Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 21:26
Static task
static1
Behavioral task
behavioral1
Sample
44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe
Resource
win7-20240903-en
General
-
Target
44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe
-
Size
71KB
-
MD5
e6bd64c9052ea30a44c5ea7ba87bf2e0
-
SHA1
43b903f486e65d5dd28dd53e51e9e21982fb3725
-
SHA256
44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ff
-
SHA512
1f93b9e4b913d113361abac41ae58d458ec941ecef3875ac60bb086fd301a74b3e78568e7872f070a0159162d75b37a03bc6ccaf25a75ca2efac6a09e69117c1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLH+t:ymb3NkkiQ3mdBjF0yMliCt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3692 1hnnnn.exe 4228 vpdvv.exe 5052 rflrlrr.exe 3620 3tbttt.exe 3584 vdjjp.exe 2332 jjjjv.exe 4780 tbtttt.exe 2104 7nttnt.exe 3712 pvjdv.exe 3092 llrllll.exe 3412 xllxrrr.exe 1224 7hhhhh.exe 4252 ddpvv.exe 1272 flxrlll.exe 2420 1hnhht.exe 2196 dvpvd.exe 1708 xxfffxx.exe 4860 xxrfflx.exe 4300 bhtbhh.exe 3204 dvdjd.exe 1960 lxfxxxf.exe 3240 ffrffxf.exe 4440 hhnthn.exe 1472 jppvv.exe 4904 7vdjj.exe 4480 ffflffx.exe 2764 xlrfllr.exe 2608 nnbtth.exe 3540 fflrxlr.exe 2200 hbhhhh.exe 212 ddppv.exe 2388 xrxrlll.exe 636 rrxlrrr.exe 2556 bhhnnt.exe 1620 nhnttb.exe 752 jdjdd.exe 1792 1jvvv.exe 2168 fffrrlr.exe 1600 lxlrrfx.exe 4176 hthnnb.exe 4404 vjpvj.exe 4172 dpvvj.exe 2596 fxflxxf.exe 3548 lllffxx.exe 5100 nhtbhh.exe 2920 bhhnht.exe 1444 pvjjp.exe 2424 rrllfll.exe 4788 bthhhn.exe 3524 nhbtnt.exe 4484 pjppp.exe 4936 vvvdv.exe 3632 xfrrrrr.exe 3816 tthbbb.exe 3532 hhnnnn.exe 2668 jvvjd.exe 3244 jvddd.exe 2220 rrrrlfx.exe 4648 hhtnnh.exe 2104 tnhhbh.exe 2192 djdvd.exe 3840 fxxfxxr.exe 4240 lfxxrll.exe 1700 btbbtb.exe -
resource yara_rule behavioral2/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 3692 624 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 82 PID 624 wrote to memory of 3692 624 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 82 PID 624 wrote to memory of 3692 624 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 82 PID 3692 wrote to memory of 4228 3692 1hnnnn.exe 83 PID 3692 wrote to memory of 4228 3692 1hnnnn.exe 83 PID 3692 wrote to memory of 4228 3692 1hnnnn.exe 83 PID 4228 wrote to memory of 5052 4228 vpdvv.exe 84 PID 4228 wrote to memory of 5052 4228 vpdvv.exe 84 PID 4228 wrote to memory of 5052 4228 vpdvv.exe 84 PID 5052 wrote to memory of 3620 5052 rflrlrr.exe 85 PID 5052 wrote to memory of 3620 5052 rflrlrr.exe 85 PID 5052 wrote to memory of 3620 5052 rflrlrr.exe 85 PID 3620 wrote to memory of 3584 3620 3tbttt.exe 86 PID 3620 wrote to memory of 3584 3620 3tbttt.exe 86 PID 3620 wrote to memory of 3584 3620 3tbttt.exe 86 PID 3584 wrote to memory of 2332 3584 vdjjp.exe 87 PID 3584 wrote to memory of 2332 3584 vdjjp.exe 87 PID 3584 wrote to memory of 2332 3584 vdjjp.exe 87 PID 2332 wrote to memory of 4780 2332 jjjjv.exe 88 PID 2332 wrote to memory of 4780 2332 jjjjv.exe 88 PID 2332 wrote to memory of 4780 2332 jjjjv.exe 88 PID 4780 wrote to memory of 2104 4780 tbtttt.exe 89 PID 4780 wrote to memory of 2104 4780 tbtttt.exe 89 PID 4780 wrote to memory of 2104 4780 tbtttt.exe 89 PID 2104 wrote to memory of 3712 2104 7nttnt.exe 90 PID 2104 wrote to memory of 3712 2104 7nttnt.exe 90 PID 2104 wrote to memory of 3712 2104 7nttnt.exe 90 PID 3712 wrote to memory of 3092 3712 pvjdv.exe 91 PID 3712 wrote to memory of 3092 3712 pvjdv.exe 91 PID 3712 wrote to memory of 3092 3712 pvjdv.exe 91 PID 3092 wrote to memory of 3412 3092 llrllll.exe 92 PID 3092 wrote to memory of 3412 3092 llrllll.exe 92 PID 3092 wrote to memory of 3412 3092 llrllll.exe 92 PID 3412 wrote to memory of 1224 3412 xllxrrr.exe 93 PID 3412 wrote to memory of 1224 3412 xllxrrr.exe 93 PID 3412 wrote to memory of 1224 3412 xllxrrr.exe 93 PID 1224 wrote to memory of 4252 1224 7hhhhh.exe 