Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c47f433d92b00c56035a4896117c6c0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7c47f433d92b00c56035a4896117c6c0N.exe
-
Size
79KB
-
MD5
7c47f433d92b00c56035a4896117c6c0
-
SHA1
8dc89daedfb8bee7cb00853107150edd94b0a1d9
-
SHA256
8101b34d5b2b8aa262eb4382bf6b2d161945053aa1aacba1fe21588bf09b301e
-
SHA512
42bd29d6dfeb94ec8b988e097cf952f28c3f099f4f2019da6c6ba0c70e8e21d60c08965faa1845be607285a04683a355fc7e8dcc614a1f7f9d13e30f166677ea
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjDbOXY8Rn:ymb3NkkiQ3mdBjFI4VAYA
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1908 7fxlfxl.exe 3472 rrlxrfx.exe 3696 5tthhb.exe 3644 hbbhnt.exe 5112 7rlfrlf.exe 1336 hthtnh.exe 2540 nnbbhb.exe 224 5vdvj.exe 3084 5fxlxrf.exe 4276 rxrffrf.exe 4900 htnnbt.exe 4220 bnthhb.exe 2324 jppdp.exe 3800 fllxxll.exe 4244 rrlxlfr.exe 1464 hntthb.exe 1960 1dddd.exe 4076 5llflrl.exe 1144 7bbttn.exe 516 9ntnbb.exe 3404 dvpjv.exe 2560 rffxxfx.exe 4024 ttntnt.exe 696 bhbthh.exe 4580 ddvjv.exe 816 frfrlff.exe 4892 bthhhn.exe 4128 bthbhb.exe 556 jpvvp.exe 4744 ddjdj.exe 3952 xrxrllf.exe 3316 btnttb.exe 5028 nhbbnn.exe 5044 jjppd.exe 1636 9pvpj.exe 3592 rfrlffl.exe 3276 7tbbnn.exe 3808 tttttb.exe 3912 9jjdv.exe 4672 xfxlfff.exe 4368 fxlfffx.exe 4768 nthhbh.exe 1076 nhntnn.exe 4624 jvjvj.exe 2776 7vppv.exe 1652 7frlfxr.exe 3980 1fxrllf.exe 4940 bntnbb.exe 5112 ttbttt.exe 3900 jjdpv.exe 228 vppjd.exe 2680 7fflllf.exe 232 fxfxxxr.exe 224 htnhbt.exe 3080 btnnhn.exe 4092 vpvvp.exe 2488 vpdpp.exe 2556 llllfff.exe 4188 lrxfxlf.exe 5012 tnnhnn.exe 2832 htbttt.exe 1796 vjdvp.exe 2960 jpjdv.exe 4244 fflfxff.exe -
resource yara_rule behavioral2/memory/1984-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1908 1984 7c47f433d92b00c56035a4896117c6c0N.exe 83 PID 1984 wrote to memory of 1908 1984 7c47f433d92b00c56035a4896117c6c0N.exe 83 PID 1984 wrote to memory of 1908 1984 7c47f433d92b00c56035a4896117c6c0N.exe 83 PID 1908 wrote to memory of 3472 1908 7fxlfxl.exe 84 PID 1908 wrote to memory of 3472 1908 7fxlfxl.exe 84 PID 1908 wrote to memory of 3472 1908 7fxlfxl.exe 84 PID 3472 wrote to memory of 3696 3472 rrlxrfx.exe 85 PID 3472 wrote to memory of 3696 3472 rrlxrfx.exe 85 PID 3472 wrote to memory of 3696 3472 rrlxrfx.exe 85 PID 3696 wrote to memory of 3644 3696 5tthhb.exe 86 PID 3696 wrote to memory of 3644 3696 5tthhb.exe 86 PID 3696 wrote to memory of 3644 3696 5tthhb.exe 86 PID 3644 wrote to memory of 5112 3644 hbbhnt.exe 87 PID 3644 wrote to memory of 5112 3644 hbbhnt.exe 87 PID 3644 wrote to memory of 5112 3644 hbbhnt.exe 87 PID 5112 wrote to memory of 1336 5112 7rlfrlf.exe 88 PID 5112 wrote to memory of 1336 5112 7rlfrlf.exe 88 PID 5112 wrote to memory of 1336 5112 7rlfrlf.exe 88 PID 1336 wrote to memory of 2540 1336 hthtnh.exe 89 PID 1336 wrote to memory of 2540 1336 hthtnh.exe 89 PID 1336 wrote to memory of 2540 1336 hthtnh.exe 89 PID 2540 wrote to memory of 224 2540 nnbbhb.exe 90 PID 2540 wrote to memory of 224 2540 nnbbhb.exe 90 PID 2540 wrote to memory of 224 2540 nnbbhb.exe 90 PID 224 wrote to memory of 3084 224 5vdvj.exe 91 PID 224 