Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74cb7fcfc9b8f047547782e7cc2787e0N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
74cb7fcfc9b8f047547782e7cc2787e0N.exe
-
Size
82KB
-
MD5
74cb7fcfc9b8f047547782e7cc2787e0
-
SHA1
0f497fb6c379a8181661983433ab52c77e0d5c39
-
SHA256
ad1ac7c4e558d189ccc2c3eb7d70f2d45251d5ad4ea978e6f3587164d9eb099c
-
SHA512
93ef1fe5a9b59a600f3163656e8eef202a99daa38686517d8560333989c123ee3c1761e8540171b2a4237799d2eda7f4a8fac2e53b9b0b0eea523c6d54b40871
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QD:ymb3NkkiQ3mdBjFIIp9L9QrrA8g
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1804-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/592-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 212 xfxrfxl.exe 592 jddjd.exe 2156 lrlxrlx.exe 2056 htbtbh.exe 4092 dvvpj.exe 3120 7ffxlll.exe 844 5tbbht.exe 2168 hhnhnn.exe 3216 nbhbbh.exe 5032 ttthtt.exe 4060 1dppp.exe 4392 ffxfllx.exe 2252 llflrxx.exe 4256 djvdd.exe 3680 9vdjj.exe 4184 ffxxrxx.exe 2416 ffrrrrx.exe 2504 dpvpp.exe 2340 jvjdd.exe 4996 lxllfff.exe 4896 btbnnh.exe 3536 7btttb.exe 2912 pvjjj.exe 2916 lxxrxrl.exe 3168 hntthh.exe 3740 bhbtnh.exe 4248 jjjdv.exe 4800 9fxxllx.exe 3108 rrxrlff.exe 4892 hbbbtn.exe 2800 jvppj.exe 3512 llrxfxr.exe 4460 hbtnhh.exe 4120 pjjjd.exe 5068 jvvvj.exe 2440 frrxrff.exe 3100 3hnhbh.exe 2156 1pjvj.exe 4476 rlrrlrl.exe 1940 rfllllf.exe 4092 bbbbbh.exe 1156 5bhbnn.exe 3120 pvdvv.exe 3156 pddvp.exe 2592 rrlxrrr.exe 1976 lxlxrlx.exe 1988 tbhnhh.exe 5020 hhnnnt.exe 4488 pppjv.exe 4984 1jvdv.exe 1864 frflxff.exe 1076 rlllxfr.exe 4140 bbnnbh.exe 1780 hbbbnt.exe 4916 pvddd.exe 3556 dvjdv.exe 3736 flffxfr.exe 680 xxrrlrr.exe 116 fffrrrf.exe 3436 bhtthh.exe 376 hhtttb.exe 1700 jvjdd.exe 5064 vvppj.exe 4944 lrlxrll.exe -
resource yara_rule behavioral2/memory/1804-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/592-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 212 1804 74cb7fcfc9b8f047547782e7cc2787e0N.exe 83 PID 1804 wrote to memory of 212 1804 74cb7fcfc9b8f047547782e7cc2787e0N.exe 83 PID 1804 wrote to memory of 212 1804 74cb7fcfc9b8f047547782e7cc2787e0N.exe 83 PID 212 wrote to memory of 592 212 xfxrfxl.exe 84 PID 212 wrote to memory of 592 212 xfxrfxl.exe 84 PID 212 wrote to memory of 592 212 xfxrfxl.exe 84 PID 592 wrote to memory of 2156 592 jddjd.exe 85 PID 592 wrote to memory of 2156 592 jddjd.exe 85 PID 592 wrote to memory of 2156 592 jddjd.exe 85 PID 2156 wrote to memory of 2056 2156 lrlxrlx.exe 86 PID 2156 wrote to memory of 2056 2156 lrlxrlx.exe 86 PID 2156 wrote to memory of 2056 2156 lrlxrlx.exe 86 PID 2056 wrote to memory of 4092 2056 htbtbh.exe 87 PID 2056 wrote to memory of 4092 2056 htbtbh.exe 87 PID 2056 wrote to memory of 4092 2056 htbtbh.exe 87 PID 4092 wrote to memory of 3120 4092 dvvpj.exe 88 PID 4092 wrote to memory of 3120 4092 dvvpj.exe 88 PID 4092 wrote to memory of 3120 4092 dvvpj.exe 88 PID 3120 wrote to memory of 844 3120 7ffxlll.exe 90 PID 3120 wrote to memory of 844 3120 7ffxlll.exe 90 PID 3120 wrote to memory of 844 3120 7ffxlll.exe 90 PID 844 wrote to memory of 2168 844 5tbbht.exe 91 PID 844 wrote to memory of 2168 844 5tbbht.exe 91 PID 844 