Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9478348dce232b0241b58c4950b4f00N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
a9478348dce232b0241b58c4950b4f00N.exe
-
Size
235KB
-
MD5
a9478348dce232b0241b58c4950b4f00
-
SHA1
86fdc37b9cb82c063c95cb617e118d6b4d311c36
-
SHA256
be47ab4df2488b814a89cbc04dd02fd32820831a3895f2fdd05ce8020d345c73
-
SHA512
a197da7904169439b8ea9d85f23417b61460cf29c8f9d9083386c2a264402c0820ed40caca3e26412d721b3dbe45a3003cc9844f9f260b5f96951c49903b1825
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjRVZEW:n3C9BRo7MlrWKo+lxtvGtVZEW
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral2/memory/4636-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3768 rfrfxrl.exe 2672 ththhb.exe 1872 pdpjd.exe 1260 9ppdv.exe 3460 7pvjv.exe 3476 djppp.exe 216 tntnbb.exe 552 ddjjj.exe 5016 5vvvp.exe 4332 ttbttt.exe 2540 vjvpp.exe 640 jdpjj.exe 1812 nnbthh.exe 3168 dpppj.exe 4728 7rxrffx.exe 3172 xfllllx.exe 864 hbbttt.exe 4572 vvpvj.exe 1176 xrrfxff.exe 2376 bbbtnh.exe 4860 nnnhhb.exe 2988 jddvv.exe 3004 lrxrlrl.exe 4768 hhtntb.exe 1848 dddvv.exe 1456 hhnhht.exe 436 7tnnhh.exe 3316 djvpv.exe 3368 ntnnhb.exe 1528 ppvvd.exe 1036 rlxfxfx.exe 4088 htnhhn.exe 4360 ppvvp.exe 3160 7fflffx.exe 4312 rlfxrxr.exe 2676 btnhbb.exe 3768 hhtnbb.exe 2368 vjvpj.exe 1188 3pjdd.exe 2356 rrrllll.exe 1260 nntnnn.exe 1364 bbnhhh.exe 4564 ddpjd.exe 316 ffxxxxr.exe 1912 lrxfffx.exe 1796 hbttbb.exe 1668 ntttbn.exe 2004 pjppj.exe 1544 frxxrrr.exe 212 fxlfffx.exe 1636 htbhbh.exe 2540 djvvd.exe 2920 dddvv.exe 396 llfxrrl.exe 2900 lfllrrf.exe 2088 bbbbbb.exe 2400 ddpdd.exe 608 jvvjv.exe 1632 xlxxlll.exe 3972 ntbbtt.exe 3832 tnttnt.exe 2472 pdpdd.exe 2276 djppp.exe 3240 frxflfr.exe -
resource yara_rule behavioral2/memory/4636-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 3768 4636 a9478348dce232b0241b58c4950b4f00N.exe 84 PID 4636 wrote to memory of 3768 4636 a9478348dce232b0241b58c4950b4f00N.exe 84 PID 4636 wrote to memory of 3768 4636 a9478348dce232b0241b58c4950b4f00N.exe 84 PID 3768 wrote to memory of 2672 3768 rfrfxrl.exe 85 PID 3768 wrote to memory of 2672 3768 rfrfxrl.exe 85 PID 3768 wrote to memory of 2672 3768 rfrfxrl.exe 85 PID 2672 wrote to memory of 1872 2672 ththhb.exe 86 PID 2672 wrote to memory of 1872 2672 ththhb.exe 86 PID 2672 wrote to memory of 1872 2672 ththhb.exe 86 PID 1872 wrote to memory of 1260 1872 pdpjd.exe 87 PID 1872 wrote to memory of 1260 1872 pdpjd.exe 87 PID 1872 wrote to memory of 1260 1872 pdpjd.exe 87 PID 1260 wrote to memory of 3460 1260 9ppdv.exe 88 PID 1260 wrote to memory of 3460 1260 9ppdv.exe 88 PID 1260 wrote to memory of 3460 1260 9ppdv.exe 88 PID 3460 wrote to memory of 3476 3460 7pvjv.exe 89 PID 3460 wrote to memory of 3476 3460 7pvjv.exe 89 PID 3460 wrote to memory of 3476 3460 7pvjv.exe 89 PID 3476 wrote to memory of 216 3476 djppp.exe 90 PID 3476 wrote to memory of 216 3476 djppp.exe 90 PID 3476 wrote to memory of 216 3476 djppp.exe 90 PID 216 wrote to memory of 552 216 tntnbb.exe 91 PID 216 wrote to memory of 552 216 tntnbb.exe 91 PID 216 wrote to memory of 552 216 tntnbb.exe 91 PID 552 wrote to memory of 5016 552 ddjjj.exe 92 PID 552 wrote