Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe
Resource
win7-20240903-en
General
-
Target
fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe
-
Size
82KB
-
MD5
2ef71c6c9977c4d36b6fc25da4472f10
-
SHA1
1ae02de6a22339f0d1ec890fab323e5dddf1c1b4
-
SHA256
fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45a
-
SHA512
49b5151f77eaa266462b33e126b8d932581e9847f6a4ed6f25e0b3d8c2582fbe447315a9146a6d9718f969298bd43ce246d7d735362db458ecf72321784bd0cf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qj:ymb3NkkiQ3mdBjFIIp9L9QrrA8C
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2496-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 dvdvp.exe 4588 rrlffff.exe 3116 tnbnnh.exe 2528 jdvpd.exe 4492 rrlxlrr.exe 872 bnnhnn.exe 704 dvddp.exe 2500 dvvdv.exe 1808 9rlfffr.exe 4784 1jvvv.exe 2424 ppjdd.exe 3228 rrxxxxx.exe 3060 nnthhn.exe 1224 jdpjj.exe 1604 vdjjj.exe 1216 1lrrrxx.exe 2560 hnhtbt.exe 4996 9ppjj.exe 4556 flflfll.exe 4872 9nbthn.exe 3640 ppdpp.exe 3588 vvdjj.exe 1812 rrrrxff.exe 1944 lxffxxx.exe 624 htbbbb.exe 4176 llxrxxf.exe 2784 hhhhhh.exe 2732 1hnhhh.exe 2632 1vvvp.exe 1100 jjvpp.exe 2996 ddjdv.exe 388 llrrlll.exe 880 nbtbbb.exe 3892 ddjpp.exe 3264 xlrxlfx.exe 1064 xrfrffr.exe 3664 ntbbbb.exe 1060 5ntnnn.exe 3764 vdjdv.exe 4976 9jvvv.exe 848 5xxlfrl.exe 464 hhtthh.exe 2156 nnnnht.exe 4820 pdvpj.exe 2060 rrfffxr.exe 3756 bhhhhh.exe 4948 nbnhtn.exe 4148 5dddd.exe 4364 rrxrxxx.exe 2164 hhtttt.exe 3340 xlrrrxx.exe 4252 nntttt.exe 4876 pjdvp.exe 2988 flrffll.exe 4504 bthhbh.exe 4864 jvdvv.exe 1304 fflllrr.exe 2840 nbnnnn.exe 3912 jvdpj.exe 704 rlllrrr.exe 1640 rrxllxr.exe 3552 pjjjd.exe 2692 5lrrrrx.exe 4984 llrrrrr.exe -
resource yara_rule behavioral2/memory/2496-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2792 2496 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 82 PID 2496 wrote to memory of 2792 2496 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 82 PID 2496 wrote to memory of 2792 2496 fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe 82 PID 2792 wrote to memory of 4588 2792 dvdvp.exe 83 PID 2792 wrote to memory of 4588 2792 dvdvp.exe 83 PID 2792 wrote to memory of 4588 2792 dvdvp.exe 83 PID 4588 wrote to memory of 3116 4588 rrlffff.exe 84 PID 4588 wrote to memory of 3116 4588 rrlffff.exe 84 PID 4588 wrote to memory of 3116 4588 rrlffff.exe 84 PID 3116 wrote to memory of 2528 3116 tnbnnh.exe 85 PID 3116 wrote to memory of 2528 3116 tnbnnh.exe 85 PID 3116 wrote to memory of 2528 3116 tnbnnh.exe 85 PID 2528 wrote to memory of 4492 2528 jdvpd.exe 86 PID 2528 wrote to memory of 4492 2528 jdvpd.exe 86 PID 2528 wrote to memory of 4492 2528 jdvpd.exe 86 PID 4492 wrote to memory of 872 4492 rrlxlrr.exe 87 PID 4492 wrote to memory of 872 4492 rrlxlrr.exe 87 PID 4492 wrote to memory of 872 4492 rrlxlrr.exe 87 PID 872 wrote to memory of 704 872 bnnhnn.exe 88 PID 872 wrote to memory of 704 872 bnnhnn.exe 88 PID 872 wrote to memory of 704 872 bnnhnn.exe 88 PID 704 wrote to memory of 2500 704 dvddp.exe 89 PID 704 wrote to memory of 2500 704 dvddp.exe 89 PID 704 wrote to memory of 2500 704 dvddp.exe 89 PID 2500 wrote to memory of 1808 2500 