Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe
Resource
win7-20240704-en
General
-
Target
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe
-
Size
230KB
-
MD5
18ddcc606a221e8d20834287a92fe100
-
SHA1
57cd8c7f9e5f2ad12d0dbd37b3e263e03284ccfe
-
SHA256
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873
-
SHA512
217d3a43f88b5dad180cb85dcd9a72476a2caf8f0115c0bbf16e26c568a026291d7860cc506d0486478f1e3d29875633c3e5422b13ec8844f3c52406df5e6d45
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fE:n3C9BRo7MlrWKo+lxKk1fE
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1924-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1812 680662.exe 3884 thhhbh.exe 5092 ddvdv.exe 5084 6004048.exe 3576 864402.exe 3964 2084466.exe 2760 04646.exe 968 pvdvp.exe 3756 btbhbb.exe 4060 k84488.exe 4460 tnthbb.exe 1408 2288006.exe 1824 rlrlrrx.exe 720 llrrrrr.exe 2776 8684888.exe 1100 htbttb.exe 4760 4826628.exe 2000 k82266.exe 1916 lflrrxl.exe 3600 468822.exe 2428 e40000.exe 4584 402622.exe 3440 pdjjd.exe 4628 04486.exe 4468 btbhhn.exe 2572 hhbbbb.exe 2228 nhnbtn.exe 4316 622204.exe 1580 026244.exe 848 fxrllll.exe 400 8000660.exe 4180 nnhthb.exe 800 8888288.exe 4740 246600.exe 1844 rxxrllf.exe 4796 66888.exe 4380 vpjpj.exe 2432 028266.exe 1816 i044220.exe 3884 3lrrflx.exe 4732 fxfxrxx.exe 3940 c028282.exe 4500 bnnthh.exe 2464 2026040.exe 4516 6422604.exe 3256 nnnnhb.exe 2624 jjjdv.exe 1904 7hnbtt.exe 1628 jddvv.exe 3008 0000888.exe 4328 ttntnn.exe 4324 0428666.exe 720 6400080.exe 2776 jdddd.exe 4296 frrrlrr.exe 3424 424884.exe 2000 s8444.exe 3404 jpvvp.exe 3600 20226.exe 2428 28048.exe 1604 a6048.exe 3164 bbttnn.exe 1736 624600.exe 1068 206044.exe -
resource yara_rule behavioral2/memory/1924-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-11-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q22648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 802222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8488488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4460444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1812 1924 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 89 PID 1924 wrote to memory of 1812 1924 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 89 PID 1924 wrote to memory of 1812 1924 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 89 PID 1812 wrote to memory of 3884 1812 680662.exe 90 PID 1812 wrote to memory of 3884 1812 680662.exe 90 PID 1812 wrote to memory of 3884 1812 680662.exe 90 PID 3884 wrote to memory of 5092 3884 thhhbh.exe 91 PID 3884 wrote to memory of 5092 3884 thhhbh.exe 91 PID 3884 wrote to memory of 5092 3884 thhhbh.exe 91 PID 5092 wrote to memory of 5084 5092 ddvdv.exe 92 PID 5092 wrote to memory of 5084 5092 ddvdv.exe 92 PID 5092 wrote to memory of 5084 5092 ddvdv.exe 92 PID 5084 wrote to memory of 3576 5084 6004048.exe 93 PID 5084 wrote to memory of 3576 5084 6004048.exe 93 PID 5084 wrote to memory of 3576 5084 6004048.exe 93 PID 3576 wrote to memory of 3964 3576 864402.exe 94 PID 3576 wrote to memory of 3964 3576 864402.exe 94 PID 3576 wrote to memory of 3964 3576 864402.exe 94 PID 3964 wrote to memory of 2760 3964 2084466.exe 95 PID 3964 wrote to memory of 2760 3964 2084466.exe 95 PID 