Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 21:38
Static task
static1
Behavioral task
behavioral1
Sample
4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe
Resource
win7-20240903-en
General
-
Target
4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe
-
Size
593KB
-
MD5
d3bb638ec9454f8a0089189e3157cc17
-
SHA1
640ae0f4c3da443a71b4f97d4cd8ba107fea8588
-
SHA256
4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203
-
SHA512
1d300a3298e9430276fbaa38426c6e93da7b642e78f546690b5cb61233c8833e1702961d36846ecfb668038d6afba71f58ab1370f454d112099fe1fe58394643
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayLAw:n3C9Lebz+xt4vFeFmgayX
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1284-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1740 nbhhbb.exe 1784 hntntt.exe 440 1rrrllf.exe 2784 thbtnb.exe 2300 rrxrllx.exe 3044 jvpjp.exe 2924 jpddd.exe 820 vjvjd.exe 2564 7lllfff.exe 3640 btthbt.exe 2700 rlxffll.exe 4924 ddpvj.exe 3272 jdpvv.exe 2024 rxlllrx.exe 1548 vvjdp.exe 3496 vjvdv.exe 216 rrffflr.exe 4232 jjppd.exe 4004 flrxxxr.exe 972 dppvv.exe 4112 dpvvj.exe 2304 pvjpp.exe 2244 fxlrrlr.exe 2476 htbhnb.exe 3132 xlxxxff.exe 4108 hnhnbh.exe 4868 bnnhhh.exe 1380 5xrllrr.exe 2404 bbhbhn.exe 1628 jvpdj.exe 1676 vvvjp.exe 3092 9vdvp.exe 4448 frffrrl.exe 4396 nhnhhh.exe 4744 flrrrrr.exe 2900 hnhbbh.exe 4792 pdvpj.exe 532 ffrllrl.exe 4424 3htnbh.exe 440 djjdd.exe 5108 flrlfrl.exe 1848 hnhnth.exe 2468 dvppj.exe 4432 xlrxrrx.exe 756 hhtnbb.exe 3080 ppjjj.exe 2792 thntbn.exe 3636 pppvj.exe 4964 rrlllll.exe 4672 bbnntb.exe 4492 jdjjd.exe 4488 xllfrrr.exe 344 ttnthn.exe 1960 jvjjd.exe 4064 tnnbbn.exe 1008 pvvvv.exe 892 llllfff.exe 3380 dvpjd.exe 4976 fflffrf.exe 3296 jpvvp.exe 1968 vjddd.exe 5112 9xllfrf.exe 4036 xxlrxfl.exe 2476 jvvdp.exe -
resource yara_rule behavioral2/memory/1284-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1740 1284 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 83 PID 1284 wrote to memory of 1740 1284 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 83 PID 1284 wrote to memory of 1740 1284 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 83 PID 1740 wrote to memory of 1784 1740 nbhhbb.exe 84 PID 1740 wrote to memory of 1784 1740 nbhhbb.exe 84 PID 1740 wrote to memory of 1784 1740 nbhhbb.exe 84 PID 1784 wrote to memory of 440 1784 hntntt.exe 86 PID 1784 wrote to memory of 440 1784 hntntt.exe 86 PID 1784 wrote to memory of 440 1784 hntntt.exe 86 PID 440 wrote to memory of 2784 440 1rrrllf.exe 87 PID 440 wrote to memory of 2784 440 1rrrllf.exe 87 PID 440 wrote to memory of 2784 440 1rrrllf.exe 87 PID 2784 wrote to memory of 2300 2784 thbtnb.exe 88 PID 2784 wrote to memory of 2300 2784 thbtnb.exe 88 PID 2784 wrote to memory of 2300 2784 thbtnb.exe 88 PID 2300 wrote to memory of 3044 2300 rrxrllx.exe 89 PID 2300 wrote to memory of 3044 2300 rrxrllx.exe 89 PID 2300 wrote to memory of 3044 2300 rrxrllx.exe 89 PID 3044 wrote to memory of 2924 3044 jvpjp.exe 91 PID 3044 wrote to memory of 2924 3044 jvpjp.exe 91 PID 3044 wrote to memory of 2924 3044 jvpjp.exe 91 PID 2924 wrote to memory of 820 2924 jpddd.exe 92 PID 2924 wrote to memory of 820 2924 jpddd.exe 92 PID 2924 