Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe
Resource
win7-20240708-en
General
-
Target
0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe
-
Size
59KB
-
MD5
a50d0c8b93ee5501fdab131d957baec0
-
SHA1
c0c01a3bc75dabdb82bcccdf6a9a4c0c146aad67
-
SHA256
0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305
-
SHA512
f05de455f218ab8f2a92a5d18f7b6f6af9328de916cad4ea92e0724963c6dd8558e377be21b6272e13da9c28369789b13e25d90965eb64725e813fae9d9da4d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgTdx:ymb3NkkiQ3mdBjFIg/
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/916-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3176 hnbbht.exe 3088 tnbbnn.exe 2856 5pdpj.exe 372 rrrrllr.exe 956 rfllrxx.exe 2728 nnthhb.exe 5060 hthhnn.exe 2156 jdjdp.exe 4584 frlxxxf.exe 1704 1bnhbb.exe 2744 jdjdv.exe 1904 xrrlflf.exe 1756 bhnnhn.exe 3504 3nnhbb.exe 4400 dddvp.exe 1872 lfxrlff.exe 1196 jdjjp.exe 544 rffffxx.exe 3524 xlllllf.exe 5088 ppjvp.exe 1164 xxfxxrr.exe 1584 lrxlxxl.exe 624 thhbnb.exe 1532 vdjdd.exe 4564 vpjdv.exe 3520 rrxrxxl.exe 1972 fxxxrrl.exe 5024 ntthtn.exe 4668 dddvv.exe 4172 7lrlfff.exe 2124 9nnnhh.exe 1568 5thnhh.exe 3200 vjpjp.exe 4544 5pvjp.exe 4704 3frrxxf.exe 2304 nnhbbt.exe 2612 btnttt.exe 2460 1ppvj.exe 4044 3pvjj.exe 2320 fxxlllr.exe 1152 xlrrlll.exe 4772 nnhhbh.exe 3112 ttbnhh.exe 1092 vjjdv.exe 5044 dvddj.exe 3004 fxxxxff.exe 4236 frxrlff.exe 1144 3ttnnn.exe 4332 dddvp.exe 3404 5vjpv.exe 3772 flxxfrl.exe 4456 7fxflfl.exe 3860 nhnhhh.exe 1700 bthbbb.exe 2188 hbhbnn.exe 3796 jdddp.exe 996 9ffxllf.exe 1268 7xfffff.exe 2112 rlxxxxx.exe 212 tnbbbh.exe 464 bthhbb.exe 2028 dvpjv.exe 2236 pvjjv.exe 4584 fflfxxr.exe -
resource yara_rule behavioral2/memory/916-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 916 wrote to memory of 3176 916 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 84 PID 916 wrote to memory of 3176 916 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 84 PID 916 wrote to memory of 3176 916 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 84 PID 3176 wrote to memory of 3088 3176 hnbbht.exe 85 PID 3176 wrote to memory of 3088 3176 hnbbht.exe 85 PID 3176 wrote to memory of 3088 3176 hnbbht.exe 85 PID 3088 wrote to memory of 2856 3088 tnbbnn.exe 86 PID 3088 wrote to memory of 2856 3088 tnbbnn.exe 86 PID 3088 wrote to memory of 2856 3088 tnbbnn.exe 86 PID 2856 wrote to memory of 372 2856 5pdpj.exe 87 PID 2856 wrote to memory of 372 2856 5pdpj.exe 87 PID 2856 wrote to memory of 372 2856 5pdpj.exe 87 PID 372 wrote to memory of 956 372 rrrrllr.exe 88 PID 372 wrote to memory of 956 372 rrrrllr.exe 88 PID 372 wrote to memory of 956 372 rrrrllr.exe 88 PID 956 wrote to memory of 2728 956 rfllrxx.exe 89 PID 956 wrote to memory of 2728 956 rfllrxx.exe 89 PID 956 wrote to memory of 2728 956 rfllrxx.exe 89 PID 2728 wrote to memory of 5060 2728 nnthhb.exe 90 PID 2728 wrote to memory of 5060 2728 nnthhb.exe 90 PID 2728 wrote to memory of 5060 2728 nnthhb.exe 90 PID 5060 wrote to memory of 2156 5060 hthhnn.exe 91 PID 5060 wrote to memory of 2156 5060 hthhnn.exe 91 PID 5060 wrote to memory of 2156 5060 hthhnn.exe 91 PID 2156 wrote to