Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/10/2024, 05:37 UTC
Static task
static1
1 signatures
General
-
Target
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe
-
Size
230KB
-
MD5
18ddcc606a221e8d20834287a92fe100
-
SHA1
57cd8c7f9e5f2ad12d0dbd37b3e263e03284ccfe
-
SHA256
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873
-
SHA512
217d3a43f88b5dad180cb85dcd9a72476a2caf8f0115c0bbf16e26c568a026291d7860cc506d0486478f1e3d29875633c3e5422b13ec8844f3c52406df5e6d45
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fE:n3C9BRo7MlrWKo+lxKk1fE
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/1344-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4068-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4716-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4108-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4320-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/4320-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/5012-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3952-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4240-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3436-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4728-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3408-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3796-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4352-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4068 7lrlrll.exe 1524 1tnhnh.exe 4716 jdvpj.exe 4108 nnhhbb.exe 4320 jvjdd.exe 5012 rxffllr.exe 2040 7bnnbh.exe 756 dvvpv.exe 1516 rrrrrxx.exe 2876 bntnhb.exe 2656 tthnbh.exe 416 djjjp.exe 3952 rlrlffr.exe 4240 hbtnhh.exe 1476 dpppp.exe 3436 lllfxxr.exe 4056 hnthbn.exe 2632 vjjdv.exe 2996 xrrlxxx.exe 2264 bnhttn.exe 1944 hbnhth.exe 856 djpjd.exe 1772 jjppj.exe 1168 3frxrrl.exe 4728 vdpjp.exe 1252 xrxrlxx.exe 2956 nttnbn.exe 3408 jvjvv.exe 4088 lfrxrxf.exe 3796 3nhnhh.exe 4352 vpvpv.exe 5008 rfrlxfl.exe 3636 tntntt.exe 3332 djjpj.exe 4384 xlllflf.exe 1356 lflfxrl.exe 2192 nthbtt.exe 1432 jddvv.exe 4416 pvdvv.exe 2100 3rfrxxx.exe 1312 lfrffxl.exe 1864 nbhbtn.exe 4924 pjpjd.exe 1044 xrlxrrl.exe 1844 7lrxrlx.exe 2852 bhhhnh.exe 4580 nnhbtt.exe 4692 dpdvp.exe 4736 9fxrflf.exe 1344 lllfxxf.exe 432 nnnnht.exe 4896 9pjdv.exe 1892 vjjjj.exe 4944 xfllffx.exe 4208 hbbbtt.exe 4320 bthbbb.exe 4016 9vpjd.exe 460 rllxxrl.exe 1480 5llxrrl.exe 2912 9hhhtt.exe 4688 ddvvp.exe 1816 5xlfxll.exe 412 1xrrrrr.exe 1176 9htbtb.exe -
resource yara_rule behavioral1/memory/1344-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4068-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4716-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4108-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4320-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5012-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3952-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4240-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3436-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4728-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3408-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3796-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4352-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 4068 1344 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 78 PID 1344 wrote to memory of 4068 1344 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 78 PID 1344 wrote to memory of 4068 1344 