Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe
Resource
win7-20240903-en
General
-
Target
7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe
-
Size
50KB
-
MD5
d0055aaf2813796f4836cff3779a8fd7
-
SHA1
f118ac31aa6ebcc137f57579d4cca3535cef30d8
-
SHA256
7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659
-
SHA512
d3751189d8fb83831aaaa57604480031c540c1de25343d95d93dd58da5d28148f775960c3b0fbab3f62579b28c84127e61b47da97cf453fe0d7442cbaf1586d8
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvXB:0cdpeeBSHHMHLf9RyIKB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3264-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-511-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-518-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-554-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-619-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-638-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-840-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-1084-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-1336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-1550-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3976 7lxrfxr.exe 1408 bhhbtt.exe 1536 dddpd.exe 2892 3rfrflr.exe 3752 nbbtnn.exe 3708 pjvpp.exe 2388 fxxlfxl.exe 4260 tbthhb.exe 2528 djddv.exe 548 xrrrrlr.exe 2636 lxxlrff.exe 4868 3nnhbb.exe 3220 vvvpj.exe 3692 5rxrxxl.exe 4776 ttnhnh.exe 2188 bhhbnh.exe 1184 vdvpd.exe 4472 dvdjj.exe 2992 3hbnbh.exe 1696 3thtnn.exe 228 jvddv.exe 1680 7rxrllf.exe 2080 nnhnbn.exe 4148 thnhnh.exe 3988 ppdvj.exe 3040 rrllfxx.exe 4368 lfxlrlr.exe 2236 nbnbnh.exe 3560 dddvd.exe 4568 3lrrfxf.exe 4052 9rxrxrx.exe 4456 5nbttb.exe 2364 jpdvv.exe 4916 rfrlffx.exe 2544 3lrxxxx.exe 4480 pjjjd.exe 4420 xlxrrrl.exe 3196 httnnt.exe 4848 1jddv.exe 4372 flrfxrl.exe 1600 tnbntt.exe 1380 pppdv.exe 4768 pjppd.exe 1920 lxrfllf.exe 1116 1ntntt.exe 4304 hhbttt.exe 2100 9jjvp.exe 2260 5djdp.exe 3012 7fffxll.exe 4676 thhnhb.exe 4004 vpvpd.exe 4104 xfrfxrr.exe 3120 xxfflfl.exe 2864 ntbhhh.exe 3036 bbtnbt.exe 2636 ppppd.exe 408 ppvdp.exe 2392 fxrfxrl.exe 4976 3bhhnt.exe 3184 btnhnt.exe 2760 jjdvv.exe 3596 flxllrf.exe 4932 fxffxff.exe 1184 hntnbn.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 3976 3264 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 83 PID 3264 wrote to memory of 3976 3264 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 83 PID 3264 wrote to memory of 3976 3264 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 83 PID 3976 wrote to memory of 1408 3976 7lxrfxr.exe 84 PID 3976 wrote to memory of 1408 3976 7lxrfxr.exe 84 PID 3976 wrote to memory of 1408 3976 7lxrfxr.exe 84 PID 1408 wrote to memory of 1536 1408 bhhbtt.exe 85 PID 1408 wrote to memory of 1536 1408 bhhbtt.exe 85 PID 1408 wrote to memory of 1536 1408 bhhbtt.exe 85 PID 1536 wrote to memory of 2892 1536 dddpd.exe 86 PID 1536 wrote to memory of 2892 1536 dddpd.exe 86 PID 1536 wrote to memory of 2892 1536 dddpd.exe 86 PID 2892 wrote to memory of 3752 2892 3rfrflr.exe 88 PID 2892 wrote to memory of 3752 2892 3rfrflr.exe 88 PID 2892 wrote to memory of 3752 2892 3rfrflr.exe 88 PID 3752 wrote to memory of 3708 3752 nbbtnn.exe 89 PID 3752 wrote to memory of 3708 3752 nbbtnn.exe 89 PID 3752 wrote to memory of 3708 3752 nbbtnn.exe 89 PID 