Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 05:34 UTC
Static task
static1
Behavioral task
behavioral1
Sample
d4db9c85fa9495da6140a0db7178e150N.exe
Resource
win7-20240903-en
General
-
Target
d4db9c85fa9495da6140a0db7178e150N.exe
-
Size
92KB
-
MD5
d4db9c85fa9495da6140a0db7178e150
-
SHA1
bae87e6faf5f9dee21d621de4ff0133b3e073f77
-
SHA256
d0d847cc8ffc482f51591448828e86a582c3b534a4fcba641b67b9d28d741ccc
-
SHA512
7f09682399c5637e9f6404ce9360f6e43f3268a3872a4454780f63e4d36b703ff4c2b0818b350ecfefaa5a4d55f881d8ff2e7ad3fb453ee859b5b7331376a544
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLn9t:ymb3NkkiQ3mdBjFIi/REUZnKlb94xs
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1712-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3604 9pvpd.exe 4956 xrfflrx.exe 4852 hbhhbt.exe 1792 vpdvj.exe 3388 xlrffrr.exe 3116 3bbtnt.exe 4520 3flfxrl.exe 2152 hhbhtb.exe 4424 tntnnh.exe 4448 djvvv.exe 1056 3xfrffx.exe 3372 bntttt.exe 2364 9jjdv.exe 2052 jvjjv.exe 2740 7xrxrxr.exe 5088 thbttn.exe 2384 5dpjd.exe 1848 rfllfff.exe 4340 bbnhtn.exe 1152 5hbhbb.exe 2528 djpjd.exe 2640 ppvvp.exe 1628 rxxrlll.exe 3004 hhbtnn.exe 1512 7pddj.exe 4052 fllxrlf.exe 2808 1tbtbb.exe 3632 vpdvv.exe 1920 lrrflfr.exe 3056 nhhbtt.exe 3088 vjvjd.exe 3380 rrrxlxf.exe 4540 ffxxxxr.exe 4156 1tnbtb.exe 3800 dpppv.exe 4112 pvjdp.exe 4528 xlfxrrl.exe 3980 tthnnh.exe 3208 vjdvp.exe 3920 ddpdv.exe 4760 xffllll.exe 4944 nnttnt.exe 4772 1tbbbb.exe 4852 pvjdv.exe 3880 vvjjp.exe 1016 xlffxrx.exe 4028 lffxllx.exe 1572 bthbnn.exe 2268 thhtnt.exe 2760 jdjdj.exe 2152 9vjdj.exe 1704 5xfxllx.exe 3344 ffxrrff.exe 1048 7hnnhh.exe 3940 dvvpp.exe 3732 9jjvj.exe 1556 xflfrlf.exe 3284 rrlffxx.exe 4200 9hbtnh.exe 1516 nbbtnt.exe 3260 jdvpj.exe 1948 jvpvv.exe 4848 frxxxrx.exe 2068 fxxrllf.exe -
resource yara_rule behavioral2/memory/1712-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 3604 1712 d4db9c85fa9495da6140a0db7178e150N.exe 83 PID 1712 wrote to memory of 3604 1712 d4db9c85fa9495da6140a0db7178e150N.exe 83 PID 1712 wrote to memory of 3604 1712 d4db9c85fa9495da6140a0db7178e150N.exe 83 PID 3604 wrote to memory of 4956 3604 9pvpd.exe 84 PID 3604 wrote to memory of 4956 3604 9pvpd.exe 84 PID 3604 wrote to memory of 4956 3604 9pvpd.exe 84 PID 4956 wrote to memory of 4852 4956 xrfflrx.exe 85 PID 4956 wrote to memory of 4852 4956 xrfflrx.exe 85 PID 4956 wrote to memory of 4852 4956 xrfflrx.exe 85 PID 4852 wrote to memory of 1792 4852 hbhhbt.exe 86 PID 4852 wrote to memory of 1792 4852 hbhhbt.exe 86 PID 4852 wrote to memory of 1792 4852 hbhhbt.exe 86 PID 1792 wrote to memory of 3388 1792 vpdvj.exe 87 PID 1792 wrote to memory of 3388 1792 vpdvj.exe 87 PID 1792 wrote to memory of 3388 1792 vpdvj.exe 87 PID 3388 wrote to memory of 3116 3388 xlrffrr.exe 88 PID 3388 wrote to memory of 3116 3388 xlrffrr.exe 88 PID 3388 wrote to memory of 3116 3388 xlrffrr.exe 88 PID 3116 wrote to memory of 4520 3116 3bbtnt.exe 89 PID 3116 wrote to memory of 4520 3116 3bbtnt.exe 89 PID 3116 wrote to memory of 4520 3116 3bbtnt.exe 89 PID 4520 wrote to memory of 2152 4520 3flfxrl.exe 90 PID 4520 wrote to memory of 2152 4520 3flfxrl.exe 90 PID 4520 wrote to memory of 2152 4520 3flfxrl.exe 90 PID 2152 wrote to