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 78 PID 4068 wrote to memory of 1524 4068 7lrlrll.exe 79 PID 4068 wrote to memory of 1524 4068 7lrlrll.exe 79 PID 4068 wrote to memory of 1524 4068 7lrlrll.exe 79 PID 1524 wrote to memory of 4716 1524 1tnhnh.exe 80 PID 1524 wrote to memory of 4716 1524 1tnhnh.exe 80 PID 1524 wrote to memory of 4716 1524 1tnhnh.exe 80 PID 4716 wrote to memory of 4108 4716 jdvpj.exe 81 PID 4716 wrote to memory of 4108 4716 jdvpj.exe 81 PID 4716 wrote to memory of 4108 4716 jdvpj.exe 81 PID 4108 wrote to memory of 4320 4108 nnhhbb.exe 82 PID 4108 wrote to memory of 4320 4108 nnhhbb.exe 82 PID 4108 wrote to memory of 4320 4108 nnhhbb.exe 82 PID 4320 wrote to memory of 5012 4320 jvjdd.exe 83 PID 4320 wrote to memory of 5012 4320 jvjdd.exe 83 PID 4320 wrote to memory of 5012 4320 jvjdd.exe 83 PID 5012 wrote to memory of 2040 5012 rxffllr.exe 84 PID 5012 wrote to memory of 2040 5012 rxffllr.exe 84 PID 5012 wrote to memory of 2040 5012 rxffllr.exe 84 PID 2040 wrote to memory of 756 2040 7bnnbh.exe 85 PID 2040 wrote to memory of 756 2040 7bnnbh.exe 85 PID 2040 wrote to memory of 756 2040 7bnnbh.exe 85 PID 756 wrote to memory of 1516 756 dvvpv.exe 86 PID 756 wrote to memory of 1516 756 dvvpv.exe 86 PID 756 wrote to memory of 1516 756 dvvpv.exe 86 PID 1516 wrote to memory of 2876 1516 rrrrrxx.exe 87 PID 1516 wrote to memory of 2876 1516 rrrrrxx.exe 87 PID 1516 wrote to memory of 2876 1516 rrrrrxx.exe 87 PID 2876 wrote to memory of 2656 2876 bntnhb.exe 88 PID 2876 wrote to memory of 2656 2876 bntnhb.exe 88 PID 2876 wrote to memory of 2656 2876 bntnhb.exe 88 PID 2656 wrote to memory of 416 2656 tthnbh.exe 89 PID 2656 wrote to memory of 416 2656 tthnbh.exe 89 PID 2656 wrote to memory of 416 2656 tthnbh.exe 89 PID 416 wrote to memory of 3952 416 djjjp.exe 90 PID 416 wrote to memory of 3952 416 djjjp.exe 90 PID 416 wrote to memory of 3952 416 djjjp.exe 90 PID 3952 wrote to memory of 4240 3952 rlrlffr.exe 91 PID 3952 wrote to memory of 4240 3952 rlrlffr.exe 91 PID 3952 wrote to memory of 4240 3952 rlrlffr.exe 91 PID 4240 wrote to memory of 1476 4240 hbtnhh.exe 92 PID 4240 wrote to memory of 1476 4240 hbtnhh.exe 92 PID 4240 wrote to memory of 1476 4240 hbtnhh.exe 92 PID 1476 wrote to memory of 3436 1476 dpppp.exe 93 PID 1476 wrote to memory of 3436 1476 dpppp.exe 93 PID 1476 wrote to memory of 3436 1476 dpppp.exe 93 PID 3436 wrote to memory of 4056 3436 lllfxxr.exe 94 PID 3436 wrote to memory of 4056 3436 lllfxxr.exe 94 PID 3436 wrote to memory of 4056 3436 lllfxxr.exe 94 PID 4056 wrote to memory of 2632 4056 hnthbn.exe 95 PID 4056 wrote to memory of 2632 4056 hnthbn.exe 95 PID 4056 wrote to memory of 2632 4056 hnthbn.exe 95 PID 2632 wrote to memory of 2996 2632 vjjdv.exe 96 PID 2632 wrote to memory of 2996 2632 vjjdv.exe 96 PID 2632 wrote to memory of 2996 2632 vjjdv.exe 96 PID 2996 wrote to memory of 2264 2996 xrrlxxx.exe 97 PID 2996 wrote to memory of 2264 2996 xrrlxxx.exe 97 PID 2996 wrote to memory of 2264 2996 xrrlxxx.exe 97 PID 2264 wrote to memory of 1944 2264 bnhttn.exe 98 PID 2264 wrote to memory of 1944 2264 bnhttn.exe 98 PID 2264 wrote to memory of 1944 2264 bnhttn.exe 98 PID 1944 wrote to memory of 856 1944 hbnhth.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe"C:\Users\Admin\AppData\Local\Temp\f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\7lrlrll.exec:\7lrlrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\1tnhnh.exec:\1tnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\jdvpj.exec:\jdvpj.