Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe
Resource
win7-20240708-en
General
-
Target
18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe
-
Size
71KB
-
MD5
97c2b47c015b7f2e0dff6dba3c36da50
-
SHA1
5d1612d3a43829242c9ef57b0cb978e6f4b84ea7
-
SHA256
18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362
-
SHA512
22d2d9a92f19e80072ccfd0f0b6879dee04124841b3917db2998b4b51d261f4fc840d7c8c8c42cc9b93090aa17e4c428c4037de0054b59e8ea37b09ed59d69b9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjJ:ymb3NkkiQ3mdBjFI4VZ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1808-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 432 1pvdv.exe 4148 7xfxrrr.exe 440 9fxlxrf.exe 1932 bhtbtn.exe 1072 jvdvv.exe 2904 xrxlfxr.exe 456 1bnhbt.exe 1944 pdjjj.exe 1124 rxfflrx.exe 2620 5hnhhh.exe 3472 vjvjd.exe 2272 vddpv.exe 756 rlrffxr.exe 2348 1bhthb.exe 1768 pdpjd.exe 1520 pdvpp.exe 3632 xflrrlr.exe 4132 tnntth.exe 1332 jpjpp.exe 552 7bhtbt.exe 3092 5tbtnh.exe 4924 3vvpd.exe 4816 vvvpd.exe 2248 thnbtn.exe 4836 hhhbtn.exe 752 pdvpd.exe 4472 1rxrxrx.exe 2332 nnnnbt.exe 3204 dvvpj.exe 4360 vjdvj.exe 2612 5rrllff.exe 812 nhnhnt.exe 2288 hbbttn.exe 2108 vpdvj.exe 4200 xfxlfxr.exe 1340 xffxlfx.exe 464 nbtnhb.exe 4868 bnthbt.exe 2800 dddvj.exe 2580 frxlrxr.exe 1264 fxlffrl.exe 1224 1hhbnn.exe 4348 7bhhbn.exe 4896 7jdjj.exe 2064 xrflflr.exe 432 7llfxrl.exe 392 bnbntn.exe 944 jvpjj.exe 440 vppdv.exe 732 vjjdp.exe 1132 lrrxlxl.exe 5088 hhbttn.exe 3448 jjjpp.exe 4948 pvvpv.exe 1196 frxxxrx.exe 2112 htthnh.exe 1484 ntthtn.exe 3236 pppdv.exe 4376 vjjjd.exe 4648 xrrfxlx.exe 3472 btnbnh.exe 2868 ntbhnb.exe 448 dddvv.exe 3088 djpdj.exe -
resource yara_rule behavioral2/memory/1808-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 432 1808 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 82 PID 1808 wrote to memory of 432 1808 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 82 PID 1808 wrote to memory of 432 1808 18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe 82 PID 432 wrote to memory of 4148 432 1pvdv.exe 83 PID 432 wrote to memory of 4148 432 1pvdv.exe 83 PID 432 wrote to memory of 4148 432 1pvdv.exe 83 PID 4148 wrote to memory of 440 4148 7xfxrrr.exe 84 PID 4148 wrote to memory of 440 4148 7xfxrrr.exe 84 PID 4148 wrote to memory of 440 4148 7xfxrrr.exe 84 PID 440 wrote to memory of 1932 440 9fxlxrf.exe 85 PID 440 wrote to memory of 1932 440 9fxlxrf.exe 85 PID 440 wrote to memory of 1932 440 9fxlxrf.exe 85 PID 1932 wrote to memory of 1072 1932 bhtbtn.exe 86 PID 1932 wrote to memory of 1072 1932 bhtbtn.exe 86 PID 1932 wrote to memory of 1072 1932 bhtbtn.exe 86 PID 1072 wrote to memory of 2904 1072 jvdvv.exe 87 PID 1072 wrote to memory of 2904 1072 jvdvv.exe 87 PID 1072 wrote to memory of 2904 1072 jvdvv.exe 87 PID 2904 wrote to memory of 456 2904 xrxlfxr.exe 88 PID 2904 wrote to memory of 456 2904 xrxlfxr.exe 88 PID 2904 wrote to memory of 456 2904 xrxlfxr.exe 88 PID 456 wrote to memory of 1944 456 1bnhbt.exe 89 PID 456 wrote to memory of 1944 456 1bnhbt.exe 89 PID 456 wrote to memory of 1944 456 1bnhbt.exe 89 PID 1944 wrote to memory of 1124 