Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fecfe2ce715c2e01aedfacf2036e9440N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
fecfe2ce715c2e01aedfacf2036e9440N.exe
-
Size
65KB
-
MD5
fecfe2ce715c2e01aedfacf2036e9440
-
SHA1
8b9733f0cf590e244e23e51acafb24f6bff5cfa6
-
SHA256
03fc86ed07231b32ed56cddb0de78bd4359dcd3c93bf8b8078f99fec4422b0f1
-
SHA512
13bdb7bf711961ac1d940522c8f30b3e004f7449c309b9ade40329b553f683d6cf93a41d05729b81ff0c1023afb10c808f4f248958ae9b2dee8628d0196f20e5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe/:ymb3NkkiQ3mdBjF0y7kbU/
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1804-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 700 jvvjj.exe 5004 3xxlxff.exe 2756 lxxxxxr.exe 3984 3bnnhh.exe 2372 bhnhbb.exe 732 xxffflr.exe 1336 bttnnn.exe 4500 vdvvp.exe 1004 9rllfxr.exe 3540 jpdpp.exe 924 5ddpd.exe 1028 rflfxxx.exe 2280 llllxxl.exe 1540 3hhhhh.exe 4976 pddvp.exe 1716 jjjvp.exe 5068 xlrllll.exe 4300 3nhtnn.exe 3376 vvdvd.exe 2072 5ppjd.exe 3320 lflfrrl.exe 640 tnhhbb.exe 3432 9hnnnn.exe 2964 jdvjv.exe 1908 3jdvp.exe 648 7rrrrrl.exe 3476 ffllrrf.exe 5020 9btbtb.exe 3644 1jvjv.exe 3156 jvpvp.exe 5016 flxrllr.exe 4232 hhnnhh.exe 3700 bhbnhb.exe 4172 bnnnbb.exe 2676 3djjv.exe 4956 dvvpj.exe 2508 llxrffl.exe 4676 fllfrlr.exe 4872 nbbttn.exe 4384 hhthnn.exe 3688 dvpdp.exe 3488 lxlfxxx.exe 4536 bnnnhb.exe 2864 pjvpj.exe 2700 vppjv.exe 3984 rxffrfr.exe 4396 htthbt.exe 4836 hnhbnn.exe 940 dvjdv.exe 732 jvdvj.exe 3380 lxrrlff.exe 2264 rllxrxr.exe 3000 7rxxrlf.exe 2704 bhnhtn.exe 1004 1ntnbt.exe 3540 3dpjd.exe 3592 9ppdd.exe 4168 lllfrlf.exe 4048 5rfxlfx.exe 1388 tnhbnh.exe 368 ththhh.exe 2648 dvjdp.exe 2288 ppjdp.exe 1848 jvvpj.exe -
resource yara_rule behavioral2/memory/1804-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 700 1804 fecfe2ce715c2e01aedfacf2036e9440N.exe 83 PID 1804 wrote to memory of 700 1804 fecfe2ce715c2e01aedfacf2036e9440N.exe 83 PID 1804 wrote to memory of 700 1804 fecfe2ce715c2e01aedfacf2036e9440N.exe 83 PID 700 wrote to memory of 5004 700 jvvjj.exe 84 PID 700 wrote to memory of 5004 700 jvvjj.exe 84 PID 700 wrote to memory of 5004 700 jvvjj.exe 84 PID 5004 wrote to memory of 2756 5004 3xxlxff.exe 85 PID 5004 wrote to memory of 2756 5004 3xxlxff.exe 85 PID 5004 wrote to memory of 2756 5004 3xxlxff.exe 85 PID 2756 wrote to memory of 3984 2756 lxxxxxr.exe 86 PID 2756 wrote to memory of 3984 2756 lxxxxxr.exe 86 PID 2756 wrote to memory of 3984 2756 lxxxxxr.exe 86 PID 3984 wrote to memory of 2372 3984 3bnnhh.exe 87 PID 3984 wrote to memory of 2372 3984 3bnnhh.exe 87 PID 3984 wrote to memory of 2372 3984 3bnnhh.exe 87 PID 2372 wrote to memory of 732 2372 bhnhbb.exe 89 PID 2372 wrote to memory of 732 2372 bhnhbb.exe 89 PID 2372 wrote to memory of 732 2372 bhnhbb.exe 89 PID 732 wrote to memory of 1336 732 xxffflr.exe 90 PID 732 wrote to memory of 1336 732 xxffflr.exe 90 PID 732 wrote to memory of 1336 732 xxffflr.exe 90 PID 1336 wrote to memory of 4500 1336 bttnnn.exe 91 PID 1336 wrote to memory of 4500 1336 bttnnn.exe 91 PID 1336 wrote to memory of 4500 1336 bttnnn.exe 91 PID 4500 wrote to memory of 1004 4500 vdvvp.exe 92 PID 4500 wrote to memory of 