3964 wrote to memory of 2760 3964 2084466.exe 95 PID 2760 wrote to memory of 968 2760 04646.exe 96 PID 2760 wrote to memory of 968 2760 04646.exe 96 PID 2760 wrote to memory of 968 2760 04646.exe 96 PID 968 wrote to memory of 3756 968 pvdvp.exe 97 PID 968 wrote to memory of 3756 968 pvdvp.exe 97 PID 968 wrote to memory of 3756 968 pvdvp.exe 97 PID 3756 wrote to memory of 4060 3756 btbhbb.exe 98 PID 3756 wrote to memory of 4060 3756 btbhbb.exe 98 PID 3756 wrote to memory of 4060 3756 btbhbb.exe 98 PID 4060 wrote to memory of 4460 4060 k84488.exe 99 PID 4060 wrote to memory of 4460 4060 k84488.exe 99 PID 4060 wrote to memory of 4460 4060 k84488.exe 99 PID 4460 wrote to memory of 1408 4460 tnthbb.exe 100 PID 4460 wrote to memory of 1408 4460 tnthbb.exe 100 PID 4460 wrote to memory of 1408 4460 tnthbb.exe 100 PID 1408 wrote to memory of 1824 1408 2288006.exe 101 PID 1408 wrote to memory of 1824 1408 2288006.exe 101 PID 1408 wrote to memory of 1824 1408 2288006.exe 101 PID 1824 wrote to memory of 720 1824 rlrlrrx.exe 102 PID 1824 wrote to memory of 720 1824 rlrlrrx.exe 102 PID 1824 wrote to memory of 720 1824 rlrlrrx.exe 102 PID 720 wrote to memory of 2776 720 llrrrrr.exe 103 PID 720 wrote to memory of 2776 720 llrrrrr.exe 103 PID 720 wrote to memory of 2776 720 llrrrrr.exe 103 PID 2776 wrote to memory of 1100 2776 8684888.exe 104 PID 2776 wrote to memory of 1100 2776 8684888.exe 104 PID 2776 wrote to memory of 1100 2776 8684888.exe 104 PID 1100 wrote to memory of 4760 1100 htbttb.exe 105 PID 1100 wrote to memory of 4760 1100 htbttb.exe 105 PID 1100 wrote to memory of 4760 1100 htbttb.exe 105 PID 4760 wrote to memory of 2000 4760 4826628.exe 145 PID 4760 wrote to memory of 2000 4760 4826628.exe 145 PID 4760 wrote to memory of 2000 4760 4826628.exe 145 PID 2000 wrote to memory of 1916 2000 k82266.exe 107 PID 2000 wrote to memory of 1916 2000 k82266.exe 107 PID 2000 wrote to memory of 1916 2000 k82266.exe 107 PID 1916 wrote to memory of 3600 1916 lflrrxl.exe 108 PID 1916 wrote to memory of 3600 1916 lflrrxl.exe 108 PID 1916 wrote to memory of 3600 1916 lflrrxl.exe 108 PID 3600 wrote to memory of 2428 3600 468822.exe 109 PID 3600 wrote to memory of 2428 3600 468822.exe 109 PID 3600 wrote to memory of 2428 3600 468822.exe 109 PID 2428 wrote to memory of 4584 2428 e40000.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe"C:\Users\Admin\AppData\Local\Temp\f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\680662.exec:\680662.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\thhhbh.exec:\thhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\ddvdv.exec:\ddvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\6004048.exec:\6004048.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\864402.exec:\864402.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\2084466.exec:\2084466.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\04646.exec:\04646.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pvdvp.exec:\pvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\btbhbb.exec:\btbhbb.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\k84488.exec:\k84488.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\tnthbb.exec:\tnthbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\2288006.exec:\2288006.