Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe
Resource
win7-20240903-en
General
-
Target
b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe
-
Size
72KB
-
MD5
366778de520f3ba12fe89324217a5d77
-
SHA1
5ac6cfafe568e64b92e4a9ce734b7babcdef0030
-
SHA256
b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a
-
SHA512
6614a436a29a1a1872a218a5a99e794dc26ae017cc7a8ebfe32da17b10ce4f8cb43643ed0a619889047c4ae7f5d76ee49d0c60dbf35d2705af5584cb1dba2b40
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIdiW65OA:ymb3NkkiQ3mdBjFIFdJ8bViW6r
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3596-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4544 jdjdd.exe 216 3lllllr.exe 1880 hbhhnn.exe 1904 vvvjd.exe 4416 xrfxrrl.exe 2872 fxrlllf.exe 400 btnnhh.exe 2040 jdjdj.exe 980 xllfrrl.exe 1172 tntthn.exe 5096 5ddpj.exe 4012 3xxrrlf.exe 2828 7bbnhh.exe 4344 1vppj.exe 4172 dpdvp.exe 4780 lxxxxxx.exe 3720 9hbtnn.exe 3836 vpdvj.exe 1676 vdjdv.exe 1832 xlrlrrl.exe 2944 9bttnn.exe 1692 nhnttn.exe 4340 jvdvj.exe 3728 lllfxxr.exe 3116 rfrfxxx.exe 3980 fxffxxr.exe 3936 nbtnhh.exe 1376 dppjj.exe 1984 pjdjd.exe 5084 rrxllfl.exe 3100 thbbtt.exe 1892 nbbhtt.exe 2952 tbbhbb.exe 2848 jjpjv.exe 3636 xrxxffl.exe 4084 rfllfxx.exe 3552 btnthn.exe 2704 jddvd.exe 2888 nthtnt.exe 764 tthbtt.exe 2568 pppjj.exe 524 5vvpd.exe 1156 xfxlfrf.exe 2636 hntttt.exe 2532 dvvpp.exe 3408 llrfrrl.exe 4844 7rfxrrl.exe 3612 nhhhbt.exe 3940 1nnnbn.exe 1940 htttnt.exe 1988 1jvjd.exe 1624 rrrlfll.exe 4208 xlffxxx.exe 912 tnhbbb.exe 2280 bbnhbh.exe 64 pvvpj.exe 4204 vdjdj.exe 1740 1frllfx.exe 2828 ntnhbt.exe 4344 btnthh.exe 1504 vjddv.exe 3016 jddvv.exe 1556 pjddp.exe 2516 rxllflf.exe -
resource yara_rule behavioral2/memory/3596-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3596 wrote to memory of 4544 3596 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 85 PID 3596 wrote to memory of 4544 3596 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 85 PID 3596 wrote to memory of 4544 3596 b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe 85 PID 4544 wrote to memory of 216 4544 jdjdd.exe 86 PID 4544 wrote to memory of 216 4544 jdjdd.exe 86 PID 4544 wrote to memory of 216 4544 jdjdd.exe 86 PID 216 wrote to memory of 1880 216 3lllllr.exe 87 PID 216 wrote to memory of 1880 216 3lllllr.exe 87 PID 216 wrote to memory of 1880 216 3lllllr.exe 87 PID 1880 wrote to memory of 1904 1880 hbhhnn.exe 89 PID 1880 wrote to memory of 1904 1880 hbhhnn.exe 89 PID 1880 wrote to memory of 1904 1880 hbhhnn.exe 89 PID 1904 wrote to memory of 4416 1904 vvvjd.exe 90 PID 1904 wrote to memory of 4416 1904 vvvjd.exe 90 PID 1904 wrote to memory of 4416 1904 vvvjd.exe 90 PID 4416 wrote to memory of 2872 4416 xrfxrrl.exe 91 PID 4416 wrote to memory of 2872 4416 xrfxrrl.exe 91 PID 4416 wrote to memory of 2872 4416 xrfxrrl.exe 91 PID 2872 wrote to memory of 400 2872 fxrlllf.exe 92 PID 2872 wrote to memory of 400 2872 fxrlllf.exe 92 PID 2872 wrote to memory of 400 2872 fxrlllf.exe 92 PID 400 wrote to memory of 2040 400 btnnhh.exe 93 PID 400 wrote to memory of 2040 400 btnnhh.exe 93 PID 400 wrote to memory of 2040 400 btnnhh.exe 