wrote to memory of 2168 844 5tbbht.exe 91 PID 2168 wrote to memory of 3216 2168 hhnhnn.exe 92 PID 2168 wrote to memory of 3216 2168 hhnhnn.exe 92 PID 2168 wrote to memory of 3216 2168 hhnhnn.exe 92 PID 3216 wrote to memory of 5032 3216 nbhbbh.exe 93 PID 3216 wrote to memory of 5032 3216 nbhbbh.exe 93 PID 3216 wrote to memory of 5032 3216 nbhbbh.exe 93 PID 5032 wrote to memory of 4060 5032 ttthtt.exe 94 PID 5032 wrote to memory of 4060 5032 ttthtt.exe 94 PID 5032 wrote to memory of 4060 5032 ttthtt.exe 94 PID 4060 wrote to memory of 4392 4060 1dppp.exe 96 PID 4060 wrote to memory of 4392 4060 1dppp.exe 96 PID 4060 wrote to memory of 4392 4060 1dppp.exe 96 PID 4392 wrote to memory of 2252 4392 ffxfllx.exe 97 PID 4392 wrote to memory of 2252 4392 ffxfllx.exe 97 PID 4392 wrote to memory of 2252 4392 ffxfllx.exe 97 PID 2252 wrote to memory of 4256 2252 llflrxx.exe 98 PID 2252 wrote to memory of 4256 2252 llflrxx.exe 98 PID 2252 wrote to memory of 4256 2252 llflrxx.exe 98 PID 4256 wrote to memory of 3680 4256 djvdd.exe 99 PID 4256 wrote to memory of 3680 4256 djvdd.exe 99 PID 4256 wrote to memory of 3680 4256 djvdd.exe 99 PID 3680 wrote to memory of 4184 3680 9vdjj.exe 100 PID 3680 wrote to memory of 4184 3680 9vdjj.exe 100 PID 3680 wrote to memory of 4184 3680 9vdjj.exe 100 PID 4184 wrote to memory of 2416 4184 ffxxrxx.exe 101 PID 4184 wrote to memory of 2416 4184 ffxxrxx.exe 101 PID 4184 wrote to memory of 2416 4184 ffxxrxx.exe 101 PID 2416 wrote to memory of 2504 2416 ffrrrrx.exe 102 PID 2416 wrote to memory of 2504 2416 ffrrrrx.exe 102 PID 2416 wrote to memory of 2504 2416 ffrrrrx.exe 102 PID 2504 wrote to memory of 2340 2504 dpvpp.exe 103 PID 2504 wrote to memory of 2340 2504 dpvpp.exe 103 PID 2504 wrote to memory of 2340 2504 dpvpp.exe 103 PID 2340 wrote to memory of 4996 2340 jvjdd.exe 104 PID 2340 wrote to memory of 4996 2340 jvjdd.exe 104 PID 2340 wrote to memory of 4996 2340 jvjdd.exe 104 PID 4996 wrote to memory of 4896 4996 lxllfff.exe 105 PID 4996 wrote to memory of 4896 4996 lxllfff.exe 105 PID 4996 wrote to memory of 4896 4996 lxllfff.exe 105 PID 4896 wrote to memory of 3536 4896 btbnnh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\74cb7fcfc9b8f047547782e7cc2787e0N.exe"C:\Users\Admin\AppData\Local\Temp\74cb7fcfc9b8f047547782e7cc2787e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\xfxrfxl.exec:\xfxrfxl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\jddjd.exec:\jddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\lrlxrlx.exec:\lrlxrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\htbtbh.exec:\htbtbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\dvvpj.exec:\dvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\7ffxlll.exec:\7ffxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\5tbbht.exec:\5tbbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\hhnhnn.exec:\hhnhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nbhbbh.exec:\nbhbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\ttthtt.exec:\ttthtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\1dppp.exec:\1dppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\ffxfllx.exec:\ffxfllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\llflrxx.exec:\llflrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\djvdd.exec:\djvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\9vdjj.exec:\9vdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\dpvpp.exec:\dpvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jvjdd.exec:\jvjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lxllfff.exec:\lxllfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\btbnnh.exec:\btbnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\7btttb.exec:\7btttb.exe23⤵
- Executes dropped EXE
PID:3536 -
\??\c:\pvjjj.exec:\pvjjj.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxxrxrl.exec:\lxxrxrl.exe25⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hntthh.exec:\hntthh.exe26⤵
- Executes dropped EXE
PID:3168 -
\??\c:\bhbtnh.exec:\bhbtnh.exe27⤵
- Executes dropped EXE
PID:3740 -
\??\c:\jjjdv.exec:\jjjdv.exe28⤵
- Executes dropped EXE
PID:4248 -
\??\c:\9fxxllx.exec:\9fxxllx.exe29⤵
- Executes dropped EXE
PID:4800 -
\??\c:\rrxrlff.exec:\rrxrlff.exe30⤵
- Executes dropped EXE
PID:3108 -
\??\c:\hbbbtn.exec:\hbbbtn.exe31⤵
- Executes dropped EXE
PID:4892 -
\??\c:\jvppj.exec:\jvppj.exe32⤵
- Executes dropped EXE
PID:2800 -
\??\c:\llrxfxr.exec:\llrxfxr.exe33⤵
- Executes dropped EXE
PID:3512 -
\??\c:\hbtnhh.exec:\hbtnhh.exe34⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pjjjd.exec:\pjjjd.exe35⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jvvvj.exec:\jvvvj.exe36⤵
- Executes dropped EXE
PID:5068 -
\??\c:\frrxrff.exec:\frrxrff.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\3hnhbh.exec:\3hnhbh.exe38⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1pjvj.exec:\1pjvj.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe40⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rfllllf.exec:\rfllllf.exe41⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbbbbh.exec:\bbbbbh.exe42⤵
- Executes dropped EXE
PID:4092 -
\??\c:\5bhbnn.exec:\5bhbnn.exe43⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pvdvv.exec:\pvdvv.exe44⤵
- Executes dropped EXE
PID:3120 -
\??\c:\pddvp.exec:\pddvp.exe45⤵
- Executes dropped EXE
PID:3156 -
\??\c:\rrlxrrr.exec:\rrlxrrr.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lxlxrlx.exec:\lxlxrlx.exe47⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tbhnhh.exec:\tbhnhh.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hhnnnt.exec:\hhnnnt.exe49⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pppjv.exec:\pppjv.exe50⤵
- Executes dropped EXE
PID:4488 -
\??\c:\1jvdv.exec:\1jvdv.exe51⤵
- Executes dropped EXE
PID:4984 -
\??\c:\frflxff.exec:\frflxff.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlllxfr.exec:\rlllxfr.exe53⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bbnnbh.exec:\bbnnbh.exe54⤵
- Executes dropped EXE
PID:4140 -
\??\c:\hbbbnt.exec:\hbbbnt.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pvddd.exec:\pvddd.exe56⤵
- Executes dropped EXE
PID:4916 -
\??\c:\dvjdv.exec:\dvjdv.exe57⤵
- Executes dropped EXE
PID:3556 -
\??\c:\flffxfr.exec:\flffxfr.exe58⤵
- Executes dropped EXE
PID:3736 -
\??\c:\xxrrlrr.exec:\xxrrlrr.exe59⤵
- Executes dropped EXE
