Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe
Resource
win7-20240903-en
General
-
Target
555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe
-
Size
64KB
-
MD5
6411652fed2bc73d96e797a3d7ab1953
-
SHA1
9dcdadd68388776606e272a952b389904b7abe2f
-
SHA256
555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181
-
SHA512
6977a48ad4c75f2abb8b7ee560c1a3b90618a1ea1ca8d4d14d247f1cc762687ad7ffb9415bc1a0e1bf75be2b005dd678fdc6b098c75dc7cad0ff6e0a98d3b244
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiT:ymb3NkkiQ3mdBjF0y7kbQ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/216-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2244 xlrffxf.exe 4324 9btttt.exe 4660 dpvdd.exe 460 bnhnhb.exe 4712 pjdvp.exe 636 9lxflfl.exe 1564 xrffxfx.exe 3576 7ttttb.exe 3372 dpppj.exe 1764 3rffxfx.exe 4484 thbnhn.exe 2856 bthbtn.exe 224 7ddvp.exe 3508 1lrrrrr.exe 1952 1hhhhh.exe 4908 9hbtht.exe 2844 5vdvp.exe 4148 rrrlxll.exe 444 xxfflrf.exe 4368 btttnn.exe 2220 jjdpj.exe 1092 5lrlffl.exe 4640 fxxxrrf.exe 2808 3nnhbt.exe 3684 1tbttt.exe 2152 vpvvv.exe 3456 jdjdv.exe 4764 lxfxllf.exe 4344 nhnhtn.exe 2116 tbhtnh.exe 4472 jvjjd.exe 2920 dppdv.exe 452 lxrfxlf.exe 2012 hhhtnn.exe 2908 5bhbbt.exe 3164 5jppp.exe 2824 3xxrlxr.exe 3052 rffffff.exe 3000 5hnnnn.exe 212 9vvpd.exe 3176 7pppj.exe 1688 vpvpj.exe 3988 1xfxffx.exe 4840 3lrrlll.exe 4664 tbttth.exe 4996 jpvpj.exe 4712 lfrrrrx.exe 1496 lllrrrr.exe 1400 3bhbbh.exe 2468 ttnhbb.exe 3908 jdvpv.exe 3576 vpdvj.exe 3084 fxxrrll.exe 3660 xllfxlf.exe 3200 tttthh.exe 3252 bntthn.exe 4360 vdvjd.exe 224 vpjdd.exe 3492 7lrlllf.exe 1296 lllrrrf.exe 4424 nbhhbb.exe 528 tntnbh.exe 3812 pjvpv.exe 2792 dppjd.exe -
resource yara_rule behavioral2/memory/216-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 2244 216 555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe 82 PID 216 wrote to memory of 2244 216 555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe 82 PID 216 wrote to memory of 2244 216 555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe 82 PID 2244 wrote to memory of 4324 2244 xlrffxf.exe 83 PID 2244 wrote to memory of 4324 2244 xlrffxf.exe 83 PID 2244 wrote to memory of 4324 2244 xlrffxf.exe 83 PID 4324 wrote to memory of 4660 4324 9btttt.exe 84 PID 4324 wrote to memory of 4660 4324 9btttt.exe 84 PID 4324 wrote to memory of 4660 4324 9btttt.exe 84 PID 4660 wrote to memory of 460 4660 dpvdd.exe 85 PID 4660 wrote to memory of 460 4660 dpvdd.exe 85 PID 4660 wrote to memory of 460 4660 dpvdd.exe 85 PID 460 wrote to memory of 4712 460 bnhnhb.exe 86 PID 460 wrote to memory of 4712 460 bnhnhb.exe 86 PID 460 wrote to memory of 4712 460 bnhnhb.exe 86 PID 4712 wrote to memory of 636 4712 pjdvp.exe 87 PID 4712 wrote to memory of 636 4712 pjdvp.exe 87 PID 4712 wrote to memory of 636 4712 pjdvp.exe 87 PID 636 wrote to memory of 1564 636 9lxflfl.exe 88 PID 636 wrote to memory of 1564 636 9lxflfl.exe 88 PID 636 wrote to memory of 1564 636 9lxflfl.exe 88 PID 1564 wrote to memory of 3576 1564 xrffxfx.exe 89 PID 1564 wrote to memory of 3576 1564 xrffxfx.exe 89 PID 1564 wrote to memory of 3576 1564 xrffxfx.exe 89 PID 3576 wrote to memory of 3372 3576 7ttttb.exe 91 