3708 wrote to memory of 2388 3708 pjvpp.exe 90 PID 3708 wrote to memory of 2388 3708 pjvpp.exe 90 PID 3708 wrote to memory of 2388 3708 pjvpp.exe 90 PID 2388 wrote to memory of 4260 2388 fxxlfxl.exe 91 PID 2388 wrote to memory of 4260 2388 fxxlfxl.exe 91 PID 2388 wrote to memory of 4260 2388 fxxlfxl.exe 91 PID 4260 wrote to memory of 2528 4260 tbthhb.exe 92 PID 4260 wrote to memory of 2528 4260 tbthhb.exe 92 PID 4260 wrote to memory of 2528 4260 tbthhb.exe 92 PID 2528 wrote to memory of 548 2528 djddv.exe 93 PID 2528 wrote to memory of 548 2528 djddv.exe 93 PID 2528 wrote to memory of 548 2528 djddv.exe 93 PID 548 wrote to memory of 2636 548 xrrrrlr.exe 94 PID 548 wrote to memory of 2636 548 xrrrrlr.exe 94 PID 548 wrote to memory of 2636 548 xrrrrlr.exe 94 PID 2636 wrote to memory of 4868 2636 lxxlrff.exe 95 PID 2636 wrote to memory of 4868 2636 lxxlrff.exe 95 PID 2636 wrote to memory of 4868 2636 lxxlrff.exe 95 PID 4868 wrote to memory of 3220 4868 3nnhbb.exe 96 PID 4868 wrote to memory of 3220 4868 3nnhbb.exe 96 PID 4868 wrote to memory of 3220 4868 3nnhbb.exe 96 PID 3220 wrote to memory of 3692 3220 vvvpj.exe 97 PID 3220 wrote to memory of 3692 3220 vvvpj.exe 97 PID 3220 wrote to memory of 3692 3220 vvvpj.exe 97 PID 3692 wrote to memory of 4776 3692 5rxrxxl.exe 98 PID 3692 wrote to memory of 4776 3692 5rxrxxl.exe 98 PID 3692 wrote to memory of 4776 3692 5rxrxxl.exe 98 PID 4776 wrote to memory of 2188 4776 ttnhnh.exe 100 PID 4776 wrote to memory of 2188 4776 ttnhnh.exe 100 PID 4776 wrote to memory of 2188 4776 ttnhnh.exe 100 PID 2188 wrote to memory of 1184 2188 bhhbnh.exe 101 PID 2188 wrote to memory of 1184 2188 bhhbnh.exe 101 PID 2188 wrote to memory of 1184 2188 bhhbnh.exe 101 PID 1184 wrote to memory of 4472 1184 vdvpd.exe 102 PID 1184 wrote to memory of 4472 1184 vdvpd.exe 102 PID 1184 wrote to memory of 4472 1184 vdvpd.exe 102 PID 4472 wrote to memory of 2992 4472 dvdjj.exe 103 PID 4472 wrote to memory of 2992 4472 dvdjj.exe 103 PID 4472 wrote to memory of 2992 4472 dvdjj.exe 103 PID 2992 wrote to memory of 1696 2992 3hbnbh.exe 104 PID 2992 wrote to memory of 1696 2992 3hbnbh.exe 104 PID 2992 wrote to memory of 1696 2992 3hbnbh.exe 104 PID 1696 wrote to memory of 228 1696 3thtnn.exe 105 PID 1696 wrote to memory of 228 1696 3thtnn.exe 105 PID 1696 wrote to memory of 228 1696 3thtnn.exe 105 PID 228 wrote to memory of 1680 228 jvddv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe"C:\Users\Admin\AppData\Local\Temp\7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\7lxrfxr.exec:\7lxrfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\bhhbtt.exec:\bhhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\dddpd.exec:\dddpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\3rfrflr.exec:\3rfrflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nbbtnn.exec:\nbbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\pjvpp.exec:\pjvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\fxxlfxl.exec:\fxxlfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\tbthhb.exec:\tbthhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\djddv.exec:\djddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xrrrrlr.exec:\xrrrrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\lxxlrff.exec:\lxxlrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