Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5dff1f9213d36b3d18184aff20a62f10N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
5dff1f9213d36b3d18184aff20a62f10N.exe
-
Size
66KB
-
MD5
5dff1f9213d36b3d18184aff20a62f10
-
SHA1
8fc877dc0dc9760d0f0c9481ea2889b50023a864
-
SHA256
84aeac416aa10e32f95e9ffb24b6e245b510fb947cd5686bc4ac7a126825d804
-
SHA512
ce4f1b0c12a6f9924a031deefd36f8c989086ab175a319da0517d339a3e5ebddf9393fecc2ab39e6907a22bfe8924c77e18f7560520800b936861ed15ad571c4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27BqfR:ymb3NkkiQ3mdBjFI9cqfR
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3416-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1784 xfllflf.exe 764 fxflrfl.exe 1116 20666.exe 1944 8048288.exe 2872 bthnht.exe 3380 64426.exe 1216 5vvpj.exe 3556 dvppj.exe 3208 btttbh.exe 3480 806082.exe 3948 8626622.exe 2364 800000.exe 392 2406444.exe 1612 424448.exe 3600 llfxxxr.exe 4408 nhttnh.exe 2064 0060882.exe 3108 80666.exe 2184 jvvpp.exe 1940 440488.exe 4340 820444.exe 4452 ntbtnn.exe 4812 jdjdp.exe 4440 268822.exe 4120 vvvpj.exe 4732 7pddd.exe 5032 406060.exe 2928 c226048.exe 3020 060208.exe 2336 vppdv.exe 1804 a0488.exe 2392 7hbbtb.exe 4908 808020.exe 4824 i222066.exe 3244 0668662.exe 388 nnnnnn.exe 872 062266.exe 1672 002822.exe 4208 g6282.exe 3900 xfffxxx.exe 3432 nhbthh.exe 3260 pjjjp.exe 2348 s4666.exe 1612 ddjjj.exe 3828 828222.exe 5084 m4660.exe 3920 frxrlll.exe 3460 jdpjp.exe 1960 e84826.exe 4076 28844.exe 232 q84044.exe 3304 btbthh.exe 4968 6844888.exe 2104 rxrxrxx.exe 4452 20266.exe 4004 lxfxrrx.exe 3204 jjjdd.exe 1852 hnbthh.exe 2896 g4606.exe 4676 84820.exe 244 tbnbtt.exe 3524 8244828.exe 5004 1nnnth.exe 1756 5lfxrrx.exe -
resource yara_rule behavioral2/memory/3416-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4022602.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c060848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 1784 3416 5dff1f9213d36b3d18184aff20a62f10N.exe 91 PID 3416 wrote to memory of 1784 3416 5dff1f9213d36b3d18184aff20a62f10N.exe 91 PID 3416 wrote to memory of 1784 3416 5dff1f9213d36b3d18184aff20a62f10N.exe 91 PID 1784 wrote to memory of 764 1784 xfllflf.exe 92 PID 1784 wrote to memory of 764 1784 xfllflf.exe 92 PID 1784 wrote to memory of 764 1784 xfllflf.exe 92 PID 764 wrote to memory of 1116 764 fxflrfl.exe 93 PID 764 wrote to memory of 1116 764 fxflrfl.exe 93 PID 764 wrote to memory of 1116 764 fxflrfl.exe 93 PID 1116 wrote to memory of 1944 1116 20666.exe 94 PID 1116 wrote to memory of 1944 1116 20666.exe 94 PID 1116 wrote to memory of 1944 1116 20666.exe 94 PID 1944 wrote to memory of 2872 1944 8048288.exe 95 PID 1944 wrote to memory of 2872 1944 8048288.exe 95 PID 1944 wrote to memory of 2872 1944 8048288.exe 95 PID 2872 wrote to memory of 3380 2872 bthnht.exe 96 PID 2872 wrote to memory of 3380 2872 bthnht.exe 96 PID 2872 wrote to memory of 3380 2872 bthnht.exe 96 PID 3380 wrote to memory of 1216 3380 64426.exe 97 PID 3380 wrote to memory of 1216 3380 64426.exe 97 PID 3380 wrote to memory of 1216 3380 64426.exe 97 PID 1216 wrote to memory of 3556 1216 5vvpj.exe 99 PID 1216 wrote to memory of 3556 1216 5vvpj.exe 99 PID 1216 wrote to