Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe
Resource
win7-20240903-en
General
-
Target
99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe
-
Size
72KB
-
MD5
0eb6da3ab12da2004224e2979d5ff0d0
-
SHA1
c13bbf22ce0e5f046a87d489f33e2d74dd507623
-
SHA256
99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4
-
SHA512
f0fd27f65e01d2bf0dae924b39e7151c31c1b345790cfa83977376eea361b687785e383db9f5c6e15a4df99f68425a97ab73a01957570029a7796b4ea1313447
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjP:ymb3NkkiQ3mdBjFI4V/
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3056 rrllffx.exe 1588 3fffrlf.exe 2684 24288.exe 2548 hthntb.exe 2296 0680886.exe 2600 dpjdj.exe 2436 fxlrlfx.exe 1996 lrxxfrr.exe 1780 200488.exe 4764 04266.exe 4656 284802.exe 3868 ntnbbt.exe 4484 0682482.exe 4156 g6884.exe 4868 6026000.exe 2392 e40006.exe 4428 80606.exe 4364 624006.exe 948 280442.exe 1536 a8860.exe 2816 dvvdd.exe 2360 lrxrffx.exe 3236 608440.exe 1580 5vvdv.exe 4664 48844.exe 2944 5ppvv.exe 1672 820228.exe 2352 lxfxxxr.exe 3600 024484.exe 2488 vvdjp.exe 4408 vvdjj.exe 3764 pjjvj.exe 3056 02448.exe 2100 xflfxrf.exe 1512 246266.exe 4948 60604.exe 2520 nhnbtt.exe 3324 680208.exe 436 ntbtbv.exe 4276 lrxrffx.exe 4412 480628.exe 4528 m6886.exe 3964 24466.exe 3932 tnbtnh.exe 1760 868888.exe 1796 fllfllf.exe 4764 3ttnnh.exe 2320 hhhthb.exe 1016 428648.exe 3708 2066688.exe 4000 bbbnnn.exe 4156 xrxrxxf.exe 4792 g8844.exe 4828 flxxfff.exe 380 k26600.exe 2792 4626000.exe 1764 vjjjj.exe 3184 5jdjd.exe 1976 fxrlrlr.exe 3924 6660044.exe 2596 thtttb.exe 2308 btbnnt.exe 4888 pvppv.exe 3088 668666.exe -
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6626680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0448222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6282004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4048082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3056 4016 99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe 89 PID 4016 wrote to memory of 3056 4016 99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe 89 PID 4016 wrote to memory of 3056 4016 99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe 89 PID 3056 wrote to memory of 1588 3056 rrllffx.exe 90 PID 3056 wrote to memory of 1588 3056 rrllffx.exe 90 PID 3056 wrote to memory of 1588 3056 rrllffx.exe 90 PID 1588 wrote to memory of 2684 1588 3fffrlf.exe 91 PID 1588 wrote to memory of 2684 1588 3fffrlf.exe 91 PID 1588 wrote to memory of 2684 1588 3fffrlf.exe 91 PID 2684 wrote to memory of 2548 2684 24288.exe 92 PID 2684 wrote to memory of 2548 2684 24288.exe 92 PID 2684 wrote to memory of 2548 2684 24288.exe 92 PID 2548 wrote to memory of 2296 2548 hthntb.exe 93 PID 2548 wrote to memory of 2296 2548 hthntb.exe 93 PID 2548 wrote to memory of 2296 2548 hthntb.exe 93 PID 2296 wrote to memory of 2600 2296 0680886.exe 94 PID 2296 wrote to memory of 2600 2296 0680886.exe 94 PID 2296 wrote to memory of 2600 2296 0680886.exe 94 PID 2600 wrote to memory of 2436 2600 dpjdj.exe 95 PID 2600 wrote to memory of 2436 2600 dpjdj.exe 95 PID 2600 wrote to memory of 2436 2600 dpjdj.exe 95 PID 2436 wrote to memory of 1996 2436 fxlrlfx.exe 96 PID 2436 wrote to memory of 1996 2436 fxlrlfx.exe 