wrote to memory of 3084 224 5vdvj.exe 91 PID 224 wrote to memory of 3084 224 5vdvj.exe 91 PID 3084 wrote to memory of 4276 3084 5fxlxrf.exe 92 PID 3084 wrote to memory of 4276 3084 5fxlxrf.exe 92 PID 3084 wrote to memory of 4276 3084 5fxlxrf.exe 92 PID 4276 wrote to memory of 4900 4276 rxrffrf.exe 93 PID 4276 wrote to memory of 4900 4276 rxrffrf.exe 93 PID 4276 wrote to memory of 4900 4276 rxrffrf.exe 93 PID 4900 wrote to memory of 4220 4900 htnnbt.exe 94 PID 4900 wrote to memory of 4220 4900 htnnbt.exe 94 PID 4900 wrote to memory of 4220 4900 htnnbt.exe 94 PID 4220 wrote to memory of 2324 4220 bnthhb.exe 96 PID 4220 wrote to memory of 2324 4220 bnthhb.exe 96 PID 4220 wrote to memory of 2324 4220 bnthhb.exe 96 PID 2324 wrote to memory of 3800 2324 jppdp.exe 97 PID 2324 wrote to memory of 3800 2324 jppdp.exe 97 PID 2324 wrote to memory of 3800 2324 jppdp.exe 97 PID 3800 wrote to memory of 4244 3800 fllxxll.exe 98 PID 3800 wrote to memory of 4244 3800 fllxxll.exe 98 PID 3800 wrote to memory of 4244 3800 fllxxll.exe 98 PID 4244 wrote to memory of 1464 4244 rrlxlfr.exe 99 PID 4244 wrote to memory of 1464 4244 rrlxlfr.exe 99 PID 4244 wrote to memory of 1464 4244 rrlxlfr.exe 99 PID 1464 wrote to memory of 1960 1464 hntthb.exe 100 PID 1464 wrote to memory of 1960 1464 hntthb.exe 100 PID 1464 wrote to memory of 1960 1464 hntthb.exe 100 PID 1960 wrote to memory of 4076 1960 1dddd.exe 102 PID 1960 wrote to memory of 4076 1960 1dddd.exe 102 PID 1960 wrote to memory of 4076 1960 1dddd.exe 102 PID 4076 wrote to memory of 1144 4076 5llflrl.exe 103 PID 4076 wrote to memory of 1144 4076 5llflrl.exe 103 PID 4076 wrote to memory of 1144 4076 5llflrl.exe 103 PID 1144 wrote to memory of 516 1144 7bbttn.exe 104 PID 1144 wrote to memory of 516 1144 7bbttn.exe 104 PID 1144 wrote to memory of 516 1144 7bbttn.exe 104 PID 516 wrote to memory of 3404 516 9ntnbb.exe 105 PID 516 wrote to memory of 3404 516 9ntnbb.exe 105 PID 516 wrote to memory of 3404 516 9ntnbb.exe 105 PID 3404 wrote to memory of 2560 3404 dvpjv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c47f433d92b00c56035a4896117c6c0N.exe"C:\Users\Admin\AppData\Local\Temp\7c47f433d92b00c56035a4896117c6c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\7fxlfxl.exec:\7fxlfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\5tthhb.exec:\5tthhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\hbbhnt.exec:\hbbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\7rlfrlf.exec:\7rlfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\hthtnh.exec:\hthtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\nnbbhb.exec:\nnbbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5vdvj.exec:\5vdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\5fxlxrf.exec:\5fxlxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\rxrffrf.exec:\rxrffrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\htnnbt.exec:\htnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\bnthhb.exec:\bnthhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\jppdp.exec:\jppdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\fllxxll.exec:\fllxxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\hntthb.exec:\hntthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\1dddd.exec:\1dddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\5llflrl.exec:\5llflrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\7bbttn.exec:\7bbttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\9ntnbb.exec:\9ntnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\dvpjv.exec:\dvpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\rffxxfx.exec:\rffxxfx.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ttntnt.exec:\ttntnt.exe24⤵
- Executes dropped EXE
PID:4024 -
\??\c:\bhbthh.exec:\bhbthh.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\ddvjv.exec:\ddvjv.exe26⤵
- Executes dropped EXE
PID:4580 -
\??\c:\frfrlff.exec:\frfrlff.exe27⤵
- Executes dropped EXE
PID:816 -
\??\c:\bthhhn.exec:\bthhhn.exe28⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bthbhb.exec:\bthbhb.exe29⤵
- Executes dropped EXE
PID:4128 -
\??\c:\jpvvp.exec:\jpvvp.exe30⤵
- Executes dropped EXE
PID:556 -
\??\c:\ddjdj.exec:\ddjdj.exe31⤵
- Executes dropped EXE
PID:4744 -
\??\c:\xrxrllf.exec:\xrxrllf.exe32⤵
- Executes dropped EXE
PID:3952 -
\??\c:\btnttb.exec:\btnttb.exe33⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nhbbnn.exec:\nhbbnn.exe34⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jjppd.exec:\jjppd.exe35⤵
- Executes dropped EXE
PID:5044 -
\??\c:\9pvpj.exec:\9pvpj.exe36⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rfrlffl.exec:\rfrlffl.exe37⤵
- Executes dropped EXE
PID:3592 -
\??\c:\7tbbnn.exec:\7tbbnn.exe38⤵
- Executes dropped EXE
PID:3276 -
\??\c:\tttttb.exec:\tttttb.exe39⤵
- Executes dropped EXE
PID:3808 -
\??\c:\9jjdv.exec:\9jjdv.exe40⤵
- Executes dropped EXE
PID:3912 -
\??\c:\xfxlfff.exec:\xfxlfff.exe41⤵
- Executes dropped EXE
PID:4672 -
\??\c:\fxlfffx.exec:\fxlfffx.exe42⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nthhbh.exec:\nthhbh.exe43⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nhntnn.exec:\nhntnn.exe44⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jvjvj.exec:\jvjvj.exe45⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7vppv.exec:\7vppv.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7frlfxr.exec:\7frlfxr.exe47⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1fxrllf.exec:\1fxrllf.exe48⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bntnbb.exec:\bntnbb.exe49⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ttbttt.exec:\ttbttt.exe50⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jjdpv.exec:\jjdpv.exe51⤵
- Executes dropped EXE
PID:3900 -
\??\c:\vppjd.exec:\vppjd.exe52⤵
- Executes dropped EXE
PID:228 -
\??\c:\7fflllf.exec:\7fflllf.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe54⤵
- Executes dropped EXE
PID:232 -
\??\c:\htnhbt.exec:\htnhbt.exe55⤵
- Executes dropped EXE
PID:224 -
\??\c:\btnnhn.exec:\btnnhn.exe56⤵
- Executes dropped EXE
PID:3080 -
\??\c:\vpvvp.exec:\vpvvp.exe57⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vpdpp.exec:\vpdpp.exe58⤵
- Executes dropped EXE
PID:2488 -