to memory of 5016 552 ddjjj.exe 92 PID 552 wrote to memory of 5016 552 ddjjj.exe 92 PID 5016 wrote to memory of 4332 5016 5vvvp.exe 93 PID 5016 wrote to memory of 4332 5016 5vvvp.exe 93 PID 5016 wrote to memory of 4332 5016 5vvvp.exe 93 PID 4332 wrote to memory of 2540 4332 ttbttt.exe 94 PID 4332 wrote to memory of 2540 4332 ttbttt.exe 94 PID 4332 wrote to memory of 2540 4332 ttbttt.exe 94 PID 2540 wrote to memory of 640 2540 vjvpp.exe 95 PID 2540 wrote to memory of 640 2540 vjvpp.exe 95 PID 2540 wrote to memory of 640 2540 vjvpp.exe 95 PID 640 wrote to memory of 1812 640 jdpjj.exe 96 PID 640 wrote to memory of 1812 640 jdpjj.exe 96 PID 640 wrote to memory of 1812 640 jdpjj.exe 96 PID 1812 wrote to memory of 3168 1812 nnbthh.exe 97 PID 1812 wrote to memory of 3168 1812 nnbthh.exe 97 PID 1812 wrote to memory of 3168 1812 nnbthh.exe 97 PID 3168 wrote to memory of 4728 3168 dpppj.exe 99 PID 3168 wrote to memory of 4728 3168 dpppj.exe 99 PID 3168 wrote to memory of 4728 3168 dpppj.exe 99 PID 4728 wrote to memory of 3172 4728 7rxrffx.exe 100 PID 4728 wrote to memory of 3172 4728 7rxrffx.exe 100 PID 4728 wrote to memory of 3172 4728 7rxrffx.exe 100 PID 3172 wrote to memory of 864 3172 xfllllx.exe 101 PID 3172 wrote to memory of 864 3172 xfllllx.exe 101 PID 3172 wrote to memory of 864 3172 xfllllx.exe 101 PID 864 wrote to memory of 4572 864 hbbttt.exe 102 PID 864 wrote to memory of 4572 864 hbbttt.exe 102 PID 864 wrote to memory of 4572 864 hbbttt.exe 102 PID 4572 wrote to memory of 1176 4572 vvpvj.exe 103 PID 4572 wrote to memory of 1176 4572 vvpvj.exe 103 PID 4572 wrote to memory of 1176 4572 vvpvj.exe 103 PID 1176 wrote to memory of 2376 1176 xrrfxff.exe 105 PID 1176 wrote to memory of 2376 1176 xrrfxff.exe 105 PID 1176 wrote to memory of 2376 1176 xrrfxff.exe 105 PID 2376 wrote to memory of 4860 2376 bbbtnh.exe 106 PID 2376 wrote to memory of 4860 2376 bbbtnh.exe 106 PID 2376 wrote to memory of 4860 2376 bbbtnh.exe 106 PID 4860 wrote to memory of 2988 4860 nnnhhb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9478348dce232b0241b58c4950b4f00N.exe"C:\Users\Admin\AppData\Local\Temp\a9478348dce232b0241b58c4950b4f00N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\ththhb.exec:\ththhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pdpjd.exec:\pdpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\9ppdv.exec:\9ppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\7pvjv.exec:\7pvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\djppp.exec:\djppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\tntnbb.exec:\tntnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\ddjjj.exec:\ddjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\5vvvp.exec:\5vvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\ttbttt.exec:\ttbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\vjvpp.exec:\vjvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jdpjj.exec:\jdpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\nnbthh.exec:\nnbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\dpppj.exec:\dpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\7rxrffx.exec:\7rxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\xfllllx.exec:\xfllllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\hbbttt.exec:\hbbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\vvpvj.exec:\vvpvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\xrrfxff.exec:\xrrfxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\bbbtnh.exec:\bbbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\nnnhhb.exec:\nnnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\jddvv.exec:\jddvv.exe23⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrxrlrl.exec:\lrxrlrl.exe24⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hhtntb.exec:\hhtntb.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\dddvv.exec:\dddvv.exe26⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hhnhht.exec:\hhnhht.exe27⤵
- Executes dropped EXE
PID:1456 -
\??\c:\7tnnhh.exec:\7tnnhh.exe28⤵
- Executes dropped EXE
PID:436 -
\??\c:\djvpv.exec:\djvpv.exe29⤵
- Executes dropped EXE
PID:3316 -
\??\c:\ntnnhb.exec:\ntnnhb.exe30⤵
- Executes dropped EXE
PID:3368 -
\??\c:\ppvvd.exec:\ppvvd.exe31⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlxfxfx.exec:\rlxfxfx.exe32⤵
- Executes dropped EXE
PID:1036 -
\??\c:\htnhhn.exec:\htnhhn.exe33⤵
- Executes dropped EXE
PID:4088 -
\??\c:\ppvvp.exec:\ppvvp.exe34⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7fflffx.exec:\7fflffx.exe35⤵
- Executes dropped EXE
PID:3160 -
\??\c:\rlfxrxr.exec:\rlfxrxr.exe36⤵
- Executes dropped EXE
PID:4312 -
\??\c:\btnhbb.exec:\btnhbb.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hhtnbb.exec:\hhtnbb.exe38⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vjvpj.exec:\vjvpj.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3pjdd.exec:\3pjdd.exe40⤵
- Executes dropped EXE
PID:1188 -
\??\c:\rrrllll.exec:\rrrllll.exe41⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nntnnn.exec:\nntnnn.exe42⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bbnhhh.exec:\bbnhhh.exe43⤵
- Executes dropped EXE
PID:1364 -
\??\c:\ddpjd.exec:\ddpjd.exe44⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe45⤵
- Executes dropped EXE
PID:316 -
\??\c:\lrxfffx.exec:\lrxfffx.exe46⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hbttbb.exec:\hbttbb.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ntttbn.exec:\ntttbn.exe48⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pjppj.exec:\pjppj.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frxxrrr.exec:\frxxrrr.exe50⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fxlfffx.exec:\fxlfffx.exe51⤵
- Executes dropped EXE
PID:212 -
\??\c:\htbhbh.exec:\htbhbh.exe52⤵
- Executes dropped EXE
PID:1636 -
\??\c:\djvvd.exec:\djvvd.exe53⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dddvv.exec:\dddvv.exe54⤵
- Executes dropped EXE
PID:2920 -
\??\c:\llfxrrl.exec:\llfxrrl.exe55⤵
- Executes dropped EXE
PID:396 -
\??\c:\lfllrrf.exec:\lfllrrf.exe56⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bbbbbb.exec:\bbbbbb.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ddpdd.exec:\ddpdd.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jvvjv.exec:\jvvjv.exe59⤵
- Executes dropped EXE
PID:608 -