1944 pdjjj.exe 90 PID 1944 wrote to memory of 1124 1944 pdjjj.exe 90 PID 1944 wrote to memory of 1124 1944 pdjjj.exe 90 PID 1124 wrote to memory of 2620 1124 rxfflrx.exe 91 PID 1124 wrote to memory of 2620 1124 rxfflrx.exe 91 PID 1124 wrote to memory of 2620 1124 rxfflrx.exe 91 PID 2620 wrote to memory of 3472 2620 5hnhhh.exe 92 PID 2620 wrote to memory of 3472 2620 5hnhhh.exe 92 PID 2620 wrote to memory of 3472 2620 5hnhhh.exe 92 PID 3472 wrote to memory of 2272 3472 vjvjd.exe 93 PID 3472 wrote to memory of 2272 3472 vjvjd.exe 93 PID 3472 wrote to memory of 2272 3472 vjvjd.exe 93 PID 2272 wrote to memory of 756 2272 vddpv.exe 94 PID 2272 wrote to memory of 756 2272 vddpv.exe 94 PID 2272 wrote to memory of 756 2272 vddpv.exe 94 PID 756 wrote to memory of 2348 756 rlrffxr.exe 95 PID 756 wrote to memory of 2348 756 rlrffxr.exe 95 PID 756 wrote to memory of 2348 756 rlrffxr.exe 95 PID 2348 wrote to memory of 1768 2348 1bhthb.exe 96 PID 2348 wrote to memory of 1768 2348 1bhthb.exe 96 PID 2348 wrote to memory of 1768 2348 1bhthb.exe 96 PID 1768 wrote to memory of 1520 1768 pdpjd.exe 97 PID 1768 wrote to memory of 1520 1768 pdpjd.exe 97 PID 1768 wrote to memory of 1520 1768 pdpjd.exe 97 PID 1520 wrote to memory of 3632 1520 pdvpp.exe 98 PID 1520 wrote to memory of 3632 1520 pdvpp.exe 98 PID 1520 wrote to memory of 3632 1520 pdvpp.exe 98 PID 3632 wrote to memory of 4132 3632 xflrrlr.exe 99 PID 3632 wrote to memory of 4132 3632 xflrrlr.exe 99 PID 3632 wrote to memory of 4132 3632 xflrrlr.exe 99 PID 4132 wrote to memory of 1332 4132 tnntth.exe 100 PID 4132 wrote to memory of 1332 4132 tnntth.exe 100 PID 4132 wrote to memory of 1332 4132 tnntth.exe 100 PID 1332 wrote to memory of 552 1332 jpjpp.exe 101 PID 1332 wrote to memory of 552 1332 jpjpp.exe 101 PID 1332 wrote to memory of 552 1332 jpjpp.exe 101 PID 552 wrote to memory of 3092 552 7bhtbt.exe 102 PID 552 wrote to memory of 3092 552 7bhtbt.exe 102 PID 552 wrote to memory of 3092 552 7bhtbt.exe 102 PID 3092 wrote to memory of 4924 3092 5tbtnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe"C:\Users\Admin\AppData\Local\Temp\18f28bed7ab0d17eacc82f1d113c8cd5f8d4216ef0c043657b513499c87a0362N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\1pvdv.exec:\1pvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\9fxlxrf.exec:\9fxlxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\bhtbtn.exec:\bhtbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\jvdvv.exec:\jvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1bnhbt.exec:\1bnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\pdjjj.exec:\pdjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rxfflrx.exec:\rxfflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\5hnhhh.exec:\5hnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vjvjd.exec:\vjvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\vddpv.exec:\vddpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rlrffxr.exec:\rlrffxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\1bhthb.exec:\1bhthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\pdpjd.exec:\pdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\pdvpp.exec:\pdvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\xflrrlr.exec:\xflrrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\tnntth.exec:\tnntth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\jpjpp.exec:\jpjpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\7bhtbt.exec:\7bhtbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\5tbtnh.exec:\5tbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\3vvpd.exec:\3vvpd.exe23⤵
- Executes dropped EXE
PID:4924 -
\??\c:\vvvpd.exec:\vvvpd.exe24⤵
- Executes dropped EXE
PID:4816 -
\??\c:\thnbtn.exec:\thnbtn.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hhhbtn.exec:\hhhbtn.exe26⤵
- Executes dropped EXE
PID:4836 -
\??\c:\pdvpd.exec:\pdvpd.exe27⤵
- Executes dropped EXE
PID:752 -
\??\c:\1rxrxrx.exec:\1rxrxrx.exe28⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nnnnbt.exec:\nnnnbt.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dvvpj.exec:\dvvpj.exe30⤵
- Executes dropped EXE
PID:3204 -
\??\c:\vjdvj.exec:\vjdvj.exe31⤵
- Executes dropped EXE
PID:4360 -
\??\c:\5rrllff.exec:\5rrllff.exe32⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhnhnt.exec:\nhnhnt.exe33⤵
- Executes dropped EXE
PID:812 -
\??\c:\hbbttn.exec:\hbbttn.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vpdvj.exec:\vpdvj.exe35⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xfxlfxr.exec:\xfxlfxr.exe36⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xffxlfx.exec:\xffxlfx.exe37⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nbtnhb.exec:\nbtnhb.exe38⤵
- Executes dropped EXE
PID:464 -
\??\c:\bnthbt.exec:\bnthbt.exe39⤵
- Executes dropped EXE
PID:4868 -
\??\c:\dddvj.exec:\dddvj.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frxlrxr.exec:\frxlrxr.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fxlffrl.exec:\fxlffrl.exe42⤵
- Executes dropped EXE
PID:1264 -
\??\c:\1hhbnn.exec:\1hhbnn.exe43⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7bhhbn.exec:\7bhhbn.exe44⤵
- Executes dropped EXE
PID:4348 -
\??\c:\7jdjj.exec:\7jdjj.exe45⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xrflflr.exec:\xrflflr.exe46⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7llfxrl.exec:\7llfxrl.exe47⤵
- Executes dropped EXE
PID:432 -
\??\c:\bnbntn.exec:\bnbntn.exe48⤵
- Executes dropped EXE
PID:392 -
\??\c:\jvpjj.exec:\jvpjj.exe49⤵
- Executes dropped EXE
PID:944 -
\??\c:\vppdv.exec:\vppdv.exe50⤵
- Executes dropped EXE
PID:440 -
\??\c:\vjjdp.exec:\vjjdp.exe51⤵
- Executes dropped EXE
PID:732 -
\??\c:\lrrxlxl.exec:\lrrxlxl.exe52⤵
- Executes dropped EXE
PID:1132 -
\??\c:\hhbttn.exec:\hhbttn.exe53⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jjjpp.exec:\jjjpp.exe54⤵
- Executes dropped EXE
PID:3448 -
\??\c:\pvvpv.exec:\pvvpv.exe55⤵
- Executes dropped EXE
PID:4948 -
\??\c:\frxxxrx.exec:\frxxxrx.exe56⤵
- Executes dropped EXE
PID:1196 -
\??\c:\htthnh.exec:\htthnh.exe57⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ntthtn.exec:\ntthtn.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pppdv.exec:\pppdv.exe59⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vjjjd.exec:\vjjjd.exe60⤵
