Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 01:49
Static task
static1
Behavioral task
behavioral1
Sample
6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe
Resource
win7-20240903-en
General
-
Target
6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe
-
Size
107KB
-
MD5
7461f95eb1b187083c509b60cfdec670
-
SHA1
1baa81647383f00fe47a80dd1d722c15a112ae01
-
SHA256
6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75
-
SHA512
4b235c62e255f3d2f64268dcb4c94988c66b538bce2b951d7fb8b4ffce6b38e23d3f4767ae0d7fb9f578c7370e76790d8154d7096083101f5277cb93708ea368
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3Cme:n3C9BRo7MlrWKVT+buBGu3PHe
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/316-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4424 xllfxlx.exe 740 5hhthh.exe 3580 htnhth.exe 4460 rlrlxrx.exe 2756 jdpvd.exe 5040 vpvdv.exe 3488 htnbbh.exe 3740 vjpjd.exe 1608 fxfxxrx.exe 2584 rllfxrx.exe 3324 3bnhbt.exe 2348 xlfrfxl.exe 3032 3vvpv.exe 1652 7vvjv.exe 3192 3lffrrl.exe 5032 5ttntn.exe 4648 jvvpj.exe 3576 xflxlfr.exe 3604 nhtnbt.exe 5064 nhtnnn.exe 4652 dvvpd.exe 2716 xlllxff.exe 4912 9lrfrlf.exe 1576 nhnhbb.exe 4824 djdpv.exe 2480 pppdp.exe 1628 fllxlfx.exe 4276 btnnhh.exe 1216 tbbtnh.exe 896 vdvpd.exe 1796 xlxrfxr.exe 1208 xrlxrlx.exe 428 httnbt.exe 4932 5djdv.exe 3444 ddjdp.exe 4388 lllfxlf.exe 4376 htnhtn.exe 3960 hththt.exe 1096 vjdpd.exe 2116 5fxrxrf.exe 2236 7htbnh.exe 2652 5xrfrlf.exe 3448 frfrrxx.exe 2360 5hbtnh.exe 748 7tbnbt.exe 4548 3pjdp.exe 3228 ffrlxrf.exe 2332 xrxrfxx.exe 5016 hnhbhh.exe 316 tttnbt.exe 4424 pvpjv.exe 4324 pvvdp.exe 4964 rxffrrl.exe 396 rflxrfx.exe 2044 htnhtn.exe 656 hbhhtn.exe 4848 vpjvj.exe 1964 xlxlxlr.exe 1496 9tthtn.exe 3488 3tnhtn.exe 1008 9vvvj.exe 744 rfffllx.exe 2012 tbnbtt.exe 2276 nhnnbt.exe -
resource yara_rule behavioral2/memory/316-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 316 wrote to memory of 4424 316 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 81 PID 316 wrote to memory of 4424 316 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 81 PID 316 wrote to memory of 4424 316 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 81 PID 4424 wrote to memory of 740 4424 xllfxlx.exe 82 PID 4424 wrote to memory of 740 4424 xllfxlx.exe 82 PID 4424 wrote to memory of 740 4424 xllfxlx.exe 82 PID 740 wrote to memory of 3580 740 5hhthh.exe 83 PID 740 wrote to memory of 3580 740 5hhthh.exe 83 PID 740 wrote to memory of 3580 740 5hhthh.exe 83 PID 3580 wrote to memory of 4460 3580 htnhth.exe 84 PID 3580 wrote to memory of 4460 3580 htnhth.exe 84 PID 3580 wrote to memory of 4460 3580 htnhth.exe 84 PID 4460 wrote to memory of 2756 4460 rlrlxrx.exe 85 PID 4460 wrote to memory of 2756 4460 rlrlxrx.exe 85 PID 4460 wrote to memory of 2756 4460 rlrlxrx.exe 85 PID 2756 wrote to memory of 5040 2756 jdpvd.exe 86 PID 2756 wrote to memory of 5040 2756 jdpvd.exe 86 PID 2756 wrote to memory of 5040 2756 jdpvd.exe 86 PID 5040 wrote to memory of 3488 5040 vpvdv.exe 87 PID 5040 wrote to memory of 3488 5040 vpvdv.exe 87 PID 5040 wrote to memory of 3488 5040 vpvdv.exe 87 PID 3488 wrote to memory of 3740 3488 htnbbh.exe 88 PID 3488 