Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe
Resource
win7-20240903-en
General
-
Target
4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe
-
Size
82KB
-
MD5
a67205c38d1e1643d6857a8ded9c3d0f
-
SHA1
c19a68e2cbea3217f0b6c44a9e5ba085ab3bb44b
-
SHA256
4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d
-
SHA512
8c5eaaad694f32815a430b6d3e58a823d12e48d019beda495e1a2417f797751f492577d900db334d821ddc33c7c4339cd2121897f2f05b8eb7e1d802220625a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqa:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3248-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3248 lfflxxf.exe 3116 0620482.exe 2364 lxxrfxr.exe 2636 m4482.exe 2504 lxxlxfr.exe 264 xlrfxrf.exe 4396 bbnbbb.exe 2024 jdjvd.exe 4824 e80022.exe 2028 0008260.exe 3176 lrxrffr.exe 4836 1ppjv.exe 3728 7jjvj.exe 2960 64600.exe 1968 842802.exe 1396 262604.exe 4852 88608.exe 1804 866240.exe 3412 dpvpp.exe 1568 6400600.exe 2668 668826.exe 4400 6260848.exe 2612 6248260.exe 864 rxfxlrl.exe 4760 fflxrxl.exe 4888 66264.exe 4512 86686.exe 4196 httthn.exe 3668 lffxrlr.exe 1092 bbbnhb.exe 2488 208684.exe 1788 u226048.exe 1192 tntnnh.exe 3104 044420.exe 3504 1dvdp.exe 1356 lxxlfxr.exe 116 084242.exe 4352 462042.exe 3452 rlfrfff.exe 2936 844426.exe 1020 600084.exe 3116 hhhnnb.exe 4312 frrrfxf.exe 4892 fxfllxx.exe 4940 5bhtbb.exe 1320 bnnhtt.exe 2076 644826.exe 1040 644860.exe 4764 8220060.exe 4872 4048264.exe 2592 a8864.exe 4516 880242.exe 1732 nhthth.exe 2648 7xrrffx.exe 3176 q24222.exe 3300 2424420.exe 2556 228200.exe 2944 k28200.exe 956 08442.exe 4376 btnhbt.exe 3672 4026448.exe 2652 04268.exe 1252 606266.exe 1804 nttnnh.exe -
resource yara_rule behavioral2/memory/4540-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-8-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q68260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0026884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i448600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2626488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 806004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u886442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o222262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6248222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3248 4540 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 83 PID 4540 wrote to memory of 3248 4540 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 83 PID 4540 wrote to memory of 3248 4540 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 83 PID 3248 wrote to memory of 3116 3248 lfflxxf.exe 324 PID 3248 wrote to memory of 3116 3248 lfflxxf.exe 324 PID 3248 wrote to memory of 3116 3248 lfflxxf.exe 324 PID 3116 wrote to memory of 2364 3116 0620482.exe 85 PID 3116 wrote to memory of 2364 3116 0620482.exe 85 PID 3116 wrote to memory of 2364 3116 0620482.exe 85 PID 2364 wrote to memory of 2636 2364 lxxrfxr.exe 86 PID 2364 wrote to memory of 2636 2364 lxxrfxr.exe 86 PID 2364 wrote to memory of 2636 2364 lxxrfxr.exe 86 PID 2636 wrote to memory of 2504 2636 m4482.exe 87 PID 2636 wrote to memory of 2504 2636 m4482.exe 87 PID 2636 wrote to memory of 2504 2636 m4482.exe 87 PID 2504 wrote to memory of 264 2504 lxxlxfr.exe 88 PID 2504 wrote to memory of 264 2504 lxxlxfr.exe 