- Executes dropped EXE
PID:4376 -
\??\c:\xrrfxlx.exec:\xrrfxlx.exe61⤵
- Executes dropped EXE
PID:4648 -
\??\c:\btnbnh.exec:\btnbnh.exe62⤵
- Executes dropped EXE
PID:3472 -
\??\c:\ntbhnb.exec:\ntbhnb.exe63⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dddvv.exec:\dddvv.exe64⤵
- Executes dropped EXE
PID:448 -
\??\c:\djpdj.exec:\djpdj.exe65⤵
- Executes dropped EXE
PID:3088 -
\??\c:\9rfrlll.exec:\9rfrlll.exe66⤵PID:3664
-
\??\c:\3xffxxr.exec:\3xffxxr.exe67⤵PID:1768
-
\??\c:\nbtnbt.exec:\nbtnbt.exe68⤵PID:1520
-
\??\c:\1hhbbt.exec:\1hhbbt.exe69⤵PID:3100
-
\??\c:\pdpdp.exec:\pdpdp.exe70⤵PID:4084
-
\??\c:\rlflfxx.exec:\rlflfxx.exe71⤵PID:5016
-
\??\c:\rfllflx.exec:\rfllflx.exe72⤵PID:2240
-
\??\c:\7lfxrrl.exec:\7lfxrrl.exe73⤵PID:4544
-
\??\c:\nhhbnn.exec:\nhhbnn.exe74⤵PID:3092
-
\??\c:\pjjjj.exec:\pjjjj.exe75⤵PID:2280
-
\??\c:\dvdjd.exec:\dvdjd.exe76⤵PID:4940
-
\??\c:\frrfxrx.exec:\frrfxrx.exe77⤵PID:3184
-
\??\c:\tnbhnh.exec:\tnbhnh.exe78⤵PID:3032
-
\??\c:\tbbntn.exec:\tbbntn.exe79⤵PID:4932
-
\??\c:\btnhbb.exec:\btnhbb.exe80⤵PID:3364
-
\??\c:\7vvvp.exec:\7vvvp.exe81⤵PID:4072
-
\??\c:\dvvpp.exec:\dvvpp.exe82⤵PID:3104
-
\??\c:\1xfxllr.exec:\1xfxllr.exe83⤵PID:4420
-
\??\c:\1rlfffx.exec:\1rlfffx.exe84⤵PID:3432
-
\??\c:\tnhnnb.exec:\tnhnnb.exe85⤵PID:4992
-
\??\c:\1bbttt.exec:\1bbttt.exe86⤵PID:1920
-
\??\c:\jddjj.exec:\jddjj.exe87⤵PID:2832
-
\??\c:\7jjdv.exec:\7jjdv.exe88⤵PID:396
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe89⤵PID:4044
-
\??\c:\btnnhh.exec:\btnnhh.exe90⤵PID:3512
-
\??\c:\pdvpj.exec:\pdvpj.exe91⤵PID:1216
-
\??\c:\dpvjv.exec:\dpvjv.exe92⤵PID:1340
-
\??\c:\xrxxrll.exec:\xrxxrll.exe93⤵PID:2664
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe94⤵PID:1996
-
\??\c:\bttntt.exec:\bttntt.exe95⤵PID:400
-
\??\c:\tbhbnh.exec:\tbhbnh.exe96⤵PID:3496
-
\??\c:\dvddv.exec:\dvddv.exe97⤵PID:868
-
\??\c:\ffrfxrl.exec:\ffrfxrl.exe98⤵PID:4356
-
\??\c:\nnnntt.exec:\nnnntt.exe99⤵PID:4128
-
\??\c:\bttttb.exec:\bttttb.exe100⤵PID:4252
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe101⤵PID:1916
-
\??\c:\3nnhtn.exec:\3nnhtn.exe102⤵PID:2436
-
\??\c:\tnhhbt.exec:\tnhhbt.exe103⤵
- System Location Discovery: System Language Discovery
PID:392 -
\??\c:\jdpvp.exec:\jdpvp.exe104⤵PID:944
-
\??\c:\vpjvd.exec:\vpjvd.exe105⤵PID:4656
-
\??\c:\rfffxxr.exec:\rfffxxr.exe106⤵PID:3504
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe107⤵PID:1132
-
\??\c:\hbtnbb.exec:\hbtnbb.exe108⤵PID:3576
-
\??\c:\1ntttb.exec:\1ntttb.exe109⤵PID:456
-
\??\c:\jpvpd.exec:\jpvpd.exe110⤵PID:1152
-
\??\c:\jvpjv.exec:\jvpjv.exe111⤵PID:1196
-
\??\c:\lffxllf.exec:\lffxllf.exe112⤵PID:2112
-
\??\c:\hbttnn.exec:\hbttnn.exe113⤵PID:1408
-
\??\c:\1tbnbt.exec:\1tbnbt.exe114⤵PID:4304
-
\??\c:\pjddv.exec:\pjddv.exe115⤵PID:1632
-
\??\c:\5ddvp.exec:\5ddvp.exe116⤵PID:1652
-
\??\c:\xxlfflr.exec:\xxlfflr.exe117⤵PID:2000
-
\??\c:\hnntnb.exec:\hnntnb.exe118⤵PID:3464
-
\??\c:\nbtttt.exec:\nbtttt.exe119⤵PID:1580
-
\??\c:\dpvdd.exec:\dpvdd.exe120⤵PID:1892
-
\??\c:\dvjdd.exec:\dvjdd.exe121⤵PID:1884
-
\??\c:\fxlrxrx.exec:\fxlrxrx.exe122⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-