Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 06:01
Static task
static1
Behavioral task
behavioral1
Sample
a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe
Resource
win7-20240903-en
General
-
Target
a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe
-
Size
71KB
-
MD5
1a1fd3ac0b6520ebacbfa48578d8f8f0
-
SHA1
16abafff7e2c954929e5052ce32d64ccd9809f30
-
SHA256
a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586b
-
SHA512
58cdd84cffdb816dec83ba8c8b0e4fbce2b2d3429b20f5e4603c50daf1e6c0af16c0c49eccaf8a0036a9c561408c2bb80300af3633db7d88823a54eda9bd8f28
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj/:ymb3NkkiQ3mdBjFI4VP
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4436-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/504-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-15521-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 dddjj.exe 1660 lxfrllx.exe 4788 9fxrlfx.exe 1040 hbtttt.exe 1544 rfxrrlf.exe 4924 bnnhbt.exe 504 nhtnnh.exe 1216 vppdv.exe 1508 jpjdp.exe 2132 nhnhbh.exe 4408 dvjdv.exe 2204 vvvdd.exe 3268 xlfxxrl.exe 3016 7bnhtt.exe 4832 jvpjv.exe 3192 lxxrffl.exe 1680 rflfrrl.exe 4144 btbbtt.exe 1744 jjvdv.exe 2248 xfxxrrl.exe 3944 tnttbt.exe 4292 hbttnh.exe 4064 jdppp.exe 1380 rlrllfl.exe 4220 bhnhbt.exe 3928 jddpj.exe 3804 5lxxrxx.exe 2028 1llfxlf.exe 3920 btnnhh.exe 3504 vpdvv.exe 4024 xrfrlfx.exe 1684 dpppj.exe 1756 llrlllf.exe 3472 thnnhh.exe 1468 rfxfflr.exe 4464 frflflf.exe 3508 vdvvv.exe 5116 thnbnh.exe 4208 jdvpp.exe 3512 nnbnnt.exe 2432 jdpjv.exe 3856 dddvv.exe 3484 3fllfll.exe 4652 lxfxrrl.exe 3264 nnnbbn.exe 2328 vppjj.exe 3968 vdppj.exe 1400 frrrrxx.exe 1396 xrrlfrr.exe 4192 nttnhh.exe 4972 jddpd.exe 2820 vddvj.exe 3480 llrxrff.exe 3580 nnnhhb.exe 4288 tbhbhn.exe 4256 jdddv.exe 3748 jvdvv.exe 2480 rrffxxf.exe 3536 tnntnt.exe 1216 hbbttt.exe 2964 5vjvp.exe 4520 xlrlffx.exe 1192 9xffxff.exe 2132 nnhtbt.exe -
resource yara_rule behavioral2/memory/4436-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/504-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-15521-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 3672 4436 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 82 PID 4436 wrote to memory of 3672 4436 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 82 PID 4436 wrote to memory of 3672 4436 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 82 PID 3672 wrote to memory of 1660 3672 dddjj.exe 83 PID 3672 wrote to memory of 1660 3672 dddjj.exe 83 PID 3672 wrote to memory of 1660 3672 dddjj.exe 83 PID 1660 wrote to memory of 4788 1660 lxfrllx.exe 84 PID 1660 wrote to memory of 4788 1660 lxfrllx.exe 84 PID 1660 wrote to memory of 4788 1660 lxfrllx.exe 84 PID 4788 wrote to memory of 1040 4788 9fxrlfx.exe 85 PID 4788 wrote to memory of 1040 4788 9fxrlfx.exe 85 PID 4788 wrote to memory of 1040 4788 9fxrlfx.exe 85 PID 1040 wrote to memory of 1544 1040 hbtttt.exe 86 PID 1040 wrote to memory of 1544 1040 hbtttt.exe 86 PID 1040 wrote to memory of 1544 1040 hbtttt.exe 86 PID 1544 wrote to memory of 4924 1544 rfxrrlf.exe 87 PID 1544 wrote to memory of 4924 1544 rfxrrlf.exe 87 PID 1544 wrote to memory of 4924 1544 rfxrrlf.exe 87 PID 4924 wrote to memory of 504 4924 bnnhbt.exe 88 PID 4924 wrote to memory of 504 