88 PID 2504 wrote to memory of 264 2504 lxxlxfr.exe 88 PID 264 wrote to memory of 4396 264 xlrfxrf.exe 277 PID 264 wrote to memory of 4396 264 xlrfxrf.exe 277 PID 264 wrote to memory of 4396 264 xlrfxrf.exe 277 PID 4396 wrote to memory of 2024 4396 bbnbbb.exe 227 PID 4396 wrote to memory of 2024 4396 bbnbbb.exe 227 PID 4396 wrote to memory of 2024 4396 bbnbbb.exe 227 PID 2024 wrote to memory of 4824 2024 jdjvd.exe 91 PID 2024 wrote to memory of 4824 2024 jdjvd.exe 91 PID 2024 wrote to memory of 4824 2024 jdjvd.exe 91 PID 4824 wrote to memory of 2028 4824 e80022.exe 180 PID 4824 wrote to memory of 2028 4824 e80022.exe 180 PID 4824 wrote to memory of 2028 4824 e80022.exe 180 PID 2028 wrote to memory of 3176 2028 0008260.exe 93 PID 2028 wrote to memory of 3176 2028 0008260.exe 93 PID 2028 wrote to memory of 3176 2028 0008260.exe 93 PID 3176 wrote to memory of 4836 3176 lrxrffr.exe 337 PID 3176 wrote to memory of 4836 3176 lrxrffr.exe 337 PID 3176 wrote to memory of 4836 3176 lrxrffr.exe 337 PID 4836 wrote to memory of 3728 4836 1ppjv.exe 232 PID 4836 wrote to memory of 3728 4836 1ppjv.exe 232 PID 4836 wrote to memory of 3728 4836 1ppjv.exe 232 PID 3728 wrote to memory of 2960 3728 7jjvj.exe 96 PID 3728 wrote to memory of 2960 3728 7jjvj.exe 96 PID 3728 wrote to memory of 2960 3728 7jjvj.exe 96 PID 2960 wrote to memory of 1968 2960 64600.exe 235 PID 2960 wrote to memory of 1968 2960 64600.exe 235 PID 2960 wrote to memory of 1968 2960 64600.exe 235 PID 1968 wrote to memory of 1396 1968 842802.exe 98 PID 1968 wrote to memory of 1396 1968 842802.exe 98 PID 1968 wrote to memory of 1396 1968 842802.exe 98 PID 1396 wrote to memory of 4852 1396 262604.exe 99 PID 1396 wrote to memory of 4852 1396 262604.exe 99 PID 1396 wrote to memory of 4852 1396 262604.exe 99 PID 4852 wrote to memory of 1804 4852 88608.exe 100 PID 4852 wrote to memory of 1804 4852 88608.exe 100 PID 4852 wrote to memory of 1804 4852 88608.exe 100 PID 1804 wrote to memory of 3412 1804 866240.exe 101 PID 1804 wrote to memory of 3412 1804 866240.exe 101 PID 1804 wrote to memory of 3412 1804 866240.exe 101 PID 3412 wrote to memory of 1568 3412 dpvpp.exe 192 PID 3412 wrote to memory of 1568 3412 dpvpp.exe 192 PID 3412 wrote to memory of 1568 3412 dpvpp.exe 192 PID 1568 wrote to memory of 2668 1568 6400600.exe 349 PID 1568 wrote to memory of 2668 1568 6400600.exe 349 PID 1568 wrote to memory of 2668 1568 6400600.exe 349 PID 2668 wrote to memory of 4400 2668 668826.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe"C:\Users\Admin\AppData\Local\Temp\4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\lfflxxf.exec:\lfflxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\0620482.exec:\0620482.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\m4482.exec:\m4482.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lxxlxfr.exec:\lxxlxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\bbnbbb.exec:\bbnbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\jdjvd.exec:\jdjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\e80022.exec:\e80022.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\0008260.exec:\0008260.