1004 4500 vdvvp.exe 92 PID 4500 wrote to memory of 1004 4500 vdvvp.exe 92 PID 1004 wrote to memory of 3540 1004 9rllfxr.exe 94 PID 1004 wrote to memory of 3540 1004 9rllfxr.exe 94 PID 1004 wrote to memory of 3540 1004 9rllfxr.exe 94 PID 3540 wrote to memory of 924 3540 jpdpp.exe 95 PID 3540 wrote to memory of 924 3540 jpdpp.exe 95 PID 3540 wrote to memory of 924 3540 jpdpp.exe 95 PID 924 wrote to memory of 1028 924 5ddpd.exe 96 PID 924 wrote to memory of 1028 924 5ddpd.exe 96 PID 924 wrote to memory of 1028 924 5ddpd.exe 96 PID 1028 wrote to memory of 2280 1028 rflfxxx.exe 97 PID 1028 wrote to memory of 2280 1028 rflfxxx.exe 97 PID 1028 wrote to memory of 2280 1028 rflfxxx.exe 97 PID 2280 wrote to memory of 1540 2280 llllxxl.exe 98 PID 2280 wrote to memory of 1540 2280 llllxxl.exe 98 PID 2280 wrote to memory of 1540 2280 llllxxl.exe 98 PID 1540 wrote to memory of 4976 1540 3hhhhh.exe 100 PID 1540 wrote to memory of 4976 1540 3hhhhh.exe 100 PID 1540 wrote to memory of 4976 1540 3hhhhh.exe 100 PID 4976 wrote to memory of 1716 4976 pddvp.exe 101 PID 4976 wrote to memory of 1716 4976 pddvp.exe 101 PID 4976 wrote to memory of 1716 4976 pddvp.exe 101 PID 1716 wrote to memory of 5068 1716 jjjvp.exe 102 PID 1716 wrote to memory of 5068 1716 jjjvp.exe 102 PID 1716 wrote to memory of 5068 1716 jjjvp.exe 102 PID 5068 wrote to memory of 4300 5068 xlrllll.exe 103 PID 5068 wrote to memory of 4300 5068 xlrllll.exe 103 PID 5068 wrote to memory of 4300 5068 xlrllll.exe 103 PID 4300 wrote to memory of 3376 4300 3nhtnn.exe 104 PID 4300 wrote to memory of 3376 4300 3nhtnn.exe 104 PID 4300 wrote to memory of 3376 4300 3nhtnn.exe 104 PID 3376 wrote to memory of 2072 3376 vvdvd.exe 105 PID 3376 wrote to memory of 2072 3376 vvdvd.exe 105 PID 3376 wrote to memory of 2072 3376 vvdvd.exe 105 PID 2072 wrote to memory of 3320 2072 5ppjd.exe 106 PID 2072 wrote to memory of 3320 2072 5ppjd.exe 106 PID 2072 wrote to memory of 3320 2072 5ppjd.exe 106 PID 3320 wrote to memory of 640 3320 lflfrrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\fecfe2ce715c2e01aedfacf2036e9440N.exe"C:\Users\Admin\AppData\Local\Temp\fecfe2ce715c2e01aedfacf2036e9440N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\jvvjj.exec:\jvvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\3xxlxff.exec:\3xxlxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lxxxxxr.exec:\lxxxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3bnnhh.exec:\3bnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\bhnhbb.exec:\bhnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xxffflr.exec:\xxffflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\bttnnn.exec:\bttnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\vdvvp.exec:\vdvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\9rllfxr.exec:\9rllfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\jpdpp.exec:\jpdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\5ddpd.exec:\5ddpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\rflfxxx.exec:\rflfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\llllxxl.exec:\llllxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\3hhhhh.exec:\3hhhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\pddvp.exec:\pddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jjjvp.exec:\jjjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xlrllll.exec:\xlrllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\3nhtnn.exec:\3nhtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\vvdvd.exec:\vvdvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\5ppjd.exec:\5ppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lflfrrl.exec:\lflfrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\tnhhbb.exec:\tnhhbb.exe23⤵
- Executes dropped EXE
PID:640 -
\??\c:\9hnnnn.exec:\9hnnnn.exe24⤵
- Executes dropped EXE
PID:3432 -
\??\c:\jdvjv.exec:\jdvjv.exe25⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3jdvp.exec:\3jdvp.exe26⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7rrrrrl.exec:\7rrrrrl.exe27⤵
- Executes dropped EXE
PID:648 -
\??\c:\ffllrrf.exec:\ffllrrf.exe28⤵
- Executes dropped EXE
PID:3476 -
\??\c:\9btbtb.exec:\9btbtb.exe29⤵
- Executes dropped EXE
PID:5020 -
\??\c:\1jvjv.exec:\1jvjv.exe30⤵
- Executes dropped EXE
PID:3644 -
\??\c:\jvpvp.exec:\jvpvp.exe31⤵
- Executes dropped EXE
PID:3156 -
\??\c:\flxrllr.exec:\flxrllr.exe32⤵
- Executes dropped EXE
PID:5016 -
\??\c:\hhnnhh.exec:\hhnnhh.exe33⤵
- Executes dropped EXE
PID:4232 -
\??\c:\bhbnhb.exec:\bhbnhb.exe34⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bnnnbb.exec:\bnnnbb.exe35⤵
- Executes dropped EXE
PID:4172 -
\??\c:\3djjv.exec:\3djjv.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvvpj.exec:\dvvpj.exe37⤵
- Executes dropped EXE
PID:4956 -
\??\c:\llxrffl.exec:\llxrffl.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fllfrlr.exec:\fllfrlr.exe39⤵
- Executes dropped EXE
PID:4676 -
\??\c:\nbbttn.exec:\nbbttn.exe40⤵
- Executes dropped EXE
PID:4872 -
\??\c:\hhthnn.exec:\hhthnn.exe41⤵
- Executes dropped EXE
PID:4384 -
\??\c:\dvpdp.exec:\dvpdp.exe42⤵
- Executes dropped EXE
PID:3688 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe43⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bnnnhb.exec:\bnnnhb.exe44⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pjvpj.exec:\pjvpj.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vppjv.exec:\vppjv.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rxffrfr.exec:\rxffrfr.exe47⤵
- Executes dropped EXE
PID:3984 -
\??\c:\htthbt.exec:\htthbt.exe48⤵
- Executes dropped EXE
PID:4396 -
\??\c:\hnhbnn.exec:\hnhbnn.exe49⤵
- Executes dropped EXE
PID:4836 -
\??\c:\dvjdv.exec:\dvjdv.exe50⤵
- Executes dropped EXE
PID:940 -
\??\c:\jvdvj.exec:\jvdvj.exe51⤵
- Executes dropped EXE
PID:732 -
\??\c:\lxrrlff.exec:\lxrrlff.exe52⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rllxrxr.exec:\rllxrxr.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7rxxrlf.exec:\7rxxrlf.exe54⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bhnhtn.exec:\bhnhtn.exe55⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1ntnbt.exec:\1ntnbt.exe56⤵
- Executes dropped EXE
PID:1004 -
\??\c:\3dpjd.exec:\3dpjd.exe57⤵
- Executes dropped EXE
PID:3540 -
\??\c:\9ppdd.exec:\9ppdd.exe58⤵
- Executes dropped EXE
PID:3592 -
\??\c:\lllfrlf.exec:\lllfrlf.exe59⤵
- Executes dropped EXE
PID:4168 -
