Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea449a2b035626109c6710e991fe7cd0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
ea449a2b035626109c6710e991fe7cd0N.exe
-
Size
63KB
-
MD5
ea449a2b035626109c6710e991fe7cd0
-
SHA1
e5daf26c325a8bc62a46e03b454c33f4750d6834
-
SHA256
4dfbf94d18fbb4faac21ae7e79124145c47dbd9089dba6bd629ba4ee5fbc2b9d
-
SHA512
c0714a5e2fa87bfaee1dff5b8ee9485b0fd558c1072010a0d8f73166745db6e96ef1477e6ce462c3d21a5b9452caff41109ab0dcee2c073b99d0a5e454f61dd5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbsN:ymb3NkkiQ3mdBjF0y7kbE
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/64-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/612-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2608 1rlxrll.exe 2112 nhtntn.exe 5092 vppjd.exe 4892 pvjdp.exe 2808 vpddv.exe 5016 pjdpd.exe 5008 lfllrrx.exe 880 nthbtn.exe 2012 hbbtnn.exe 3616 vjvpp.exe 3812 llllrrf.exe 1400 rfrlllr.exe 3640 thbtbt.exe 2736 dvpjp.exe 1392 xllfxrr.exe 2260 frlfxxr.exe 4652 xfllfff.exe 1092 tnttnh.exe 3224 vppjd.exe 4828 lfllffx.exe 4112 frrrllf.exe 2056 nbtbbb.exe 540 vpdvd.exe 1496 vvvpv.exe 2724 xrrrllr.exe 2812 lrxxrrr.exe 612 httbbb.exe 1636 bhhtnb.exe 2544 7pddv.exe 1056 ddjdp.exe 1888 rlfxrlf.exe 4460 lxffffx.exe 4448 bbhbbb.exe 2104 5ntnhh.exe 1684 djjdp.exe 3884 vvppj.exe 4540 fxxrrll.exe 4380 xlrllxx.exe 4756 btbbtt.exe 3268 btnhhh.exe 2628 jdpjj.exe 3612 dvpdv.exe 2112 rlrlxxr.exe 3776 fxrrllf.exe 4892 thbthh.exe 2916 bhnhtt.exe 652 7vvvp.exe 5012 jjjpv.exe 4376 djvvj.exe 1652 rrxxrrr.exe 3240 nhhbbb.exe 1736 tbnbtt.exe 2992 thhbtb.exe 3616 jdddd.exe 3812 dpvdv.exe 4624 lxffrrx.exe 2740 nhbtnn.exe 4292 vvpvv.exe 2376 rlfxlxx.exe 748 xlxxxxr.exe 5108 hbtttt.exe 1544 nhbttt.exe 3592 pdjdv.exe 1476 pdpdj.exe -
resource yara_rule behavioral2/memory/64-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 2608 64 ea449a2b035626109c6710e991fe7cd0N.exe 83 PID 64 wrote to memory of 2608 64 ea449a2b035626109c6710e991fe7cd0N.exe 83 PID 64 wrote to memory of 2608 64 ea449a2b035626109c6710e991fe7cd0N.exe 83 PID 2608 wrote to memory of 2112 2608 1rlxrll.exe 84 PID 2608 wrote to memory of 2112 2608 1rlxrll.exe 84 PID 2608 wrote to memory of 2112 2608 1rlxrll.exe 84 PID 2112 wrote to memory of 5092 2112 nhtntn.exe 85 PID 2112 wrote to memory of 5092 2112 nhtntn.exe 85 PID 2112 wrote to memory of 5092 2112 nhtntn.exe 85 PID 5092 wrote to memory of 4892 5092 vppjd.exe 86 PID 5092 wrote to memory of 4892 5092 vppjd.exe 86 PID 5092 wrote to memory of 4892 5092 vppjd.exe 86 PID 4892 wrote to memory of 2808 4892 pvjdp.exe 88 PID 4892 wrote to memory of 2808 4892 pvjdp.exe 88 PID 4892 wrote to memory of 2808 4892 pvjdp.exe 88 PID 2808 wrote to memory of 5016 2808 vpddv.exe 89 PID 2808 wrote to memory of 5016 2808 vpddv.exe 89 PID 2808 wrote to memory of 5016 2808 vpddv.exe 89 PID 5016 wrote to memory of 5008 5016 pjdpd.exe 90 PID 5016 wrote to memory of 5008 5016 pjdpd.exe 90 PID 5016 wrote to memory of 5008 5016 pjdpd.exe 90 PID 5008 wrote to memory of 880 5008 lfllrrx.exe 91 PID 5008 wrote to memory of 880 5008 lfllrrx.exe 91 PID 5008 wrote to memory of 880 5008 lfllrrx.exe 91 PID 880 wrote to memory of 2012 880 