Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe
Resource
win7-20240903-en
General
-
Target
70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe
-
Size
106KB
-
MD5
196222614f4d7f8e424927d7a09ceb30
-
SHA1
8bfaaf9f1aedfbbb18088620abe80de30adde225
-
SHA256
70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971
-
SHA512
bb029b4a94a065ba872ee0274f36da218405a49c98e3e9ba5336e358297d9a918bfcdafc9ae40933463bf6c7749cf6dc8b51d7edacd560bdb593bee2171c5116
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CA+:n3C9BRo7MlrWKVT+buBGu3PC
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3308-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3720 9frllll.exe 2924 nbtbhh.exe 4592 nhnhbb.exe 3576 pjjjd.exe 2988 ffxrllf.exe 1624 rflrllf.exe 3668 hhhhnn.exe 3288 jvpvj.exe 3060 fxlrxfr.exe 5112 djvdp.exe 2744 ppvpp.exe 4436 5fxrfxr.exe 3732 rlxffll.exe 4024 7nttbb.exe 2420 bttnbb.exe 4760 djpjj.exe 3912 lffxlll.exe 1616 btbhhn.exe 3020 vvvdv.exe 4916 pjpdp.exe 3168 rfffxxx.exe 3240 jvvpv.exe 1800 xlxrffx.exe 4564 tntbtb.exe 4140 ppjjv.exe 2124 vvdvj.exe 4204 rfffxxr.exe 1840 xflllfx.exe 4244 tbnnhh.exe 1088 3vvpj.exe 2688 lxrllrl.exe 3256 lrxrlxx.exe 3528 htbbtn.exe 3676 bnnhbb.exe 2364 jdvdv.exe 4852 dvppd.exe 2132 lrrlxxx.exe 4528 xfrrxfl.exe 5008 nhhnhh.exe 668 httnhb.exe 532 3vppd.exe 3904 ththhh.exe 2164 jppjd.exe 4144 vvvpj.exe 4724 rxlfxff.exe 1252 xrxxrxx.exe 1036 tthntb.exe 2148 tnbtbb.exe 2792 9jpjv.exe 4464 vdvpj.exe 1508 rxlfxxx.exe 4680 rlxrllf.exe 3596 bhttbb.exe 3972 htbtnn.exe 5116 ddvpp.exe 4900 xlrxrlr.exe 3692 rlxrxrl.exe 5112 tnnhtn.exe 2316 5tbnbt.exe 2024 9ddjv.exe 2492 rfxlfrx.exe 4060 rlffxrl.exe 4024 frlxrfr.exe 1488 thhbbt.exe -
resource yara_rule behavioral2/memory/3308-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 3720 3308 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 86 PID 3308 wrote to memory of 3720 3308 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 86 PID 3308 wrote to memory of 3720 3308 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 86 PID 3720 wrote to memory of 2924 3720 9frllll.exe 87 PID 3720 wrote to memory of 2924 3720 9frllll.exe 87 PID 3720 wrote to memory of 2924 3720 9frllll.exe 87 PID 2924 wrote to memory of 4592 2924 nbtbhh.exe 88 PID 2924 wrote to memory of 4592 2924 nbtbhh.exe 88 PID 2924 wrote to memory of 4592 2924 nbtbhh.exe 88 PID 4592 wrote to memory of 3576 4592 nhnhbb.exe 89 PID 4592 wrote to memory of 3576 4592 nhnhbb.exe 89 PID 4592 wrote to memory of 3576 4592 nhnhbb.exe 89 PID 3576 wrote to memory of 2988 3576 pjjjd.exe 90 PID 3576 wrote to memory of 2988 3576 pjjjd.exe 90 PID 3576 wrote to memory of 2988 3576 pjjjd.exe 90 PID 2988 wrote to memory of 1624 2988 ffxrllf.exe 91 PID 2988 wrote to memory of 1624 2988 ffxrllf.exe 91 PID 2988 wrote to memory of 1624 2988 ffxrllf.exe 91 PID 1624 wrote to memory of 3668 1624 rflrllf.exe 92 PID 1624 wrote to memory of 3668 1624 rflrllf.exe 92 PID 1624 wrote to memory of 3668 1624 rflrllf.exe 92 PID 3668 wrote to memory of 3288 3668 hhhhnn.exe 93 PID 3668 wrote to memory of 3288 3668 hhhhnn.exe 93 PID 3668 wrote to memory of 3288 3668 hhhhnn.exe 93 PID 3288 wrote