\??\c:\5rfxlfx.exec:\5rfxlfx.exe60⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tnhbnh.exec:\tnhbnh.exe61⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ththhh.exec:\ththhh.exe62⤵
- Executes dropped EXE
PID:368 -
\??\c:\dvjdp.exec:\dvjdp.exe63⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ppjdp.exec:\ppjdp.exe64⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jvvpj.exec:\jvvpj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\llrlxrl.exec:\llrlxrl.exe66⤵PID:4364
-
\??\c:\lrrlrfl.exec:\lrrlrfl.exe67⤵PID:1864
-
\??\c:\btbthb.exec:\btbthb.exe68⤵PID:3160
-
\??\c:\1tnhtt.exec:\1tnhtt.exe69⤵PID:4280
-
\??\c:\tbtnbn.exec:\tbtnbn.exe70⤵PID:3376
-
\??\c:\3pvjv.exec:\3pvjv.exe71⤵PID:2540
-
\??\c:\vdvjv.exec:\vdvjv.exe72⤵PID:3552
-
\??\c:\ffrllfr.exec:\ffrllfr.exe73⤵PID:3320
-
\??\c:\fxrllfx.exec:\fxrllfx.exe74⤵PID:2852
-
\??\c:\nnbthb.exec:\nnbthb.exe75⤵PID:4588
-
\??\c:\hntnth.exec:\hntnth.exe76⤵PID:4868
-
\??\c:\pvpjd.exec:\pvpjd.exe77⤵PID:4512
-
\??\c:\7ppjv.exec:\7ppjv.exe78⤵PID:4792
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe79⤵PID:3692
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe80⤵PID:2880
-
\??\c:\nnnhnn.exec:\nnnhnn.exe81⤵PID:4564
-
\??\c:\3ntnbh.exec:\3ntnbh.exe82⤵PID:3012
-
\??\c:\vjvpd.exec:\vjvpd.exe83⤵PID:4292
-
\??\c:\jvjdj.exec:\jvjdj.exe84⤵PID:3156
-
\??\c:\xlllxrf.exec:\xlllxrf.exe85⤵PID:2696
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe86⤵PID:1624
-
\??\c:\xlxfflr.exec:\xlxfflr.exe87⤵PID:208
-
\??\c:\btbhnb.exec:\btbhnb.exe88⤵PID:1444
-
\??\c:\nbtbbh.exec:\nbtbbh.exe89⤵PID:4172
-
\??\c:\xllxllf.exec:\xllxllf.exe90⤵PID:5032
-
\??\c:\xflfrlx.exec:\xflfrlx.exe91⤵PID:4956
-
\??\c:\xffxrlf.exec:\xffxrlf.exe92⤵PID:704
-
\??\c:\bttnhb.exec:\bttnhb.exe93⤵PID:4508
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe94⤵PID:856
-
\??\c:\fxxfxfr.exec:\fxxfxfr.exe95⤵PID:4720
-
\??\c:\9xxrfrf.exec:\9xxrfrf.exe96⤵PID:3488
-
\??\c:\htttnn.exec:\htttnn.exe97⤵PID:4856
-
\??\c:\5hhhtn.exec:\5hhhtn.exe98⤵PID:3708
-
\??\c:\ppjvj.exec:\ppjvj.exe99⤵PID:4344
-
\??\c:\ppjvv.exec:\ppjvv.exe100⤵PID:2980
-
\??\c:\fffxrrr.exec:\fffxrrr.exe101⤵PID:1920
-
\??\c:\1xffllr.exec:\1xffllr.exe102⤵PID:3576
-
\??\c:\hntnnn.exec:\hntnnn.exe103⤵PID:1960
-
\??\c:\nntntn.exec:\nntntn.exe104⤵PID:4092
-
\??\c:\3vjjj.exec:\3vjjj.exe105⤵PID:1572
-
\??\c:\ddjjv.exec:\ddjjv.exe106⤵PID:4572
-
\??\c:\rllfrrl.exec:\rllfrrl.exe107⤵PID:4860
-
\??\c:\tnbnnh.exec:\tnbnnh.exe108⤵PID:1760
-
\??\c:\pvpdp.exec:\pvpdp.exe109⤵PID:3956
-
\??\c:\fxfrrlx.exec:\fxfrrlx.exe110⤵PID:2708
-
\??\c:\5frxxfr.exec:\5frxxfr.exe111⤵PID:3080
-
\??\c:\hhhbtt.exec:\hhhbtt.exe112⤵PID:1228
-
\??\c:\bttnnh.exec:\bttnnh.exe113⤵PID:60
-
\??\c:\jpvjd.exec:\jpvjd.exe114⤵PID:1492
-
\??\c:\jddpj.exec:\jddpj.exe115⤵PID:4968
-
\??\c:\9xffxff.exec:\9xffxff.exe116⤵PID:2932
-
\??\c:\ntbbtn.exec:\ntbbtn.exe117⤵PID:3272
-
\??\c:\hhnhnn.exec:\hhnhnn.exe118⤵PID:1900
-
\??\c:\vpjdp.exec:\vpjdp.exe119⤵PID:1864
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:3160
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe121⤵PID:1860
-
\??\c:\lxxlxxl.exec:\lxxlxxl.exe122⤵PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-