3nnhbb.exec:\3nnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\vvvpj.exec:\vvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\5rxrxxl.exec:\5rxrxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\ttnhnh.exec:\ttnhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\bhhbnh.exec:\bhhbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\vdvpd.exec:\vdvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\dvdjj.exec:\dvdjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\3hbnbh.exec:\3hbnbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3thtnn.exec:\3thtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jvddv.exec:\jvddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\7rxrllf.exec:\7rxrllf.exe23⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nnhnbn.exec:\nnhnbn.exe24⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thnhnh.exec:\thnhnh.exe25⤵
- Executes dropped EXE
PID:4148 -
\??\c:\ppdvj.exec:\ppdvj.exe26⤵
- Executes dropped EXE
PID:3988 -
\??\c:\rrllfxx.exec:\rrllfxx.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lfxlrlr.exec:\lfxlrlr.exe28⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nbnbnh.exec:\nbnbnh.exe29⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dddvd.exec:\dddvd.exe30⤵
- Executes dropped EXE
PID:3560 -
\??\c:\3lrrfxf.exec:\3lrrfxf.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\9rxrxrx.exec:\9rxrxrx.exe32⤵
- Executes dropped EXE
PID:4052 -
\??\c:\5nbttb.exec:\5nbttb.exe33⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jpdvv.exec:\jpdvv.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rfrlffx.exec:\rfrlffx.exe35⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3lrxxxx.exec:\3lrxxxx.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjjjd.exec:\pjjjd.exe37⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe38⤵
- Executes dropped EXE
PID:4420 -
\??\c:\httnnt.exec:\httnnt.exe39⤵
- Executes dropped EXE
PID:3196 -
\??\c:\1jddv.exec:\1jddv.exe40⤵
- Executes dropped EXE
PID:4848 -
\??\c:\flrfxrl.exec:\flrfxrl.exe41⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tnbntt.exec:\tnbntt.exe42⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pppdv.exec:\pppdv.exe43⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pjppd.exec:\pjppd.exe44⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lxrfllf.exec:\lxrfllf.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1ntntt.exec:\1ntntt.exe46⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hhbttt.exec:\hhbttt.exe47⤵
- Executes dropped EXE
PID:4304 -
\??\c:\9jjvp.exec:\9jjvp.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5djdp.exec:\5djdp.exe49⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7fffxll.exec:\7fffxll.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\thhnhb.exec:\thhnhb.exe51⤵
- Executes dropped EXE
PID:4676 -
\??\c:\vpvpd.exec:\vpvpd.exe52⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xfrfxrr.exec:\xfrfxrr.exe53⤵
- Executes dropped EXE
PID:4104 -
\??\c:\xxfflfl.exec:\xxfflfl.exe54⤵
- Executes dropped EXE
PID:3120 -
\??\c:\ntbhhh.exec:\ntbhhh.exe55⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbtnbt.exec:\bbtnbt.exe56⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppppd.exec:\ppppd.exe57⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ppvdp.exec:\ppvdp.exe58⤵