memory of 3556 1216 5vvpj.exe 99 PID 3556 wrote to memory of 3208 3556 dvppj.exe 100 PID 3556 wrote to memory of 3208 3556 dvppj.exe 100 PID 3556 wrote to memory of 3208 3556 dvppj.exe 100 PID 3208 wrote to memory of 3480 3208 btttbh.exe 101 PID 3208 wrote to memory of 3480 3208 btttbh.exe 101 PID 3208 wrote to memory of 3480 3208 btttbh.exe 101 PID 3480 wrote to memory of 3948 3480 806082.exe 102 PID 3480 wrote to memory of 3948 3480 806082.exe 102 PID 3480 wrote to memory of 3948 3480 806082.exe 102 PID 3948 wrote to memory of 2364 3948 8626622.exe 103 PID 3948 wrote to memory of 2364 3948 8626622.exe 103 PID 3948 wrote to memory of 2364 3948 8626622.exe 103 PID 2364 wrote to memory of 392 2364 800000.exe 104 PID 2364 wrote to memory of 392 2364 800000.exe 104 PID 2364 wrote to memory of 392 2364 800000.exe 104 PID 392 wrote to memory of 1612 392 2406444.exe 105 PID 392 wrote to memory of 1612 392 2406444.exe 105 PID 392 wrote to memory of 1612 392 2406444.exe 105 PID 1612 wrote to memory of 3600 1612 424448.exe 106 PID 1612 wrote to memory of 3600 1612 424448.exe 106 PID 1612 wrote to memory of 3600 1612 424448.exe 106 PID 3600 wrote to memory of 4408 3600 llfxxxr.exe 108 PID 3600 wrote to memory of 4408 3600 llfxxxr.exe 108 PID 3600 wrote to memory of 4408 3600 llfxxxr.exe 108 PID 4408 wrote to memory of 2064 4408 nhttnh.exe 109 PID 4408 wrote to memory of 2064 4408 nhttnh.exe 109 PID 4408 wrote to memory of 2064 4408 nhttnh.exe 109 PID 2064 wrote to memory of 3108 2064 0060882.exe 110 PID 2064 wrote to memory of 3108 2064 0060882.exe 110 PID 2064 wrote to memory of 3108 2064 0060882.exe 110 PID 3108 wrote to memory of 2184 3108 80666.exe 111 PID 3108 wrote to memory of 2184 3108 80666.exe 111 PID 3108 wrote to memory of 2184 3108 80666.exe 111 PID 2184 wrote to memory of 1940 2184 jvvpp.exe 112 PID 2184 wrote to memory of 1940 2184 jvvpp.exe 112 PID 2184 wrote to memory of 1940 2184 jvvpp.exe 112 PID 1940 wrote to memory of 4340 1940 440488.exe 113 PID 1940 wrote to memory of 4340 1940 440488.exe 113 PID 1940 wrote to memory of 4340 1940 440488.exe 113 PID 4340 wrote to memory of 4452 4340 820444.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dff1f9213d36b3d18184aff20a62f10N.exe"C:\Users\Admin\AppData\Local\Temp\5dff1f9213d36b3d18184aff20a62f10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\xfllflf.exec:\xfllflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\fxflrfl.exec:\fxflrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\20666.exec:\20666.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\8048288.exec:\8048288.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\bthnht.exec:\bthnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\64426.exec:\64426.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\5vvpj.exec:\5vvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dvppj.exec:\dvppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\btttbh.exec:\btttbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\806082.exec:\806082.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\8626622.exec:\8626622.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\800000.exec:\800000.