96 PID 2436 wrote to memory of 1996 2436 fxlrlfx.exe 96 PID 1996 wrote to memory of 1780 1996 lrxxfrr.exe 97 PID 1996 wrote to memory of 1780 1996 lrxxfrr.exe 97 PID 1996 wrote to memory of 1780 1996 lrxxfrr.exe 97 PID 1780 wrote to memory of 4764 1780 200488.exe 98 PID 1780 wrote to memory of 4764 1780 200488.exe 98 PID 1780 wrote to memory of 4764 1780 200488.exe 98 PID 4764 wrote to memory of 4656 4764 04266.exe 99 PID 4764 wrote to memory of 4656 4764 04266.exe 99 PID 4764 wrote to memory of 4656 4764 04266.exe 99 PID 4656 wrote to memory of 3868 4656 284802.exe 100 PID 4656 wrote to memory of 3868 4656 284802.exe 100 PID 4656 wrote to memory of 3868 4656 284802.exe 100 PID 3868 wrote to memory of 4484 3868 ntnbbt.exe 101 PID 3868 wrote to memory of 4484 3868 ntnbbt.exe 101 PID 3868 wrote to memory of 4484 3868 ntnbbt.exe 101 PID 4484 wrote to memory of 4156 4484 0682482.exe 102 PID 4484 wrote to memory of 4156 4484 0682482.exe 102 PID 4484 wrote to memory of 4156 4484 0682482.exe 102 PID 4156 wrote to memory of 4868 4156 g6884.exe 103 PID 4156 wrote to memory of 4868 4156 g6884.exe 103 PID 4156 wrote to memory of 4868 4156 g6884.exe 103 PID 4868 wrote to memory of 2392 4868 6026000.exe 104 PID 4868 wrote to memory of 2392 4868 6026000.exe 104 PID 4868 wrote to memory of 2392 4868 6026000.exe 104 PID 2392 wrote to memory of 4428 2392 e40006.exe 105 PID 2392 wrote to memory of 4428 2392 e40006.exe 105 PID 2392 wrote to memory of 4428 2392 e40006.exe 105 PID 4428 wrote to memory of 4364 4428 80606.exe 106 PID 4428 wrote to memory of 4364 4428 80606.exe 106 PID 4428 wrote to memory of 4364 4428 80606.exe 106 PID 4364 wrote to memory of 948 4364 624006.exe 107 PID 4364 wrote to memory of 948 4364 624006.exe 107 PID 4364 wrote to memory of 948 4364 624006.exe 107 PID 948 wrote to memory of 1536 948 280442.exe 108 PID 948 wrote to memory of 1536 948 280442.exe 108 PID 948 wrote to memory of 1536 948 280442.exe 108 PID 1536 wrote to memory of 2816 1536 a8860.exe 109 PID 1536 wrote to memory of 2816 1536 a8860.exe 109 PID 1536 wrote to memory of 2816 1536 a8860.exe 109 PID 2816 wrote to memory of 2360 2816 dvvdd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe"C:\Users\Admin\AppData\Local\Temp\99af7873f0df3f7d6dc9bfec3895259b554755c6e479ea8ac448fccde1b83da4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\rrllffx.exec:\rrllffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\3fffrlf.exec:\3fffrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\24288.exec:\24288.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hthntb.exec:\hthntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\0680886.exec:\0680886.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dpjdj.exec:\dpjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fxlrlfx.exec:\fxlrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lrxxfrr.exec:\lrxxfrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\200488.exec:\200488.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\04266.exec:\04266.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\284802.exec:\284802.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\ntnbbt.exec:\ntnbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\0682482.exec:\0682482.