- Executes dropped EXE
PID:408 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe59⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3bhhnt.exec:\3bhhnt.exe60⤵
- Executes dropped EXE
PID:4976 -
\??\c:\btnhnt.exec:\btnhnt.exe61⤵
- Executes dropped EXE
PID:3184 -
\??\c:\jjdvv.exec:\jjdvv.exe62⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flxllrf.exec:\flxllrf.exe63⤵
- Executes dropped EXE
PID:3596 -
\??\c:\fxffxff.exec:\fxffxff.exe64⤵
- Executes dropped EXE
PID:4932 -
\??\c:\hntnbn.exec:\hntnbn.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\5lxrffx.exec:\5lxrffx.exe66⤵PID:2052
-
\??\c:\rllflff.exec:\rllflff.exe67⤵PID:2000
-
\??\c:\tttbbb.exec:\tttbbb.exe68⤵PID:1520
-
\??\c:\pppdd.exec:\pppdd.exe69⤵PID:4024
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:5048
-
\??\c:\xfflllx.exec:\xfflllx.exe71⤵PID:3520
-
\??\c:\9bbtnb.exec:\9bbtnb.exe72⤵PID:3764
-
\??\c:\nthhhh.exec:\nthhhh.exe73⤵PID:1884
-
\??\c:\jddvv.exec:\jddvv.exe74⤵PID:1796
-
\??\c:\1ddvp.exec:\1ddvp.exe75⤵PID:1012
-
\??\c:\fllrxff.exec:\fllrxff.exe76⤵PID:3312
-
\??\c:\bbtttt.exec:\bbtttt.exe77⤵PID:4772
-
\??\c:\1hhbbh.exec:\1hhbbh.exe78⤵PID:768
-
\??\c:\vvvpj.exec:\vvvpj.exe79⤵PID:4964
-
\??\c:\jjjdv.exec:\jjjdv.exe80⤵PID:3584
-
\??\c:\rrxrrll.exec:\rrxrrll.exe81⤵PID:3724
-
\??\c:\bntnhb.exec:\bntnhb.exe82⤵PID:3888
-
\??\c:\pvddp.exec:\pvddp.exe83⤵PID:4860
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe84⤵PID:3928
-
\??\c:\bnbbnn.exec:\bnbbnn.exe85⤵PID:4404
-
\??\c:\ttbttt.exec:\ttbttt.exe86⤵PID:4764
-
\??\c:\jdddp.exec:\jdddp.exe87⤵PID:2956
-
\??\c:\1flfflf.exec:\1flfflf.exe88⤵PID:1980
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe89⤵PID:2856
-
\??\c:\nhbnhh.exec:\nhbnhh.exe90⤵PID:1932
-
\??\c:\tnttnn.exec:\tnttnn.exe91⤵PID:980
-
\??\c:\jvjdp.exec:\jvjdp.exe92⤵PID:2776
-
\??\c:\lxrflfl.exec:\lxrflfl.exe93⤵PID:4580
-
\??\c:\lffxrlf.exec:\lffxrlf.exe94⤵PID:4380
-
\??\c:\1hhbnn.exec:\1hhbnn.exe95⤵PID:4168
-
\??\c:\ntbbtt.exec:\ntbbtt.exe96⤵PID:1344
-
\??\c:\dvvvd.exec:\dvvvd.exe97⤵PID:1408
-
\??\c:\vdvvd.exec:\vdvvd.exe98⤵PID:4316
-
\??\c:\frrlllf.exec:\frrlllf.exe99⤵PID:2276
-
\??\c:\thnnhb.exec:\thnnhb.exe100⤵PID:4744
-
\??\c:\pdjdv.exec:\pdjdv.exe101⤵PID:4440
-
\??\c:\dvjpd.exec:\dvjpd.exe102⤵PID:1984
-
\??\c:\1xrrfll.exec:\1xrrfll.exe103⤵PID:5060
-
\??\c:\rrfrrlr.exec:\rrfrrlr.exe104⤵PID:804
-
\??\c:\nhnhbt.exec:\nhnhbt.exe105⤵PID:1776
-
\??\c:\nbbbbt.exec:\nbbbbt.exe106⤵PID:4832
-
\??\c:\9jpjj.exec:\9jpjj.exe107⤵PID:2528
-
\??\c:\pppjd.exec:\pppjd.exe108⤵PID:2872
-
\??\c:\xllfrff.exec:\xllfrff.exe109⤵
- System Location Discovery: System Language Discovery
PID:3672 -
\??\c:\llffxff.exec:\llffxff.exe110⤵PID:3036
-
\??\c:\tthntt.exec:\tthntt.exe111⤵PID:2636
-
\??\c:\bnhthb.exec:\bnhthb.exe112⤵PID:3016
-
\??\c:\pvddv.exec:\pvddv.exe113⤵PID:3980
-
\??\c:\frrxrrf.exec:\frrxrrf.exe114⤵PID:4976
-
\??\c:\tntttt.exec:\tntttt.exe115⤵PID:1944
-
\??\c:\bnnnhh.exec:\bnnnhh.exe116⤵PID:3024
-
\??\c:\djjdd.exec:\djjdd.exe117⤵PID:4544
-
\??\c:\vvdjj.exec:\vvdjj.exe118⤵PID:3484
-
\??\c:\flxrxrf.exec:\flxrxrf.exe119⤵PID:3296
-
\??\c:\nbnnhb.exec:\nbnnhb.exe120⤵PID:4584
-
\??\c:\bnnnbh.exec:\bnnnbh.exe121⤵PID:2992
-
\??\c:\pppdp.exec:\pppdp.exe122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-