\??\c:\xlxxlll.exec:\xlxxlll.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ntbbtt.exec:\ntbbtt.exe61⤵
- Executes dropped EXE
PID:3972 -
\??\c:\tnttnt.exec:\tnttnt.exe62⤵
- Executes dropped EXE
PID:3832 -
\??\c:\pdpdd.exec:\pdpdd.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djppp.exec:\djppp.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\frxflfr.exec:\frxflfr.exe65⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe66⤵PID:3984
-
\??\c:\ttbttt.exec:\ttbttt.exe67⤵PID:3332
-
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:2988
-
\??\c:\djppv.exec:\djppv.exe69⤵PID:5072
-
\??\c:\lrffxxx.exec:\lrffxxx.exe70⤵PID:4608
-
\??\c:\lrfffff.exec:\lrfffff.exe71⤵PID:900
-
\??\c:\hhttnt.exec:\hhttnt.exe72⤵PID:4492
-
\??\c:\dvvdj.exec:\dvvdj.exe73⤵PID:872
-
\??\c:\vpvpp.exec:\vpvpp.exe74⤵PID:1384
-
\??\c:\fflfxxr.exec:\fflfxxr.exe75⤵PID:436
-
\??\c:\hhbbtb.exec:\hhbbtb.exe76⤵PID:1780
-
\??\c:\ntbbtt.exec:\ntbbtt.exe77⤵PID:1564
-
\??\c:\dddvv.exec:\dddvv.exe78⤵PID:4252
-
\??\c:\xffffff.exec:\xffffff.exe79⤵PID:1208
-
\??\c:\xxfxxff.exec:\xxfxxff.exe80⤵PID:3760
-
\??\c:\hntbtt.exec:\hntbtt.exe81⤵PID:4708
-
\??\c:\hbbttn.exec:\hbbttn.exe82⤵PID:4752
-
\??\c:\pjdvv.exec:\pjdvv.exe83⤵PID:4568
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe84⤵PID:1352
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe85⤵PID:4580
-
\??\c:\9bhhhh.exec:\9bhhhh.exe86⤵PID:400
-
\??\c:\1vvpp.exec:\1vvpp.exe87⤵PID:2784
-
\??\c:\pdddd.exec:\pdddd.exe88⤵PID:368
-
\??\c:\rlffffx.exec:\rlffffx.exe89⤵PID:2500
-
\??\c:\tntbhh.exec:\tntbhh.exe90⤵PID:3056
-
\??\c:\5tbttb.exec:\5tbttb.exe91⤵PID:4292
-
\??\c:\vpvpj.exec:\vpvpj.exe92⤵PID:1340
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe93⤵PID:1912
-
\??\c:\xxxrrll.exec:\xxxrrll.exe94⤵PID:4460
-
\??\c:\tbhtnn.exec:\tbhtnn.exe95⤵PID:692
-
\??\c:\jjvdv.exec:\jjvdv.exe96⤵PID:888
-
\??\c:\jdppp.exec:\jdppp.exe97⤵PID:1672
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe98⤵PID:1696
-
\??\c:\7lllllf.exec:\7lllllf.exe99⤵PID:3672
-
\??\c:\httnhb.exec:\httnhb.exe100⤵PID:2056
-
\??\c:\jjppp.exec:\jjppp.exe101⤵PID:3580
-
\??\c:\jdppv.exec:\jdppv.exe102⤵PID:2316
-
\??\c:\xxfxxll.exec:\xxfxxll.exe103⤵PID:3452
-
\??\c:\3rfxxxr.exec:\3rfxxxr.exe104⤵PID:1764
-
\??\c:\hntnnn.exec:\hntnnn.exe105⤵PID:1736
-
\??\c:\1pvvp.exec:\1pvvp.exe106⤵PID:2800
-
\??\c:\5jvvj.exec:\5jvvj.exe107⤵PID:2172
-
\??\c:\llrxllf.exec:\llrxllf.exe108⤵PID:1704
-
\??\c:\1tbbhh.exec:\1tbbhh.exe109⤵PID:1984
-
\??\c:\tbhhbb.exec:\tbhhbb.exe110⤵PID:3576
-
\??\c:\jvvdj.exec:\jvvdj.exe111⤵PID:1288
-
\??\c:\frxxfll.exec:\frxxfll.exe112⤵
- System Location Discovery: System Language Discovery
PID:3408 -
\??\c:\tnbhtn.exec:\tnbhtn.exe113⤵PID:2036
-
\??\c:\nntnhh.exec:\nntnhh.exe114⤵PID:4168
-
\??\c:\jdddv.exec:\jdddv.exe115⤵PID:2384
-
\??\c:\lfrlfll.exec:\lfrlfll.exe116⤵PID:4776
-
\??\c:\lxffxxr.exec:\lxffxxr.exe117⤵PID:2292
-
\??\c:\1hhnht.exec:\1hhnht.exe118⤵PID:2944
-
\??\c:\nthhhh.exec:\nthhhh.exe119⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\dpjdd.exec:\dpjdd.exe120⤵PID:3372
-
\??\c:\ppjpj.exec:\ppjpj.exe121⤵PID:1780
-
\??\c:\frxxxfx.exec:\frxxxfx.exe122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-