Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe
Resource
win7-20240903-en
General
-
Target
5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe
-
Size
70KB
-
MD5
8548bff631248a0a2d2ffd3b76d88c50
-
SHA1
acf97f0b02aa3d935e46eccbdd9cad97fe7fa7e0
-
SHA256
5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51d
-
SHA512
71e3d29495ebc701403a354eace730ab6c477bafb027735d3cfeb8aa7eb093edd2bf6eda530a765207162d65a266b2d25d4b1d2b5babf297cbdbfb9606e0b8dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicZfU:ymb3NkkiQ3mdBjFI4V4ciX
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/3916-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3104 rlrrrll.exe 868 9tbthb.exe 4544 hnbnnb.exe 3280 vpvvp.exe 404 7tnhbt.exe 2312 bhbnbt.exe 2608 3vpjp.exe 2876 vjpdv.exe 1708 7rrlxrf.exe 5088 bbthtn.exe 3968 jpjpj.exe 552 xllfffx.exe 3592 3rrlffx.exe 3228 5tbttt.exe 4128 3vdpd.exe 440 9xrlrrl.exe 716 1xrrffr.exe 2144 tnhhbb.exe 4564 pvjdp.exe 5020 vdjdp.exe 1776 fxxlxxr.exe 4892 httnhh.exe 392 5ppjv.exe 4860 5vvvj.exe 4256 lfrfrlx.exe 2108 lfxfrlf.exe 4048 5hnnbb.exe 2000 3jdvj.exe 4164 xrrlfxx.exe 1640 5tbtbb.exe 1304 bntnhh.exe 2776 vjpjp.exe 4808 3jvpp.exe 952 9rrlxxr.exe 4056 dvpjd.exe 4836 5dpjd.exe 5080 fllfffx.exe 636 pdjdv.exe 3424 llrlfff.exe 4396 btthbb.exe 4948 fxlxrfx.exe 3604 dvdpj.exe 4992 3bhhbh.exe 1804 tttnhb.exe 516 dddvj.exe 5016 lfrllfl.exe 2040 fffflrr.exe 2752 ppjjd.exe 4556 pdpvp.exe 868 9frlffx.exe 316 xfllfxl.exe 4976 tnhbth.exe 2896 vjdvj.exe 1648 jvvpd.exe 3852 rllfffx.exe 3344 nhntnh.exe 2464 3nthbb.exe 2268 jjjdv.exe 1084 xflfrfx.exe 5076 flllffx.exe 2140 nttnhb.exe 2172 dpppp.exe 4820 pjpjd.exe 3968 pvdvj.exe -
resource yara_rule behavioral2/memory/3916-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 3104 3916 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 82 PID 3916 wrote to memory of 3104 3916 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 82 PID 3916 wrote to memory of 3104 3916 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 82 PID 3104 wrote to memory of 868 3104 rlrrrll.exe 83 PID 3104 wrote to memory of 868 3104 rlrrrll.exe 83 PID 3104 wrote to memory of 868 3104 rlrrrll.exe 83 PID 868 wrote to memory of 4544 868 9tbthb.exe 84 PID 868 wrote to memory of 4544 868 9tbthb.exe 84 PID 868 wrote to memory of 4544 868 9tbthb.exe 84 PID 4544 wrote to memory of 3280 4544 hnbnnb.exe 85 PID 4544 wrote to memory of 3280 4544 hnbnnb.exe 85 PID 4544 wrote to memory of 3280 4544 hnbnnb.exe 85 PID 3280 wrote to memory of 404 3280 vpvvp.exe 86 PID 3280 wrote to memory of 404 3280 vpvvp.exe 86 PID 3280 wrote to memory of 404 3280 vpvvp.exe 86 PID 404 wrote to memory of 2312 404 7tnhbt.exe 87 PID 404 wrote to memory of 2312 404 7tnhbt.exe 87 PID 404 wrote to memory of 2312 404 7tnhbt.exe 87 PID 2312 wrote to memory of 2608 2312 bhbnbt.exe 88 PID 2312 wrote to memory of 2608 2312 bhbnbt.exe 88 PID 2312 wrote to memory of 2608 2312 bhbnbt.exe 88 PID 2608 wrote to memory of 2876 2608 3vpjp.exe 89 PID 2608 wrote to memory of 2876 2608 3vpjp.exe 89 PID 2608 wrote to memory of 2876 2608 3vpjp.exe 89 PID 2876 wrote to memory of 1708 2876 