PID 3576 wrote to memory of 3372 3576 7ttttb.exe 91 PID 3576 wrote to memory of 3372 3576 7ttttb.exe 91 PID 3372 wrote to memory of 1764 3372 dpppj.exe 92 PID 3372 wrote to memory of 1764 3372 dpppj.exe 92 PID 3372 wrote to memory of 1764 3372 dpppj.exe 92 PID 1764 wrote to memory of 4484 1764 3rffxfx.exe 93 PID 1764 wrote to memory of 4484 1764 3rffxfx.exe 93 PID 1764 wrote to memory of 4484 1764 3rffxfx.exe 93 PID 4484 wrote to memory of 2856 4484 thbnhn.exe 94 PID 4484 wrote to memory of 2856 4484 thbnhn.exe 94 PID 4484 wrote to memory of 2856 4484 thbnhn.exe 94 PID 2856 wrote to memory of 224 2856 bthbtn.exe 95 PID 2856 wrote to memory of 224 2856 bthbtn.exe 95 PID 2856 wrote to memory of 224 2856 bthbtn.exe 95 PID 224 wrote to memory of 3508 224 7ddvp.exe 97 PID 224 wrote to memory of 3508 224 7ddvp.exe 97 PID 224 wrote to memory of 3508 224 7ddvp.exe 97 PID 3508 wrote to memory of 1952 3508 1lrrrrr.exe 98 PID 3508 wrote to memory of 1952 3508 1lrrrrr.exe 98 PID 3508 wrote to memory of 1952 3508 1lrrrrr.exe 98 PID 1952 wrote to memory of 4908 1952 1hhhhh.exe 99 PID 1952 wrote to memory of 4908 1952 1hhhhh.exe 99 PID 1952 wrote to memory of 4908 1952 1hhhhh.exe 99 PID 4908 wrote to memory of 2844 4908 9hbtht.exe 100 PID 4908 wrote to memory of 2844 4908 9hbtht.exe 100 PID 4908 wrote to memory of 2844 4908 9hbtht.exe 100 PID 2844 wrote to memory of 4148 2844 5vdvp.exe 101 PID 2844 wrote to memory of 4148 2844 5vdvp.exe 101 PID 2844 wrote to memory of 4148 2844 5vdvp.exe 101 PID 4148 wrote to memory of 444 4148 rrrlxll.exe 102 PID 4148 wrote to memory of 444 4148 rrrlxll.exe 102 PID 4148 wrote to memory of 444 4148 rrrlxll.exe 102 PID 444 wrote to memory of 4368 444 xxfflrf.exe 103 PID 444 wrote to memory of 4368 444 xxfflrf.exe 103 PID 444 wrote to memory of 4368 444 xxfflrf.exe 103 PID 4368 wrote to memory of 2220 4368 btttnn.exe 105 PID 4368 wrote to memory of 2220 4368 btttnn.exe 105 PID 4368 wrote to memory of 2220 4368 btttnn.exe 105 PID 2220 wrote to memory of 1092 2220 jjdpj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe"C:\Users\Admin\AppData\Local\Temp\555ec86ee090a9ab3319ac75746be4e4e0f447e1f07ebf70486768b07a9e4181.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xlrffxf.exec:\xlrffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\9btttt.exec:\9btttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\dpvdd.exec:\dpvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\bnhnhb.exec:\bnhnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\pjdvp.exec:\pjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\9lxflfl.exec:\9lxflfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\xrffxfx.exec:\xrffxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\7ttttb.exec:\7ttttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\dpppj.exec:\dpppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\3rffxfx.exec:\3rffxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\thbnhn.exec:\thbnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bthbtn.exec:\bthbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7ddvp.exec:\7ddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\1lrrrrr.exec:\1lrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\1hhhhh.exec:\1hhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\9hbtht.exec:\9hbtht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\5vdvp.exec:\5vdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\rrrlxll.exec:\rrrlxll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\xxfflrf.exec:\xxfflrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\btttnn.exec:\btttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\jjdpj.exec:\jjdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\5lrlffl.exec:\5lrlffl.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe24⤵
- Executes dropped EXE
PID:4640 -
\??\c:\3nnhbt.exec:\3nnhbt.exe25⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1tbttt.exec:\1tbttt.exe26⤵
- Executes dropped EXE
PID:3684 -
\??\c:\vpvvv.exec:\vpvvv.exe27⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jdjdv.exec:\jdjdv.exe28⤵
- Executes dropped EXE
PID:3456 -
\??\c:\lxfxllf.exec:\lxfxllf.exe29⤵
- Executes dropped EXE
PID:4764 -
\??\c:\nhnhtn.exec:\nhnhtn.exe30⤵
- Executes dropped EXE
PID:4344 -
\??\c:\tbhtnh.exec:\tbhtnh.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jvjjd.exec:\jvjjd.exe32⤵
- Executes dropped EXE
PID:4472 -
\??\c:\dppdv.exec:\dppdv.exe33⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxrfxlf.exec:\lxrfxlf.exe34⤵
- Executes dropped EXE
PID:452 -
\??\c:\hhhtnn.exec:\hhhtnn.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5bhbbt.exec:\5bhbbt.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5jppp.exec:\5jppp.exe37⤵
- Executes dropped EXE
PID:3164 -
\??\c:\3xxrlxr.exec:\3xxrlxr.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rffffff.exec:\rffffff.exe39⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5hnnnn.exec:\5hnnnn.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btnthn.exec:\btnthn.exe41⤵PID:4400
-
\??\c:\9vvpd.exec:\9vvpd.exe42⤵
- Executes dropped EXE
PID:212 -
\??\c:\7pppj.exec:\7pppj.exe43⤵
- Executes dropped EXE
PID:3176 -
\??\c:\vpvpj.exec:\vpvpj.exe44⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1xfxffx.exec:\1xfxffx.exe45⤵
- Executes dropped EXE
PID:3988 -
\??\c:\3lrrlll.exec:\3lrrlll.exe46⤵
- Executes dropped EXE
PID:4840 -
\??\c:\tbttth.exec:\tbttth.exe47⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jpvpj.exec:\jpvpj.exe48⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe49⤵
- Executes dropped EXE
PID:4712 -
\??\c:\lllrrrr.exec:\lllrrrr.exe50⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3bhbbh.exec:\3bhbbh.exe51⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ttnhbb.exec:\ttnhbb.exe52⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jdvpv.exec:\jdvpv.exe53⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vpdvj.exec:\vpdvj.exe54⤵
- Executes dropped EXE
PID:3576 -
\??\c:\fxxrrll.exec:\fxxrrll.exe55⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xllfxlf.exec:\xllfxlf.exe56⤵
- Executes dropped EXE
PID:3660 -
\??\c:\tttthh.exec:\tttthh.exe57⤵
- Executes dropped EXE
PID:3200 -
\??\c:\bntthn.exec:\bntthn.exe58⤵
- Executes dropped EXE
PID:3252 -
\??\c:\vdvjd.exec:\vdvjd.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4360 -