nthbtn.exe 92 PID 880 wrote to memory of 2012 880 nthbtn.exe 92 PID 880 wrote to memory of 2012 880 nthbtn.exe 92 PID 2012 wrote to memory of 3616 2012 hbbtnn.exe 93 PID 2012 wrote to memory of 3616 2012 hbbtnn.exe 93 PID 2012 wrote to memory of 3616 2012 hbbtnn.exe 93 PID 3616 wrote to memory of 3812 3616 vjvpp.exe 94 PID 3616 wrote to memory of 3812 3616 vjvpp.exe 94 PID 3616 wrote to memory of 3812 3616 vjvpp.exe 94 PID 3812 wrote to memory of 1400 3812 llllrrf.exe 95 PID 3812 wrote to memory of 1400 3812 llllrrf.exe 95 PID 3812 wrote to memory of 1400 3812 llllrrf.exe 95 PID 1400 wrote to memory of 3640 1400 rfrlllr.exe 96 PID 1400 wrote to memory of 3640 1400 rfrlllr.exe 96 PID 1400 wrote to memory of 3640 1400 rfrlllr.exe 96 PID 3640 wrote to memory of 2736 3640 thbtbt.exe 97 PID 3640 wrote to memory of 2736 3640 thbtbt.exe 97 PID 3640 wrote to memory of 2736 3640 thbtbt.exe 97 PID 2736 wrote to memory of 1392 2736 dvpjp.exe 99 PID 2736 wrote to memory of 1392 2736 dvpjp.exe 99 PID 2736 wrote to memory of 1392 2736 dvpjp.exe 99 PID 1392 wrote to memory of 2260 1392 xllfxrr.exe 100 PID 1392 wrote to memory of 2260 1392 xllfxrr.exe 100 PID 1392 wrote to memory of 2260 1392 xllfxrr.exe 100 PID 2260 wrote to memory of 4652 2260 frlfxxr.exe 101 PID 2260 wrote to memory of 4652 2260 frlfxxr.exe 101 PID 2260 wrote to memory of 4652 2260 frlfxxr.exe 101 PID 4652 wrote to memory of 1092 4652 xfllfff.exe 102 PID 4652 wrote to memory of 1092 4652 xfllfff.exe 102 PID 4652 wrote to memory of 1092 4652 xfllfff.exe 102 PID 1092 wrote to memory of 3224 1092 tnttnh.exe 103 PID 1092 wrote to memory of 3224 1092 tnttnh.exe 103 PID 1092 wrote to memory of 3224 1092 tnttnh.exe 103 PID 3224 wrote to memory of 4828 3224 vppjd.exe 104 PID 3224 wrote to memory of 4828 3224 vppjd.exe 104 PID 3224 wrote to memory of 4828 3224 vppjd.exe 104 PID 4828 wrote to memory of 4112 4828 lfllffx.exe 106 PID 4828 wrote to memory of 4112 4828 lfllffx.exe 106 PID 4828 wrote to memory of 4112 4828 lfllffx.exe 106 PID 4112 wrote to memory of 2056 4112 frrrllf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea449a2b035626109c6710e991fe7cd0N.exe"C:\Users\Admin\AppData\Local\Temp\ea449a2b035626109c6710e991fe7cd0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\1rlxrll.exec:\1rlxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nhtntn.exec:\nhtntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vppjd.exec:\vppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\pvjdp.exec:\pvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\vpddv.exec:\vpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\pjdpd.exec:\pjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\lfllrrx.exec:\lfllrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\nthbtn.exec:\nthbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\hbbtnn.exec:\hbbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vjvpp.exec:\vjvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\llllrrf.exec:\llllrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\rfrlllr.exec:\rfrlllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\thbtbt.exec:\thbtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