vjpdv.exe 90 PID 2876 wrote to memory of 1708 2876 vjpdv.exe 90 PID 2876 wrote to memory of 1708 2876 vjpdv.exe 90 PID 1708 wrote to memory of 5088 1708 7rrlxrf.exe 91 PID 1708 wrote to memory of 5088 1708 7rrlxrf.exe 91 PID 1708 wrote to memory of 5088 1708 7rrlxrf.exe 91 PID 5088 wrote to memory of 3968 5088 bbthtn.exe 92 PID 5088 wrote to memory of 3968 5088 bbthtn.exe 92 PID 5088 wrote to memory of 3968 5088 bbthtn.exe 92 PID 3968 wrote to memory of 552 3968 jpjpj.exe 93 PID 3968 wrote to memory of 552 3968 jpjpj.exe 93 PID 3968 wrote to memory of 552 3968 jpjpj.exe 93 PID 552 wrote to memory of 3592 552 xllfffx.exe 94 PID 552 wrote to memory of 3592 552 xllfffx.exe 94 PID 552 wrote to memory of 3592 552 xllfffx.exe 94 PID 3592 wrote to memory of 3228 3592 3rrlffx.exe 95 PID 3592 wrote to memory of 3228 3592 3rrlffx.exe 95 PID 3592 wrote to memory of 3228 3592 3rrlffx.exe 95 PID 3228 wrote to memory of 4128 3228 5tbttt.exe 96 PID 3228 wrote to memory of 4128 3228 5tbttt.exe 96 PID 3228 wrote to memory of 4128 3228 5tbttt.exe 96 PID 4128 wrote to memory of 440 4128 3vdpd.exe 97 PID 4128 wrote to memory of 440 4128 3vdpd.exe 97 PID 4128 wrote to memory of 440 4128 3vdpd.exe 97 PID 440 wrote to memory of 716 440 9xrlrrl.exe 98 PID 440 wrote to memory of 716 440 9xrlrrl.exe 98 PID 440 wrote to memory of 716 440 9xrlrrl.exe 98 PID 716 wrote to memory of 2144 716 1xrrffr.exe 99 PID 716 wrote to memory of 2144 716 1xrrffr.exe 99 PID 716 wrote to memory of 2144 716 1xrrffr.exe 99 PID 2144 wrote to memory of 4564 2144 tnhhbb.exe 100 PID 2144 wrote to memory of 4564 2144 tnhhbb.exe 100 PID 2144 wrote to memory of 4564 2144 tnhhbb.exe 100 PID 4564 wrote to memory of 5020 4564 pvjdp.exe 101 PID 4564 wrote to memory of 5020 4564 pvjdp.exe 101 PID 4564 wrote to memory of 5020 4564 pvjdp.exe 101 PID 5020 wrote to memory of 1776 5020 vdjdp.exe 102 PID 5020 wrote to memory of 1776 5020 vdjdp.exe 102 PID 5020 wrote to memory of 1776 5020 vdjdp.exe 102 PID 1776 wrote to memory of 4892 1776 fxxlxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe"C:\Users\Admin\AppData\Local\Temp\5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\rlrrrll.exec:\rlrrrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\9tbthb.exec:\9tbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\hnbnnb.exec:\hnbnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\vpvvp.exec:\vpvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\7tnhbt.exec:\7tnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\bhbnbt.exec:\bhbnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3vpjp.exec:\3vpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vjpdv.exec:\vjpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7rrlxrf.exec:\7rrlxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\bbthtn.exec:\bbthtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\jpjpj.exec:\jpjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\xllfffx.exec:\xllfffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\3rrlffx.exec:\3rrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\5tbttt.exec:\5tbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