Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37e3a9a9a84561752662f01ed2495200N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
37e3a9a9a84561752662f01ed2495200N.exe
-
Size
65KB
-
MD5
37e3a9a9a84561752662f01ed2495200
-
SHA1
f8c3ca95bcca24d1d48e4ba98b65c6978de13a9a
-
SHA256
71a55f3d8cbe5f2ae85be40a1a93201c0f7d05bf130b1972cfab78b8997fa8bb
-
SHA512
58bf401f6f5d8b0c5314579f77b0338ff20382ad2a6e3a8a8a2673a614ed0709d03b130cab294f69d35c2a2cb3c401dbbbf2437af1670a7d63ffd7dd6dc57102
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe6a:ymb3NkkiQ3mdBjF0y7kbUv
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4144-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4720 vpvpp.exe 3936 vvvpj.exe 2732 xrllrrx.exe 4796 nhhbbb.exe 2892 ddddv.exe 4468 tnbntn.exe 4240 nhnhbb.exe 4724 dvjjd.exe 3296 lrxrrxx.exe 1848 5jjjj.exe 1704 pjjpd.exe 736 hbhnnn.exe 4316 bthnnb.exe 4832 jdpvp.exe 2400 rfllfff.exe 1864 7xffrxr.exe 2640 bbttnn.exe 2320 jpjjv.exe 3016 xrrlfff.exe 632 5rrrrrl.exe 4088 dvdvv.exe 2264 lflfxff.exe 2076 hbhtnb.exe 1084 vpvpp.exe 3152 ppvdv.exe 1012 1rffffx.exe 2280 tbnnnn.exe 3524 3pjdv.exe 4968 flllrff.exe 2168 rxrrrxx.exe 344 thntbn.exe 472 7pvvv.exe 756 pdddp.exe 1612 pjddd.exe 964 rrlfflf.exe 3096 xxlrffl.exe 2092 nhbbtn.exe 5076 vpppv.exe 2888 vvjdd.exe 224 jddvp.exe 5052 lllfffr.exe 4192 ffrrxll.exe 116 nbbbbh.exe 2732 1dppd.exe 948 vvpvp.exe 4320 vpvpj.exe 1744 xrrrrff.exe 4064 hhbtth.exe 1092 3ppvv.exe 4240 fxlllxr.exe 4416 ffffflr.exe 2648 nntnbb.exe 3960 jjjjv.exe 4488 5jppj.exe 1768 rrlxxfr.exe 5116 ffllfll.exe 2204 nntnnn.exe 4696 jvddd.exe 4832 1dpjj.exe 1688 lxllfll.exe 1608 fxrrrrr.exe 5084 nhhntb.exe 1312 nntnhh.exe 3344 pjdvv.exe -
resource yara_rule behavioral2/memory/4144-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/344-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4720 4144 37e3a9a9a84561752662f01ed2495200N.exe 83 PID 4144 wrote to memory of 4720 4144 37e3a9a9a84561752662f01ed2495200N.exe 83 PID 4144 wrote to memory of 4720 4144 37e3a9a9a84561752662f01ed2495200N.exe 83 PID 4720 wrote to memory of 3936 4720 vpvpp.exe 84 PID 4720 wrote to memory of 3936 4720 vpvpp.exe 84 PID 4720 wrote to memory of 3936 4720 vpvpp.exe 84 PID 3936 wrote to memory of 2732 3936 vvvpj.exe 85 PID 3936 wrote to memory of 2732 3936 vvvpj.exe 85 PID 3936 wrote to memory of 2732 3936 vvvpj.exe 85 PID 2732 wrote to memory of 4796 2732 xrllrrx.exe 86 PID 2732 wrote to memory of 4796 2732 xrllrrx.exe 86 PID 2732 wrote to memory of 4796 2732 xrllrrx.exe 86 PID 4796 wrote to memory of 2892 4796 nhhbbb.exe 87 PID 4796 wrote to memory of 2892 4796 nhhbbb.exe 87 PID 4796 wrote to memory of 2892 4796 nhhbbb.exe 87 PID 2892 wrote to memory of 4468 2892 ddddv.exe 88 PID 2892 wrote to memory of 4468 2892 ddddv.exe 88 PID 2892 wrote to memory of 4468 2892 ddddv.exe 88 PID 4468 wrote to memory of 4240 4468 tnbntn.exe 89 PID 4468 wrote to memory of 4240 4468 tnbntn.exe 89 PID 4468 wrote to memory of 4240 4468 tnbntn.exe 89 PID 4240 wrote to memory of 4724 4240 nhnhbb.exe 91 PID 4240 wrote to memory of 4724 4240 nhnhbb.exe 91 PID 4240 wrote to memory of 4724 4240 