\dvpjp.exec:\dvpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xllfxrr.exec:\xllfxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\frlfxxr.exec:\frlfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\xfllfff.exec:\xfllfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\tnttnh.exec:\tnttnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\vppjd.exec:\vppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\lfllffx.exec:\lfllffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\frrrllf.exec:\frrrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\nbtbbb.exec:\nbtbbb.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vpdvd.exec:\vpdvd.exe24⤵
- Executes dropped EXE
PID:540 -
\??\c:\vvvpv.exec:\vvvpv.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrrrllr.exec:\xrrrllr.exe26⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe27⤵
- Executes dropped EXE
PID:2812 -
\??\c:\httbbb.exec:\httbbb.exe28⤵
- Executes dropped EXE
PID:612 -
\??\c:\bhhtnb.exec:\bhhtnb.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\7pddv.exec:\7pddv.exe30⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ddjdp.exec:\ddjdp.exe31⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe32⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lxffffx.exec:\lxffffx.exe33⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bbhbbb.exec:\bbhbbb.exe34⤵
- Executes dropped EXE
PID:4448 -
\??\c:\5ntnhh.exec:\5ntnhh.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\djjdp.exec:\djjdp.exe36⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vvppj.exec:\vvppj.exe37⤵
- Executes dropped EXE
PID:3884 -
\??\c:\fxxrrll.exec:\fxxrrll.exe38⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xlrllxx.exec:\xlrllxx.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\btbbtt.exec:\btbbtt.exe40⤵
- Executes dropped EXE
PID:4756 -
\??\c:\btnhhh.exec:\btnhhh.exe41⤵
- Executes dropped EXE
PID:3268 -
\??\c:\jdpjj.exec:\jdpjj.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dvpdv.exec:\dvpdv.exe43⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe44⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxrrllf.exec:\fxrrllf.exe45⤵
- Executes dropped EXE
PID:3776 -
\??\c:\thbthh.exec:\thbthh.exe46⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bhnhtt.exec:\bhnhtt.exe47⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7vvvp.exec:\7vvvp.exe48⤵
- Executes dropped EXE
PID:652 -
\??\c:\jjjpv.exec:\jjjpv.exe49⤵
- Executes dropped EXE
PID:5012 -
\??\c:\djvvj.exec:\djvvj.exe50⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe51⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhhbbb.exec:\nhhbbb.exe52⤵
- Executes dropped EXE
PID:3240 -
\??\c:\tbnbtt.exec:\tbnbtt.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\thhbtb.exec:\thhbtb.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jdddd.exec:\jdddd.exe55⤵
- Executes dropped EXE
PID:3616 -
\??\c:\dpvdv.exec:\dpvdv.exe56⤵
- Executes dropped EXE
PID:3812 -
\??\c:\lxffrrx.exec:\lxffrrx.exe57⤵
- Executes dropped EXE
PID:4624 -
\??\c:\nhbtnn.exec:\nhbtnn.exe58⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvpvv.exec:\vvpvv.exe59⤵
- Executes dropped EXE