dvvdv.exe 90 PID 2500 wrote to memory of 1808 2500 dvvdv.exe 90 PID 2500 wrote to memory of 1808 2500 dvvdv.exe 90 PID 1808 wrote to memory of 4784 1808 9rlfffr.exe 91 PID 1808 wrote to memory of 4784 1808 9rlfffr.exe 91 PID 1808 wrote to memory of 4784 1808 9rlfffr.exe 91 PID 4784 wrote to memory of 2424 4784 1jvvv.exe 92 PID 4784 wrote to memory of 2424 4784 1jvvv.exe 92 PID 4784 wrote to memory of 2424 4784 1jvvv.exe 92 PID 2424 wrote to memory of 3228 2424 ppjdd.exe 93 PID 2424 wrote to memory of 3228 2424 ppjdd.exe 93 PID 2424 wrote to memory of 3228 2424 ppjdd.exe 93 PID 3228 wrote to memory of 3060 3228 rrxxxxx.exe 94 PID 3228 wrote to memory of 3060 3228 rrxxxxx.exe 94 PID 3228 wrote to memory of 3060 3228 rrxxxxx.exe 94 PID 3060 wrote to memory of 1224 3060 nnthhn.exe 95 PID 3060 wrote to memory of 1224 3060 nnthhn.exe 95 PID 3060 wrote to memory of 1224 3060 nnthhn.exe 95 PID 1224 wrote to memory of 1604 1224 jdpjj.exe 96 PID 1224 wrote to memory of 1604 1224 jdpjj.exe 96 PID 1224 wrote to memory of 1604 1224 jdpjj.exe 96 PID 1604 wrote to memory of 1216 1604 vdjjj.exe 97 PID 1604 wrote to memory of 1216 1604 vdjjj.exe 97 PID 1604 wrote to memory of 1216 1604 vdjjj.exe 97 PID 1216 wrote to memory of 2560 1216 1lrrrxx.exe 98 PID 1216 wrote to memory of 2560 1216 1lrrrxx.exe 98 PID 1216 wrote to memory of 2560 1216 1lrrrxx.exe 98 PID 2560 wrote to memory of 4996 2560 hnhtbt.exe 99 PID 2560 wrote to memory of 4996 2560 hnhtbt.exe 99 PID 2560 wrote to memory of 4996 2560 hnhtbt.exe 99 PID 4996 wrote to memory of 4556 4996 9ppjj.exe 100 PID 4996 wrote to memory of 4556 4996 9ppjj.exe 100 PID 4996 wrote to memory of 4556 4996 9ppjj.exe 100 PID 4556 wrote to memory of 4872 4556 flflfll.exe 101 PID 4556 wrote to memory of 4872 4556 flflfll.exe 101 PID 4556 wrote to memory of 4872 4556 flflfll.exe 101 PID 4872 wrote to memory of 3640 4872 9nbthn.exe 102 PID 4872 wrote to memory of 3640 4872 9nbthn.exe 102 PID 4872 wrote to memory of 3640 4872 9nbthn.exe 102 PID 3640 wrote to memory of 3588 3640 ppdpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe"C:\Users\Admin\AppData\Local\Temp\fe9242e635be3c9045ed2d8b248774372ea157bf51f04f095f0a0e0e9e4fa45aN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dvdvp.exec:\dvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rrlffff.exec:\rrlffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\tnbnnh.exec:\tnbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\jdvpd.exec:\jdvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\bnnhnn.exec:\bnnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\dvddp.exec:\dvddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\dvvdv.exec:\dvvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\9rlfffr.exec:\9rlfffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\1jvvv.exec:\1jvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\ppjdd.exec:\ppjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\nnthhn.exec:\nnthhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jdpjj.exec:\jdpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\vdjjj.exec:\vdjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\hnhtbt.exec:\hnhtbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\9ppjj.exec:\9ppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\flflfll.exec:\flflfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\9nbthn.exec:\9nbthn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\ppdpp.exec:\ppdpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\vvdjj.exec:\vvdjj.exe23⤵