4924 bnnhbt.exe 88 PID 4924 wrote to memory of 504 4924 bnnhbt.exe 88 PID 504 wrote to memory of 1216 504 nhtnnh.exe 89 PID 504 wrote to memory of 1216 504 nhtnnh.exe 89 PID 504 wrote to memory of 1216 504 nhtnnh.exe 89 PID 1216 wrote to memory of 1508 1216 vppdv.exe 90 PID 1216 wrote to memory of 1508 1216 vppdv.exe 90 PID 1216 wrote to memory of 1508 1216 vppdv.exe 90 PID 1508 wrote to memory of 2132 1508 jpjdp.exe 91 PID 1508 wrote to memory of 2132 1508 jpjdp.exe 91 PID 1508 wrote to memory of 2132 1508 jpjdp.exe 91 PID 2132 wrote to memory of 4408 2132 nhnhbh.exe 92 PID 2132 wrote to memory of 4408 2132 nhnhbh.exe 92 PID 2132 wrote to memory of 4408 2132 nhnhbh.exe 92 PID 4408 wrote to memory of 2204 4408 dvjdv.exe 93 PID 4408 wrote to memory of 2204 4408 dvjdv.exe 93 PID 4408 wrote to memory of 2204 4408 dvjdv.exe 93 PID 2204 wrote to memory of 3268 2204 vvvdd.exe 94 PID 2204 wrote to memory of 3268 2204 vvvdd.exe 94 PID 2204 wrote to memory of 3268 2204 vvvdd.exe 94 PID 3268 wrote to memory of 3016 3268 xlfxxrl.exe 95 PID 3268 wrote to memory of 3016 3268 xlfxxrl.exe 95 PID 3268 wrote to memory of 3016 3268 xlfxxrl.exe 95 PID 3016 wrote to memory of 4832 3016 7bnhtt.exe 96 PID 3016 wrote to memory of 4832 3016 7bnhtt.exe 96 PID 3016 wrote to memory of 4832 3016 7bnhtt.exe 96 PID 4832 wrote to memory of 3192 4832 jvpjv.exe 97 PID 4832 wrote to memory of 3192 4832 jvpjv.exe 97 PID 4832 wrote to memory of 3192 4832 jvpjv.exe 97 PID 3192 wrote to memory of 1680 3192 lxxrffl.exe 98 PID 3192 wrote to memory of 1680 3192 lxxrffl.exe 98 PID 3192 wrote to memory of 1680 3192 lxxrffl.exe 98 PID 1680 wrote to memory of 4144 1680 rflfrrl.exe 99 PID 1680 wrote to memory of 4144 1680 rflfrrl.exe 99 PID 1680 wrote to memory of 4144 1680 rflfrrl.exe 99 PID 4144 wrote to memory of 1744 4144 btbbtt.exe 100 PID 4144 wrote to memory of 1744 4144 btbbtt.exe 100 PID 4144 wrote to memory of 1744 4144 btbbtt.exe 100 PID 1744 wrote to memory of 2248 1744 jjvdv.exe 101 PID 1744 wrote to memory of 2248 1744 jjvdv.exe 101 PID 1744 wrote to memory of 2248 1744 jjvdv.exe 101 PID 2248 wrote to memory of 3944 2248 xfxxrrl.exe 102 PID 2248 wrote to memory of 3944 2248 xfxxrrl.exe 102 PID 2248 wrote to memory of 3944 2248 xfxxrrl.exe 102 PID 3944 wrote to memory of 4292 3944 tnttbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe"C:\Users\Admin\AppData\Local\Temp\a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\dddjj.exec:\dddjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\lxfrllx.exec:\lxfrllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\9fxrlfx.exec:\9fxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\hbtttt.exec:\hbtttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\rfxrrlf.exec:\rfxrrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\bnnhbt.exec:\bnnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\nhtnnh.exec:\nhtnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:504 -
