Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 11:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fbf00f864740fdb9976f3908477d49a0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
fbf00f864740fdb9976f3908477d49a0N.exe
-
Size
82KB
-
MD5
fbf00f864740fdb9976f3908477d49a0
-
SHA1
408bae2e147edbfdaa456abc2b14fb6141f9a941
-
SHA256
b6d058d4e9d28e480b300d0ecdd55320cc6d57b251812569f36c77b649217c56
-
SHA512
7b3e8354ce7862134a48205a507bc43c5d5c1f23354f6f5122307e7ead1c16c5a33f144fb598dd077f82cf2328c77cb5d2e43d141dac911cb93b14710a096ddc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q3:ymb3NkkiQ3mdBjFIIp9L9QrrA8O
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4828 lxxxrrl.exe 368 vdjdv.exe 1452 vppjd.exe 4364 xxxrffx.exe 3436 nhnhbt.exe 1724 1tbttn.exe 5024 7llxxrr.exe 3220 tttnhn.exe 464 xrxlflf.exe 3752 bnhbtt.exe 2688 jpppj.exe 1968 rllrlfx.exe 4748 7rxxrxr.exe 820 7httbt.exe 3912 vddvp.exe 3960 5xffrrr.exe 8 7tbttn.exe 2468 vdjvp.exe 664 rrrrfff.exe 3636 rlxxfxl.exe 4244 hnttnn.exe 1972 vpjpp.exe 816 llxxxxr.exe 2596 lrxrrrr.exe 3016 bnbbbb.exe 5096 pjjdp.exe 3116 ppjdd.exe 1712 fxffxfx.exe 3424 vdppp.exe 1840 fxxrllf.exe 960 rlffffx.exe 392 7btthh.exe 764 tnnnnn.exe 2424 ppvdj.exe 4504 jvvvv.exe 3600 xrxllfl.exe 208 rlrlxxr.exe 1036 ntbttt.exe 4352 nbbthb.exe 4640 djjvj.exe 1564 5ddpd.exe 988 rxxlxxr.exe 4592 lffxrrf.exe 3800 hhtntn.exe 4760 hnhbnn.exe 2512 jdddp.exe 4780 jddvp.exe 1496 rllrlff.exe 2232 rxllxxx.exe 992 hhhbtn.exe 5024 nnttbt.exe 3248 vvvjd.exe 3140 1rfrxrx.exe 2540 ffxrllf.exe 4536 5ttnnh.exe 4848 3hbtnn.exe 4612 1jppj.exe 4316 pvvpj.exe 5036 xrffxrr.exe 2032 9ntnhb.exe 4964 hhhbnn.exe 436 pjdvj.exe 2836 jpvjv.exe 3912 lrllxfx.exe -
resource yara_rule behavioral2/memory/4656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 4828 4656 fbf00f864740fdb9976f3908477d49a0N.exe 83 PID 4656 wrote to memory of 4828 4656 fbf00f864740fdb9976f3908477d49a0N.exe 83 PID 4656 wrote to memory of 4828 4656 fbf00f864740fdb9976f3908477d49a0N.exe 83 PID 4828 wrote to memory of 368 4828 lxxxrrl.exe 84 PID 4828 wrote to memory of 368 4828 lxxxrrl.exe 84 PID 4828 wrote to memory of 368 4828 lxxxrrl.exe 84 PID 368 wrote to memory of 1452 368 vdjdv.exe 85 PID 368 wrote to memory of 1452 368 vdjdv.exe 85 PID 368 wrote to memory of 1452 368 vdjdv.exe 85 PID 1452 wrote to memory of 4364 1452 vppjd.exe 86 PID 1452 wrote to memory of 4364 1452 vppjd.exe 86 PID 1452 wrote to memory of 4364 1452 vppjd.exe 86 PID 4364 wrote to memory of 3436 4364 xxxrffx.exe 87 PID 4364 wrote to memory of 3436 4364 xxxrffx.exe 87 PID 4364 wrote to memory of 3436 4364 xxxrffx.exe 87 PID 3436 wrote to memory of 1724 3436 nhnhbt.exe 88 PID 3436 wrote to memory of 1724 3436 nhnhbt.exe 88 PID 3436 wrote to memory of 1724 3436 nhnhbt.exe 88 PID 1724 wrote to memory of 5024 1724 1tbttn.exe 90 PID 1724 wrote to memory of 5024 1724 1tbttn.exe 90 PID 1724 wrote to memory of 5024 1724 1tbttn.exe 90 PID 5024 wrote to memory of 3220 5024 7llxxrr.exe 91 PID 5024 wrote to memory of 3220 5024 7llxxrr.exe 91 PID 5024 wrote to memory of 3220 5024 7llxxrr.exe 91 PID 3220 wrote to memory of 464 3220 tttnhn.exe 93 