 2732 xfxxrll.exe 2844 lrrlffx.exe 2504 bhnhbb.exe 4420 nhhbtt.exe 1900 9ddpj.exe 3592 dppjd.exe 4796 fxlxxxx.exe 5108 nbhhbt.exe 2292 bhhtnb.exe 3616 pdpjv.exe 5060 fxfxxrf.exe 864 xllfxxr.exe 4004 nnnnnt.exe -
resource yara_rule behavioral2/memory/4124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/592-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 2944 4124 67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe 84 PID 4124 wrote to memory of 2944 4124 67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe 84 PID 4124 wrote to memory of 2944 4124 67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe 84 PID 2944 wrote to memory of 1492 2944 dpjdv.exe 85 PID 2944 wrote to memory of 1492 2944 dpjdv.exe 85 PID 2944 wrote to memory of 1492 2944 dpjdv.exe 85 PID 1492 wrote to memory of 3596 1492 fxfrlrl.exe 86 PID 1492 wrote to memory of 3596 1492 fxfrlrl.exe 86 PID 1492 wrote to memory of 3596 1492 fxfrlrl.exe 86 PID 3596 wrote to memory of 1684 3596 hbhbtt.exe 87 PID 3596 wrote to memory of 1684 3596 hbhbtt.exe 87 PID 3596 wrote to memory of 1684 3596 hbhbtt.exe 87 PID 1684 wrote to memory of 4312 1684 nbntht.exe 89 PID 1684 wrote to memory of 4312 1684 nbntht.exe 89 PID 1684 wrote to memory of 4312 1684 nbntht.exe 89 PID 4312 wrote to memory of 3460 4312 1ppjd.exe 90 PID 4312 wrote to memory of 3460 4312 1ppjd.exe 90 PID 4312 wrote to memory of 3460 4312 1ppjd.exe 90 PID 3460 wrote to memory of 2532 3460 frrrlll.exe 91 PID 3460 wrote to memory of 2532 3460 frrrlll.exe 91 PID 3460 wrote to memory of 2532 3460 frrrlll.exe 91 PID 2532 wrote to memory of 2168 2532 nbhbbn.exe 92 PID 2532 wrote to memory of 2168 2532 nbhbbn.exe 92 PID 2532 wrote to memory of 2168 2532 nbhbbn.exe 92 PID 2168 wrote to memory of 2072 2168 djppd.exe 93 PID 2168 wrote to memory of 2072 2168 djppd.exe 93 PID 2168 wrote to memory of 2072 2168 djppd.exe 93 PID 2072 wrote to memory of 4608 2072 5xxxrrf.exe 94 PID 2072 wrote to memory of 4608 2072 5xxxrrf.exe 94 PID 2072 wrote to memory of 4608 2072 5xxxrrf.exe 94 PID 4608 wrote to memory of 592 4608 thtttt.exe 95 PID 4608 wrote to memory of 592 4608 thtttt.exe 95 PID 4608 wrote to memory of 592 4608 thtttt.exe 95 PID 592 wrote to memory of 3544 592 jdvpj.exe 96 PID 592 wrote to memory of 3544 592 jdvpj.exe 96 PID 592 wrote to memory of 3544 592 jdvpj.exe 96 PID 3544 wrote to memory of 976 3544 jdddv.exe 97 PID 3544 wrote to memory of 976 3544 jdddv.exe 97 PID 3544 wrote to memory of 976 3544 jdddv.exe 97 PID 976 wrote to memory of 4668 976 xrxfxfx.exe 99 PID 976 wrote to memory of 4668 976 xrxfxfx.exe 99 PID 976 wrote to memory of 4668 976 xrxfxfx.exe 99 PID 4668 wrote to memory of 468 4668 rxxfxxr.exe 100 PID 4668 wrote to memory of 468 4668 rxxfxxr.exe 100 PID 4668 wrote to memory of 468 4668 rxxfxxr.exe 100 PID 468 wrote to memory of 3224 468 tnhbtn.exe 101 PID 468 wrote to memory of 3224 468 tnhbtn.exe 101 PID 468 wrote to memory of 3224 468 tnhbtn.exe 101 PID 3224 wrote to memory of 2556 3224 5jjdp.exe 102 PID 3224 wrote to memory of 2556 3224 5jjdp.exe 102 PID 3224 wrote to memory of 2556 3224 5jjdp.exe 102 PID 2556 wrote to memory of 448 2556 xrrlxll.exe 103 PID 2556 wrote to memory of 448 2556 xrrlxll.exe 103 PID 2556 wrote to memory of 448 2556 xrrlxll.exe 103 PID 448 wrote to memory of 4128 448 xflfxxx.exe 104 PID 448 wrote to memory of 4128 448 xflfxxx.exe 104 PID 448 wrote to memory of 4128 448 xflfxxx.exe 104 PID 4128 wrote to memory of 5080 4128 7vvpj.exe 106 PID 4128 wrote to memory of 5080 4128 7vvpj.exe 106 PID 4128 wrote to memory of 5080 4128 7vvpj.exe 106 PID 5080 wrote to memory of 1864 5080 xxlrrxr.exe 107 PID 5080 wrote to memory of 1864 5080 xxlrrxr.exe 107 PID 5080 wrote to memory of 1864 5080 xxlrrxr.exe 107 PID 1864 wrote to memory of 3292 1864 frrlffx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe"C:\Users\Admin\AppData\Local\Temp\67aff6b67f57ab26134561d93e479bcc17e18834165f337fe6ceca67c0363144.