memory of 4424 2152 hhbhtb.exe 91 PID 2152 wrote to memory of 4424 2152 hhbhtb.exe 91 PID 2152 wrote to memory of 4424 2152 hhbhtb.exe 91 PID 4424 wrote to memory of 4448 4424 tntnnh.exe 93 PID 4424 wrote to memory of 4448 4424 tntnnh.exe 93 PID 4424 wrote to memory of 4448 4424 tntnnh.exe 93 PID 4448 wrote to memory of 1056 4448 djvvv.exe 94 PID 4448 wrote to memory of 1056 4448 djvvv.exe 94 PID 4448 wrote to memory of 1056 4448 djvvv.exe 94 PID 1056 wrote to memory of 3372 1056 3xfrffx.exe 95 PID 1056 wrote to memory of 3372 1056 3xfrffx.exe 95 PID 1056 wrote to memory of 3372 1056 3xfrffx.exe 95 PID 3372 wrote to memory of 2364 3372 bntttt.exe 96 PID 3372 wrote to memory of 2364 3372 bntttt.exe 96 PID 3372 wrote to memory of 2364 3372 bntttt.exe 96 PID 2364 wrote to memory of 2052 2364 9jjdv.exe 97 PID 2364 wrote to memory of 2052 2364 9jjdv.exe 97 PID 2364 wrote to memory of 2052 2364 9jjdv.exe 97 PID 2052 wrote to memory of 2740 2052 jvjjv.exe 98 PID 2052 wrote to memory of 2740 2052 jvjjv.exe 98 PID 2052 wrote to memory of 2740 2052 jvjjv.exe 98 PID 2740 wrote to memory of 5088 2740 7xrxrxr.exe 99 PID 2740 wrote to memory of 5088 2740 7xrxrxr.exe 99 PID 2740 wrote to memory of 5088 2740 7xrxrxr.exe 99 PID 5088 wrote to memory of 2384 5088 thbttn.exe 101 PID 5088 wrote to memory of 2384 5088 thbttn.exe 101 PID 5088 wrote to memory of 2384 5088 thbttn.exe 101 PID 2384 wrote to memory of 1848 2384 5dpjd.exe 102 PID 2384 wrote to memory of 1848 2384 5dpjd.exe 102 PID 2384 wrote to memory of 1848 2384 5dpjd.exe 102 PID 1848 wrote to memory of 4340 1848 rfllfff.exe 103 PID 1848 wrote to memory of 4340 1848 rfllfff.exe 103 PID 1848 wrote to memory of 4340 1848 rfllfff.exe 103 PID 4340 wrote to memory of 1152 4340 bbnhtn.exe 104 PID 4340 wrote to memory of 1152 4340 bbnhtn.exe 104 PID 4340 wrote to memory of 1152 4340 bbnhtn.exe 104 PID 1152 wrote to memory of 2528 1152 5hbhbb.exe 105 PID 1152 wrote to memory of 2528 1152 5hbhbb.exe 105 PID 1152 wrote to memory of 2528 1152 5hbhbb.exe 105 PID 2528 wrote to memory of 2640 2528 djpjd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4db9c85fa9495da6140a0db7178e150N.exe"C:\Users\Admin\AppData\Local\Temp\d4db9c85fa9495da6140a0db7178e150N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\9pvpd.exec:\9pvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\xrfflrx.exec:\xrfflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\hbhhbt.exec:\hbhhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\vpdvj.exec:\vpdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\xlrffrr.exec:\xlrffrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\3bbtnt.exec:\3bbtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\3flfxrl.exec:\3flfxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\hhbhtb.exec:\hhbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tntnnh.exec:\tntnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\djvvv.exec:\djvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\3xfrffx.exec:\3xfrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\bntttt.exec:\bntttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\9jjdv.exec:\9jjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