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\g6884.exec:\g6884.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\6026000.exec:\6026000.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\e40006.exec:\e40006.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\80606.exec:\80606.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\624006.exec:\624006.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\280442.exec:\280442.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\a8860.exec:\a8860.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\dvvdd.exec:\dvvdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lrxrffx.exec:\lrxrffx.exe23⤵
- Executes dropped EXE
PID:2360 -
\??\c:\608440.exec:\608440.exe24⤵
- Executes dropped EXE
PID:3236 -
\??\c:\5vvdv.exec:\5vvdv.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\48844.exec:\48844.exe26⤵
- Executes dropped EXE
PID:4664 -
\??\c:\5ppvv.exec:\5ppvv.exe27⤵
- Executes dropped EXE
PID:2944 -
\??\c:\820228.exec:\820228.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\024484.exec:\024484.exe30⤵
- Executes dropped EXE
PID:3600 -
\??\c:\vvdjp.exec:\vvdjp.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vvdjj.exec:\vvdjj.exe32⤵
- Executes dropped EXE
PID:4408 -
\??\c:\pjjvj.exec:\pjjvj.exe33⤵
- Executes dropped EXE
PID:3764 -
\??\c:\02448.exec:\02448.exe34⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xflfxrf.exec:\xflfxrf.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\246266.exec:\246266.exe36⤵
- Executes dropped EXE
PID:1512 -
\??\c:\60604.exec:\60604.exe37⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nhnbtt.exec:\nhnbtt.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\680208.exec:\680208.exe39⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ntbtbv.exec:\ntbtbv.exe40⤵
- Executes dropped EXE
PID:436 -
\??\c:\lrxrffx.exec:\lrxrffx.exe41⤵
- Executes dropped EXE
PID:4276 -
\??\c:\480628.exec:\480628.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412 -
\??\c:\m6886.exec:\m6886.exe43⤵
- Executes dropped EXE
PID:4528 -
\??\c:\24466.exec:\24466.exe44⤵
- Executes dropped EXE
PID:3964 -
\??\c:\tnbtnh.exec:\tnbtnh.exe45⤵
- Executes dropped EXE
PID:3932 -
\??\c:\868888.exec:\868888.exe46⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fllfllf.exec:\fllfllf.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\3ttnnh.exec:\3ttnnh.exe48⤵
- Executes dropped EXE
PID:4764 -
\??\c:\hhhthb.exec:\hhhthb.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\428648.exec:\428648.exe50⤵
- Executes dropped EXE
PID:1016 -
\??\c:\2066688.exec:\2066688.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bbbnnn.exec:\bbbnnn.exe52⤵
- Executes dropped EXE
PID:4000 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe53⤵
- Executes dropped EXE
PID:4156 -
\??\c:\g8844.exec:\g8844.exe54⤵
- Executes dropped EXE
PID:4792 -
\??\c:\flxxfff.exec:\flxxfff.exe55⤵
- Executes dropped EXE
PID:4828 -
\??\c:\k26600.exec:\k26600.exe56⤵
- Executes dropped EXE
PID:380 -
\??\c:\4626000.exec:\4626000.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vjjjj.exec:\vjjjj.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5jdjd.exec:\5jdjd.exe59⤵