\??\c:\vppdv.exec:\vppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\jpjdp.exec:\jpjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nhnhbh.exec:\nhnhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvjdv.exec:\dvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\vvvdd.exec:\vvvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\xlfxxrl.exec:\xlfxxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\7bnhtt.exec:\7bnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jvpjv.exec:\jvpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\lxxrffl.exec:\lxxrffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\rflfrrl.exec:\rflfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\btbbtt.exec:\btbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\jjvdv.exec:\jjvdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\tnttbt.exec:\tnttbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\hbttnh.exec:\hbttnh.exe23⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jdppp.exec:\jdppp.exe24⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rlrllfl.exec:\rlrllfl.exe25⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bhnhbt.exec:\bhnhbt.exe26⤵
- Executes dropped EXE
PID:4220 -
\??\c:\jddpj.exec:\jddpj.exe27⤵
- Executes dropped EXE
PID:3928 -
\??\c:\5lxxrxx.exec:\5lxxrxx.exe28⤵
- Executes dropped EXE
PID:3804 -
\??\c:\1llfxlf.exec:\1llfxlf.exe29⤵
- Executes dropped EXE
PID:2028 -
\??\c:\btnnhh.exec:\btnnhh.exe30⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vpdvv.exec:\vpdvv.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe32⤵
- Executes dropped EXE
PID:4024 -
\??\c:\dpppj.exec:\dpppj.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\llrlllf.exec:\llrlllf.exe34⤵
- Executes dropped EXE
PID:1756 -
\??\c:\thnnhh.exec:\thnnhh.exe35⤵
- Executes dropped EXE
PID:3472 -
\??\c:\rfxfflr.exec:\rfxfflr.exe36⤵
- Executes dropped EXE
PID:1468 -
\??\c:\frflflf.exec:\frflflf.exe37⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vdvvv.exec:\vdvvv.exe38⤵
- Executes dropped EXE
PID:3508 -
\??\c:\thnbnh.exec:\thnbnh.exe39⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jdvpp.exec:\jdvpp.exe40⤵
- Executes dropped EXE
PID:4208 -
\??\c:\nnbnnt.exec:\nnbnnt.exe41⤵
- Executes dropped EXE
PID:3512 -
\??\c:\jdpjv.exec:\jdpjv.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dddvv.exec:\dddvv.exe43⤵
- Executes dropped EXE
PID:3856 -
\??\c:\3fllfll.exec:\3fllfll.exe44⤵
- Executes dropped EXE
PID:3484 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe45⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nnnbbn.exec:\nnnbbn.exe46⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vppjj.exec:\vppjj.exe47⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vdppj.exec:\vdppj.exe48⤵
- Executes dropped EXE
PID:3968 -
\??\c:\frrrrxx.exec:\frrrrxx.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xrrlfrr.exec:\xrrlfrr.exe50⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nttnhh.exec:\nttnhh.exe51⤵
- Executes dropped EXE
PID:4192 -
\??\c:\jddpd.exec:\jddpd.exe52⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vddvj.exec:\vddvj.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\llrxrff.exec:\llrxrff.exe54⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nnnhhb.exec:\nnnhhb.exe55⤵
- Executes dropped EXE
PID:3580 -
\??\c:\tbhbhn.exec:\tbhbhn.exe56⤵
- Executes dropped EXE
PID:4288 -
\??\c:\jdddv.exec:\jdddv.exe57⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jvdvv.exec:\jvdvv.exe58⤵
- Executes dropped EXE
PID:3748 -