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\2406444.exec:\2406444.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\424448.exec:\424448.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\llfxxxr.exec:\llfxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\nhttnh.exec:\nhttnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\0060882.exec:\0060882.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\80666.exec:\80666.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\jvvpp.exec:\jvvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\440488.exec:\440488.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\820444.exec:\820444.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\ntbtnn.exec:\ntbtnn.exe23⤵
- Executes dropped EXE
PID:4452 -
\??\c:\jdjdp.exec:\jdjdp.exe24⤵
- Executes dropped EXE
PID:4812 -
\??\c:\268822.exec:\268822.exe25⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vvvpj.exec:\vvvpj.exe26⤵
- Executes dropped EXE
PID:4120 -
\??\c:\7pddd.exec:\7pddd.exe27⤵
- Executes dropped EXE
PID:4732 -
\??\c:\406060.exec:\406060.exe28⤵
- Executes dropped EXE
PID:5032 -
\??\c:\c226048.exec:\c226048.exe29⤵
- Executes dropped EXE
PID:2928 -
\??\c:\060208.exec:\060208.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vppdv.exec:\vppdv.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\a0488.exec:\a0488.exe32⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7hbbtb.exec:\7hbbtb.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\808020.exec:\808020.exe34⤵
- Executes dropped EXE
PID:4908 -
\??\c:\i222066.exec:\i222066.exe35⤵
- Executes dropped EXE
PID:4824 -
\??\c:\0668662.exec:\0668662.exe36⤵
- Executes dropped EXE
PID:3244 -
\??\c:\nnnnnn.exec:\nnnnnn.exe37⤵
- Executes dropped EXE
PID:388 -
\??\c:\062266.exec:\062266.exe38⤵
- Executes dropped EXE
PID:872 -
\??\c:\002822.exec:\002822.exe39⤵
- Executes dropped EXE
PID:1672 -
\??\c:\g6282.exec:\g6282.exe40⤵
- Executes dropped EXE
PID:4208 -
\??\c:\xfffxxx.exec:\xfffxxx.exe41⤵
- Executes dropped EXE
PID:3900 -
\??\c:\nhbthh.exec:\nhbthh.exe42⤵
- Executes dropped EXE
PID:3432 -
\??\c:\pjjjp.exec:\pjjjp.exe43⤵
- Executes dropped EXE
PID:3260 -
\??\c:\s4666.exec:\s4666.exe44⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ddjjj.exec:\ddjjj.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\828222.exec:\828222.exe46⤵
- Executes dropped EXE
PID:3828 -
\??\c:\m4660.exec:\m4660.exe47⤵
- Executes dropped EXE
PID:5084 -
\??\c:\frxrlll.exec:\frxrlll.exe48⤵
- Executes dropped EXE
PID:3920 -
\??\c:\jdpjp.exec:\jdpjp.exe49⤵
- Executes dropped EXE
PID:3460 -
\??\c:\e84826.exec:\e84826.exe50⤵
- Executes dropped EXE
PID:1960 -
\??\c:\28844.exec:\28844.exe51⤵
- Executes dropped EXE
PID:4076 -
\??\c:\q84044.exec:\q84044.exe52⤵
- Executes dropped EXE
PID:232 -
\??\c:\btbthh.exec:\btbthh.exe53⤵
- Executes dropped EXE
PID:3304 -
\??\c:\6844888.exec:\6844888.exe54⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rxrxrxx.exec:\rxrxrxx.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\20266.exec:\20266.exe56⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lxfxrrx.exec:\lxfxrrx.exe57⤵
- Executes dropped EXE
PID:4004 -
\??\c:\jjjdd.exec:\jjjdd.exe58⤵