nhnhbb.exe 91 PID 4724 wrote to memory of 3296 4724 dvjjd.exe 92 PID 4724 wrote to memory of 3296 4724 dvjjd.exe 92 PID 4724 wrote to memory of 3296 4724 dvjjd.exe 92 PID 3296 wrote to memory of 1848 3296 lrxrrxx.exe 93 PID 3296 wrote to memory of 1848 3296 lrxrrxx.exe 93 PID 3296 wrote to memory of 1848 3296 lrxrrxx.exe 93 PID 1848 wrote to memory of 1704 1848 5jjjj.exe 94 PID 1848 wrote to memory of 1704 1848 5jjjj.exe 94 PID 1848 wrote to memory of 1704 1848 5jjjj.exe 94 PID 1704 wrote to memory of 736 1704 pjjpd.exe 95 PID 1704 wrote to memory of 736 1704 pjjpd.exe 95 PID 1704 wrote to memory of 736 1704 pjjpd.exe 95 PID 736 wrote to memory of 4316 736 hbhnnn.exe 97 PID 736 wrote to memory of 4316 736 hbhnnn.exe 97 PID 736 wrote to memory of 4316 736 hbhnnn.exe 97 PID 4316 wrote to memory of 4832 4316 bthnnb.exe 98 PID 4316 wrote to memory of 4832 4316 bthnnb.exe 98 PID 4316 wrote to memory of 4832 4316 bthnnb.exe 98 PID 4832 wrote to memory of 2400 4832 jdpvp.exe 99 PID 4832 wrote to memory of 2400 4832 jdpvp.exe 99 PID 4832 wrote to memory of 2400 4832 jdpvp.exe 99 PID 2400 wrote to memory of 1864 2400 rfllfff.exe 100 PID 2400 wrote to memory of 1864 2400 rfllfff.exe 100 PID 2400 wrote to memory of 1864 2400 rfllfff.exe 100 PID 1864 wrote to memory of 2640 1864 7xffrxr.exe 101 PID 1864 wrote to memory of 2640 1864 7xffrxr.exe 101 PID 1864 wrote to memory of 2640 1864 7xffrxr.exe 101 PID 2640 wrote to memory of 2320 2640 bbttnn.exe 102 PID 2640 wrote to memory of 2320 2640 bbttnn.exe 102 PID 2640 wrote to memory of 2320 2640 bbttnn.exe 102 PID 2320 wrote to memory of 3016 2320 jpjjv.exe 103 PID 2320 wrote to memory of 3016 2320 jpjjv.exe 103 PID 2320 wrote to memory of 3016 2320 jpjjv.exe 103 PID 3016 wrote to memory of 632 3016 xrrlfff.exe 104 PID 3016 wrote to memory of 632 3016 xrrlfff.exe 104 PID 3016 wrote to memory of 632 3016 xrrlfff.exe 104 PID 632 wrote to memory of 4088 632 5rrrrrl.exe 106 PID 632 wrote to memory of 4088 632 5rrrrrl.exe 106 PID 632 wrote to memory of 4088 632 5rrrrrl.exe 106 PID 4088 wrote to memory of 2264 4088 dvdvv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\37e3a9a9a84561752662f01ed2495200N.exe"C:\Users\Admin\AppData\Local\Temp\37e3a9a9a84561752662f01ed2495200N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\vpvpp.exec:\vpvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\vvvpj.exec:\vvvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\xrllrrx.exec:\xrllrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhhbbb.exec:\nhhbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\ddddv.exec:\ddddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tnbntn.exec:\tnbntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\nhnhbb.exec:\nhnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\dvjjd.exec:\dvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\lrxrrxx.exec:\lrxrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\5jjjj.exec:\5jjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\pjjpd.exec:\pjjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hbhnnn.exec:\hbhnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