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\lrxrffr.exec:\lrxrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\1ppjv.exec:\1ppjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\7jjvj.exec:\7jjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\64600.exec:\64600.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\842802.exec:\842802.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\262604.exec:\262604.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\88608.exec:\88608.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\866240.exec:\866240.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dpvpp.exec:\dpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\6400600.exec:\6400600.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\668826.exec:\668826.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\6260848.exec:\6260848.exe23⤵
- Executes dropped EXE
PID:4400 -
\??\c:\6248260.exec:\6248260.exe24⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rxfxlrl.exec:\rxfxlrl.exe25⤵
- Executes dropped EXE
PID:864 -
\??\c:\fflxrxl.exec:\fflxrxl.exe26⤵
- Executes dropped EXE
PID:4760 -
\??\c:\66264.exec:\66264.exe27⤵
- Executes dropped EXE
PID:4888 -
\??\c:\86686.exec:\86686.exe28⤵
- Executes dropped EXE
PID:4512 -
\??\c:\httthn.exec:\httthn.exe29⤵
- Executes dropped EXE
PID:4196 -
\??\c:\lffxrlr.exec:\lffxrlr.exe30⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bbbnhb.exec:\bbbnhb.exe31⤵
- Executes dropped EXE
PID:1092 -
\??\c:\208684.exec:\208684.exe32⤵
- Executes dropped EXE
PID:2488 -
\??\c:\u226048.exec:\u226048.exe33⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tntnnh.exec:\tntnnh.exe34⤵
- Executes dropped EXE
PID:1192 -
\??\c:\044420.exec:\044420.exe35⤵
- Executes dropped EXE
PID:3104 -
\??\c:\1dvdp.exec:\1dvdp.exe36⤵
- Executes dropped EXE
PID:3504 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe37⤵
- Executes dropped EXE
PID:1356 -
\??\c:\084242.exec:\084242.exe38⤵
- Executes dropped EXE
PID:116 -
\??\c:\462042.exec:\462042.exe39⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rlfrfff.exec:\rlfrfff.exe40⤵
- Executes dropped EXE
PID:3452 -
\??\c:\844426.exec:\844426.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\600084.exec:\600084.exe42⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hhhnnb.exec:\hhhnnb.exe43⤵
- Executes dropped EXE
PID:3116 -
\??\c:\frrrfxf.exec:\frrrfxf.exe44⤵
- Executes dropped EXE
PID:4312 -
\??\c:\fxfllxx.exec:\fxfllxx.exe45⤵
- Executes dropped EXE
PID:4892 -
\??\c:\5bhtbb.exec:\5bhtbb.exe46⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bnnhtt.exec:\bnnhtt.exe47⤵
- Executes dropped EXE
PID:1320 -
\??\c:\644826.exec:\644826.exe48⤵
- Executes dropped EXE
PID:2076 -
\??\c:\644860.exec:\644860.exe49⤵
- Executes dropped EXE
PID:1040 -
\??\c:\8220060.exec:\8220060.exe50⤵
- Executes dropped EXE
PID:4764 -
\??\c:\4048264.exec:\4048264.exe51⤵
- Executes dropped EXE
PID:4872 -
\??\c:\a8864.exec:\a8864.exe52⤵
- Executes dropped EXE
PID:2592 -
\??\c:\880242.exec:\880242.exe53⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nhthth.exec:\nhthth.exe54⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7xrrffx.exec:\7xrrffx.exe55⤵
- Executes dropped EXE
PID:2648 -
\??\c:\q24222.exec:\q24222.exe56⤵
- Executes dropped EXE
PID:3176 -
\??\c:\2424420.exec:\2424420.exe57⤵
- Executes dropped EXE
PID:3300 -
\??\c:\228200.exec:\228200.exe58⤵
- Executes dropped EXE