\??\c:\vpjdd.exec:\vpjdd.exe60⤵
- Executes dropped EXE
PID:224 -
\??\c:\7lrlllf.exec:\7lrlllf.exe61⤵
- Executes dropped EXE
PID:3492 -
\??\c:\lllrrrf.exec:\lllrrrf.exe62⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nbhhbb.exec:\nbhhbb.exe63⤵
- Executes dropped EXE
PID:4424 -
\??\c:\tntnbh.exec:\tntnbh.exe64⤵
- Executes dropped EXE
PID:528 -
\??\c:\pjvpv.exec:\pjvpv.exe65⤵
- Executes dropped EXE
PID:3812 -
\??\c:\dppjd.exec:\dppjd.exe66⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rrrlfff.exec:\rrrlfff.exe67⤵PID:4068
-
\??\c:\3rfxrxr.exec:\3rfxrxr.exe68⤵PID:1684
-
\??\c:\nhnbbb.exec:\nhnbbb.exe69⤵PID:1736
-
\??\c:\nbhbht.exec:\nbhbht.exe70⤵PID:1312
-
\??\c:\jjppp.exec:\jjppp.exe71⤵PID:4976
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe72⤵PID:3976
-
\??\c:\fxrrlll.exec:\fxrrlll.exe73⤵PID:3036
-
\??\c:\thnhnh.exec:\thnhnh.exe74⤵PID:4636
-
\??\c:\nbhbtn.exec:\nbhbtn.exe75⤵PID:2808
-
\??\c:\7pvpv.exec:\7pvpv.exe76⤵PID:4704
-
\??\c:\1pvpj.exec:\1pvpj.exe77⤵PID:680
-
\??\c:\rxllllr.exec:\rxllllr.exe78⤵PID:4548
-
\??\c:\nhnttt.exec:\nhnttt.exe79⤵PID:1028
-
\??\c:\bnntbn.exec:\bnntbn.exe80⤵
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\pvpdv.exec:\pvpdv.exe81⤵PID:1064
-
\??\c:\dpjjj.exec:\dpjjj.exe82⤵PID:1280
-
\??\c:\xflfxrl.exec:\xflfxrl.exe83⤵PID:2304
-
\??\c:\7xrrrrx.exec:\7xrrrrx.exe84⤵PID:3656
-
\??\c:\tnhhhh.exec:\tnhhhh.exe85⤵PID:1448
-
\??\c:\tnbttt.exec:\tnbttt.exe86⤵PID:3220
-
\??\c:\pjppp.exec:\pjppp.exe87⤵PID:4008
-
\??\c:\jdjjp.exec:\jdjjp.exe88⤵PID:2728
-
\??\c:\thbtnn.exec:\thbtnn.exe89⤵PID:3164
-
\??\c:\ntntnb.exec:\ntntnb.exe90⤵PID:2824
-
\??\c:\pddvv.exec:\pddvv.exe91⤵PID:3896
-
\??\c:\vdpjd.exec:\vdpjd.exe92⤵PID:3960
-
\??\c:\rllffff.exec:\rllffff.exe93⤵PID:2704
-
\??\c:\bttnhh.exec:\bttnhh.exe94⤵PID:660
-
\??\c:\thhbtt.exec:\thhbtt.exe95⤵PID:4672
-
\??\c:\9djjd.exec:\9djjd.exe96⤵PID:5084
-
\??\c:\pdjdd.exec:\pdjdd.exe97⤵PID:4500
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe98⤵PID:3712
-
\??\c:\thhhbb.exec:\thhhbb.exe99⤵PID:1272
-
\??\c:\htbttb.exec:\htbttb.exe100⤵PID:868
-
\??\c:\pvvvp.exec:\pvvvp.exe101⤵PID:1496
-
\??\c:\djppj.exec:\djppj.exe102⤵PID:4164
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe103⤵PID:3224
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe104⤵PID:4168
-
\??\c:\httbnt.exec:\httbnt.exe105⤵PID:960
-
\??\c:\vjpjd.exec:\vjpjd.exe106⤵PID:3084
-
\??\c:\dppjd.exec:\dppjd.exe107⤵PID:2004
-
\??\c:\7flrlxr.exec:\7flrlxr.exe108⤵PID:2856
-
\??\c:\rffxrrr.exec:\rffxrrr.exe109⤵PID:2832
-
\??\c:\nnbtbb.exec:\nnbtbb.exe110⤵PID:4668
-
\??\c:\bttnht.exec:\bttnht.exe111⤵PID:2700
-
\??\c:\pvvpd.exec:\pvvpd.exe112⤵PID:3232
-
\??\c:\pdjdv.exec:\pdjdv.exe113⤵PID:2732
-
\??\c:\lxrrflf.exec:\lxrrflf.exe114⤵PID:2092
-
\??\c:\fxrlrll.exec:\fxrlrll.exe115⤵PID:1104
-
\??\c:\hhbnhh.exec:\hhbnhh.exe116⤵PID:4216
-
\??\c:\jpppp.exec:\jpppp.exe117⤵PID:3340
-
\??\c:\vpdjd.exec:\vpdjd.exe118⤵PID:2760
-
\??\c:\lxxrfrl.exec:\lxxrfrl.exe119⤵PID:3116
-
\??\c:\tbnhhb.exec:\tbnhhb.exe120⤵PID:4796
-
\??\c:\hbbthh.exec:\hbbthh.exe121⤵PID:3972
-
\??\c:\jvvpv.exec:\jvvpv.exe122⤵PID:3216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-