\3vdpd.exec:\3vdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\9xrlrrl.exec:\9xrlrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\1xrrffr.exec:\1xrrffr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\tnhhbb.exec:\tnhhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\pvjdp.exec:\pvjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\vdjdp.exec:\vdjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\fxxlxxr.exec:\fxxlxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\httnhh.exec:\httnhh.exe23⤵
- Executes dropped EXE
PID:4892 -
\??\c:\5ppjv.exec:\5ppjv.exe24⤵
- Executes dropped EXE
PID:392 -
\??\c:\5vvvj.exec:\5vvvj.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lfrfrlx.exec:\lfrfrlx.exe26⤵
- Executes dropped EXE
PID:4256 -
\??\c:\lfxfrlf.exec:\lfxfrlf.exe27⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5hnnbb.exec:\5hnnbb.exe28⤵
- Executes dropped EXE
PID:4048 -
\??\c:\3jdvj.exec:\3jdvj.exe29⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe30⤵
- Executes dropped EXE
PID:4164 -
\??\c:\5tbtbb.exec:\5tbtbb.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640 -
\??\c:\bntnhh.exec:\bntnhh.exe32⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vjpjp.exec:\vjpjp.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3jvpp.exec:\3jvpp.exe34⤵
- Executes dropped EXE
PID:4808 -
\??\c:\9rrlxxr.exec:\9rrlxxr.exe35⤵
- Executes dropped EXE
PID:952 -
\??\c:\dvpjd.exec:\dvpjd.exe36⤵
- Executes dropped EXE
PID:4056 -
\??\c:\5dpjd.exec:\5dpjd.exe37⤵
- Executes dropped EXE
PID:4836 -
\??\c:\fllfffx.exec:\fllfffx.exe38⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pdjdv.exec:\pdjdv.exe39⤵
- Executes dropped EXE
PID:636 -
\??\c:\llrlfff.exec:\llrlfff.exe40⤵
- Executes dropped EXE
PID:3424 -
\??\c:\btthbb.exec:\btthbb.exe41⤵
- Executes dropped EXE
PID:4396 -
\??\c:\fxlxrfx.exec:\fxlxrfx.exe42⤵
- Executes dropped EXE
PID:4948 -
\??\c:\dvdpj.exec:\dvdpj.exe43⤵
- Executes dropped EXE
PID:3604 -
\??\c:\3bhhbh.exec:\3bhhbh.exe44⤵
- Executes dropped EXE
PID:4992 -
\??\c:\tttnhb.exec:\tttnhb.exe45⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dddvj.exec:\dddvj.exe46⤵
- Executes dropped EXE
PID:516 -
\??\c:\lfrllfl.exec:\lfrllfl.exe47⤵
- Executes dropped EXE
PID:5016 -
\??\c:\fffflrr.exec:\fffflrr.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bbbthn.exec:\bbbthn.exe49⤵PID:3268
-
\??\c:\ppjjd.exec:\ppjjd.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pdpvp.exec:\pdpvp.exe51⤵
- Executes dropped EXE
PID:4556 -
\??\c:\9frlffx.exec:\9frlffx.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\xfllfxl.exec:\xfllfxl.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\tnhbth.exec:\tnhbth.exe54⤵
- Executes dropped EXE
PID:4976 -
\??\c:\vjdvj.exec:\vjdvj.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jvvpd.exec:\jvvpd.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rllfffx.exec:\rllfffx.exe57⤵
- Executes dropped EXE
PID:3852 -
\??\c:\nhntnh.exec:\nhntnh.exe58⤵
- Executes dropped EXE
PID:3344 -