to memory of 3060 3288 jvpvj.exe 94 PID 3288 wrote to memory of 3060 3288 jvpvj.exe 94 PID 3288 wrote to memory of 3060 3288 jvpvj.exe 94 PID 3060 wrote to memory of 5112 3060 fxlrxfr.exe 95 PID 3060 wrote to memory of 5112 3060 fxlrxfr.exe 95 PID 3060 wrote to memory of 5112 3060 fxlrxfr.exe 95 PID 5112 wrote to memory of 2744 5112 djvdp.exe 96 PID 5112 wrote to memory of 2744 5112 djvdp.exe 96 PID 5112 wrote to memory of 2744 5112 djvdp.exe 96 PID 2744 wrote to memory of 4436 2744 ppvpp.exe 97 PID 2744 wrote to memory of 4436 2744 ppvpp.exe 97 PID 2744 wrote to memory of 4436 2744 ppvpp.exe 97 PID 4436 wrote to memory of 3732 4436 5fxrfxr.exe 98 PID 4436 wrote to memory of 3732 4436 5fxrfxr.exe 98 PID 4436 wrote to memory of 3732 4436 5fxrfxr.exe 98 PID 3732 wrote to memory of 4024 3732 rlxffll.exe 99 PID 3732 wrote to memory of 4024 3732 rlxffll.exe 99 PID 3732 wrote to memory of 4024 3732 rlxffll.exe 99 PID 4024 wrote to memory of 2420 4024 7nttbb.exe 100 PID 4024 wrote to memory of 2420 4024 7nttbb.exe 100 PID 4024 wrote to memory of 2420 4024 7nttbb.exe 100 PID 2420 wrote to memory of 4760 2420 bttnbb.exe 101 PID 2420 wrote to memory of 4760 2420 bttnbb.exe 101 PID 2420 wrote to memory of 4760 2420 bttnbb.exe 101 PID 4760 wrote to memory of 3912 4760 djpjj.exe 102 PID 4760 wrote to memory of 3912 4760 djpjj.exe 102 PID 4760 wrote to memory of 3912 4760 djpjj.exe 102 PID 3912 wrote to memory of 1616 3912 lffxlll.exe 103 PID 3912 wrote to memory of 1616 3912 lffxlll.exe 103 PID 3912 wrote to memory of 1616 3912 lffxlll.exe 103 PID 1616 wrote to memory of 3020 1616 btbhhn.exe 104 PID 1616 wrote to memory of 3020 1616 btbhhn.exe 104 PID 1616 wrote to memory of 3020 1616 btbhhn.exe 104 PID 3020 wrote to memory of 4916 3020 vvvdv.exe 105 PID 3020 wrote to memory of 4916 3020 vvvdv.exe 105 PID 3020 wrote to memory of 4916 3020 vvvdv.exe 105 PID 4916 wrote to memory of 3168 4916 pjpdp.exe 106 PID 4916 wrote to memory of 3168 4916 pjpdp.exe 106 PID 4916 wrote to memory of 3168 4916 pjpdp.exe 106 PID 3168 wrote to memory of 3240 3168 rfffxxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe"C:\Users\Admin\AppData\Local\Temp\70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\9frllll.exec:\9frllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\nbtbhh.exec:\nbtbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nhnhbb.exec:\nhnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\pjjjd.exec:\pjjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\ffxrllf.exec:\ffxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rflrllf.exec:\rflrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\hhhhnn.exec:\hhhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\jvpvj.exec:\jvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\djvdp.exec:\djvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\ppvpp.exec:\ppvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5fxrfxr.exec:\5fxrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\rlxffll.exec:\rlxffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\7nttbb.exec:\7nttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\bttnbb.exec:\bttnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\djpjj.exec:\djpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\lffxlll.exec:\lffxlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\btbhhn.exec:\btbhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\vvvdv.exec:\vvvdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pjpdp.exec:\pjpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\rfffxxx.exec:\rfffxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\jvvpv.exec:\jvvpv.exe23⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xlxrffx.exec:\xlxrffx.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tntbtb.exec:\tntbtb.exe25⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ppjjv.exec:\ppjjv.exe26⤵
- Executes dropped EXE
PID:4140 -
\??\c:\vvdvj.exec:\vvdvj.exe27⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rfffxxr.exec:\rfffxxr.exe28⤵
- Executes dropped EXE
PID:4204 -
\??\c:\xflllfx.exec:\xflllfx.exe29⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tbnnhh.exec:\tbnnhh.exe30⤵
- Executes dropped EXE
PID:4244 -
\??\c:\3vvpj.exec:\3vvpj.exe31⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lxrllrl.exec:\lxrllrl.exe32⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lrxrlxx.exec:\lrxrlxx.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3256 -
\??\c:\htbbtn.exec:\htbbtn.exe34⤵
- Executes dropped EXE
PID:3528 -
\??\c:\bnnhbb.exec:\bnnhbb.exe35⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jdvdv.exec:\jdvdv.exe36⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dvppd.exec:\dvppd.exe37⤵
- Executes dropped EXE
PID:4852 -
\??\c:\lrrlxxx.exec:\lrrlxxx.exe38⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe39⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nhhnhh.exec:\nhhnhh.exe40⤵
- Executes dropped EXE
PID:5008 -
\??\c:\httnhb.exec:\httnhb.exe41⤵
- Executes dropped EXE
PID:668 -
\??\c:\3vppd.exec:\3vppd.exe42⤵
- Executes dropped EXE
PID:532 -
\??\c:\ththhh.exec:\ththhh.exe43⤵
- Executes dropped EXE
PID:3904 -
\??\c:\jppjd.exec:\jppjd.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vvvpj.exec:\vvvpj.exe45⤵
- Executes dropped EXE
PID:4144 -
\??\c:\rxlfxff.exec:\rxlfxff.exe46⤵
- Executes dropped EXE
PID:4724 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe47⤵
- Executes dropped EXE
PID:1252 -
\??\c:\tthntb.exec:\tthntb.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tnbtbb.exec:\tnbtbb.exe49⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9jpjv.exec:\9jpjv.exe50⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vdvpj.exec:\vdvpj.exe51⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rlxrllf.exec:\rlxrllf.exe53⤵
- Executes dropped EXE
PID:4680 -
\??\c:\bhttbb.exec:\bhttbb.exe54⤵
- Executes dropped EXE
PID:3596 -
\??\c:\htbtnn.exec:\htbtnn.exe55⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ddvpp.exec:\ddvpp.exe56⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xlrxrlr.exec:\xlrxrlr.exe57⤵
- Executes dropped EXE
PID:4900 -
\??\c:\rlxrxrl.exec:\rlxrxrl.exe58⤵
- Executes dropped EXE
PID:3692 -
\??\c:\tnnhtn.exec:\tnnhtn.exe59⤵
- Executes dropped EXE
PID:5112 -