wrote to memory of 820 2924 jpddd.exe 92 PID 820 wrote to memory of 2564 820 vjvjd.exe 93 PID 820 wrote to memory of 2564 820 vjvjd.exe 93 PID 820 wrote to memory of 2564 820 vjvjd.exe 93 PID 2564 wrote to memory of 3640 2564 7lllfff.exe 95 PID 2564 wrote to memory of 3640 2564 7lllfff.exe 95 PID 2564 wrote to memory of 3640 2564 7lllfff.exe 95 PID 3640 wrote to memory of 2700 3640 btthbt.exe 96 PID 3640 wrote to memory of 2700 3640 btthbt.exe 96 PID 3640 wrote to memory of 2700 3640 btthbt.exe 96 PID 2700 wrote to memory of 4924 2700 rlxffll.exe 97 PID 2700 wrote to memory of 4924 2700 rlxffll.exe 97 PID 2700 wrote to memory of 4924 2700 rlxffll.exe 97 PID 4924 wrote to memory of 3272 4924 ddpvj.exe 98 PID 4924 wrote to memory of 3272 4924 ddpvj.exe 98 PID 4924 wrote to memory of 3272 4924 ddpvj.exe 98 PID 3272 wrote to memory of 2024 3272 jdpvv.exe 99 PID 3272 wrote to memory of 2024 3272 jdpvv.exe 99 PID 3272 wrote to memory of 2024 3272 jdpvv.exe 99 PID 2024 wrote to memory of 1548 2024 rxlllrx.exe 100 PID 2024 wrote to memory of 1548 2024 rxlllrx.exe 100 PID 2024 wrote to memory of 1548 2024 rxlllrx.exe 100 PID 1548 wrote to memory of 3496 1548 vvjdp.exe 101 PID 1548 wrote to memory of 3496 1548 vvjdp.exe 101 PID 1548 wrote to memory of 3496 1548 vvjdp.exe 101 PID 3496 wrote to memory of 216 3496 vjvdv.exe 102 PID 3496 wrote to memory of 216 3496 vjvdv.exe 102 PID 3496 wrote to memory of 216 3496 vjvdv.exe 102 PID 216 wrote to memory of 4232 216 rrffflr.exe 103 PID 216 wrote to memory of 4232 216 rrffflr.exe 103 PID 216 wrote to memory of 4232 216 rrffflr.exe 103 PID 4232 wrote to memory of 4004 4232 jjppd.exe 104 PID 4232 wrote to memory of 4004 4232 jjppd.exe 104 PID 4232 wrote to memory of 4004 4232 jjppd.exe 104 PID 4004 wrote to memory of 972 4004 flrxxxr.exe 105 PID 4004 wrote to memory of 972 4004 flrxxxr.exe 105 PID 4004 wrote to memory of 972 4004 flrxxxr.exe 105 PID 972 wrote to memory of 4112 972 dppvv.exe 106 PID 972 wrote to memory of 4112 972 dppvv.exe 106 PID 972 wrote to memory of 4112 972 dppvv.exe 106 PID 4112 wrote to memory of 2304 4112 dpvvj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe"C:\Users\Admin\AppData\Local\Temp\4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\nbhhbb.exec:\nbhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hntntt.exec:\hntntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\1rrrllf.exec:\1rrrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\thbtnb.exec:\thbtnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rrxrllx.exec:\rrxrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jvpjp.exec:\jvpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\jpddd.exec:\jpddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vjvjd.exec:\vjvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\7lllfff.exec:\7lllfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\btthbt.exec:\btthbt.