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\dpjdv.exec:\dpjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\hbhbtt.exec:\hbhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\nbntht.exec:\nbntht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\1ppjd.exec:\1ppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\frrrlll.exec:\frrrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\nbhbbn.exec:\nbhbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\djppd.exec:\djppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\5xxxrrf.exec:\5xxxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\thtttt.exec:\thtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\jdvpj.exec:\jdvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\jdddv.exec:\jdddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\xrxfxfx.exec:\xrxfxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\rxxfxxr.exec:\rxxfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\tnhbtn.exec:\tnhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\5jjdp.exec:\5jjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\xrrlxll.exec:\xrrlxll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xflfxxx.exec:\xflfxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\7vvpj.exec:\7vvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\xxlrrxr.exec:\xxlrrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\frrlffx.exec:\frrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\bnhbtt.exec:\bnhbtt.exe23⤵
- Executes dropped EXE
PID:3292 -
\??\c:\7ntnhh.exec:\7ntnhh.exe24⤵
- Executes dropped EXE
PID:3112 -
\??\c:\1ddvp.exec:\1ddvp.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lrxrfxx.exec:\lrxrfxx.exe26⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tntttt.exec:\tntttt.exe28⤵
- Executes dropped EXE
PID:3928 -
\??\c:\ppjdv.exec:\ppjdv.exe29⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jvdvp.exec:\jvdvp.exe30⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rllrfxr.exec:\rllrfxr.exe31⤵
- Executes dropped EXE
PID:3696 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe32⤵
- Executes dropped EXE
PID:4532 -
\??\c:\hbtbnh.exec:\hbtbnh.exe33⤵
- Executes dropped EXE
PID:3212 -
\??\c:\dvdpv.exec:\dvdpv.exe34⤵
- Executes dropped EXE
PID:932 -
\??\c:\fxxlxxf.exec:\fxxlxxf.exe35⤵
- Executes dropped EXE
PID:4080 -
\??\c:\thbtnh.exec:\thbtnh.exe36⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jjjjv.exec:\jjjjv.exe37⤵
- Executes dropped EXE
PID:4284 -
\??\c:\fxxrllf.exec:\fxxrllf.exe38⤵
- Executes dropped EXE
PID:3208 -
\??\c:\lxrrlxx.exec:\lxrrlxx.exe39⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nhbthh.exec:\nhbthh.exe40⤵
- Executes dropped EXE
PID:3692 -
\??\c:\dpvpp.exec:\dpvpp.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jvpjd.exec:\jvpjd.exe42⤵
- Executes dropped EXE
PID:440 -
\??\c:\fxfxrll.exec:\fxfxrll.exe43⤵
- Executes dropped EXE
PID:3752 -
\??\c:\httnnh.exec:\httnnh.exe44⤵
- Executes dropped EXE
PID:208 -
\??\c:\nhbhtn.exec:\nhbhtn.exe45⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dpvvj.exec:\dpvvj.exe46⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1djdp.exec:\1djdp.exe47⤵
- Executes dropped EXE
PID:1332 -
\??\c:\llrrrxf.exec:\llrrrxf.exe48⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xfffxxr.exec:\xfffxxr.exe49⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nbtttt.exec:\nbtttt.exe50⤵
- Executes dropped EXE
PID:4060 -
\??\c:\9pjpj.exec:\9pjpj.exe51⤵