PID 3220 wrote to memory of 464 3220 tttnhn.exe 93 PID 3220 wrote to memory of 464 3220 tttnhn.exe 93 PID 464 wrote to memory of 3752 464 xrxlflf.exe 94 PID 464 wrote to memory of 3752 464 xrxlflf.exe 94 PID 464 wrote to memory of 3752 464 xrxlflf.exe 94 PID 3752 wrote to memory of 2688 3752 bnhbtt.exe 95 PID 3752 wrote to memory of 2688 3752 bnhbtt.exe 95 PID 3752 wrote to memory of 2688 3752 bnhbtt.exe 95 PID 2688 wrote to memory of 1968 2688 jpppj.exe 96 PID 2688 wrote to memory of 1968 2688 jpppj.exe 96 PID 2688 wrote to memory of 1968 2688 jpppj.exe 96 PID 1968 wrote to memory of 4748 1968 rllrlfx.exe 97 PID 1968 wrote to memory of 4748 1968 rllrlfx.exe 97 PID 1968 wrote to memory of 4748 1968 rllrlfx.exe 97 PID 4748 wrote to memory of 820 4748 7rxxrxr.exe 98 PID 4748 wrote to memory of 820 4748 7rxxrxr.exe 98 PID 4748 wrote to memory of 820 4748 7rxxrxr.exe 98 PID 820 wrote to memory of 3912 820 7httbt.exe 99 PID 820 wrote to memory of 3912 820 7httbt.exe 99 PID 820 wrote to memory of 3912 820 7httbt.exe 99 PID 3912 wrote to memory of 3960 3912 vddvp.exe 101 PID 3912 wrote to memory of 3960 3912 vddvp.exe 101 PID 3912 wrote to memory of 3960 3912 vddvp.exe 101 PID 3960 wrote to memory of 8 3960 5xffrrr.exe 102 PID 3960 wrote to memory of 8 3960 5xffrrr.exe 102 PID 3960 wrote to memory of 8 3960 5xffrrr.exe 102 PID 8 wrote to memory of 2468 8 7tbttn.exe 103 PID 8 wrote to memory of 2468 8 7tbttn.exe 103 PID 8 wrote to memory of 2468 8 7tbttn.exe 103 PID 2468 wrote to memory of 664 2468 vdjvp.exe 104 PID 2468 wrote to memory of 664 2468 vdjvp.exe 104 PID 2468 wrote to memory of 664 2468 vdjvp.exe 104 PID 664 wrote to memory of 3636 664 rrrrfff.exe 105 PID 664 wrote to memory of 3636 664 rrrrfff.exe 105 PID 664 wrote to memory of 3636 664 rrrrfff.exe 105 PID 3636 wrote to memory of 4244 3636 rlxxfxl.exe 106 PID 3636 wrote to memory of 4244 3636 rlxxfxl.exe 106 PID 3636 wrote to memory of 4244 3636 rlxxfxl.exe 106 PID 4244 wrote to memory of 1972 4244 hnttnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbf00f864740fdb9976f3908477d49a0N.exe"C:\Users\Admin\AppData\Local\Temp\fbf00f864740fdb9976f3908477d49a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vdjdv.exec:\vdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\vppjd.exec:\vppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\xxxrffx.exec:\xxxrffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\nhnhbt.exec:\nhnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\1tbttn.exec:\1tbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\7llxxrr.exec:\7llxxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\tttnhn.exec:\tttnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\xrxlflf.exec:\xrxlflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\bnhbtt.exec:\bnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\jpppj.exec:\jpppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rllrlfx.exec:\rllrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7rxxrxr.exec:\7rxxrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\7httbt.exec:\7httbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\vddvp.exec:\vddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\5xffrrr.exec:\5xffrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\7tbttn.exec:\7tbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\vdjvp.exec:\vdjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rrrrfff.exec:\rrrrfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\rlxxfxl.exec:\rlxxfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\hnttnn.exec:\hnttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\vpjpp.exec:\vpjpp.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\llxxxxr.exec:\llxxxxr.exe24⤵
- Executes dropped EXE
PID:816 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe25⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bnbbbb.exec:\bnbbbb.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pjjdp.exec:\pjjdp.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5096 -
\??\c:\ppjdd.exec:\ppjdd.exe28⤵
- Executes dropped EXE
PID:3116 -
\??\c:\fxffxfx.exec:\fxffxfx.exe29⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vdppp.exec:\vdppp.exe30⤵
- Executes dropped EXE
PID:3424 -
\??\c:\fxxrllf.exec:\fxxrllf.exe31⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rlffffx.exec:\rlffffx.exe32⤵
- Executes dropped EXE
PID:960 -
\??\c:\7btthh.exec:\7btthh.exe33⤵
- Executes dropped EXE
PID:392 -
\??\c:\tnnnnn.exec:\tnnnnn.exe34⤵
- Executes dropped EXE
PID:764 -
\??\c:\ppvdj.exec:\ppvdj.exe35⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jvvvv.exec:\jvvvv.exe36⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xrxllfl.exec:\xrxllfl.exe37⤵
- Executes dropped EXE
PID:3600 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe38⤵
- Executes dropped EXE
PID:208 -
\??\c:\ntbttt.exec:\ntbttt.exe39⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nbbthb.exec:\nbbthb.exe40⤵
- Executes dropped EXE
PID:4352 -
\??\c:\djjvj.exec:\djjvj.exe41⤵
- Executes dropped EXE
PID:4640 -
\??\c:\5ddpd.exec:\5ddpd.exe42⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe43⤵
- Executes dropped EXE
PID:988 -
\??\c:\lffxrrf.exec:\lffxrrf.exe44⤵
- Executes dropped EXE
PID:4592 -
\??\c:\hhtntn.exec:\hhtntn.exe45⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hnhbnn.exec:\hnhbnn.exe46⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jdddp.exec:\jdddp.exe47⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jddvp.exec:\jddvp.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rllrlff.exec:\rllrlff.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rxllxxx.exec:\rxllxxx.exe50⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hhhbtn.exec:\hhhbtn.exe51⤵
- Executes dropped EXE
PID:992 -
\??\c:\nnttbt.exec:\nnttbt.exe52⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vvvjd.exec:\vvvjd.exe53⤵
- Executes dropped EXE
PID:3248 -
\??\c:\1rfrxrx.exec:\1rfrxrx.exe54⤵
- Executes dropped EXE
PID:3140 -
\??\c:\ffxrllf.exec:\ffxrllf.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5ttnnh.exec:\5ttnnh.exe56⤵
- Executes dropped EXE
PID:4536 -
\??\c:\3hbtnn.exec:\3hbtnn.exe57⤵
- Executes dropped EXE
PID:4848 -
\??\c:\1jppj.exec:\1jppj.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pvvpj.exec:\pvvpj.exe59⤵