- Executes dropped EXE
PID:3184 -
\??\c:\fxrlrlr.exec:\fxrlrlr.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\6660044.exec:\6660044.exe61⤵
- Executes dropped EXE
PID:3924 -
\??\c:\thtttb.exec:\thtttb.exe62⤵
- Executes dropped EXE
PID:2596 -
\??\c:\btbnnt.exec:\btbnnt.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pvppv.exec:\pvppv.exe64⤵
- Executes dropped EXE
PID:4888 -
\??\c:\668666.exec:\668666.exe65⤵
- Executes dropped EXE
PID:3088 -
\??\c:\g2828.exec:\g2828.exe66⤵PID:5108
-
\??\c:\nnnhnn.exec:\nnnhnn.exe67⤵PID:996
-
\??\c:\80862.exec:\80862.exe68⤵PID:3468
-
\??\c:\fxxfxrr.exec:\fxxfxrr.exe69⤵PID:1672
-
\??\c:\80600.exec:\80600.exe70⤵PID:4884
-
\??\c:\vvvvv.exec:\vvvvv.exe71⤵PID:3728
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe72⤵PID:4368
-
\??\c:\nhtbbh.exec:\nhtbbh.exe73⤵PID:2488
-
\??\c:\hhnnhh.exec:\hhnnhh.exe74⤵PID:4572
-
\??\c:\htbbtt.exec:\htbbtt.exe75⤵PID:3944
-
\??\c:\8466600.exec:\8466600.exe76⤵PID:2992
-
\??\c:\rlrllll.exec:\rlrllll.exe77⤵
- System Location Discovery: System Language Discovery
PID:720 -
\??\c:\7rffllf.exec:\7rffllf.exe78⤵PID:2924
-
\??\c:\vjdbh.exec:\vjdbh.exe79⤵PID:4948
-
\??\c:\04886.exec:\04886.exe80⤵PID:2520
-
\??\c:\8888222.exec:\8888222.exe81⤵PID:944
-
\??\c:\jpdvv.exec:\jpdvv.exe82⤵PID:436
-
\??\c:\60226.exec:\60226.exe83⤵PID:2852
-
\??\c:\600048.exec:\600048.exe84⤵PID:2044
-
\??\c:\pjvvv.exec:\pjvvv.exe85⤵PID:4528
-
\??\c:\lrrxxlf.exec:\lrrxxlf.exe86⤵PID:1568
-
\??\c:\2222882.exec:\2222882.exe87⤵PID:5064
-
\??\c:\5lrrfff.exec:\5lrrfff.exe88⤵PID:1628
-
\??\c:\tnnnht.exec:\tnnnht.exe89⤵PID:532
-
\??\c:\020006.exec:\020006.exe90⤵PID:1636
-
\??\c:\26060.exec:\26060.exe91⤵PID:2476
-
\??\c:\6282682.exec:\6282682.exe92⤵PID:4460
-
\??\c:\jjjdd.exec:\jjjdd.exe93⤵PID:2428
-
\??\c:\bnbtht.exec:\bnbtht.exe94⤵
- System Location Discovery: System Language Discovery
PID:1988 -
\??\c:\0460264.exec:\0460264.exe95⤵PID:1068
-
\??\c:\7fllllf.exec:\7fllllf.exe96⤵PID:4584
-
\??\c:\5jjvp.exec:\5jjvp.exe97⤵PID:3368
-
\??\c:\tnttnt.exec:\tnttnt.exe98⤵PID:4136
-
\??\c:\tbnhhh.exec:\tbnhhh.exe99⤵PID:4376
-
\??\c:\280222.exec:\280222.exe100⤵PID:1868
-
\??\c:\0622660.exec:\0622660.exe101⤵PID:2416
-
\??\c:\600440.exec:\600440.exe102⤵PID:2112
-
\??\c:\408024.exec:\408024.exe103⤵PID:2860
-
\??\c:\ttthbt.exec:\ttthbt.exe104⤵PID:1316
-
\??\c:\c262260.exec:\c262260.exe105⤵PID:668
-
\??\c:\hhthnt.exec:\hhthnt.exe106⤵PID:2372
-
\??\c:\tnnnhh.exec:\tnnnhh.exe107⤵PID:1444
-
\??\c:\flrlfff.exec:\flrlfff.exe108⤵PID:3556
-
\??\c:\e24022.exec:\e24022.exe109⤵PID:528
-
\??\c:\s6882.exec:\s6882.exe110⤵PID:4892
-
\??\c:\60060.exec:\60060.exe111⤵PID:3192
-
\??\c:\pjpjv.exec:\pjpjv.exe112⤵PID:3004
-
\??\c:\62044.exec:\62044.exe113⤵PID:4832
-
\??\c:\828844.exec:\828844.exe114⤵PID:4844
-
\??\c:\bnthbt.exec:\bnthbt.exe115⤵PID:4872
-
\??\c:\026044.exec:\026044.exe116⤵PID:3764
-
\??\c:\1rrlrlr.exec:\1rrlrlr.exe117⤵PID:4120
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe118⤵PID:1588
-
\??\c:\bhhtnh.exec:\bhhtnh.exe119⤵PID:3608
-
\??\c:\0626868.exec:\0626868.exe120⤵PID:2056
-
\??\c:\c088440.exec:\c088440.exe121⤵PID:3128
-
\??\c:\5nnnhb.exec:\5nnnhb.exe122⤵PID:3348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-