\??\c:\5tbnbt.exec:\5tbnbt.exe60⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9ddjv.exec:\9ddjv.exe61⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rfxlfrx.exec:\rfxlfrx.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rlffxrl.exec:\rlffxrl.exe63⤵
- Executes dropped EXE
PID:4060 -
\??\c:\frlxrfr.exec:\frlxrfr.exe64⤵
- Executes dropped EXE
PID:4024 -
\??\c:\thhbbt.exec:\thhbbt.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jpppj.exec:\jpppj.exe66⤵PID:4876
-
\??\c:\jdpjp.exec:\jdpjp.exe67⤵PID:1148
-
\??\c:\lxfrllx.exec:\lxfrllx.exe68⤵PID:228
-
\??\c:\3lfxrlx.exec:\3lfxrlx.exe69⤵PID:2172
-
\??\c:\nnbtnh.exec:\nnbtnh.exe70⤵PID:4256
-
\??\c:\9vvpj.exec:\9vvpj.exe71⤵PID:3520
-
\??\c:\vpjdp.exec:\vpjdp.exe72⤵PID:4216
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe73⤵PID:4196
-
\??\c:\tbbtnb.exec:\tbbtnb.exe74⤵PID:3584
-
\??\c:\bntnnh.exec:\bntnnh.exe75⤵PID:4940
-
\??\c:\vvvvd.exec:\vvvvd.exe76⤵PID:3468
-
\??\c:\dpjvd.exec:\dpjvd.exe77⤵PID:408
-
\??\c:\xlrrflf.exec:\xlrrflf.exe78⤵PID:468
-
\??\c:\nbtnbt.exec:\nbtnbt.exe79⤵PID:4792
-
\??\c:\3ttthb.exec:\3ttthb.exe80⤵PID:4948
-
\??\c:\vddvj.exec:\vddvj.exe81⤵PID:4004
-
\??\c:\vppjd.exec:\vppjd.exe82⤵PID:4204
-
\??\c:\3fxxflr.exec:\3fxxflr.exe83⤵PID:3816
-
\??\c:\bttnhh.exec:\bttnhh.exe84⤵PID:3752
-
\??\c:\bnntht.exec:\bnntht.exe85⤵PID:4560
-
\??\c:\vjvjv.exec:\vjvjv.exe86⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\rllxfxl.exec:\rllxfxl.exe87⤵PID:400
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe88⤵
- System Location Discovery: System Language Discovery
PID:5040 -
\??\c:\tnbthh.exec:\tnbthh.exe89⤵PID:2140
-
\??\c:\7nntbt.exec:\7nntbt.exe90⤵PID:4964
-
\??\c:\pvdpd.exec:\pvdpd.exe91⤵PID:4444
-
\??\c:\dpvvd.exec:\dpvvd.exe92⤵PID:4480
-
\??\c:\rlfxfrf.exec:\rlfxfrf.exe93⤵PID:1912
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe94⤵PID:4976
-
\??\c:\bbhbnh.exec:\bbhbnh.exe95⤵PID:3660
-
\??\c:\pdpdp.exec:\pdpdp.exe96⤵PID:4588
-
\??\c:\vdjdd.exec:\vdjdd.exe97⤵PID:3252
-
\??\c:\ffffffx.exec:\ffffffx.exe98⤵PID:4016
-
\??\c:\lxffllf.exec:\lxffllf.exe99⤵PID:1908
-
\??\c:\hnttbb.exec:\hnttbb.exe100⤵PID:4284
-
\??\c:\bbntnt.exec:\bbntnt.exe101⤵PID:4260
-
\??\c:\ppjpp.exec:\ppjpp.exe102⤵PID:2464
-
\??\c:\lfffrrr.exec:\lfffrrr.exe103⤵PID:2768
-
\??\c:\rllllll.exec:\rllllll.exe104⤵PID:1096
-
\??\c:\fxxxrff.exec:\fxxxrff.exe105⤵PID:4612
-
\??\c:\thtnhh.exec:\thtnhh.exe106⤵PID:4464
-
\??\c:\ppvpp.exec:\ppvpp.exe107⤵PID:2392
-
\??\c:\dpvpj.exec:\dpvpj.exe108⤵PID:4372
-
\??\c:\rlxxffx.exec:\rlxxffx.exe109⤵PID:4944
-
\??\c:\fffffff.exec:\fffffff.exe110⤵PID:1112
-
\??\c:\thhhhh.exec:\thhhhh.exe111⤵PID:4952
-
\??\c:\jpvpd.exec:\jpvpd.exe112⤵PID:2668
-
\??\c:\dvpjv.exec:\dvpjv.exe113⤵PID:1424
-
\??\c:\frfxxxx.exec:\frfxxxx.exe114⤵PID:5112
-
\??\c:\xrrrllf.exec:\xrrrllf.exe115⤵PID:2316
-
\??\c:\9hbbbb.exec:\9hbbbb.exe116⤵PID:3732
-
\??\c:\3tnhbt.exec:\3tnhbt.exe117⤵PID:3292
-
\??\c:\vpvjd.exec:\vpvjd.exe118⤵PID:4060
-
\??\c:\xxxxxll.exec:\xxxxxll.exe119⤵PID:4024
-
\??\c:\flxxrrl.exec:\flxxrrl.exe120⤵PID:1488
-
\??\c:\bbtttt.exec:\bbtttt.exe121⤵PID:1604
-
\??\c:\ttnbtt.exec:\ttnbtt.exe122⤵PID:4224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-