\bthnnb.exec:\bthnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\jdpvp.exec:\jdpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\rfllfff.exec:\rfllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\7xffrxr.exec:\7xffrxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\bbttnn.exec:\bbttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jpjjv.exec:\jpjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrrlfff.exec:\xrrlfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\5rrrrrl.exec:\5rrrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\dvdvv.exec:\dvdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\lflfxff.exec:\lflfxff.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbhtnb.exec:\hbhtnb.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vpvpp.exec:\vpvpp.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ppvdv.exec:\ppvdv.exe26⤵
- Executes dropped EXE
PID:3152 -
\??\c:\1rffffx.exec:\1rffffx.exe27⤵
- Executes dropped EXE
PID:1012 -
\??\c:\tbnnnn.exec:\tbnnnn.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3pjdv.exec:\3pjdv.exe29⤵
- Executes dropped EXE
PID:3524 -
\??\c:\flllrff.exec:\flllrff.exe30⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe31⤵
- Executes dropped EXE
PID:2168 -
\??\c:\thntbn.exec:\thntbn.exe32⤵
- Executes dropped EXE
PID:344 -
\??\c:\7pvvv.exec:\7pvvv.exe33⤵
- Executes dropped EXE
PID:472 -
\??\c:\pdddp.exec:\pdddp.exe34⤵
- Executes dropped EXE
PID:756 -
\??\c:\pjddd.exec:\pjddd.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rrlfflf.exec:\rrlfflf.exe36⤵
- Executes dropped EXE
PID:964 -
\??\c:\xxlrffl.exec:\xxlrffl.exe37⤵
- Executes dropped EXE
PID:3096 -
\??\c:\nhbbtn.exec:\nhbbtn.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vpppv.exec:\vpppv.exe39⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vvjdd.exec:\vvjdd.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
PID:224 -
\??\c:\lllfffr.exec:\lllfffr.exe42⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ffrrxll.exec:\ffrrxll.exe43⤵
- Executes dropped EXE
PID:4192 -
\??\c:\nbbbbh.exec:\nbbbbh.exe44⤵
- Executes dropped EXE
PID:116 -
\??\c:\1dppd.exec:\1dppd.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vvpvp.exec:\vvpvp.exe46⤵
- Executes dropped EXE
PID:948 -
\??\c:\vpvpj.exec:\vpvpj.exe47⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xrrrrff.exec:\xrrrrff.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhbtth.exec:\hhbtth.exe49⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3ppvv.exec:\3ppvv.exe50⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxlllxr.exec:\fxlllxr.exe51⤵
- Executes dropped EXE
PID:4240 -
\??\c:\ffffflr.exec:\ffffflr.exe52⤵
- Executes dropped EXE
PID:4416 -
\??\c:\nntnbb.exec:\nntnbb.exe53⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jjjjv.exec:\jjjjv.exe54⤵
- Executes dropped EXE
PID:3960 -
\??\c:\5jppj.exec:\5jppj.exe55⤵
- Executes dropped EXE
PID:4488 -
\??\c:\rrlxxfr.exec:\rrlxxfr.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ffllfll.exec:\ffllfll.exe57⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nntnnn.exec:\nntnnn.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jvddd.exec:\jvddd.exe59⤵