93 PID 2040 wrote to memory of 980 2040 jdjdj.exe 94 PID 2040 wrote to memory of 980 2040 jdjdj.exe 94 PID 2040 wrote to memory of 980 2040 jdjdj.exe 94 PID 980 wrote to memory of 1172 980 xllfrrl.exe 96 PID 980 wrote to memory of 1172 980 xllfrrl.exe 96 PID 980 wrote to memory of 1172 980 xllfrrl.exe 96 PID 1172 wrote to memory of 5096 1172 tntthn.exe 97 PID 1172 wrote to memory of 5096 1172 tntthn.exe 97 PID 1172 wrote to memory of 5096 1172 tntthn.exe 97 PID 5096 wrote to memory of 4012 5096 5ddpj.exe 98 PID 5096 wrote to memory of 4012 5096 5ddpj.exe 98 PID 5096 wrote to memory of 4012 5096 5ddpj.exe 98 PID 4012 wrote to memory of 2828 4012 3xxrrlf.exe 99 PID 4012 wrote to memory of 2828 4012 3xxrrlf.exe 99 PID 4012 wrote to memory of 2828 4012 3xxrrlf.exe 99 PID 2828 wrote to memory of 4344 2828 7bbnhh.exe 100 PID 2828 wrote to memory of 4344 2828 7bbnhh.exe 100 PID 2828 wrote to memory of 4344 2828 7bbnhh.exe 100 PID 4344 wrote to memory of 4172 4344 1vppj.exe 101 PID 4344 wrote to memory of 4172 4344 1vppj.exe 101 PID 4344 wrote to memory of 4172 4344 1vppj.exe 101 PID 4172 wrote to memory of 4780 4172 dpdvp.exe 102 PID 4172 wrote to memory of 4780 4172 dpdvp.exe 102 PID 4172 wrote to memory of 4780 4172 dpdvp.exe 102 PID 4780 wrote to memory of 3720 4780 lxxxxxx.exe 103 PID 4780 wrote to memory of 3720 4780 lxxxxxx.exe 103 PID 4780 wrote to memory of 3720 4780 lxxxxxx.exe 103 PID 3720 wrote to memory of 3836 3720 9hbtnn.exe 105 PID 3720 wrote to memory of 3836 3720 9hbtnn.exe 105 PID 3720 wrote to memory of 3836 3720 9hbtnn.exe 105 PID 3836 wrote to memory of 1676 3836 vpdvj.exe 106 PID 3836 wrote to memory of 1676 3836 vpdvj.exe 106 PID 3836 wrote to memory of 1676 3836 vpdvj.exe 106 PID 1676 wrote to memory of 1832 1676 vdjdv.exe 107 PID 1676 wrote to memory of 1832 1676 vdjdv.exe 107 PID 1676 wrote to memory of 1832 1676 vdjdv.exe 107 PID 1832 wrote to memory of 2944 1832 xlrlrrl.exe 108 PID 1832 wrote to memory of 2944 1832 xlrlrrl.exe 108 PID 1832 wrote to memory of 2944 1832 xlrlrrl.exe 108 PID 2944 wrote to memory of 1692 2944 9bttnn.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe"C:\Users\Admin\AppData\Local\Temp\b52e80380e15b9aab7cfc06c38aafb76850e775ea25c15d5be2e49e0f95b5c9a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\jdjdd.exec:\jdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\3lllllr.exec:\3lllllr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\hbhhnn.exec:\hbhhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vvvjd.exec:\vvvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\fxrlllf.exec:\fxrlllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\btnnhh.exec:\btnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\jdjdj.exec:\jdjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xllfrrl.exec:\xllfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\tntthn.exec:\tntthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\5ddpj.exec:\5ddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3xxrrlf.exec:\3xxrrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\7bbnhh.exec:\7bbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