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\rlxffll.exec:\rlxffll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ddpvj.exec:\ddpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\jdpvv.exec:\jdpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\rxlllrx.exec:\rxlllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vvjdp.exec:\vvjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\vjvdv.exec:\vjvdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\rrffflr.exec:\rrffflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\jjppd.exec:\jjppd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\flrxxxr.exec:\flrxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\dppvv.exec:\dppvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\dpvvj.exec:\dpvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\pvjpp.exec:\pvjpp.exe23⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fxlrrlr.exec:\fxlrrlr.exe24⤵
- Executes dropped EXE
PID:2244 -
\??\c:\htbhnb.exec:\htbhnb.exe25⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xlxxxff.exec:\xlxxxff.exe26⤵
- Executes dropped EXE
PID:3132 -
\??\c:\hnhnbh.exec:\hnhnbh.exe27⤵
- Executes dropped EXE
PID:4108 -
\??\c:\bnnhhh.exec:\bnnhhh.exe28⤵
- Executes dropped EXE
PID:4868 -
\??\c:\5xrllrr.exec:\5xrllrr.exe29⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bbhbhn.exec:\bbhbhn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\jvpdj.exec:\jvpdj.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvvjp.exec:\vvvjp.exe32⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9vdvp.exec:\9vdvp.exe33⤵
- Executes dropped EXE
PID:3092 -
\??\c:\frffrrl.exec:\frffrrl.exe34⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nhnhhh.exec:\nhnhhh.exe35⤵
- Executes dropped EXE
PID:4396 -
\??\c:\flrrrrr.exec:\flrrrrr.exe36⤵
- Executes dropped EXE
PID:4744 -
\??\c:\hnhbbh.exec:\hnhbbh.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pdvpj.exec:\pdvpj.exe38⤵
- Executes dropped EXE
PID:4792 -
\??\c:\ffrllrl.exec:\ffrllrl.exe39⤵
- Executes dropped EXE
PID:532 -
\??\c:\3htnbh.exec:\3htnbh.exe40⤵
- Executes dropped EXE
PID:4424 -
\??\c:\djjdd.exec:\djjdd.exe41⤵
- Executes dropped EXE
PID:440 -
\??\c:\flrlfrl.exec:\flrlfrl.exe42⤵
- Executes dropped EXE
PID:5108 -
\??\c:\hnhnth.exec:\hnhnth.exe43⤵
- Executes dropped EXE
PID:1848 -
\??\c:\dvppj.exec:\dvppj.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xlrxrrx.exec:\xlrxrrx.exe45⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hhtnbb.exec:\hhtnbb.exe46⤵
- Executes dropped EXE
PID:756 -
\??\c:\ppjjj.exec:\ppjjj.exe47⤵
- Executes dropped EXE
PID:3080 -
\??\c:\thntbn.exec:\thntbn.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pppvj.exec:\pppvj.exe49⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rrlllll.exec:\rrlllll.exe50⤵
- Executes dropped EXE
PID:4964 -
\??\c:\bbnntb.exec:\bbnntb.exe51⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jdjjd.exec:\jdjjd.exe52⤵
- Executes dropped EXE
PID:4492 -
\??\c:\xllfrrr.exec:\xllfrrr.exe53⤵
- Executes dropped EXE
PID:4488 -
\??\c:\ttnthn.exec:\ttnthn.exe54⤵
- Executes dropped EXE
PID:344 -
\??\c:\jvjjd.exec:\jvjjd.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tnnbbn.exec:\tnnbbn.exe56⤵
- Executes dropped EXE
PID:4064 -
\??\c:\pvvvv.exec:\pvvvv.exe57⤵
- Executes dropped EXE
PID:1008 -
\??\c:\llllfff.exec:\llllfff.exe58⤵
- Executes dropped EXE
PID:892 -
\??\c:\dvpjd.exec:\dvpjd.exe59⤵
- Executes dropped EXE