- Executes dropped EXE
PID:3588 -
\??\c:\rrrrxff.exec:\rrrrxff.exe24⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lxffxxx.exec:\lxffxxx.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\htbbbb.exec:\htbbbb.exe26⤵
- Executes dropped EXE
PID:624 -
\??\c:\llxrxxf.exec:\llxrxxf.exe27⤵
- Executes dropped EXE
PID:4176 -
\??\c:\hhhhhh.exec:\hhhhhh.exe28⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1hnhhh.exec:\1hnhhh.exe29⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1vvvp.exec:\1vvvp.exe30⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jjvpp.exec:\jjvpp.exe31⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ddjdv.exec:\ddjdv.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\llrrlll.exec:\llrrlll.exe33⤵
- Executes dropped EXE
PID:388 -
\??\c:\nbtbbb.exec:\nbtbbb.exe34⤵
- Executes dropped EXE
PID:880 -
\??\c:\ddjpp.exec:\ddjpp.exe35⤵
- Executes dropped EXE
PID:3892 -
\??\c:\xlrxlfx.exec:\xlrxlfx.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264 -
\??\c:\xrfrffr.exec:\xrfrffr.exe37⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ntbbbb.exec:\ntbbbb.exe38⤵
- Executes dropped EXE
PID:3664 -
\??\c:\5ntnnn.exec:\5ntnnn.exe39⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vdjdv.exec:\vdjdv.exe40⤵
- Executes dropped EXE
PID:3764 -
\??\c:\9jvvv.exec:\9jvvv.exe41⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5xxlfrl.exec:\5xxlfrl.exe42⤵
- Executes dropped EXE
PID:848 -
\??\c:\hhtthh.exec:\hhtthh.exe43⤵
- Executes dropped EXE
PID:464 -
\??\c:\nnnnht.exec:\nnnnht.exe44⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pdvpj.exec:\pdvpj.exe45⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rrfffxr.exec:\rrfffxr.exe46⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bhhhhh.exec:\bhhhhh.exe47⤵
- Executes dropped EXE
PID:3756 -
\??\c:\nbnhtn.exec:\nbnhtn.exe48⤵
- Executes dropped EXE
PID:4948 -
\??\c:\5dddd.exec:\5dddd.exe49⤵
- Executes dropped EXE
PID:4148 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe50⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hhtttt.exec:\hhtttt.exe51⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe52⤵
- Executes dropped EXE
PID:3340 -
\??\c:\nntttt.exec:\nntttt.exe53⤵
- Executes dropped EXE
PID:4252 -
\??\c:\pjdvp.exec:\pjdvp.exe54⤵
- Executes dropped EXE
PID:4876 -
\??\c:\flrffll.exec:\flrffll.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bthhbh.exec:\bthhbh.exe56⤵
- Executes dropped EXE
PID:4504 -
\??\c:\jvdvv.exec:\jvdvv.exe57⤵
- Executes dropped EXE
PID:4864 -
\??\c:\fflllrr.exec:\fflllrr.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nbnnnn.exec:\nbnnnn.exe59⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jvdpj.exec:\jvdpj.exe60⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rlllrrr.exec:\rlllrrr.exe61⤵