- Executes dropped EXE
PID:3796 -
\??\c:\vppjj.exec:\vppjj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4224 -
\??\c:\xfxxrll.exec:\xfxxrll.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lrrlffx.exec:\lrrlffx.exe54⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bhnhbb.exec:\bhnhbb.exe55⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nhhbtt.exec:\nhhbtt.exe56⤵
- Executes dropped EXE
PID:4420 -
\??\c:\9ddpj.exec:\9ddpj.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dppjd.exec:\dppjd.exe58⤵
- Executes dropped EXE
PID:3592 -
\??\c:\fxlxxxx.exec:\fxlxxxx.exe59⤵
- Executes dropped EXE
PID:4796 -
\??\c:\nbhhbt.exec:\nbhhbt.exe60⤵
- Executes dropped EXE
PID:5108 -
\??\c:\bhhtnb.exec:\bhhtnb.exe61⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pdpjv.exec:\pdpjv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3616 -
\??\c:\fxfxxrf.exec:\fxfxxrf.exe63⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xllfxxr.exec:\xllfxxr.exe64⤵
- Executes dropped EXE
PID:864 -
\??\c:\nnnnnt.exec:\nnnnnt.exe65⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vdjdj.exec:\vdjdj.exe66⤵PID:2520
-
\??\c:\3dddv.exec:\3dddv.exe67⤵PID:1252
-
\??\c:\1fxfrrr.exec:\1fxfrrr.exe68⤵PID:1756
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe69⤵PID:3112
-
\??\c:\btnnbb.exec:\btnnbb.exe70⤵PID:4456
-
\??\c:\vpjdd.exec:\vpjdd.exe71⤵PID:2280
-
\??\c:\dvvjp.exec:\dvvjp.exe72⤵PID:4536
-
\??\c:\rfflrrl.exec:\rfflrrl.exe73⤵PID:3664
-
\??\c:\thhbtt.exec:\thhbtt.exe74⤵PID:1728
-
\??\c:\1jddv.exec:\1jddv.exe75⤵PID:4708
-
\??\c:\1jjdv.exec:\1jjdv.exe76⤵PID:316
-
\??\c:\lxllxrl.exec:\lxllxrl.exe77⤵PID:3696
-
\??\c:\7fxrxxf.exec:\7fxrxxf.exe78⤵PID:1376
-
\??\c:\tbhbbt.exec:\tbhbbt.exe79⤵PID:4448
-
\??\c:\vpppd.exec:\vpppd.exe80⤵PID:3476
-
\??\c:\3vdvj.exec:\3vdvj.exe81⤵PID:4352
-
\??\c:\rrfrlfl.exec:\rrfrlfl.exe82⤵PID:2080
-
\??\c:\tnnhbb.exec:\tnnhbb.exe83⤵PID:5020
-
\??\c:\ttbbtt.exec:\ttbbtt.exe84⤵PID:3100
-
\??\c:\vpdpd.exec:\vpdpd.exe85⤵PID:4200
-
\??\c:\jjvpj.exec:\jjvpj.exe86⤵PID:3672
-
\??\c:\rfxfrfx.exec:\rfxfrfx.exe87⤵PID:3056
-
\??\c:\thhtbb.exec:\thhtbb.exe88⤵PID:3700
-
\??\c:\httbhn.exec:\httbhn.exe89⤵PID:4312
-
\??\c:\pjdvp.exec:\pjdvp.exe90⤵PID:1248
-
\??\c:\jdpjd.exec:\jdpjd.exe91⤵PID:1556
-
\??\c:\xffxxxx.exec:\xffxxxx.exe92⤵PID:1332
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe93⤵PID:1548
-
\??\c:\7nhbth.exec:\7nhbth.exe94⤵PID:3232
-
\??\c:\vdjdv.exec:\vdjdv.exe95⤵PID:1512
-
\??\c:\5vvpj.exec:\5vvpj.exe96⤵PID:1568
-
\??\c:\rrrlrll.exec:\rrrlrll.exe97⤵PID:4940
-
\??\c:\xrffffl.exec:\xrffffl.exe98⤵PID:3556
-
\??\c:\tnhbbb.exec:\tnhbbb.exe99⤵PID:3264
-
\??\c:\tntthh.exec:\tntthh.exe100⤵PID:468
-
\??\c:\vpvpd.exec:\vpvpd.exe101⤵PID:2656
-
\??\c:\vjpdv.exec:\vjpdv.exe102⤵PID:2480
-
\??\c:\fxxrllf.exec:\fxxrllf.exe103⤵PID:3592
-
\??\c:\rrrrxlx.exec:\rrrrxlx.exe104⤵PID:1468
-
\??\c:\nnnhhh.exec:\nnnhhh.exe105⤵PID:5108
-
\??\c:\dvpjv.exec:\dvpjv.exe106⤵PID:3680
-
\??\c:\jdvvv.exec:\jdvvv.exe107⤵PID:376
-
\??\c:\llfxffx.exec:\llfxffx.exe108⤵PID:3104
-
\??\c:\tnttnt.exec:\tnttnt.exe109⤵PID:5080
-
\??\c:\pdjdp.exec:\pdjdp.exe110⤵PID:4044
-
\??\c:\pdvvj.exec:\pdvvj.exe111⤵PID:1356
-
\??\c:\fflfxxr.exec:\fflfxxr.exe112⤵PID:1252
-
\??\c:\hhhbht.exec:\hhhbht.exe113⤵PID:3424
-
\??\c:\tnnhhh.exec:\tnnhhh.exe114⤵PID:3112
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:2260
-
\??\c:\9jjjp.exec:\9jjjp.exe116⤵PID:2460
-
\??\c:\rlxxffl.exec:\rlxxffl.exe117⤵PID:3308
-
\??\c:\ffllffr.exec:\ffllffr.exe118⤵PID:1620
-
\??\c:\thbbtt.exec:\thbbtt.exe119⤵PID:4912
-
\??\c:\bhbthh.exec:\bhbthh.exe120⤵PID:428
-
\??\c:\vjjdv.exec:\vjjdv.exe121⤵PID:2748
-
\??\c:\pvvvp.exec:\pvvvp.exe122⤵PID:1892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-