jvjjv.exec:\jvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\7xrxrxr.exec:\7xrxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\thbttn.exec:\thbttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\5dpjd.exec:\5dpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rfllfff.exec:\rfllfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\bbnhtn.exec:\bbnhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\5hbhbb.exec:\5hbhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\djpjd.exec:\djpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ppvvp.exec:\ppvvp.exe23⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rxxrlll.exec:\rxxrlll.exe24⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hhbtnn.exec:\hhbtnn.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7pddj.exec:\7pddj.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fllxrlf.exec:\fllxrlf.exe27⤵
- Executes dropped EXE
PID:4052 -
\??\c:\1tbtbb.exec:\1tbtbb.exe28⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vpdvv.exec:\vpdvv.exe29⤵
- Executes dropped EXE
PID:3632 -
\??\c:\lrrflfr.exec:\lrrflfr.exe30⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nhhbtt.exec:\nhhbtt.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\vjvjd.exec:\vjvjd.exe32⤵
- Executes dropped EXE
PID:3088 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe33⤵
- Executes dropped EXE
PID:3380 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe34⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1tnbtb.exec:\1tnbtb.exe35⤵
- Executes dropped EXE
PID:4156 -
\??\c:\dpppv.exec:\dpppv.exe36⤵
- Executes dropped EXE
PID:3800 -
\??\c:\pvjdp.exec:\pvjdp.exe37⤵
- Executes dropped EXE
PID:4112 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe38⤵
- Executes dropped EXE
PID:4528 -
\??\c:\tthnnh.exec:\tthnnh.exe39⤵
- Executes dropped EXE
PID:3980 -
\??\c:\vjdvp.exec:\vjdvp.exe40⤵
- Executes dropped EXE
PID:3208 -
\??\c:\ddpdv.exec:\ddpdv.exe41⤵
- Executes dropped EXE
PID:3920 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe42⤵PID:1800
-
\??\c:\xffllll.exec:\xffllll.exe43⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nnttnt.exec:\nnttnt.exe44⤵
- Executes dropped EXE
PID:4944 -
\??\c:\1tbbbb.exec:\1tbbbb.exe45⤵
- Executes dropped EXE
PID:4772 -
\??\c:\pvjdv.exec:\pvjdv.exe46⤵
- Executes dropped EXE
PID:4852 -
\??\c:\vvjjp.exec:\vvjjp.exe47⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xlffxrx.exec:\xlffxrx.exe48⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lffxllx.exec:\lffxllx.exe49⤵
- Executes dropped EXE
PID:4028 -
\??\c:\bthbnn.exec:\bthbnn.exe50⤵
- Executes dropped EXE
PID:1572 -
\??\c:\thhtnt.exec:\thhtnt.exe51⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdjdj.exec:\jdjdj.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9vjdj.exec:\9vjdj.exe53⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5xfxllx.exec:\5xfxllx.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ffxrrff.exec:\ffxrrff.exe55⤵
- Executes dropped EXE
PID:3344 -
\??\c:\7hnnhh.exec:\7hnnhh.exe56⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dvvpp.exec:\dvvpp.exe57⤵
- Executes dropped EXE
PID:3940 -