\??\c:\3nthbb.exec:\3nthbb.exe59⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jjjdv.exec:\jjjdv.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xflfrfx.exec:\xflfrfx.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\flllffx.exec:\flllffx.exe62⤵
- Executes dropped EXE
PID:5076 -
\??\c:\nttnhb.exec:\nttnhb.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dpppp.exec:\dpppp.exe64⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pjpjd.exec:\pjpjd.exe65⤵
- Executes dropped EXE
PID:4820 -
\??\c:\pvdvj.exec:\pvdvj.exe66⤵
- Executes dropped EXE
PID:3968 -
\??\c:\lfrrllx.exec:\lfrrllx.exe67⤵PID:3192
-
\??\c:\frffxxx.exec:\frffxxx.exe68⤵PID:1092
-
\??\c:\bttnhh.exec:\bttnhh.exe69⤵PID:3592
-
\??\c:\jvpjj.exec:\jvpjj.exe70⤵PID:5104
-
\??\c:\jdjdv.exec:\jdjdv.exe71⤵PID:4532
-
\??\c:\xllfrrl.exec:\xllfrrl.exe72⤵PID:3468
-
\??\c:\nhnntt.exec:\nhnntt.exe73⤵PID:4140
-
\??\c:\dpvjp.exec:\dpvjp.exe74⤵PID:2228
-
\??\c:\5jdvp.exec:\5jdvp.exe75⤵PID:764
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe76⤵PID:2320
-
\??\c:\nbnhbb.exec:\nbnhbb.exe77⤵PID:1740
-
\??\c:\1dvjd.exec:\1dvjd.exe78⤵PID:4392
-
\??\c:\5frlrrf.exec:\5frlrrf.exe79⤵PID:4940
-
\??\c:\5llfxrl.exec:\5llfxrl.exe80⤵PID:4636
-
\??\c:\bhnthh.exec:\bhnthh.exe81⤵PID:1552
-
\??\c:\hbbhtt.exec:\hbbhtt.exe82⤵PID:392
-
\??\c:\7pjdp.exec:\7pjdp.exe83⤵PID:4060
-
\??\c:\jvvpd.exec:\jvvpd.exe84⤵PID:4256
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe85⤵PID:4680
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe86⤵PID:1824
-
\??\c:\7tthbt.exec:\7tthbt.exe87⤵PID:2056
-
\??\c:\ddjdd.exec:\ddjdd.exe88⤵PID:4032
-
\??\c:\jjppd.exec:\jjppd.exe89⤵PID:2684
-
\??\c:\rxrrfff.exec:\rxrrfff.exe90⤵PID:3652
-
\??\c:\xffxrll.exec:\xffxrll.exe91⤵PID:4792
-
\??\c:\thnbhb.exec:\thnbhb.exe92⤵PID:4188
-
\??\c:\ddpjj.exec:\ddpjj.exe93⤵PID:4084
-
\??\c:\dvvpd.exec:\dvvpd.exe94⤵PID:5092
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe95⤵
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\xxrrxxx.exec:\xxrrxxx.exe96⤵PID:4972
-
\??\c:\hhbtbt.exec:\hhbtbt.exe97⤵PID:1688
-
\??\c:\vvjvv.exec:\vvjvv.exe98⤵PID:2200
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe99⤵PID:4160
-
\??\c:\lfffxfx.exec:\lfffxfx.exe100⤵PID:636
-
\??\c:\bhhhbn.exec:\bhhhbn.exe101⤵PID:1456
-
\??\c:\hnnhtn.exec:\hnnhtn.exe102⤵PID:4396
-
\??\c:\vddvj.exec:\vddvj.exe103⤵PID:4148
-
\??\c:\ddvjv.exec:\ddvjv.exe104⤵PID:1644
-
\??\c:\xrllrrr.exec:\xrllrrr.exe105⤵PID:3056
-
\??\c:\3nnnnn.exec:\3nnnnn.exe106⤵PID:3532
-
\??\c:\nbbnbb.exec:\nbbnbb.exe107⤵PID:1920
-
\??\c:\pjdvp.exec:\pjdvp.exe108⤵PID:4512
-
\??\c:\pddvj.exec:\pddvj.exe109⤵PID:5108
-
\??\c:\fllxlfr.exec:\fllxlfr.exe110⤵PID:2476
-
\??\c:\rffxrrl.exec:\rffxrrl.exe111⤵PID:3104
-
\??\c:\hbbhbb.exec:\hbbhbb.exe112⤵PID:4416
-
\??\c:\jppdp.exec:\jppdp.exe113⤵PID:3540
-
\??\c:\lxrrfxr.exec:\lxrrfxr.exe114⤵PID:4876
-
\??\c:\1llxrlx.exec:\1llxrlx.exe115⤵PID:4000
-
\??\c:\tbhhbb.exec:\tbhhbb.exe116⤵PID:2544
-
\??\c:\btbbbb.exec:\btbbbb.exe117⤵PID:2808
-
\??\c:\jvdvp.exec:\jvdvp.exe118⤵PID:2288
-
\??\c:\pdddv.exec:\pdddv.exe119⤵PID:4584
-
\??\c:\frfrrrx.exec:\frfrrrx.exe120⤵PID:1888
-
\??\c:\jpppj.exec:\jpppj.exe121⤵PID:2460
-
\??\c:\djjjd.exec:\djjjd.exe122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-