wrote to memory of 3740 3488 htnbbh.exe 88 PID 3488 wrote to memory of 3740 3488 htnbbh.exe 88 PID 3740 wrote to memory of 1608 3740 vjpjd.exe 89 PID 3740 wrote to memory of 1608 3740 vjpjd.exe 89 PID 3740 wrote to memory of 1608 3740 vjpjd.exe 89 PID 1608 wrote to memory of 2584 1608 fxfxxrx.exe 90 PID 1608 wrote to memory of 2584 1608 fxfxxrx.exe 90 PID 1608 wrote to memory of 2584 1608 fxfxxrx.exe 90 PID 2584 wrote to memory of 3324 2584 rllfxrx.exe 91 PID 2584 wrote to memory of 3324 2584 rllfxrx.exe 91 PID 2584 wrote to memory of 3324 2584 rllfxrx.exe 91 PID 3324 wrote to memory of 2348 3324 3bnhbt.exe 92 PID 3324 wrote to memory of 2348 3324 3bnhbt.exe 92 PID 3324 wrote to memory of 2348 3324 3bnhbt.exe 92 PID 2348 wrote to memory of 3032 2348 xlfrfxl.exe 93 PID 2348 wrote to memory of 3032 2348 xlfrfxl.exe 93 PID 2348 wrote to memory of 3032 2348 xlfrfxl.exe 93 PID 3032 wrote to memory of 1652 3032 3vvpv.exe 94 PID 3032 wrote to memory of 1652 3032 3vvpv.exe 94 PID 3032 wrote to memory of 1652 3032 3vvpv.exe 94 PID 1652 wrote to memory of 3192 1652 7vvjv.exe 95 PID 1652 wrote to memory of 3192 1652 7vvjv.exe 95 PID 1652 wrote to memory of 3192 1652 7vvjv.exe 95 PID 3192 wrote to memory of 5032 3192 3lffrrl.exe 96 PID 3192 wrote to memory of 5032 3192 3lffrrl.exe 96 PID 3192 wrote to memory of 5032 3192 3lffrrl.exe 96 PID 5032 wrote to memory of 4648 5032 5ttntn.exe 97 PID 5032 wrote to memory of 4648 5032 5ttntn.exe 97 PID 5032 wrote to memory of 4648 5032 5ttntn.exe 97 PID 4648 wrote to memory of 3576 4648 jvvpj.exe 98 PID 4648 wrote to memory of 3576 4648 jvvpj.exe 98 PID 4648 wrote to memory of 3576 4648 jvvpj.exe 98 PID 3576 wrote to memory of 3604 3576 xflxlfr.exe 99 PID 3576 wrote to memory of 3604 3576 xflxlfr.exe 99 PID 3576 wrote to memory of 3604 3576 xflxlfr.exe 99 PID 3604 wrote to memory of 5064 3604 nhtnbt.exe 100 PID 3604 wrote to memory of 5064 3604 nhtnbt.exe 100 PID 3604 wrote to memory of 5064 3604 nhtnbt.exe 100 PID 5064 wrote to memory of 4652 5064 nhtnnn.exe 101 PID 5064 wrote to memory of 4652 5064 nhtnnn.exe 101 PID 5064 wrote to memory of 4652 5064 nhtnnn.exe 101 PID 4652 wrote to memory of 2716 4652 dvvpd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe"C:\Users\Admin\AppData\Local\Temp\6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\xllfxlx.exec:\xllfxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\5hhthh.exec:\5hhthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\htnhth.exec:\htnhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\rlrlxrx.exec:\rlrlxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\jdpvd.exec:\jdpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vpvdv.exec:\vpvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\htnbbh.exec:\htnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\vjpjd.exec:\vjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\rllfxrx.exec:\rllfxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3bnhbt.exec:\3bnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3vvpv.exec:\3vvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\7vvjv.exec:\7vvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