\??\c:\llllfff.exec:\llllfff.exe59⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lrxfxlf.exec:\lrxfxlf.exe60⤵
- Executes dropped EXE
PID:4188 -
\??\c:\tnnhnn.exec:\tnnhnn.exe61⤵
- Executes dropped EXE
PID:5012 -
\??\c:\htbttt.exec:\htbttt.exe62⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vjdvp.exec:\vjdvp.exe63⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jpjdv.exec:\jpjdv.exe64⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fflfxff.exec:\fflfxff.exe65⤵
- Executes dropped EXE
PID:4244 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe66⤵PID:2600
-
\??\c:\tbbtnn.exec:\tbbtnn.exe67⤵PID:1512
-
\??\c:\nthnbh.exec:\nthnbh.exe68⤵PID:4932
-
\??\c:\jjjdv.exec:\jjjdv.exe69⤵PID:2384
-
\??\c:\jdpjj.exec:\jdpjj.exe70⤵PID:4832
-
\??\c:\lffxrrl.exec:\lffxrrl.exe71⤵PID:3680
-
\??\c:\llrrrrx.exec:\llrrrrx.exe72⤵PID:4064
-
\??\c:\lffxrll.exec:\lffxrll.exe73⤵PID:4824
-
\??\c:\htbbbb.exec:\htbbbb.exe74⤵PID:4852
-
\??\c:\tnnhtt.exec:\tnnhtt.exe75⤵PID:1624
-
\??\c:\vvppv.exec:\vvppv.exe76⤵PID:1744
-
\??\c:\pjvpp.exec:\pjvpp.exe77⤵PID:2708
-
\??\c:\rflxfxl.exec:\rflxfxl.exe78⤵PID:4444
-
\??\c:\nhbtnn.exec:\nhbtnn.exe79⤵PID:2736
-
\??\c:\htbbtb.exec:\htbbtb.exe80⤵PID:4464
-
\??\c:\vpjdd.exec:\vpjdd.exe81⤵PID:2548
-
\??\c:\pvdjv.exec:\pvdjv.exe82⤵PID:3436
-
\??\c:\frxrrrr.exec:\frxrrrr.exe83⤵PID:4432
-
\??\c:\rllflfl.exec:\rllflfl.exe84⤵PID:4524
-
\??\c:\thhtnn.exec:\thhtnn.exe85⤵PID:3992
-
\??\c:\hbbtnh.exec:\hbbtnh.exe86⤵PID:3952
-
\??\c:\pdjdd.exec:\pdjdd.exe87⤵PID:2372
-
\??\c:\xxxxlll.exec:\xxxxlll.exe88⤵PID:1536
-
\??\c:\7flfllx.exec:\7flfllx.exe89⤵PID:1480
-
\??\c:\jdvvp.exec:\jdvvp.exe90⤵PID:1928
-
\??\c:\jjvpp.exec:\jjvpp.exe91⤵PID:536
-
\??\c:\xrrrllr.exec:\xrrrllr.exe92⤵PID:1640
-
\??\c:\1ffxxrx.exec:\1ffxxrx.exe93⤵PID:4452
-
\??\c:\pdpjj.exec:\pdpjj.exe94⤵PID:2744
-
\??\c:\pdjjd.exec:\pdjjd.exe95⤵PID:4324
-
\??\c:\frrlllr.exec:\frrlllr.exe96⤵PID:3932
-
\??\c:\hhtttt.exec:\hhtttt.exe97⤵PID:1216
-
\??\c:\9hhhbh.exec:\9hhhbh.exe98⤵PID:3696
-
\??\c:\3pvpd.exec:\3pvpd.exe99⤵PID:3824
-
\??\c:\pjpjd.exec:\pjpjd.exe100⤵PID:2444
-
\??\c:\lrxrllr.exec:\lrxrllr.exe101⤵PID:3540
-
\??\c:\rffxllf.exec:\rffxllf.exe102⤵PID:888
-
\??\c:\hntnhh.exec:\hntnhh.exe103⤵PID:5056
-
\??\c:\nhttbb.exec:\nhttbb.exe104⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\pjvpj.exec:\pjvpj.exe105⤵PID:3948
-
\??\c:\1jvpp.exec:\1jvpp.exe106⤵PID:5072
-
\??\c:\7xxrffx.exec:\7xxrffx.exe107⤵PID:2804
-
\??\c:\xlxrlll.exec:\xlxrlll.exe108⤵PID:1152
-
\??\c:\thntnn.exec:\thntnn.exe109⤵PID:1892
-
\??\c:\9tnhbt.exec:\9tnhbt.exe110⤵PID:640
-
\??\c:\vpvpj.exec:\vpvpj.exe111⤵PID:3788
-
\??\c:\jdvpv.exec:\jdvpv.exe112⤵PID:3452
-
\??\c:\xlllffx.exec:\xlllffx.exe113⤵PID:2324
-
\??\c:\hnnnnn.exec:\hnnnnn.exe114⤵PID:3024
-
\??\c:\tntnhh.exec:\tntnhh.exe115⤵PID:3800
-
\??\c:\pvdvv.exec:\pvdvv.exe116⤵PID:1580
-
\??\c:\1djdv.exec:\1djdv.exe117⤵PID:3664
-
\??\c:\frrlllf.exec:\frrlllf.exe118⤵PID:2356
-
\??\c:\1rflfff.exec:\1rflfff.exe119⤵PID:4724
-
\??\c:\bhnhbb.exec:\bhnhbb.exe120⤵PID:4488
-
\??\c:\bnbtnn.exec:\bnbtnn.exe121⤵PID:4888
-
\??\c:\vpvvv.exec:\vpvvv.exe122⤵PID:3120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-