- Executes dropped EXE
PID:704 -
\??\c:\rrxllxr.exec:\rrxllxr.exe62⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjjjd.exec:\pjjjd.exe63⤵
- Executes dropped EXE
PID:3552 -
\??\c:\5lrrrrx.exec:\5lrrrrx.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\llrrrrr.exec:\llrrrrr.exe65⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tnnnhh.exec:\tnnnhh.exe66⤵PID:3736
-
\??\c:\jjpjv.exec:\jjpjv.exe67⤵PID:2424
-
\??\c:\vvjdv.exec:\vvjdv.exe68⤵PID:3276
-
\??\c:\rrxrxxr.exec:\rrxrxxr.exe69⤵PID:4980
-
\??\c:\3bbbtt.exec:\3bbbtt.exe70⤵PID:1212
-
\??\c:\bbbttt.exec:\bbbttt.exe71⤵PID:4260
-
\??\c:\jddjv.exec:\jddjv.exe72⤵PID:4640
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe73⤵PID:1004
-
\??\c:\xrffxxr.exec:\xrffxxr.exe74⤵PID:1960
-
\??\c:\tbthbb.exec:\tbthbb.exe75⤵PID:5052
-
\??\c:\vjdpv.exec:\vjdpv.exe76⤵PID:2332
-
\??\c:\vdjjd.exec:\vdjjd.exe77⤵PID:3300
-
\??\c:\lrrrfff.exec:\lrrrfff.exe78⤵PID:688
-
\??\c:\xrxrllr.exec:\xrxrllr.exe79⤵PID:4700
-
\??\c:\thnhbb.exec:\thnhbb.exe80⤵PID:3520
-
\??\c:\hbnhbb.exec:\hbnhbb.exe81⤵PID:5004
-
\??\c:\pdjjv.exec:\pdjjv.exe82⤵PID:1080
-
\??\c:\vvpjj.exec:\vvpjj.exe83⤵PID:3444
-
\??\c:\xffxrrl.exec:\xffxrrl.exe84⤵PID:1056
-
\??\c:\bntnhb.exec:\bntnhb.exe85⤵PID:1944
-
\??\c:\jdpjj.exec:\jdpjj.exe86⤵PID:2728
-
\??\c:\5dpjj.exec:\5dpjj.exe87⤵PID:1908
-
\??\c:\fffxxll.exec:\fffxxll.exe88⤵PID:4548
-
\??\c:\hnntnb.exec:\hnntnb.exe89⤵PID:1156
-
\??\c:\tbhhbt.exec:\tbhhbt.exe90⤵PID:920
-
\??\c:\vvjjd.exec:\vvjjd.exe91⤵PID:4292
-
\??\c:\rlflxrl.exec:\rlflxrl.exe92⤵PID:1240
-
\??\c:\9htnnn.exec:\9htnnn.exe93⤵PID:3772
-
\??\c:\bhtbth.exec:\bhtbth.exe94⤵PID:1560
-
\??\c:\jjjvp.exec:\jjjvp.exe95⤵PID:1728
-
\??\c:\jdvvj.exec:\jdvvj.exe96⤵PID:5100
-
\??\c:\3lxrxfl.exec:\3lxrxfl.exe97⤵PID:3892
-
\??\c:\3hbbhb.exec:\3hbbhb.exe98⤵PID:3024
-
\??\c:\5tthbt.exec:\5tthbt.exe99⤵PID:2192
-
\??\c:\jpvpj.exec:\jpvpj.exe100⤵PID:540
-
\??\c:\xrxrxlf.exec:\xrxrxlf.exe101⤵PID:1476
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe102⤵PID:4776
-
\??\c:\3bbttt.exec:\3bbttt.exe103⤵PID:2328
-
\??\c:\1vvpj.exec:\1vvpj.exe104⤵PID:3788
-
\??\c:\dpjvj.exec:\dpjvj.exe105⤵PID:3496
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe106⤵PID:2948
-
\??\c:\xlrlffx.exec:\xlrlffx.exe107⤵PID:1704
-
\??\c:\hhbtnt.exec:\hhbtnt.exe108⤵PID:2060
-
\??\c:\jdddv.exec:\jdddv.exe109⤵PID:3756
-
\??\c:\lfffrll.exec:\lfffrll.exe110⤵PID:4356
-
\??\c:\hhtbbb.exec:\hhtbbb.exe111⤵PID:4880
-
\??\c:\dvdvv.exec:\dvdvv.exe112⤵PID:1648
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe113⤵PID:2164
-
\??\c:\1xxxxff.exec:\1xxxxff.exe114⤵PID:3340
-
\??\c:\bttnbb.exec:\bttnbb.exe115⤵PID:4876
-
\??\c:\ddvdd.exec:\ddvdd.exe116⤵PID:4404
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe117⤵PID:456
-
\??\c:\jdjdd.exec:\jdjdd.exe118⤵PID:2364
-
\??\c:\jvdvp.exec:\jvdvp.exe119⤵
- System Location Discovery: System Language Discovery
PID:872 -
\??\c:\xxxxxrl.exec:\xxxxxrl.exe120⤵PID:4444
-
\??\c:\fxllllx.exec:\fxllllx.exe121⤵PID:3156
-
\??\c:\bbhbhn.exec:\bbhbhn.exe122⤵PID:3244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-