94 PID 1224 wrote to memory of 4252 1224 7hhhhh.exe 94 PID 1224 wrote to memory of 4252 1224 7hhhhh.exe 94 PID 4252 wrote to memory of 1272 4252 ddpvv.exe 95 PID 4252 wrote to memory of 1272 4252 ddpvv.exe 95 PID 4252 wrote to memory of 1272 4252 ddpvv.exe 95 PID 1272 wrote to memory of 2420 1272 flxrlll.exe 96 PID 1272 wrote to memory of 2420 1272 flxrlll.exe 96 PID 1272 wrote to memory of 2420 1272 flxrlll.exe 96 PID 2420 wrote to memory of 2196 2420 1hnhht.exe 97 PID 2420 wrote to memory of 2196 2420 1hnhht.exe 97 PID 2420 wrote to memory of 2196 2420 1hnhht.exe 97 PID 2196 wrote to memory of 1708 2196 dvpvd.exe 98 PID 2196 wrote to memory of 1708 2196 dvpvd.exe 98 PID 2196 wrote to memory of 1708 2196 dvpvd.exe 98 PID 1708 wrote to memory of 4860 1708 xxfffxx.exe 99 PID 1708 wrote to memory of 4860 1708 xxfffxx.exe 99 PID 1708 wrote to memory of 4860 1708 xxfffxx.exe 99 PID 4860 wrote to memory of 4300 4860 xxrfflx.exe 100 PID 4860 wrote to memory of 4300 4860 xxrfflx.exe 100 PID 4860 wrote to memory of 4300 4860 xxrfflx.exe 100 PID 4300 wrote to memory of 3204 4300 bhtbhh.exe 101 PID 4300 wrote to memory of 3204 4300 bhtbhh.exe 101 PID 4300 wrote to memory of 3204 4300 bhtbhh.exe 101 PID 3204 wrote to memory of 1960 3204 dvdjd.exe 102 PID 3204 wrote to memory of 1960 3204 dvdjd.exe 102 PID 3204 wrote to memory of 1960 3204 dvdjd.exe 102 PID 1960 wrote to memory of 3240 1960 lxfxxxf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe"C:\Users\Admin\AppData\Local\Temp\44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\1hnnnn.exec:\1hnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\vpdvv.exec:\vpdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\rflrlrr.exec:\rflrlrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\3tbttt.exec:\3tbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\vdjjp.exec:\vdjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\jjjjv.exec:\jjjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\tbtttt.exec:\tbtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\7nttnt.exec:\7nttnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pvjdv.exec:\pvjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\llrllll.exec:\llrllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\xllxrrr.exec:\xllxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\7hhhhh.exec:\7hhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\ddpvv.exec:\ddpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\flxrlll.exec:\flxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\1hnhht.exec:\1hnhht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\dvpvd.exec:\dvpvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\xxfffxx.exec:\xxfffxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xxrfflx.exec:\xxrfflx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\bhtbhh.exec:\bhtbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\dvdjd.exec:\dvdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\ffrffxf.exec:\ffrffxf.exe23⤵
- Executes dropped EXE
PID:3240 -
\??\c:\hhnthn.exec:\hhnthn.exe24⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jppvv.exec:\jppvv.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7vdjj.exec:\7vdjj.exe26⤵
- Executes dropped EXE
PID:4904 -
\??\c:\ffflffx.exec:\ffflffx.exe27⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xlrfllr.exec:\xlrfllr.exe28⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nnbtth.exec:\nnbtth.exe29⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fflrxlr.exec:\fflrxlr.exe30⤵
- Executes dropped EXE
PID:3540 -
\??\c:\hbhhhh.exec:\hbhhhh.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ddppv.exec:\ddppv.exe32⤵
- Executes dropped EXE
PID:212 -
\??\c:\xrxrlll.exec:\xrxrlll.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rrxlrrr.exec:\rrxlrrr.exe34⤵
- Executes dropped EXE