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\nnhhbb.exec:\nnhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\jvjdd.exec:\jvjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\rxffllr.exec:\rxffllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7bnnbh.exec:\7bnnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\dvvpv.exec:\dvvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bntnhb.exec:\bntnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tthnbh.exec:\tthnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\djjjp.exec:\djjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\rlrlffr.exec:\rlrlffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\hbtnhh.exec:\hbtnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\dpppp.exec:\dpppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\lllfxxr.exec:\lllfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\hnthbn.exec:\hnthbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\vjjdv.exec:\vjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bnhttn.exec:\bnhttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hbnhth.exec:\hbnhth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\djpjd.exec:\djpjd.exe23⤵
- Executes dropped EXE
PID:856 -
\??\c:\jjppj.exec:\jjppj.exe24⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3frxrrl.exec:\3frxrrl.exe25⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vdpjp.exec:\vdpjp.exe26⤵
- Executes dropped EXE
PID:4728 -
\??\c:\xrxrlxx.exec:\xrxrlxx.exe27⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nttnbn.exec:\nttnbn.exe28⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jvjvv.exec:\jvjvv.exe29⤵
- Executes dropped EXE
PID:3408 -
\??\c:\lfrxrxf.exec:\lfrxrxf.exe30⤵
- Executes dropped EXE
PID:4088 -
\??\c:\3nhnhh.exec:\3nhnhh.exe31⤵
- Executes dropped EXE
PID:3796 -
\??\c:\vpvpv.exec:\vpvpv.exe32⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rfrlxfl.exec:\rfrlxfl.exe33⤵
- Executes dropped EXE
PID:5008 -
\??\c:\tntntt.exec:\tntntt.exe34⤵
- Executes dropped EXE
PID:3636 -
\??\c:\djjpj.exec:\djjpj.exe35⤵
- Executes dropped EXE
PID:3332 -
\??\c:\xlllflf.exec:\xlllflf.exe36⤵
- Executes dropped EXE
PID:4384 -
\??\c:\lflfxrl.exec:\lflfxrl.exe37⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nthbtt.exec:\nthbtt.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jddvv.exec:\jddvv.exe39⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pvdvv.exec:\pvdvv.exe40⤵
- Executes dropped EXE
PID:4416 -
\??\c:\3rfrxxx.exec:\3rfrxxx.exe41⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lfrffxl.exec:\lfrffxl.exe42⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nbhbtn.exec:\nbhbtn.exe43⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjpjd.exec:\pjpjd.exe44⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe45⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7lrxrlx.exec:\7lrxrlx.exe46⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bhhhnh.exec:\bhhhnh.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nnhbtt.exec:\nnhbtt.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\dpdvp.exec:\dpdvp.exe49⤵
- Executes dropped EXE
PID:4692 -
\??\c:\9fxrflf.exec:\9fxrflf.exe50⤵
- Executes dropped EXE
PID:4736 -
\??\c:\lllfxxf.exec:\lllfxxf.exe51⤵
- Executes dropped EXE
PID:1344 -
\??\c:\nnnnht.exec:\nnnnht.exe52⤵
- Executes dropped EXE
PID:432 -
\??\c:\9pjdv.exec:\9pjdv.exe53⤵
- Executes dropped EXE
PID:4896 -