1vppj.exec:\1vppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\dpdvp.exec:\dpdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\9hbtnn.exec:\9hbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\vpdvj.exec:\vpdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\vdjdv.exec:\vdjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\xlrlrrl.exec:\xlrlrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\9bttnn.exec:\9bttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\nhnttn.exec:\nhnttn.exe23⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jvdvj.exec:\jvdvj.exe24⤵
- Executes dropped EXE
PID:4340 -
\??\c:\lllfxxr.exec:\lllfxxr.exe25⤵
- Executes dropped EXE
PID:3728 -
\??\c:\rfrfxxx.exec:\rfrfxxx.exe26⤵
- Executes dropped EXE
PID:3116 -
\??\c:\fxffxxr.exec:\fxffxxr.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nbtnhh.exec:\nbtnhh.exe28⤵
- Executes dropped EXE
PID:3936 -
\??\c:\dppjj.exec:\dppjj.exe29⤵
- Executes dropped EXE
PID:1376 -
\??\c:\pjdjd.exec:\pjdjd.exe30⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rrxllfl.exec:\rrxllfl.exe31⤵
- Executes dropped EXE
PID:5084 -
\??\c:\thbbtt.exec:\thbbtt.exe32⤵
- Executes dropped EXE
PID:3100 -
\??\c:\nbbhtt.exec:\nbbhtt.exe33⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tbbhbb.exec:\tbbhbb.exe34⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jjpjv.exec:\jjpjv.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrxxffl.exec:\xrxxffl.exe36⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rfllfxx.exec:\rfllfxx.exe37⤵
- Executes dropped EXE
PID:4084 -
\??\c:\btnthn.exec:\btnthn.exe38⤵
- Executes dropped EXE
PID:3552 -
\??\c:\jddvd.exec:\jddvd.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nthtnt.exec:\nthtnt.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tthbtt.exec:\tthbtt.exe41⤵
- Executes dropped EXE
PID:764 -
\??\c:\pppjj.exec:\pppjj.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5vvpd.exec:\5vvpd.exe43⤵
- Executes dropped EXE
PID:524 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe44⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hntttt.exec:\hntttt.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dvvpp.exec:\dvvpp.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\llrfrrl.exec:\llrfrrl.exe47⤵
- Executes dropped EXE
PID:3408 -
\??\c:\7rfxrrl.exec:\7rfxrrl.exe48⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nhhhbt.exec:\nhhhbt.exe49⤵
- Executes dropped EXE
PID:3612 -
\??\c:\1nnnbn.exec:\1nnnbn.exe50⤵
- Executes dropped EXE
PID:3940 -
\??\c:\htttnt.exec:\htttnt.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1jvjd.exec:\1jvjd.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rrrlfll.exec:\rrrlfll.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlffxxx.exec:\xlffxxx.exe54⤵
- Executes dropped EXE
PID:4208 -
\??\c:\tnhbbb.exec:\tnhbbb.exe55⤵
- Executes dropped EXE
PID:912 -
\??\c:\bbnhbh.exec:\bbnhbh.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pvvpj.exec:\pvvpj.exe57⤵
- Executes dropped EXE
PID:64 -
\??\c:\vdjdj.exec:\vdjdj.exe58⤵
- Executes dropped EXE
PID:4204 -