- Executes dropped EXE
PID:3204 -
\??\c:\hnbthh.exec:\hnbthh.exe59⤵
- Executes dropped EXE
PID:1852 -
\??\c:\g4606.exec:\g4606.exe60⤵
- Executes dropped EXE
PID:2896 -
\??\c:\84820.exec:\84820.exe61⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tbnbtt.exec:\tbnbtt.exe62⤵
- Executes dropped EXE
PID:244 -
\??\c:\8244828.exec:\8244828.exe63⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1nnnth.exec:\1nnnth.exe64⤵
- Executes dropped EXE
PID:5004 -
\??\c:\5lfxrrx.exec:\5lfxrrx.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\pjpvp.exec:\pjpvp.exe66⤵PID:2872
-
\??\c:\lxxrrrx.exec:\lxxrrrx.exe67⤵PID:3832
-
\??\c:\40248.exec:\40248.exe68⤵PID:3380
-
\??\c:\a6848.exec:\a6848.exe69⤵PID:1216
-
\??\c:\60406.exec:\60406.exe70⤵PID:4700
-
\??\c:\u244882.exec:\u244882.exe71⤵PID:3012
-
\??\c:\nbbbbb.exec:\nbbbbb.exe72⤵PID:3376
-
\??\c:\9xllrrf.exec:\9xllrrf.exe73⤵PID:3808
-
\??\c:\llfxflx.exec:\llfxflx.exe74⤵PID:1672
-
\??\c:\664400.exec:\664400.exe75⤵PID:4068
-
\??\c:\a4004.exec:\a4004.exe76⤵PID:2364
-
\??\c:\xrllflf.exec:\xrllflf.exe77⤵PID:1600
-
\??\c:\24601b.exec:\24601b.exe78⤵PID:224
-
\??\c:\xlrrrfr.exec:\xlrrrfr.exe79⤵PID:2844
-
\??\c:\lxlllff.exec:\lxlllff.exe80⤵PID:868
-
\??\c:\pjpjd.exec:\pjpjd.exe81⤵PID:2092
-
\??\c:\rrrrrll.exec:\rrrrrll.exe82⤵PID:2960
-
\??\c:\6622628.exec:\6622628.exe83⤵PID:4252
-
\??\c:\7lrllll.exec:\7lrllll.exe84⤵PID:4632
-
\??\c:\8226666.exec:\8226666.exe85⤵PID:1960
-
\??\c:\o222660.exec:\o222660.exe86⤵PID:2052
-
\??\c:\006224.exec:\006224.exe87⤵PID:3596
-
\??\c:\042226.exec:\042226.exe88⤵PID:5064
-
\??\c:\lflfrrx.exec:\lflfrrx.exe89⤵PID:2556
-
\??\c:\s6222.exec:\s6222.exe90⤵PID:4012
-
\??\c:\nbbtnn.exec:\nbbtnn.exe91⤵PID:3108
-
\??\c:\40260.exec:\40260.exe92⤵PID:1596
-
\??\c:\5tttnn.exec:\5tttnn.exe93⤵PID:3204
-
\??\c:\jdjdv.exec:\jdjdv.exe94⤵PID:2400
-
\??\c:\002202.exec:\002202.exe95⤵PID:4324
-
\??\c:\tnnnnn.exec:\tnnnnn.exe96⤵PID:4872
-
\??\c:\9xxrlll.exec:\9xxrlll.exe97⤵PID:244
-
\??\c:\dvppj.exec:\dvppj.exe98⤵PID:1036
-
\??\c:\7fxllrx.exec:\7fxllrx.exe99⤵PID:1348
-
\??\c:\g8484.exec:\g8484.exe100⤵PID:4588
-
\??\c:\i440048.exec:\i440048.exe101⤵PID:2232
-
\??\c:\xrlrxxx.exec:\xrlrxxx.exe102⤵PID:3832
-
\??\c:\btttnn.exec:\btttnn.exe103⤵PID:948
-
\??\c:\tnhhhh.exec:\tnhhhh.exe104⤵PID:1216
-
\??\c:\08886.exec:\08886.exe105⤵PID:4700
-
\??\c:\o682004.exec:\o682004.exe106⤵PID:3012
-
\??\c:\8466000.exec:\8466000.exe107⤵PID:3376
-
\??\c:\68444.exec:\68444.exe108⤵PID:4328
-
\??\c:\dvjdv.exec:\dvjdv.exe109⤵PID:1672
-
\??\c:\4088622.exec:\4088622.exe110⤵PID:392
-
\??\c:\bbnntt.exec:\bbnntt.exe111⤵
- System Location Discovery: System Language Discovery
PID:3432 -
\??\c:\hbbttn.exec:\hbbttn.exe112⤵PID:3588
-
\??\c:\vdjvp.exec:\vdjvp.exe113⤵PID:4628
-
\??\c:\vdddp.exec:\vdddp.exe114⤵PID:4560
-
\??\c:\i804222.exec:\i804222.exe115⤵PID:2656
-
\??\c:\24000.exec:\24000.exe116⤵PID:4660
-
\??\c:\htttnn.exec:\htttnn.exe117⤵PID:2064
-
\??\c:\ntbbhh.exec:\ntbbhh.exe118⤵PID:3100
-
\??\c:\jvvpj.exec:\jvvpj.exe119⤵PID:2184
-
\??\c:\dpddd.exec:\dpddd.exe120⤵PID:1604
-
\??\c:\4648226.exec:\4648226.exe121⤵PID:688
-
\??\c:\pvdvp.exec:\pvdvp.exe122⤵PID:3772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-