- Executes dropped EXE
PID:4316 -
\??\c:\xrffxrr.exec:\xrffxrr.exe60⤵
- Executes dropped EXE
PID:5036 -
\??\c:\9ntnhb.exec:\9ntnhb.exe61⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hhhbnn.exec:\hhhbnn.exe62⤵
- Executes dropped EXE
PID:4964 -
\??\c:\pjdvj.exec:\pjdvj.exe63⤵
- Executes dropped EXE
PID:436 -
\??\c:\jpvjv.exec:\jpvjv.exe64⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lrllxfx.exec:\lrllxfx.exe65⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rlllllf.exec:\rlllllf.exe66⤵PID:3960
-
\??\c:\bhthth.exec:\bhthth.exe67⤵PID:8
-
\??\c:\htbbnn.exec:\htbbnn.exe68⤵PID:1000
-
\??\c:\7djdd.exec:\7djdd.exe69⤵PID:3700
-
\??\c:\7vddp.exec:\7vddp.exe70⤵PID:3564
-
\??\c:\flfrfrr.exec:\flfrfrr.exe71⤵PID:3636
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe72⤵PID:2228
-
\??\c:\httnhh.exec:\httnhh.exe73⤵PID:2252
-
\??\c:\nhhnht.exec:\nhhnht.exe74⤵PID:696
-
\??\c:\5jjdj.exec:\5jjdj.exe75⤵PID:3328
-
\??\c:\vdjdd.exec:\vdjdd.exe76⤵PID:2636
-
\??\c:\rrlfflr.exec:\rrlfflr.exe77⤵PID:4516
-
\??\c:\flffxxr.exec:\flffxxr.exe78⤵PID:1156
-
\??\c:\vjdvv.exec:\vjdvv.exe79⤵PID:2452
-
\??\c:\3jjdv.exec:\3jjdv.exe80⤵PID:456
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe81⤵PID:1068
-
\??\c:\flxrrlf.exec:\flxrrlf.exe82⤵PID:1548
-
\??\c:\tnntnb.exec:\tnntnb.exe83⤵PID:2616
-
\??\c:\vjpjd.exec:\vjpjd.exe84⤵PID:2020
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe85⤵PID:3192
-
\??\c:\tbhhbt.exec:\tbhhbt.exe86⤵PID:392
-
\??\c:\hbhnnh.exec:\hbhnnh.exe87⤵PID:3964
-
\??\c:\vpjdj.exec:\vpjdj.exe88⤵PID:228
-
\??\c:\rlrlllr.exec:\rlrlllr.exe89⤵PID:4596
-
\??\c:\frrlfxr.exec:\frrlfxr.exe90⤵PID:3600
-
\??\c:\thnhhh.exec:\thnhhh.exe91⤵PID:4576
-
\??\c:\btttbb.exec:\btttbb.exe92⤵PID:4068
-
\??\c:\dvvpd.exec:\dvvpd.exe93⤵PID:4656
-
\??\c:\jppjd.exec:\jppjd.exe94⤵PID:2904
-
\??\c:\frxrllf.exec:\frxrllf.exe95⤵PID:1436
-
\??\c:\frrllxl.exec:\frrllxl.exe96⤵PID:536
-
\??\c:\httnhh.exec:\httnhh.exe97⤵PID:3100
-
\??\c:\5thbtt.exec:\5thbtt.exe98⤵PID:2280
-
\??\c:\vdjdv.exec:\vdjdv.exe99⤵PID:4412
-
\??\c:\lxrrlrx.exec:\lxrrlrx.exe100⤵PID:2332
-
\??\c:\hbhhhb.exec:\hbhhhb.exe101⤵PID:840
-
\??\c:\nhhhbh.exec:\nhhhbh.exe102⤵PID:2848
-
\??\c:\pjpjv.exec:\pjpjv.exe103⤵PID:4808
-
\??\c:\dvvpd.exec:\dvvpd.exe104⤵PID:3340
-
\??\c:\vvjdd.exec:\vvjdd.exe105⤵PID:2140
-
\??\c:\5frllll.exec:\5frllll.exe106⤵PID:4508
-
\??\c:\xlllffx.exec:\xlllffx.exe107⤵PID:2168
-
\??\c:\tttnhb.exec:\tttnhb.exe108⤵PID:3752
-
\??\c:\bttbth.exec:\bttbth.exe109⤵PID:1640
-
\??\c:\jdjdj.exec:\jdjdj.exe110⤵PID:3776
-
\??\c:\frrlfxx.exec:\frrlfxx.exe111⤵PID:2484
-
\??\c:\1xfxrlf.exec:\1xfxrlf.exe112⤵PID:2700
-
\??\c:\nhnhbb.exec:\nhnhbb.exe113⤵PID:1460
-
\??\c:\tbbtnh.exec:\tbbtnh.exe114⤵PID:2976
-
\??\c:\jvjdp.exec:\jvjdp.exe115⤵PID:2260
-
\??\c:\dpvpd.exec:\dpvpd.exe116⤵PID:4616
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe117⤵PID:3044
-
\??\c:\rrrlffx.exec:\rrrlffx.exe118⤵PID:1676
-
\??\c:\hhnthb.exec:\hhnthb.exe119⤵PID:4724
-
\??\c:\tntbnn.exec:\tntbnn.exe120⤵PID:1168
-
\??\c:\vjvpd.exec:\vjvpd.exe121⤵PID:3540
-
\??\c:\jdjvv.exec:\jdjvv.exe122⤵PID:4992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-