\3lffrrl.exec:\3lffrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\5ttntn.exec:\5ttntn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\jvvpj.exec:\jvvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\xflxlfr.exec:\xflxlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\nhtnbt.exec:\nhtnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\nhtnnn.exec:\nhtnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\dvvpd.exec:\dvvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\xlllxff.exec:\xlllxff.exe23⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9lrfrlf.exec:\9lrfrlf.exe24⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nhnhbb.exec:\nhnhbb.exe25⤵
- Executes dropped EXE
PID:1576 -
\??\c:\djdpv.exec:\djdpv.exe26⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pppdp.exec:\pppdp.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fllxlfx.exec:\fllxlfx.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\btnnhh.exec:\btnnhh.exe29⤵
- Executes dropped EXE
PID:4276 -
\??\c:\tbbtnh.exec:\tbbtnh.exe30⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vdvpd.exec:\vdvpd.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\xlxrfxr.exec:\xlxrfxr.exe32⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe33⤵
- Executes dropped EXE
PID:1208 -
\??\c:\httnbt.exec:\httnbt.exe34⤵
- Executes dropped EXE
PID:428 -
\??\c:\5djdv.exec:\5djdv.exe35⤵
- Executes dropped EXE
PID:4932 -
\??\c:\ddjdp.exec:\ddjdp.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\lllfxlf.exec:\lllfxlf.exe37⤵
- Executes dropped EXE
PID:4388 -
\??\c:\htnhtn.exec:\htnhtn.exe38⤵
- Executes dropped EXE
PID:4376 -
\??\c:\hththt.exec:\hththt.exe39⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vjdpd.exec:\vjdpd.exe40⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5fxrxrf.exec:\5fxrxrf.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7htbnh.exec:\7htbnh.exe42⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5xrfrlf.exec:\5xrfrlf.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\frfrrxx.exec:\frfrrxx.exe44⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5hbtnh.exec:\5hbtnh.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7tbnbt.exec:\7tbnbt.exe46⤵
- Executes dropped EXE
PID:748 -
\??\c:\3pjdp.exec:\3pjdp.exe47⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ffrlxrf.exec:\ffrlxrf.exe48⤵
- Executes dropped EXE
PID:3228 -
\??\c:\xrxrfxx.exec:\xrxrfxx.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hnhbhh.exec:\hnhbhh.exe50⤵
- Executes dropped EXE
PID:5016 -
\??\c:\tttnbt.exec:\tttnbt.exe51⤵
- Executes dropped EXE
PID:316 -
\??\c:\pvpjv.exec:\pvpjv.exe52⤵
- Executes dropped EXE
PID:4424 -
\??\c:\pvvdp.exec:\pvvdp.exe53⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rxffrrl.exec:\rxffrrl.exe54⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rflxrfx.exec:\rflxrfx.exe55⤵
- Executes dropped EXE
PID:396 -
\??\c:\htnhtn.exec:\htnhtn.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbhhtn.exec:\hbhhtn.exe57⤵
- Executes dropped EXE
PID:656 -