PID:4292 -
\??\c:\rlfxlxx.exec:\rlfxlxx.exe60⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe61⤵
- Executes dropped EXE
PID:748 -
\??\c:\hbtttt.exec:\hbtttt.exe62⤵
- Executes dropped EXE
PID:5108 -
\??\c:\nhbttt.exec:\nhbttt.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pdjdv.exec:\pdjdv.exe64⤵
- Executes dropped EXE
PID:3592 -
\??\c:\pdpdj.exec:\pdpdj.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\flxrffx.exec:\flxrffx.exe66⤵PID:3568
-
\??\c:\xlllxfr.exec:\xlllxfr.exe67⤵PID:2684
-
\??\c:\bnhtnt.exec:\bnhtnt.exe68⤵PID:4880
-
\??\c:\vpjdd.exec:\vpjdd.exe69⤵PID:1352
-
\??\c:\pdjdp.exec:\pdjdp.exe70⤵PID:2420
-
\??\c:\1xffrrr.exec:\1xffrrr.exe71⤵PID:3272
-
\??\c:\ffxfffr.exec:\ffxfffr.exe72⤵PID:1768
-
\??\c:\bbnhbb.exec:\bbnhbb.exe73⤵PID:368
-
\??\c:\1ttnnn.exec:\1ttnnn.exe74⤵
- System Location Discovery: System Language Discovery
PID:3964 -
\??\c:\ppjdv.exec:\ppjdv.exe75⤵PID:2364
-
\??\c:\dvjdp.exec:\dvjdp.exe76⤵PID:3648
-
\??\c:\xflfrrr.exec:\xflfrrr.exe77⤵PID:452
-
\??\c:\rrllrlr.exec:\rrllrlr.exe78⤵PID:612
-
\??\c:\tbhhhh.exec:\tbhhhh.exe79⤵PID:4032
-
\??\c:\bnnbnh.exec:\bnnbnh.exe80⤵PID:1840
-
\??\c:\jvvpp.exec:\jvvpp.exe81⤵PID:1060
-
\??\c:\vjdvj.exec:\vjdvj.exe82⤵PID:1256
-
\??\c:\frlfxxr.exec:\frlfxxr.exe83⤵PID:4404
-
\??\c:\1xxrllf.exec:\1xxrllf.exe84⤵PID:1640
-
\??\c:\fllfxlf.exec:\fllfxlf.exe85⤵PID:1248
-
\??\c:\hntnhh.exec:\hntnhh.exe86⤵PID:3688
-
\??\c:\pdpvp.exec:\pdpvp.exe87⤵PID:4172
-
\??\c:\dvdpp.exec:\dvdpp.exe88⤵PID:4632
-
\??\c:\xxlfffl.exec:\xxlfffl.exe89⤵PID:1076
-
\??\c:\vjjdd.exec:\vjjdd.exe90⤵PID:3960
-
\??\c:\jjjvj.exec:\jjjvj.exe91⤵PID:4892
-
\??\c:\vjpjj.exec:\vjpjj.exe92⤵PID:2100
-
\??\c:\xlrllll.exec:\xlrllll.exe93⤵PID:2824
-
\??\c:\thhtbb.exec:\thhtbb.exe94⤵PID:3280
-
\??\c:\nnnnbb.exec:\nnnnbb.exe95⤵PID:5008
-
\??\c:\vjjdv.exec:\vjjdv.exe96⤵PID:1652
-
\??\c:\1jdjv.exec:\1jdjv.exe97⤵PID:4248
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe98⤵PID:1860
-
\??\c:\lfxrllf.exec:\lfxrllf.exe99⤵PID:2992
-
\??\c:\nthtbn.exec:\nthtbn.exe100⤵PID:3616
-
\??\c:\thhhbb.exec:\thhhbb.exe101⤵PID:3812
-
\??\c:\3jdpd.exec:\3jdpd.exe102⤵PID:3640
-
\??\c:\jpvpp.exec:\jpvpp.exe103⤵PID:4628
-
\??\c:\rfrxlxl.exec:\rfrxlxl.exe104⤵PID:2736
-
\??\c:\9rlxrlf.exec:\9rlxrlf.exe105⤵PID:4412
-
\??\c:\htntht.exec:\htntht.exe106⤵PID:4572
-
\??\c:\nhthtn.exec:\nhthtn.exe107⤵PID:5108
-
\??\c:\btbnhb.exec:\btbnhb.exe108⤵PID:224
-
\??\c:\jvpdp.exec:\jvpdp.exe109⤵PID:3592
-
\??\c:\7pdpd.exec:\7pdpd.exe110⤵PID:4016
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe111⤵PID:3728
-
\??\c:\hthtbn.exec:\hthtbn.exe112⤵PID:1164
-
\??\c:\bthbnh.exec:\bthbnh.exe113⤵
- System Location Discovery: System Language Discovery
PID:4880 -
\??\c:\pdjvj.exec:\pdjvj.exe114⤵PID:1352
-
\??\c:\jvddj.exec:\jvddj.exe115⤵PID:3120
-
\??\c:\ddvpd.exec:\ddvpd.exe116⤵PID:3272
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe117⤵PID:1768
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe118⤵PID:4896
-
\??\c:\nhbtnh.exec:\nhbtnh.exe119⤵PID:3964
-
\??\c:\5nnbnh.exec:\5nnbnh.exe120⤵PID:2812
-
\??\c:\jpjjd.exec:\jpjjd.exe121⤵PID:1620
-
\??\c:\pdvpd.exec:\pdvpd.exe122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-