PID:2556 -
\??\c:\k28200.exec:\k28200.exe59⤵
- Executes dropped EXE
PID:2944 -
\??\c:\08442.exec:\08442.exe60⤵
- Executes dropped EXE
PID:956 -
\??\c:\btnhbt.exec:\btnhbt.exe61⤵
- Executes dropped EXE
PID:4376 -
\??\c:\4026448.exec:\4026448.exe62⤵
- Executes dropped EXE
PID:3672 -
\??\c:\04268.exec:\04268.exe63⤵
- Executes dropped EXE
PID:2652 -
\??\c:\606266.exec:\606266.exe64⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nttnnh.exec:\nttnnh.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dvvjv.exec:\dvvjv.exe66⤵PID:3412
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe67⤵PID:4572
-
\??\c:\xlrlffx.exec:\xlrlffx.exe68⤵PID:4372
-
\??\c:\3bthbt.exec:\3bthbt.exe69⤵PID:3784
-
\??\c:\bhhthh.exec:\bhhthh.exe70⤵
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\g4664.exec:\g4664.exe71⤵PID:2264
-
\??\c:\46260.exec:\46260.exe72⤵PID:4124
-
\??\c:\frxrllf.exec:\frxrllf.exe73⤵PID:1352
-
\??\c:\5fllrrl.exec:\5fllrrl.exe74⤵PID:2184
-
\??\c:\84626.exec:\84626.exe75⤵PID:1820
-
\??\c:\6008228.exec:\6008228.exe76⤵PID:3292
-
\??\c:\bhhhhh.exec:\bhhhhh.exe77⤵PID:808
-
\??\c:\tbtttt.exec:\tbtttt.exe78⤵PID:2232
-
\??\c:\hthbtb.exec:\hthbtb.exe79⤵PID:4596
-
\??\c:\hhbtnn.exec:\hhbtnn.exe80⤵PID:1084
-
\??\c:\0404444.exec:\0404444.exe81⤵PID:4220
-
\??\c:\68264.exec:\68264.exe82⤵PID:1972
-
\??\c:\022222.exec:\022222.exe83⤵PID:464
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe84⤵PID:1192
-
\??\c:\406042.exec:\406042.exe85⤵PID:4948
-
\??\c:\c488444.exec:\c488444.exe86⤵PID:4256
-
\??\c:\8626860.exec:\8626860.exe87⤵PID:3504
-
\??\c:\0026884.exec:\0026884.exe88⤵
- System Location Discovery: System Language Discovery
PID:4336 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe89⤵PID:116
-
\??\c:\htbnht.exec:\htbnht.exe90⤵PID:4352
-
\??\c:\jvvvv.exec:\jvvvv.exe91⤵PID:3320
-
\??\c:\0440620.exec:\0440620.exe92⤵PID:2452
-
\??\c:\dpvjj.exec:\dpvjj.exe93⤵PID:2548
-
\??\c:\06660.exec:\06660.exe94⤵PID:4804
-
\??\c:\7xxrffr.exec:\7xxrffr.exe95⤵PID:2008
-
\??\c:\djvvp.exec:\djvvp.exe96⤵PID:4872
-
\??\c:\g4086.exec:\g4086.exe97⤵PID:2592
-
\??\c:\0004260.exec:\0004260.exe98⤵PID:912
-
\??\c:\6482626.exec:\6482626.exe99⤵PID:2028
-
\??\c:\c648248.exec:\c648248.exe100⤵PID:2188
-
\??\c:\880246.exec:\880246.exe101⤵PID:3144
-
\??\c:\xlffrrl.exec:\xlffrrl.exe102⤵PID:3300
-
\??\c:\fxrrfxr.exec:\fxrrfxr.exe103⤵PID:2196
-
\??\c:\bntnhh.exec:\bntnhh.exe104⤵PID:3256
-
\??\c:\c022662.exec:\c022662.exe105⤵PID:4144
-
\??\c:\rflrfxr.exec:\rflrfxr.exe106⤵PID:4376
-
\??\c:\bnnnhh.exec:\bnnnhh.exe107⤵PID:3672
-
\??\c:\8066666.exec:\8066666.exe108⤵PID:4444
-
\??\c:\lxxxlll.exec:\lxxxlll.exe109⤵PID:2380
-
\??\c:\8844226.exec:\8844226.exe110⤵PID:448
-
\??\c:\9jpjv.exec:\9jpjv.exe111⤵PID:1568
-
\??\c:\tbhhhb.exec:\tbhhhb.exe112⤵PID:1232
-
\??\c:\a8088.exec:\a8088.exe113⤵PID:4028
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe114⤵PID:5112
-
\??\c:\844860.exec:\844860.exe115⤵PID:5020
-
\??\c:\4404888.exec:\4404888.exe116⤵PID:640
-
\??\c:\vpjjd.exec:\vpjjd.exe117⤵PID:1936
-
\??\c:\c442604.exec:\c442604.exe118⤵PID:2748
-
\??\c:\pdjdd.exec:\pdjdd.exe119⤵PID:672
-
\??\c:\08484.exec:\08484.exe120⤵PID:4692
-
\??\c:\1ffrfrf.exec:\1ffrfrf.exe121⤵PID:4808
-
\??\c:\6066266.exec:\6066266.exe122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-