- Executes dropped EXE
PID:4696 -
\??\c:\1dpjj.exec:\1dpjj.exe60⤵
- Executes dropped EXE
PID:4832 -
\??\c:\lxllfll.exec:\lxllfll.exe61⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhhntb.exec:\nhhntb.exe63⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nntnhh.exec:\nntnhh.exe64⤵
- Executes dropped EXE
PID:1312 -
\??\c:\pjdvv.exec:\pjdvv.exe65⤵
- Executes dropped EXE
PID:3344 -
\??\c:\ddpjd.exec:\ddpjd.exe66⤵PID:2800
-
\??\c:\9xfllrl.exec:\9xfllrl.exe67⤵PID:4744
-
\??\c:\frxffff.exec:\frxffff.exe68⤵PID:5064
-
\??\c:\3bbhnb.exec:\3bbhnb.exe69⤵PID:5012
-
\??\c:\3pvvj.exec:\3pvvj.exe70⤵PID:5048
-
\??\c:\vjvpp.exec:\vjvpp.exe71⤵PID:3748
-
\??\c:\frrlfff.exec:\frrlfff.exe72⤵PID:1404
-
\??\c:\lxrrrxf.exec:\lxrrrxf.exe73⤵PID:1084
-
\??\c:\htbbtn.exec:\htbbtn.exe74⤵PID:2884
-
\??\c:\tbnhhn.exec:\tbnhhn.exe75⤵PID:1752
-
\??\c:\ppvpj.exec:\ppvpj.exe76⤵PID:3624
-
\??\c:\pdppj.exec:\pdppj.exe77⤵PID:1096
-
\??\c:\rllrxfx.exec:\rllrxfx.exe78⤵PID:4084
-
\??\c:\djjjd.exec:\djjjd.exe79⤵PID:3352
-
\??\c:\jdvdd.exec:\jdvdd.exe80⤵PID:472
-
\??\c:\lllxrff.exec:\lllxrff.exe81⤵PID:2184
-
\??\c:\5hnnnh.exec:\5hnnnh.exe82⤵PID:4940
-
\??\c:\hhhbbt.exec:\hhhbbt.exe83⤵PID:2600
-
\??\c:\pddvj.exec:\pddvj.exe84⤵PID:4220
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe85⤵PID:920
-
\??\c:\rlxxffl.exec:\rlxxffl.exe86⤵PID:912
-
\??\c:\hhtnnn.exec:\hhtnnn.exe87⤵PID:4528
-
\??\c:\dvvpp.exec:\dvvpp.exe88⤵PID:4720
-
\??\c:\vppjj.exec:\vppjj.exe89⤵PID:3936
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe90⤵PID:116
-
\??\c:\tnttnt.exec:\tnttnt.exe91⤵PID:4796
-
\??\c:\tnhbtt.exec:\tnhbtt.exe92⤵PID:4232
-
\??\c:\jpdvd.exec:\jpdvd.exe93⤵PID:2232
-
\??\c:\llffrrl.exec:\llffrrl.exe94⤵PID:4344
-
\??\c:\7hbbbb.exec:\7hbbbb.exe95⤵PID:2492
-
\??\c:\thbbbb.exec:\thbbbb.exe96⤵PID:4180
-
\??\c:\3ppjd.exec:\3ppjd.exe97⤵PID:4748
-
\??\c:\fxrlfff.exec:\fxrlfff.exe98⤵PID:376
-
\??\c:\xrxrllf.exec:\xrxrllf.exe99⤵PID:3960
-
\??\c:\3nnhbb.exec:\3nnhbb.exe100⤵PID:4488
-
\??\c:\hbbtnn.exec:\hbbtnn.exe101⤵PID:2968
-
\??\c:\ddpjp.exec:\ddpjp.exe102⤵PID:4772
-
\??\c:\3vvvp.exec:\3vvvp.exe103⤵PID:2204
-
\??\c:\3lxxxrl.exec:\3lxxxrl.exe104⤵PID:2212
-
\??\c:\3rrrrrl.exec:\3rrrrrl.exe105⤵PID:5104
-
\??\c:\7ttthh.exec:\7ttthh.exe106⤵PID:5100
-
\??\c:\nbbtnb.exec:\nbbtnb.exe107⤵PID:4276
-
\??\c:\vpjdd.exec:\vpjdd.exe108⤵PID:2992
-
\??\c:\rllffxr.exec:\rllffxr.exe109⤵PID:208
-
\??\c:\7ntttb.exec:\7ntttb.exe110⤵PID:4840
-
\??\c:\hbnnnn.exec:\hbnnnn.exe111⤵PID:3344
-
\??\c:\jpdpj.exec:\jpdpj.exe112⤵PID:3688
-
\??\c:\jpdvd.exec:\jpdvd.exe113⤵PID:5072
-
\??\c:\5rflxlx.exec:\5rflxlx.exe114⤵
- System Location Discovery: System Language Discovery
PID:4712 -
\??\c:\lllrrrr.exec:\lllrrrr.exe115⤵PID:1748
-
\??\c:\1hhttt.exec:\1hhttt.exe116⤵PID:2736
-
\??\c:\tntnnn.exec:\tntnnn.exe117⤵PID:4788
-
\??\c:\vdddd.exec:\vdddd.exe118⤵PID:3300
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:1796
-
\??\c:\1frlllf.exec:\1frlllf.exe120⤵PID:4968
-
\??\c:\lfxrllr.exec:\lfxrllr.exe121⤵PID:4548
-
\??\c:\bttbtb.exec:\bttbtb.exe122⤵PID:3536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-