PID:680 -
\??\c:\fffrrrf.exec:\fffrrrf.exe60⤵
- Executes dropped EXE
PID:116 -
\??\c:\bhtthh.exec:\bhtthh.exe61⤵
- Executes dropped EXE
PID:3436 -
\??\c:\hhtttb.exec:\hhtttb.exe62⤵
- Executes dropped EXE
PID:376 -
\??\c:\jvjdd.exec:\jvjdd.exe63⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vvppj.exec:\vvppj.exe64⤵
- Executes dropped EXE
PID:5064 -
\??\c:\lrlxrll.exec:\lrlxrll.exe65⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rxlrxff.exec:\rxlrxff.exe66⤵PID:2900
-
\??\c:\7bhhhh.exec:\7bhhhh.exe67⤵PID:2764
-
\??\c:\jdpvp.exec:\jdpvp.exe68⤵PID:3488
-
\??\c:\vjppp.exec:\vjppp.exe69⤵PID:1240
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe70⤵PID:5060
-
\??\c:\5xflrxx.exec:\5xflrxx.exe71⤵PID:4200
-
\??\c:\ffffflf.exec:\ffffflf.exe72⤵PID:4564
-
\??\c:\nbnnhn.exec:\nbnnhn.exe73⤵PID:4948
-
\??\c:\dppvj.exec:\dppvj.exe74⤵PID:4420
-
\??\c:\jvvpj.exec:\jvvpj.exe75⤵PID:3128
-
\??\c:\fflfflf.exec:\fflfflf.exe76⤵PID:4248
-
\??\c:\ffrrffx.exec:\ffrrffx.exe77⤵PID:2244
-
\??\c:\tntttb.exec:\tntttb.exe78⤵PID:2160
-
\??\c:\ppdvv.exec:\ppdvv.exe79⤵PID:2316
-
\??\c:\5rllfll.exec:\5rllfll.exe80⤵PID:4192
-
\??\c:\lflxffl.exec:\lflxffl.exe81⤵PID:4356
-
\??\c:\btbbhh.exec:\btbbhh.exe82⤵PID:2104
-
\??\c:\hnbbnt.exec:\hnbbnt.exe83⤵PID:3148
-
\??\c:\9ddjj.exec:\9ddjj.exe84⤵PID:4124
-
\??\c:\dvdvv.exec:\dvdvv.exe85⤵PID:4512
-
\??\c:\3fllrxf.exec:\3fllrxf.exe86⤵PID:3724
-
\??\c:\btntbb.exec:\btntbb.exe87⤵PID:2568
-
\??\c:\bbbbhn.exec:\bbbbhn.exe88⤵PID:2220
-
\??\c:\ddvjd.exec:\ddvjd.exe89⤵PID:2376
-
\??\c:\jdpjv.exec:\jdpjv.exe90⤵PID:4476
-
\??\c:\xfrrrff.exec:\xfrrrff.exe91⤵PID:2036
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe92⤵PID:2976
-
\??\c:\tttbbt.exec:\tttbbt.exe93⤵PID:1156
-
\??\c:\nntbnn.exec:\nntbnn.exe94⤵PID:3524
-
\??\c:\dvdjj.exec:\dvdjj.exe95⤵PID:844
-
\??\c:\3frrxlr.exec:\3frrxlr.exe96⤵PID:4424
-
\??\c:\xrxfxrr.exec:\xrxfxrr.exe97⤵PID:2488
-
\??\c:\1bnnhn.exec:\1bnnhn.exe98⤵PID:2396
-
\??\c:\nhttbh.exec:\nhttbh.exe99⤵PID:4336
-
\??\c:\pjpjj.exec:\pjpjj.exe100⤵PID:5032
-
\??\c:\vvjjj.exec:\vvjjj.exe101⤵PID:1840
-
\??\c:\ffffrxx.exec:\ffffrxx.exe102⤵PID:1072
-
\??\c:\xrllrxr.exec:\xrllrxr.exe103⤵PID:4860
-
\??\c:\nnbbtt.exec:\nnbbtt.exe104⤵PID:3080
-
\??\c:\jjvpp.exec:\jjvpp.exe105⤵PID:4256
-
\??\c:\9ppvv.exec:\9ppvv.exe106⤵PID:4252
-
\??\c:\xlrrxfl.exec:\xlrrxfl.exe107⤵PID:4184
-
\??\c:\rlxfffl.exec:\rlxfffl.exe108⤵PID:1480
-
\??\c:\bbnhhn.exec:\bbnhhn.exe109⤵PID:840
-
\??\c:\bhbbhn.exec:\bhbbhn.exe110⤵PID:4992
-
\??\c:\vpvdd.exec:\vpvdd.exe111⤵PID:5096
-
\??\c:\pjpvd.exec:\pjpvd.exe112⤵PID:2504
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe113⤵PID:2340
-
\??\c:\bnbbtt.exec:\bnbbtt.exe114⤵PID:1912
-
\??\c:\dvpjj.exec:\dvpjj.exe115⤵PID:5088
-
\??\c:\rxrxrxx.exec:\rxrxrxx.exe116⤵
- System Location Discovery: System Language Discovery
PID:4508 -
\??\c:\1rffxrx.exec:\1rffxrx.exe117⤵PID:2328
-
\??\c:\htbbnb.exec:\htbbnb.exe118⤵PID:3500
-
\??\c:\ddpvp.exec:\ddpvp.exe119⤵PID:2704
-
\??\c:\rfrxlrf.exec:\rfrxlrf.exe120⤵PID:464
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe121⤵PID:2284
-
\??\c:\ntnbtt.exec:\ntnbtt.exe122⤵PID:3776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-