\??\c:\rrffxxf.exec:\rrffxxf.exe59⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tnntnt.exec:\tnntnt.exe60⤵
- Executes dropped EXE
PID:3536 -
\??\c:\hbbttt.exec:\hbbttt.exe61⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5vjvp.exec:\5vjvp.exe62⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xlrlffx.exec:\xlrlffx.exe63⤵
- Executes dropped EXE
PID:4520 -
\??\c:\9xffxff.exec:\9xffxff.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nnhtbt.exec:\nnhtbt.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9djjd.exec:\9djjd.exe66⤵PID:4408
-
\??\c:\llxlrlf.exec:\llxlrlf.exe67⤵PID:2196
-
\??\c:\nbbbtb.exec:\nbbbtb.exe68⤵PID:2000
-
\??\c:\bnbttn.exec:\bnbttn.exe69⤵PID:1812
-
\??\c:\3pjvp.exec:\3pjvp.exe70⤵PID:3248
-
\??\c:\pdvdv.exec:\pdvdv.exe71⤵PID:1616
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe72⤵PID:4448
-
\??\c:\bthtth.exec:\bthtth.exe73⤵PID:4544
-
\??\c:\bnbttt.exec:\bnbttt.exe74⤵PID:4008
-
\??\c:\3bhhbb.exec:\3bhhbb.exe75⤵PID:4144
-
\??\c:\pdjdv.exec:\pdjdv.exe76⤵PID:1564
-
\??\c:\flfffrr.exec:\flfffrr.exe77⤵PID:1488
-
\??\c:\3thhhh.exec:\3thhhh.exe78⤵PID:960
-
\??\c:\btntbt.exec:\btntbt.exe79⤵PID:1888
-
\??\c:\pppjj.exec:\pppjj.exe80⤵PID:4388
-
\??\c:\ppjdv.exec:\ppjdv.exe81⤵PID:2856
-
\??\c:\flxrfll.exec:\flxrfll.exe82⤵PID:1380
-
\??\c:\bbtnhh.exec:\bbtnhh.exe83⤵PID:3676
-
\??\c:\bhnhbb.exec:\bhnhbb.exe84⤵PID:3972
-
\??\c:\jdpvv.exec:\jdpvv.exe85⤵PID:2516
-
\??\c:\lrxlxxr.exec:\lrxlxxr.exe86⤵PID:3864
-
\??\c:\hhbbtt.exec:\hhbbtt.exe87⤵PID:2208
-
\??\c:\5bhhtt.exec:\5bhhtt.exe88⤵PID:1908
-
\??\c:\dvjdv.exec:\dvjdv.exe89⤵
- System Location Discovery: System Language Discovery
PID:1568 -
\??\c:\jppjd.exec:\jppjd.exe90⤵PID:1848
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe91⤵PID:5080
-
\??\c:\rrllfll.exec:\rrllfll.exe92⤵PID:1800
-
\??\c:\1nttnt.exec:\1nttnt.exe93⤵PID:4024
-
\??\c:\jjjjd.exec:\jjjjd.exe94⤵PID:4040
-
\??\c:\fflffrl.exec:\fflffrl.exe95⤵PID:4728
-
\??\c:\fffxllr.exec:\fffxllr.exe96⤵PID:1756
-
\??\c:\1nbbth.exec:\1nbbth.exe97⤵PID:4984
-
\??\c:\nhhntb.exec:\nhhntb.exe98⤵PID:1100
-
\??\c:\dpvjd.exec:\dpvjd.exe99⤵PID:3208
-
\??\c:\rxffrrr.exec:\rxffrrr.exe100⤵PID:3020
-
\??\c:\7lrrlll.exec:\7lrrlll.exe101⤵PID:4904
-
\??\c:\nhtnhn.exec:\nhtnhn.exe102⤵PID:1200
-
\??\c:\ppppp.exec:\ppppp.exe103⤵PID:3512
-
\??\c:\dvvpj.exec:\dvvpj.exe104⤵PID:2256
-
\??\c:\9llfxxx.exec:\9llfxxx.exe105⤵PID:3856
-
\??\c:\7hhhbb.exec:\7hhhbb.exe106⤵PID:4672
-
\??\c:\httbtt.exec:\httbtt.exe107⤵PID:4820
-
\??\c:\jdjdd.exec:\jdjdd.exe108⤵PID:4148
-
\??\c:\9flrrxl.exec:\9flrrxl.exe109⤵PID:4316
-
\??\c:\1flffxx.exec:\1flffxx.exe110⤵PID:3968
-
\??\c:\5lrlffx.exec:\5lrlffx.exe111⤵PID:3528
-
\??\c:\pjpvp.exec:\pjpvp.exe112⤵PID:4472
-
\??\c:\5lfxlll.exec:\5lfxlll.exe113⤵PID:3176
-
\??\c:\rxrrlrl.exec:\rxrrlrl.exe114⤵PID:1656
-
\??\c:\hbhthb.exec:\hbhthb.exe115⤵PID:3352
-
\??\c:\7djpj.exec:\7djpj.exe116⤵PID:1764
-
\??\c:\xrlfxfl.exec:\xrlfxfl.exe117⤵PID:2952
-
\??\c:\rlrllxx.exec:\rlrllxx.exe118⤵PID:380
-
\??\c:\ttbnhh.exec:\ttbnhh.exe119⤵PID:4256
-
\??\c:\bttnhh.exec:\bttnhh.exe120⤵
- System Location Discovery: System Language Discovery
PID:3748 -
\??\c:\pdjdv.exec:\pdjdv.exe121⤵PID:3112
-
\??\c:\rrfxllf.exec:\rrfxllf.exe122⤵PID:396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-