\??\c:\vpjvj.exec:\vpjvj.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xlxlxlr.exec:\xlxlxlr.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9tthtn.exec:\9tthtn.exe60⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3tnhtn.exec:\3tnhtn.exe61⤵
- Executes dropped EXE
PID:3488 -
\??\c:\9vvvj.exec:\9vvvj.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rfffllx.exec:\rfffllx.exe63⤵
- Executes dropped EXE
PID:744 -
\??\c:\tbnbtt.exec:\tbnbtt.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhnnbt.exec:\nhnnbt.exe65⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pvppv.exec:\pvppv.exe66⤵PID:4796
-
\??\c:\vpjjd.exec:\vpjjd.exe67⤵PID:3152
-
\??\c:\5frfxrf.exec:\5frfxrf.exe68⤵PID:2260
-
\??\c:\htnhbn.exec:\htnhbn.exe69⤵PID:516
-
\??\c:\7dpjv.exec:\7dpjv.exe70⤵PID:2836
-
\??\c:\xlrrrfx.exec:\xlrrrfx.exe71⤵PID:3068
-
\??\c:\1btnhb.exec:\1btnhb.exe72⤵PID:3192
-
\??\c:\vjdpd.exec:\vjdpd.exe73⤵PID:3596
-
\??\c:\djjjj.exec:\djjjj.exe74⤵PID:1588
-
\??\c:\xlfrxrl.exec:\xlfrxrl.exe75⤵PID:1936
-
\??\c:\ttnbnh.exec:\ttnbnh.exe76⤵PID:4240
-
\??\c:\hnbnhb.exec:\hnbnhb.exe77⤵PID:4960
-
\??\c:\jpjdv.exec:\jpjdv.exe78⤵PID:2188
-
\??\c:\rxffrrr.exec:\rxffrrr.exe79⤵PID:1136
-
\??\c:\rlfxfff.exec:\rlfxfff.exe80⤵PID:4788
-
\??\c:\hbtbtt.exec:\hbtbtt.exe81⤵PID:3236
-
\??\c:\3pvvj.exec:\3pvvj.exe82⤵PID:2716
-
\??\c:\vjvjv.exec:\vjvjv.exe83⤵PID:5100
-
\??\c:\rxrxlxx.exec:\rxrxlxx.exe84⤵PID:3064
-
\??\c:\rfrffxx.exec:\rfrffxx.exe85⤵PID:4748
-
\??\c:\ttnbnn.exec:\ttnbnn.exe86⤵PID:2356
-
\??\c:\5jjdd.exec:\5jjdd.exe87⤵PID:3360
-
\??\c:\pvdpd.exec:\pvdpd.exe88⤵PID:3548
-
\??\c:\lllflxr.exec:\lllflxr.exe89⤵PID:3640
-
\??\c:\rxfrfrf.exec:\rxfrfrf.exe90⤵PID:4808
-
\??\c:\tbbntn.exec:\tbbntn.exe91⤵PID:5108
-
\??\c:\1btntb.exec:\1btntb.exe92⤵PID:3756
-
\??\c:\jvvjv.exec:\jvvjv.exe93⤵PID:2024
-
\??\c:\rflflfx.exec:\rflflfx.exe94⤵PID:1208
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe95⤵PID:1572
-
\??\c:\tnbhbh.exec:\tnbhbh.exe96⤵PID:3148
-
\??\c:\nhbhtn.exec:\nhbhtn.exe97⤵PID:1368
-
\??\c:\djddp.exec:\djddp.exe98⤵PID:4708
-
\??\c:\vjpdv.exec:\vjpdv.exe99⤵PID:4376
-
\??\c:\lxrlxxl.exec:\lxrlxxl.exe100⤵PID:3672
-
\??\c:\fxfrfxx.exec:\fxfrfxx.exe101⤵PID:1004
-
\??\c:\nnhthb.exec:\nnhthb.exe102⤵PID:544
-
\??\c:\thnttb.exec:\thnttb.exe103⤵PID:2736
-
\??\c:\jvjjv.exec:\jvjjv.exe104⤵PID:3784
-
\??\c:\7dvjj.exec:\7dvjj.exe105⤵PID:4872
-
\??\c:\rxlxfrl.exec:\rxlxfrl.exe106⤵PID:4080
-
\??\c:\9rlxlfr.exec:\9rlxlfr.exe107⤵PID:1316
-
\??\c:\7bthth.exec:\7bthth.exe108⤵PID:3696
-
\??\c:\nhhtbt.exec:\nhhtbt.exe109⤵PID:4888
-
\??\c:\9vpdp.exec:\9vpdp.exe110⤵PID:3116
-
\??\c:\1xrlrlf.exec:\1xrlrlf.exe111⤵
- System Location Discovery: System Language Discovery
PID:4812 -
\??\c:\nbnhth.exec:\nbnhth.exe112⤵PID:4836
-
\??\c:\bhhthb.exec:\bhhthb.exe113⤵PID:2504
-
\??\c:\pdvjv.exec:\pdvjv.exe114⤵PID:4816
-
\??\c:\1vvjj.exec:\1vvjj.exe115⤵PID:2936
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe116⤵PID:3644
-
\??\c:\5hnhhb.exec:\5hnhhb.exe117⤵PID:3664
-
\??\c:\bnnbbt.exec:\bnnbbt.exe118⤵PID:2664
-
\??\c:\1vvpj.exec:\1vvpj.exe119⤵PID:1868
-
\??\c:\btnhbt.exec:\btnhbt.exe120⤵PID:684
-
\??\c:\vjpjv.exec:\vjpjv.exe121⤵PID:4928
-
\??\c:\xxrxxxf.exec:\xxrxxxf.exe122⤵PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-