PID:3380 -
\??\c:\fflffrf.exec:\fflffrf.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976 -
\??\c:\jpvvp.exec:\jpvvp.exe61⤵
- Executes dropped EXE
PID:3296 -
\??\c:\vjddd.exec:\vjddd.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9xllfrf.exec:\9xllfrf.exe63⤵
- Executes dropped EXE
PID:5112 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe64⤵
- Executes dropped EXE
PID:4036 -
\??\c:\jvvdp.exec:\jvvdp.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\5xllllx.exec:\5xllllx.exe66⤵PID:3972
-
\??\c:\bbtnnn.exec:\bbtnnn.exe67⤵PID:3032
-
\??\c:\ddpvp.exec:\ddpvp.exe68⤵PID:4256
-
\??\c:\fxlxxxl.exec:\fxlxxxl.exe69⤵PID:3224
-
\??\c:\nnnbtb.exec:\nnnbtb.exe70⤵PID:1844
-
\??\c:\vvpjv.exec:\vvpjv.exe71⤵PID:2720
-
\??\c:\llxxrxr.exec:\llxxrxr.exe72⤵PID:748
-
\??\c:\bthbhh.exec:\bthbhh.exe73⤵PID:1628
-
\??\c:\vdvpj.exec:\vdvpj.exe74⤵PID:5116
-
\??\c:\xrfrxfl.exec:\xrfrxfl.exe75⤵PID:4580
-
\??\c:\bhnnth.exec:\bhnnth.exe76⤵PID:4448
-
\??\c:\pddvp.exec:\pddvp.exe77⤵PID:4176
-
\??\c:\3rfrrxf.exec:\3rfrrxf.exe78⤵PID:3008
-
\??\c:\hbhbtt.exec:\hbhbtt.exe79⤵PID:2264
-
\??\c:\pddjj.exec:\pddjj.exe80⤵PID:1672
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe81⤵PID:1784
-
\??\c:\bntnnh.exec:\bntnnh.exe82⤵PID:4820
-
\??\c:\jdjvv.exec:\jdjvv.exe83⤵PID:4756
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe84⤵PID:4188
-
\??\c:\bbnhnh.exec:\bbnhnh.exe85⤵PID:4824
-
\??\c:\pvdvp.exec:\pvdvp.exe86⤵PID:3388
-
\??\c:\llrrxll.exec:\llrrxll.exe87⤵PID:1668
-
\??\c:\bhnntn.exec:\bhnntn.exe88⤵PID:3684
-
\??\c:\jjppv.exec:\jjppv.exe89⤵PID:2896
-
\??\c:\llrllrr.exec:\llrllrr.exe90⤵PID:2124
-
\??\c:\9bhhht.exec:\9bhhht.exe91⤵PID:1872
-
\??\c:\ddjdj.exec:\ddjdj.exe92⤵PID:3596
-
\??\c:\jdddj.exec:\jdddj.exe93⤵PID:3916
-
\??\c:\flrlrlx.exec:\flrlrlx.exe94⤵PID:3272
-
\??\c:\dddjj.exec:\dddjj.exe95⤵PID:4936
-
\??\c:\rlxrlff.exec:\rlxrlff.exe96⤵PID:2212
-
\??\c:\3xfffff.exec:\3xfffff.exe97⤵PID:2548
-
\??\c:\tbtntt.exec:\tbtntt.exe98⤵PID:216
-
\??\c:\5xlfrrf.exec:\5xlfrrf.exe99⤵PID:5096
-
\??\c:\xxxrxxf.exec:\xxxrxxf.exe100⤵PID:4872
-
\??\c:\htbbtn.exec:\htbbtn.exe101⤵PID:3404
-
\??\c:\vpjdd.exec:\vpjdd.exe102⤵PID:3840
-
\??\c:\llxrflx.exec:\llxrflx.exe103⤵PID:2524
-
\??\c:\vvjjd.exec:\vvjjd.exe104⤵PID:1324
-
\??\c:\ffrlflf.exec:\ffrlflf.exe105⤵PID:3680
-
\??\c:\tnbhhn.exec:\tnbhhn.exe106⤵PID:1212
-
\??\c:\dpvvv.exec:\dpvvv.exe107⤵PID:1568
-
\??\c:\lxffxxx.exec:\lxffxxx.exe108⤵PID:4348
-
\??\c:\ttbtnt.exec:\ttbtnt.exe109⤵PID:2372
-
\??\c:\ddpvd.exec:\ddpvd.exe110⤵PID:4564
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe111⤵PID:3588
-
\??\c:\btbbbb.exec:\btbbbb.exe112⤵PID:2000
-
\??\c:\jjpdv.exec:\jjpdv.exe113⤵PID:5012
-
\??\c:\9lrxxxx.exec:\9lrxxxx.exe114⤵PID:1496
-
\??\c:\bnnttt.exec:\bnnttt.exe115⤵PID:4752
-
\??\c:\jpvpv.exec:\jpvpv.exe116⤵PID:4408
-
\??\c:\7ffxfff.exec:\7ffxfff.exe117⤵PID:4388
-
\??\c:\hhhhhh.exec:\hhhhhh.exe118⤵PID:4744
-
\??\c:\vjvdv.exec:\vjvdv.exe119⤵
- System Location Discovery: System Language Discovery
PID:1740 -
\??\c:\3xfrllf.exec:\3xfrllf.exe120⤵PID:2900
-
\??\c:\bbhnhh.exec:\bbhnhh.exe121⤵PID:5020
-
\??\c:\vpppj.exec:\vpppj.exe122⤵PID:532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-