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\llrrrrr.exec:\llrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\8684888.exec:\8684888.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\htbttb.exec:\htbttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\4826628.exec:\4826628.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\k82266.exec:\k82266.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lflrrxl.exec:\lflrrxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\468822.exec:\468822.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\e40000.exec:\e40000.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\402622.exec:\402622.exe23⤵
- Executes dropped EXE
PID:4584 -
\??\c:\pdjjd.exec:\pdjjd.exe24⤵
- Executes dropped EXE
PID:3440 -
\??\c:\04486.exec:\04486.exe25⤵
- Executes dropped EXE
PID:4628 -
\??\c:\btbhhn.exec:\btbhhn.exe26⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hhbbbb.exec:\hhbbbb.exe27⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhnbtn.exec:\nhnbtn.exe28⤵
- Executes dropped EXE
PID:2228 -
\??\c:\622204.exec:\622204.exe29⤵
- Executes dropped EXE
PID:4316 -
\??\c:\026244.exec:\026244.exe30⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fxrllll.exec:\fxrllll.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\8000660.exec:\8000660.exe32⤵
- Executes dropped EXE
PID:400 -
\??\c:\nnhthb.exec:\nnhthb.exe33⤵
- Executes dropped EXE
PID:4180 -
\??\c:\8888288.exec:\8888288.exe34⤵
- Executes dropped EXE
PID:800 -
\??\c:\246600.exec:\246600.exe35⤵
- Executes dropped EXE
PID:4740 -
\??\c:\rxxrllf.exec:\rxxrllf.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\66888.exec:\66888.exe37⤵
- Executes dropped EXE
PID:4796 -
\??\c:\vpjpj.exec:\vpjpj.exe38⤵
- Executes dropped EXE
PID:4380 -
\??\c:\028266.exec:\028266.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\i044220.exec:\i044220.exe40⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3lrrflx.exec:\3lrrflx.exe41⤵
- Executes dropped EXE
PID:3884 -
\??\c:\fxfxrxx.exec:\fxfxrxx.exe42⤵
- Executes dropped EXE
PID:4732 -
\??\c:\c028282.exec:\c028282.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bnnthh.exec:\bnnthh.exe44⤵
- Executes dropped EXE
PID:4500 -
\??\c:\2026040.exec:\2026040.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\6422604.exec:\6422604.exe46⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nnnnhb.exec:\nnnnhb.exe47⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jjjdv.exec:\jjjdv.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7hnbtt.exec:\7hnbtt.exe49⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jddvv.exec:\jddvv.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\0000888.exec:\0000888.exe51⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ttntnn.exec:\ttntnn.exe52⤵
- Executes dropped EXE
PID:4328 -
\??\c:\0428666.exec:\0428666.exe53⤵
- Executes dropped EXE
PID:4324 -
\??\c:\6400080.exec:\6400080.exe54⤵
- Executes dropped EXE
PID:720 -
\??\c:\jdddd.exec:\jdddd.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\frrrlrr.exec:\frrrlrr.exe56⤵
- Executes dropped EXE
PID:4296 -
\??\c:\424884.exec:\424884.exe57⤵
- Executes dropped EXE
PID:3424 -