\??\c:\1frllfx.exec:\1frllfx.exe59⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ntnhbt.exec:\ntnhbt.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\btnthh.exec:\btnthh.exe61⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vjddv.exec:\vjddv.exe62⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jddvv.exec:\jddvv.exe63⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pjddp.exec:\pjddp.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rxllflf.exec:\rxllflf.exe65⤵
- Executes dropped EXE
PID:2516 -
\??\c:\btbbhh.exec:\btbbhh.exe66⤵PID:4600
-
\??\c:\bnhbnb.exec:\bnhbnb.exe67⤵PID:832
-
\??\c:\pvdvj.exec:\pvdvj.exe68⤵PID:2464
-
\??\c:\dddpv.exec:\dddpv.exe69⤵PID:1944
-
\??\c:\5flfrrr.exec:\5flfrrr.exe70⤵PID:864
-
\??\c:\xxffrrx.exec:\xxffrrx.exe71⤵PID:3040
-
\??\c:\hhtnhh.exec:\hhtnhh.exe72⤵PID:2776
-
\??\c:\nhhbtt.exec:\nhhbtt.exe73⤵PID:4340
-
\??\c:\pvvvj.exec:\pvvvj.exe74⤵PID:3204
-
\??\c:\dppjv.exec:\dppjv.exe75⤵PID:3528
-
\??\c:\rffrlrr.exec:\rffrlrr.exe76⤵PID:3216
-
\??\c:\rfffxxx.exec:\rfffxxx.exe77⤵PID:3980
-
\??\c:\5hbbtt.exec:\5hbbtt.exe78⤵PID:4432
-
\??\c:\ntnhtt.exec:\ntnhtt.exe79⤵PID:3640
-
\??\c:\vjjjv.exec:\vjjjv.exe80⤵PID:1416
-
\??\c:\rlfxlxr.exec:\rlfxlxr.exe81⤵PID:2948
-
\??\c:\rllffff.exec:\rllffff.exe82⤵PID:4900
-
\??\c:\nthtbt.exec:\nthtbt.exe83⤵PID:3100
-
\??\c:\thnbtt.exec:\thnbtt.exe84⤵PID:1892
-
\??\c:\frfxxll.exec:\frfxxll.exe85⤵PID:3412
-
\??\c:\3xxrxfl.exec:\3xxrxfl.exe86⤵PID:3868
-
\??\c:\nnhthb.exec:\nnhthb.exe87⤵PID:1260
-
\??\c:\nbthbt.exec:\nbthbt.exe88⤵PID:4084
-
\??\c:\dpdvv.exec:\dpdvv.exe89⤵PID:3944
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe90⤵PID:4120
-
\??\c:\xrlflfl.exec:\xrlflfl.exe91⤵PID:3356
-
\??\c:\xllffff.exec:\xllffff.exe92⤵PID:1604
-
\??\c:\nbbnbt.exec:\nbbnbt.exe93⤵PID:2804
-
\??\c:\9pvpp.exec:\9pvpp.exe94⤵PID:452
-
\??\c:\pddpj.exec:\pddpj.exe95⤵PID:2392
-
\??\c:\lxxxllf.exec:\lxxxllf.exe96⤵PID:828
-
\??\c:\fxxrxll.exec:\fxxrxll.exe97⤵PID:3212
-
\??\c:\bbhthb.exec:\bbhthb.exe98⤵PID:3196
-
\??\c:\jpjvj.exec:\jpjvj.exe99⤵PID:944
-
\??\c:\pjpvj.exec:\pjpvj.exe100⤵PID:3928
-
\??\c:\rffrfxl.exec:\rffrfxl.exe101⤵PID:4692
-
\??\c:\7llfxrf.exec:\7llfxrf.exe102⤵PID:4612
-
\??\c:\rlrrllf.exec:\rlrrllf.exe103⤵PID:3024
-
\??\c:\9bthbh.exec:\9bthbh.exe104⤵PID:4236
-
\??\c:\nhtnhb.exec:\nhtnhb.exe105⤵PID:3512
-
\??\c:\jvpdp.exec:\jvpdp.exe106⤵PID:1548
-
\??\c:\9jvjv.exec:\9jvjv.exe107⤵PID:3556
-
\??\c:\rfffrlr.exec:\rfffrlr.exe108⤵PID:2028
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe109⤵PID:4668
-
\??\c:\bthhbt.exec:\bthhbt.exe110⤵PID:2940
-
\??\c:\bnnnbh.exec:\bnnnbh.exe111⤵PID:3432
-
\??\c:\5vpjv.exec:\5vpjv.exe112⤵PID:1568
-
\??\c:\5xlfffx.exec:\5xlfffx.exe113⤵PID:5032
-
\??\c:\9frlrlr.exec:\9frlrlr.exe114⤵PID:4172
-
\??\c:\lflffxf.exec:\lflffxf.exe115⤵PID:3664
-
\??\c:\1bbhhb.exec:\1bbhhb.exe116⤵PID:60
-
\??\c:\5thbtt.exec:\5thbtt.exe117⤵PID:3720
-
\??\c:\dppjv.exec:\dppjv.exe118⤵PID:3988
-
\??\c:\vvjjv.exec:\vvjjv.exe119⤵PID:1160
-
\??\c:\xflfxxr.exec:\xflfxxr.exe120⤵PID:4652
-
\??\c:\7fxrlrr.exec:\7fxrlrr.exe121⤵PID:4716
-
\??\c:\5rrrrrl.exec:\5rrrrrl.exe122⤵PID:3096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-