\??\c:\9jjvj.exec:\9jjvj.exe58⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xflfrlf.exec:\xflfrlf.exe59⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rrlffxx.exec:\rrlffxx.exe60⤵
- Executes dropped EXE
PID:3284 -
\??\c:\9hbtnh.exec:\9hbtnh.exe61⤵
- Executes dropped EXE
PID:4200 -
\??\c:\nbbtnt.exec:\nbbtnt.exe62⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jdvpj.exec:\jdvpj.exe63⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jvpvv.exec:\jvpvv.exe64⤵
- Executes dropped EXE
PID:1948 -
\??\c:\frxxxrx.exec:\frxxxrx.exe65⤵
- Executes dropped EXE
PID:4848 -
\??\c:\fxxrllf.exec:\fxxrllf.exe66⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9bbtnn.exec:\9bbtnn.exe67⤵PID:3820
-
\??\c:\1hbtnn.exec:\1hbtnn.exe68⤵PID:4572
-
\??\c:\vvdvj.exec:\vvdvj.exe69⤵PID:3816
-
\??\c:\5vvpp.exec:\5vvpp.exe70⤵PID:4584
-
\??\c:\lxffxrx.exec:\lxffxrx.exe71⤵PID:2084
-
\??\c:\xlxrffr.exec:\xlxrffr.exe72⤵PID:4364
-
\??\c:\nnttbb.exec:\nnttbb.exe73⤵PID:1288
-
\??\c:\3bthbb.exec:\3bthbb.exe74⤵PID:1096
-
\??\c:\5jjdv.exec:\5jjdv.exe75⤵PID:1264
-
\??\c:\1ppjv.exec:\1ppjv.exe76⤵PID:3708
-
\??\c:\xrffxrr.exec:\xrffxrr.exe77⤵PID:4052
-
\??\c:\5lrxxfl.exec:\5lrxxfl.exe78⤵PID:3520
-
\??\c:\jdpdv.exec:\jdpdv.exe79⤵PID:1084
-
\??\c:\djjdp.exec:\djjdp.exe80⤵PID:1140
-
\??\c:\rrfxlll.exec:\rrfxlll.exe81⤵PID:3636
-
\??\c:\1nhhhh.exec:\1nhhhh.exe82⤵PID:1916
-
\??\c:\ppjdd.exec:\ppjdd.exe83⤵PID:2264
-
\??\c:\3lrffxr.exec:\3lrffxr.exe84⤵PID:3804
-
\??\c:\bnbttt.exec:\bnbttt.exe85⤵PID:4696
-
\??\c:\tbhbnn.exec:\tbhbnn.exe86⤵PID:212
-
\??\c:\5jddp.exec:\5jddp.exe87⤵PID:4756
-
\??\c:\rlflfff.exec:\rlflfff.exe88⤵PID:3336
-
\??\c:\1hbnhb.exec:\1hbnhb.exe89⤵PID:4064
-
\??\c:\ddvpj.exec:\ddvpj.exe90⤵PID:2820
-
\??\c:\pjdvv.exec:\pjdvv.exe91⤵PID:4456
-
\??\c:\xxxlrll.exec:\xxxlrll.exe92⤵PID:3208
-
\??\c:\5frrllx.exec:\5frrllx.exe93⤵PID:5108
-
\??\c:\tthntb.exec:\tthntb.exe94⤵PID:388
-
\??\c:\vvpjv.exec:\vvpjv.exe95⤵PID:4956
-
\??\c:\vpvvv.exec:\vpvvv.exe96⤵PID:3924
-
\??\c:\lffxrxf.exec:\lffxrxf.exe97⤵PID:4316
-
\??\c:\lfrlxlf.exec:\lfrlxlf.exe98⤵PID:1608
-
\??\c:\1nntth.exec:\1nntth.exe99⤵PID:1780
-
\??\c:\bhbhtt.exec:\bhbhtt.exe100⤵PID:1820
-
\??\c:\pjdvj.exec:\pjdvj.exe101⤵PID:1524
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe102⤵PID:1156
-
\??\c:\9hhbnn.exec:\9hhbnn.exe103⤵PID:5000
-
\??\c:\5nnnbb.exec:\5nnnbb.exe104⤵PID:1756
-
\??\c:\pvvvj.exec:\pvvvj.exe105⤵PID:3916
-
\??\c:\ppdpj.exec:\ppdpj.exe106⤵PID:3448
-
\??\c:\xfxlxxl.exec:\xfxlxxl.exe107⤵PID:3472
-
\??\c:\1flxlfx.exec:\1flxlfx.exe108⤵PID:2536
-
\??\c:\nbbbtt.exec:\nbbbtt.exe109⤵PID:2896
-
\??\c:\3nbhbn.exec:\3nbhbn.exe110⤵PID:964
-
\??\c:\dpvvv.exec:\dpvvv.exe111⤵PID:4832
-
\??\c:\9ddvj.exec:\9ddvj.exe112⤵PID:4916
-
\??\c:\rfxfrlr.exec:\rfxfrlr.exe113⤵PID:4388
-
\??\c:\frxrffx.exec:\frxrffx.exe114⤵PID:628
-
\??\c:\bbnnnn.exec:\bbnnnn.exe115⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\9hhbtt.exec:\9hhbtt.exe116⤵PID:3608
-
\??\c:\jpdvp.exec:\jpdvp.exe117⤵PID:2600
-
\??\c:\pjvjd.exec:\pjvjd.exe118⤵PID:4340
-
\??\c:\xrxxffr.exec:\xrxxffr.exe119⤵PID:1152
-
\??\c:\9frlxxl.exec:\9frlxxl.exe120⤵PID:3964
-
\??\c:\7lrlfff.exec:\7lrlfff.exe121⤵PID:1020
-
\??\c:\7hhhbb.exec:\7hhhbb.exe122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-