\??\c:\s8444.exec:\s8444.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jpvvp.exec:\jpvvp.exe59⤵
- Executes dropped EXE
PID:3404 -
\??\c:\20226.exec:\20226.exe60⤵
- Executes dropped EXE
PID:3600 -
\??\c:\28048.exec:\28048.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\a6048.exec:\a6048.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bbttnn.exec:\bbttnn.exe63⤵
- Executes dropped EXE
PID:3164 -
\??\c:\624600.exec:\624600.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\206044.exec:\206044.exe65⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5lxfxxr.exec:\5lxfxxr.exe66⤵PID:2568
-
\??\c:\vppjv.exec:\vppjv.exe67⤵PID:4888
-
\??\c:\22860.exec:\22860.exe68⤵PID:1616
-
\??\c:\jdvpp.exec:\jdvpp.exe69⤵PID:4856
-
\??\c:\3vpjv.exec:\3vpjv.exe70⤵PID:4180
-
\??\c:\a8204.exec:\a8204.exe71⤵PID:2064
-
\??\c:\o044882.exec:\o044882.exe72⤵PID:2716
-
\??\c:\20862.exec:\20862.exe73⤵PID:4448
-
\??\c:\88486.exec:\88486.exe74⤵PID:4536
-
\??\c:\pjpjj.exec:\pjpjj.exe75⤵PID:4996
-
\??\c:\xrrrlff.exec:\xrrrlff.exe76⤵PID:3408
-
\??\c:\c086268.exec:\c086268.exe77⤵PID:3644
-
\??\c:\bntnhb.exec:\bntnhb.exe78⤵PID:4832
-
\??\c:\bbthtn.exec:\bbthtn.exe79⤵PID:4640
-
\??\c:\vdjdd.exec:\vdjdd.exe80⤵PID:4592
-
\??\c:\vvdpj.exec:\vvdpj.exe81⤵PID:3156
-
\??\c:\4800446.exec:\4800446.exe82⤵PID:4520
-
\??\c:\jjddv.exec:\jjddv.exe83⤵PID:4688
-
\??\c:\rlfrlff.exec:\rlfrlff.exe84⤵PID:3756
-
\??\c:\86824.exec:\86824.exe85⤵PID:820
-
\??\c:\9djjp.exec:\9djjp.exe86⤵PID:1428
-
\??\c:\jjjdd.exec:\jjjdd.exe87⤵PID:5096
-
\??\c:\xrflxfx.exec:\xrflxfx.exe88⤵PID:1648
-
\??\c:\428844.exec:\428844.exe89⤵PID:216
-
\??\c:\662200.exec:\662200.exe90⤵PID:968
-
\??\c:\httnnn.exec:\httnnn.exe91⤵PID:2124
-
\??\c:\httttt.exec:\httttt.exe92⤵PID:4776
-
\??\c:\llffxxx.exec:\llffxxx.exe93⤵PID:2776
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe94⤵PID:4272
-
\??\c:\g0828.exec:\g0828.exe95⤵PID:4780
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe96⤵PID:4404
-
\??\c:\xrfxfff.exec:\xrfxfff.exe97⤵PID:1988
-
\??\c:\pjvvp.exec:\pjvvp.exe98⤵PID:4220
-
\??\c:\nttttt.exec:\nttttt.exe99⤵PID:756
-
\??\c:\1nnhbb.exec:\1nnhbb.exe100⤵PID:3348
-
\??\c:\26884.exec:\26884.exe101⤵PID:2892
-
\??\c:\48422.exec:\48422.exe102⤵PID:1208
-
\??\c:\0404448.exec:\0404448.exe103⤵PID:1600
-
\??\c:\9tbttt.exec:\9tbttt.exe104⤵PID:4092
-
\??\c:\xfrrxrr.exec:\xfrrxrr.exe105⤵PID:3052
-
\??\c:\6000444.exec:\6000444.exe106⤵PID:3540
-
\??\c:\lllrrxx.exec:\lllrrxx.exe107⤵PID:2096
-
\??\c:\840044.exec:\840044.exe108⤵PID:664
-
\??\c:\jvpvj.exec:\jvpvj.exe109⤵PID:2960
-
\??\c:\dpvpj.exec:\dpvpj.exe110⤵PID:3916
-
\??\c:\jvddp.exec:\jvddp.exe111⤵
- System Location Discovery: System Language Discovery
PID:3616 -
\??\c:\vjvvp.exec:\vjvvp.exe112⤵PID:3992
-
\??\c:\82800.exec:\82800.exe113⤵PID:612
-
\??\c:\ppddj.exec:\ppddj.exe114⤵PID:1808
-
\??\c:\420666.exec:\420666.exe115⤵PID:2836
-
\??\c:\ppppp.exec:\ppppp.exe116⤵PID:1844
-
\??\c:\llxrrrf.exec:\llxrrrf.exe117⤵PID:4396
-
\??\c:\jdjdv.exec:\jdjdv.exe118⤵PID:4448
-
\??\c:\pdjdp.exec:\pdjdp.exe119⤵PID:3660
-
\??\c:\3jppd.exec:\3jppd.exe120⤵PID:4996
-
\??\c:\u022444.exec:\u022444.exe121⤵PID:3408
-
\??\c:\g4044.exec:\g4044.exe122⤵PID:4680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-