\??\c:\vjjjj.exec:\vjjjj.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\xfllffx.exec:\xfllffx.exe55⤵
- Executes dropped EXE
PID:4944 -
\??\c:\hbbbtt.exec:\hbbbtt.exe56⤵
- Executes dropped EXE
PID:4208 -
\??\c:\bthbbb.exec:\bthbbb.exe57⤵
- Executes dropped EXE
PID:4320 -
\??\c:\9vpjd.exec:\9vpjd.exe58⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rllxxrl.exec:\rllxxrl.exe59⤵
- Executes dropped EXE
PID:460 -
\??\c:\5llxrrl.exec:\5llxrrl.exe60⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9hhhtt.exec:\9hhhtt.exe61⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ddvvp.exec:\ddvvp.exe62⤵
- Executes dropped EXE
PID:4688 -
\??\c:\5xlfxll.exec:\5xlfxll.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1xrrrrr.exec:\1xrrrrr.exe64⤵
- Executes dropped EXE
PID:412 -
\??\c:\9htbtb.exec:\9htbtb.exe65⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jjdvd.exec:\jjdvd.exe66⤵PID:2864
-
\??\c:\vpdjv.exec:\vpdjv.exe67⤵PID:5088
-
\??\c:\xffffff.exec:\xffffff.exe68⤵PID:5080
-
\??\c:\llffxff.exec:\llffxff.exe69⤵PID:5044
-
\??\c:\bbhhhn.exec:\bbhhhn.exe70⤵PID:2404
-
\??\c:\jpvpp.exec:\jpvpp.exe71⤵PID:4556
-
\??\c:\xrllfff.exec:\xrllfff.exe72⤵PID:2084
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe73⤵PID:4244
-
\??\c:\hhhbhh.exec:\hhhbhh.exe74⤵PID:900
-
\??\c:\ttnhbb.exec:\ttnhbb.exe75⤵PID:4792
-
\??\c:\jvvpd.exec:\jvvpd.exe76⤵PID:4504
-
\??\c:\frffxxx.exec:\frffxxx.exe77⤵PID:2848
-
\??\c:\lxfflll.exec:\lxfflll.exe78⤵PID:1288
-
\??\c:\5nnhbb.exec:\5nnhbb.exe79⤵PID:3712
-
\??\c:\djppv.exec:\djppv.exe80⤵PID:1020
-
\??\c:\1vjdd.exec:\1vjdd.exe81⤵PID:2588
-
\??\c:\7rxxrrl.exec:\7rxxrrl.exe82⤵PID:2184
-
\??\c:\bhnhnn.exec:\bhnhnn.exe83⤵PID:1468
-
\??\c:\nttbhn.exec:\nttbhn.exe84⤵PID:4404
-
\??\c:\vppvp.exec:\vppvp.exe85⤵PID:1252
-
\??\c:\xxfrrxr.exec:\xxfrrxr.exe86⤵PID:1364
-
\??\c:\5lxrxxx.exec:\5lxrxxx.exe87⤵PID:1972
-
\??\c:\hnbtnn.exec:\hnbtnn.exe88⤵PID:4592
-
\??\c:\ddjjd.exec:\ddjjd.exe89⤵PID:3560
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:4252
-
\??\c:\5lfxffr.exec:\5lfxffr.exe91⤵PID:988
-
\??\c:\nbbbtt.exec:\nbbbtt.exe92⤵PID:4936
-
\??\c:\tnhbtn.exec:\tnhbtn.exe93⤵PID:4932
-
\??\c:\pvppp.exec:\pvppp.exe94⤵PID:2684
-
\??\c:\rlfrfll.exec:\rlfrfll.exe95⤵PID:4608
-
\??\c:\fflflfl.exec:\fflflfl.exe96⤵PID:1452
-
\??\c:\bttnnn.exec:\bttnnn.exe97⤵PID:2480
-
\??\c:\tbhbtt.exec:\tbhbtt.exe98⤵PID:952
-
\??\c:\5pjpj.exec:\5pjpj.exe99⤵PID:2200
-
\??\c:\lxxrllf.exec:\lxxrllf.exe100⤵PID:1992
-
\??\c:\flllllf.exec:\flllllf.exe101⤵PID:232
-
\??\c:\nnhhhn.exec:\nnhhhn.exe102⤵PID:788
-
\??\c:\jjjvp.exec:\jjjvp.exe103⤵PID:4280
-
\??\c:\1ddvp.exec:\1ddvp.exe104⤵PID:4672
-
\??\c:\fxrrrfx.exec:\fxrrrfx.exe105⤵PID:1016
-
\??\c:\nnbntb.exec:\nnbntb.exe106⤵PID:2312
-
\??\c:\nhhhhh.exec:\nhhhhh.exe107⤵PID:4780
-
\??\c:\vvjvv.exec:\vvjvv.exe108⤵PID:4704
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe109⤵PID:3876
-
\??\c:\tbhnhh.exec:\tbhnhh.exe110⤵PID:4856
-
\??\c:\thnhbb.exec:\thnhbb.exe111⤵PID:3112
-
\??\c:\dvjdp.exec:\dvjdp.exe112⤵PID:1128
-
\??\c:\dvddd.exec:\dvddd.exe113⤵PID:3304
-
\??\c:\5rlfllf.exec:\5rlfllf.exe114⤵PID:2752
-
\??\c:\bttnnh.exec:\bttnnh.exe115⤵PID:3500
-
\??\c:\7hbbtt.exec:\7hbbtt.exe116⤵PID:4168
-
\??\c:\dpdjj.exec:\dpdjj.exe117⤵PID:5012
-
\??\c:\lflfxxr.exec:\lflfxxr.exe118⤵PID:4120
-
\??\c:\xflrlfx.exec:\xflrlfx.exe119⤵PID:2820
-
\??\c:\tntntt.exec:\tntntt.exe120⤵PID:3132
-
\??\c:\1bhbnn.exec:\1bhbnn.exe121⤵PID:4892
-
\??\c:\ddvpj.exec:\ddvpj.exe122⤵PID:4528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-