memory of 4584 2156 jdjdp.exe 92 PID 2156 wrote to memory of 4584 2156 jdjdp.exe 92 PID 2156 wrote to memory of 4584 2156 jdjdp.exe 92 PID 4584 wrote to memory of 1704 4584 frlxxxf.exe 93 PID 4584 wrote to memory of 1704 4584 frlxxxf.exe 93 PID 4584 wrote to memory of 1704 4584 frlxxxf.exe 93 PID 1704 wrote to memory of 2744 1704 1bnhbb.exe 94 PID 1704 wrote to memory of 2744 1704 1bnhbb.exe 94 PID 1704 wrote to memory of 2744 1704 1bnhbb.exe 94 PID 2744 wrote to memory of 1904 2744 jdjdv.exe 95 PID 2744 wrote to memory of 1904 2744 jdjdv.exe 95 PID 2744 wrote to memory of 1904 2744 jdjdv.exe 95 PID 1904 wrote to memory of 1756 1904 xrrlflf.exe 96 PID 1904 wrote to memory of 1756 1904 xrrlflf.exe 96 PID 1904 wrote to memory of 1756 1904 xrrlflf.exe 96 PID 1756 wrote to memory of 3504 1756 bhnnhn.exe 97 PID 1756 wrote to memory of 3504 1756 bhnnhn.exe 97 PID 1756 wrote to memory of 3504 1756 bhnnhn.exe 97 PID 3504 wrote to memory of 4400 3504 3nnhbb.exe 98 PID 3504 wrote to memory of 4400 3504 3nnhbb.exe 98 PID 3504 wrote to memory of 4400 3504 3nnhbb.exe 98 PID 4400 wrote to memory of 1872 4400 dddvp.exe 99 PID 4400 wrote to memory of 1872 4400 dddvp.exe 99 PID 4400 wrote to memory of 1872 4400 dddvp.exe 99 PID 1872 wrote to memory of 1196 1872 lfxrlff.exe 100 PID 1872 wrote to memory of 1196 1872 lfxrlff.exe 100 PID 1872 wrote to memory of 1196 1872 lfxrlff.exe 100 PID 1196 wrote to memory of 544 1196 jdjjp.exe 101 PID 1196 wrote to memory of 544 1196 jdjjp.exe 101 PID 1196 wrote to memory of 544 1196 jdjjp.exe 101 PID 544 wrote to memory of 3524 544 rffffxx.exe 102 PID 544 wrote to memory of 3524 544 rffffxx.exe 102 PID 544 wrote to memory of 3524 544 rffffxx.exe 102 PID 3524 wrote to memory of 5088 3524 xlllllf.exe 103 PID 3524 wrote to memory of 5088 3524 xlllllf.exe 103 PID 3524 wrote to memory of 5088 3524 xlllllf.exe 103 PID 5088 wrote to memory of 1164 5088 ppjvp.exe 104 PID 5088 wrote to memory of 1164 5088 ppjvp.exe 104 PID 5088 wrote to memory of 1164 5088 ppjvp.exe 104 PID 1164 wrote to memory of 1584 1164 xxfxxrr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe"C:\Users\Admin\AppData\Local\Temp\0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\hnbbht.exec:\hnbbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\tnbbnn.exec:\tnbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\5pdpj.exec:\5pdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rrrrllr.exec:\rrrrllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\rfllrxx.exec:\rfllrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\nnthhb.exec:\nnthhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hthhnn.exec:\hthhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\jdjdp.exec:\jdjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\frlxxxf.exec:\frlxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\1bnhbb.exec:\1bnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jdjdv.exec:\jdjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xrrlflf.exec:\xrrlflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\bhnnhn.exec:\bhnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\3nnhbb.exec:\3nnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\dddvp.exec:\dddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\lfxrlff.exec:\lfxrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\jdjjp.exec:\jdjjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\rffffxx.exec:\rffffxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\xlllllf.exec:\xlllllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\ppjvp.exec:\ppjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\lrxlxxl.exec:\lrxlxxl.exe23⤵
- Executes dropped EXE
PID:1584 -
\??\c:\thhbnb.exec:\thhbnb.exe24⤵
- Executes dropped EXE
PID:624 -
\??\c:\vdjdd.exec:\vdjdd.exe25⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vpjdv.exec:\vpjdv.exe26⤵
- Executes dropped EXE
PID:4564 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe27⤵
- Executes dropped EXE
PID:3520 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ntthtn.exec:\ntthtn.exe29⤵
- Executes dropped EXE
PID:5024 -
\??\c:\dddvv.exec:\dddvv.exe30⤵
- Executes dropped EXE
PID:4668 -
\??\c:\7lrlfff.exec:\7lrlfff.exe31⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9nnnhh.exec:\9nnnhh.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5thnhh.exec:\5thnhh.exe33⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vjpjp.exec:\vjpjp.exe34⤵
- Executes dropped EXE
PID:3200 -
\??\c:\5pvjp.exec:\5pvjp.exe35⤵
- Executes dropped EXE
PID:4544 -
\??\c:\3frrxxf.exec:\3frrxxf.exe36⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nnhbbt.exec:\nnhbbt.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btnttt.exec:\btnttt.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1ppvj.exec:\1ppvj.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3pvjj.exec:\3pvjj.exe40⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fxxlllr.exec:\fxxlllr.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xlrrlll.exec:\xlrrlll.exe42⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nnhhbh.exec:\nnhhbh.exe43⤵
- Executes dropped EXE
PID:4772 -
\??\c:\ttbnhh.exec:\ttbnhh.exe44⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vjjdv.exec:\vjjdv.exe45⤵
- Executes dropped EXE
PID:1092 -
\??\c:\dvddj.exec:\dvddj.exe46⤵
- Executes dropped EXE
PID:5044 -
\??\c:\fxxxxff.exec:\fxxxxff.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\frxrlff.exec:\frxrlff.exe48⤵
- Executes dropped EXE
PID:4236 -
\??\c:\3ttnnn.exec:\3ttnnn.exe49⤵
- Executes dropped EXE
PID:1144 -
\??\c:\dddvp.exec:\dddvp.exe50⤵
- Executes dropped EXE
PID:4332 -
\??\c:\5vjpv.exec:\5vjpv.exe51⤵
- Executes dropped EXE
PID:3404 -
\??\c:\flxxfrl.exec:\flxxfrl.exe52⤵
- Executes dropped EXE
PID:3772 -
\??\c:\7fxflfl.exec:\7fxflfl.exe53⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nhnhhh.exec:\nhnhhh.exe54⤵
- Executes dropped EXE
PID:3860 -
\??\c:\bthbbb.exec:\bthbbb.exe55⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbhbnn.exec:\hbhbnn.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdddp.exec:\jdddp.exe57⤵
- Executes dropped EXE
PID:3796 -
\??\c:\9ffxllf.exec:\9ffxllf.exe58⤵
- Executes dropped EXE
PID:996 -
\??\c:\7xfffff.exec:\7xfffff.exe59⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tnbbbh.exec:\tnbbbh.exe61⤵
- Executes dropped EXE
PID:212 -
\??\c:\bthhbb.exec:\bthhbb.exe62⤵
- Executes dropped EXE
PID:464 -
\??\c:\dvpjv.exec:\dvpjv.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pvjjv.exec:\pvjjv.exe64⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fflfxxr.exec:\fflfxxr.exe65⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bntbbb.exec:\bntbbb.exe66⤵PID:2312
-
\??\c:\nhtbnn.exec:\nhtbnn.exe67⤵PID:1400
-
\??\c:\pdjjj.exec:\pdjjj.exe68⤵PID:2864
-
\??\c:\7vdvp.exec:\7vdvp.exe69⤵PID:3884
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe70⤵PID:2200
-
\??\c:\xlxfxfx.exec:\xlxfxfx.exe71⤵PID:2204
-
\??\c:\hnbtnn.exec:\hnbtnn.exe72⤵PID:732
-
\??\c:\dpvpj.exec:\dpvpj.exe73⤵PID:2908
-
\??\c:\jdppv.exec:\jdppv.exe74⤵PID:4848
-
\??\c:\lllrlrr.exec:\lllrlrr.exe75⤵PID:4012
-
\??\c:\xlrrlff.exec:\xlrrlff.exe76⤵PID:4080
-
\??\c:\nbbbbb.exec:\nbbbbb.exe77⤵PID:544
-
\??\c:\bntnhh.exec:\bntnhh.exe78⤵PID:2284
-
\??\c:\pvppd.exec:\pvppd.exe79⤵PID:4660
-
\??\c:\7jvvp.exec:\7jvvp.exe80⤵PID:4912
-
\??\c:\ffrlxlf.exec:\ffrlxlf.exe81⤵PID:2160
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe82⤵PID:4856
-
\??\c:\nbbnhh.exec:\nbbnhh.exe83⤵PID:2132
-
\??\c:\htttnn.exec:\htttnn.exe84⤵PID:5080
-
\??\c:\dvjdv.exec:\dvjdv.exe85⤵PID:2512
-
\??\c:\jpvpd.exec:\jpvpd.exe86⤵PID:1156
-
\??\c:\rfrffxl.exec:\rfrffxl.exe87⤵PID:1304
-
\??\c:\9flllrr.exec:\9flllrr.exe88⤵PID:2168
-
\??\c:\7xfffrr.exec:\7xfffrr.exe89⤵PID:1696
-
\??\c:\tnbbbt.exec:\tnbbbt.exe90⤵PID:1148
-
\??\c:\tntnhh.exec:\tntnhh.exe91⤵PID:3012
-
\??\c:\jdddv.exec:\jdddv.exe92⤵PID:4668
-
\??\c:\5ddvv.exec:\5ddvv.exe93⤵PID:4172
-
\??\c:\1xflxxx.exec:\1xflxxx.exe94⤵PID:1560
-
\??\c:\3lffxrr.exec:\3lffxrr.exe95⤵PID:4356
-
\??\c:\ntthhn.exec:\ntthhn.exe96⤵PID:3204
-
\??\c:\jjpjd.exec:\jjpjd.exe97⤵
- System Location Discovery: System Language Discovery
PID:376 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe98⤵PID:1964
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe99⤵PID:528
-
\??\c:\thbtnh.exec:\thbtnh.exe100⤵PID:2612
-
\??\c:\nththb.exec:\nththb.exe101⤵PID:2460
-
\??\c:\jdvpd.exec:\jdvpd.exe102⤵PID:1940
-
\??\c:\pdpjv.exec:\pdpjv.exe103⤵PID:4180
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe104⤵PID:2400
-
\??\c:\xffrfxr.exec:\xffrfxr.exe105⤵PID:4772
-
\??\c:\bnhbnh.exec:\bnhbnh.exe106⤵PID:3956
-
\??\c:\nnbtbb.exec:\nnbtbb.exe107⤵PID:1792
-
\??\c:\ddvdj.exec:\ddvdj.exe108⤵PID:4536
-
\??\c:\1ddpj.exec:\1ddpj.exe109⤵PID:3004
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe110⤵PID:4336
-
\??\c:\xlfrfxf.exec:\xlfrfxf.exe111⤵PID:2536
-
\??\c:\9btnbb.exec:\9btnbb.exe112⤵PID:2700
-
\??\c:\jjpjp.exec:\jjpjp.exe113⤵PID:4604
-
\??\c:\dpdpd.exec:\dpdpd.exe114⤵PID:3748
-
\??\c:\fxrrflf.exec:\fxrrflf.exe115⤵PID:3380
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe116⤵PID:4212
-
\??\c:\tnbthh.exec:\tnbthh.exe117⤵PID:1700
-
\??\c:\tnhtbt.exec:\tnhtbt.exe118⤵PID:2856
-
\??\c:\jjpjd.exec:\jjpjd.exe119⤵PID:3796
-
\??\c:\vpvpj.exec:\vpvpj.exe120⤵PID:2640
-
\??\c:\rrlxfxl.exec:\rrlxfxl.exe121⤵PID:1268
-
\??\c:\bbbttt.exec:\bbbttt.exe122⤵PID:5060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-