PID:636 -
\??\c:\bhhnnt.exec:\bhhnnt.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhnttb.exec:\nhnttb.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jdjdd.exec:\jdjdd.exe37⤵
- Executes dropped EXE
PID:752 -
\??\c:\1jvvv.exec:\1jvvv.exe38⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fffrrlr.exec:\fffrrlr.exe39⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lxlrrfx.exec:\lxlrrfx.exe40⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hthnnb.exec:\hthnnb.exe41⤵
- Executes dropped EXE
PID:4176 -
\??\c:\vjpvj.exec:\vjpvj.exe42⤵
- Executes dropped EXE
PID:4404 -
\??\c:\dpvvj.exec:\dpvvj.exe43⤵
- Executes dropped EXE
PID:4172 -
\??\c:\fxflxxf.exec:\fxflxxf.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lllffxx.exec:\lllffxx.exe45⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nhtbhh.exec:\nhtbhh.exe46⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bhhnht.exec:\bhhnht.exe47⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pvjjp.exec:\pvjjp.exe48⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1djpp.exec:\1djpp.exe49⤵PID:4436
-
\??\c:\rrllfll.exec:\rrllfll.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\bthhhn.exec:\bthhhn.exe51⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nhbtnt.exec:\nhbtnt.exe52⤵
- Executes dropped EXE
PID:3524 -
\??\c:\pjppp.exec:\pjppp.exe53⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vvvdv.exec:\vvvdv.exe54⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe55⤵
- Executes dropped EXE
PID:3632 -
\??\c:\tthbbb.exec:\tthbbb.exe56⤵
- Executes dropped EXE
PID:3816 -
\??\c:\hhnnnn.exec:\hhnnnn.exe57⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jvvjd.exec:\jvvjd.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jvddd.exec:\jvddd.exe59⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rrrrlfx.exec:\rrrrlfx.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhtnnh.exec:\hhtnnh.exe61⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tnhhbh.exec:\tnhhbh.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\djdvd.exec:\djdvd.exe63⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fxxfxxr.exec:\fxxfxxr.exe64⤵
- Executes dropped EXE
PID:3840 -
\??\c:\lfxxrll.exec:\lfxxrll.exe65⤵
- Executes dropped EXE
PID:4240 -
\??\c:\btbbtb.exec:\btbbtb.exe66⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ddjdv.exec:\ddjdv.exe67⤵PID:3952
-
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:4772
-
\??\c:\rflfrrl.exec:\rflfrrl.exe69⤵PID:4576
-
\??\c:\rxlllrl.exec:\rxlllrl.exe70⤵PID:4964
-
\??\c:\bhbtnn.exec:\bhbtnn.exe71⤵PID:4884
-
\??\c:\jjjjv.exec:\jjjjv.exe72⤵PID:3648
-
\??\c:\pvpvv.exec:\pvpvv.exe73⤵PID:3604
-
\??\c:\ffffxfx.exec:\ffffxfx.exe74⤵PID:112
-
\??\c:\5bhnnn.exec:\5bhnnn.exe75⤵PID:2140
-
\??\c:\hnhnnt.exec:\hnhnnt.exe76⤵
- System Location Discovery: System Language Discovery
PID:4164 -
\??\c:\dddpp.exec:\dddpp.exe77⤵PID:1124
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe78⤵PID:4356
-
\??\c:\3nhhbb.exec:\3nhhbb.exe79⤵PID:3520
-
\??\c:\pvdjj.exec:\pvdjj.exe80⤵PID:844
-
\??\c:\pvvvd.exec:\pvvvd.exe81⤵PID:2136
-
\??\c:\fxflfll.exec:\fxflfll.exe82⤵PID:208
-
\??\c:\nhbtnt.exec:\nhbtnt.exe83⤵PID:2492
-
\??\c:\nhbtnn.exec:\nhbtnn.exe84⤵PID:3136
-
\??\c:\pjjdv.exec:\pjjdv.exe85⤵PID:5056
-
\??\c:\9jjjd.exec:\9jjjd.exe86⤵PID:3736
-
\??\c:\lfrfffx.exec:\lfrfffx.exe87⤵PID:1984
-
\??\c:\5xrlrrx.exec:\5xrlrrx.exe88⤵PID:1672
-
\??\c:\nbnhbb.exec:\nbnhbb.exe89⤵PID:8
-
\??\c:\jjvdd.exec:\jjvdd.exe90⤵PID:3700
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe91⤵PID:3336
-
\??\c:\nthbnn.exec:\nthbnn.exe92⤵PID:1544
-
\??\c:\ddvdd.exec:\ddvdd.exe93⤵PID:756
-
\??\c:\vdpvp.exec:\vdpvp.exe94⤵PID:1584
-
\??\c:\rfxxlrr.exec:\rfxxlrr.exe95⤵PID:544
-
\??\c:\bnbttt.exec:\bnbttt.exe96⤵PID:4924
-
\??\c:\nnnttb.exec:\nnnttb.exe97⤵PID:3128
-
\??\c:\vpjdj.exec:\vpjdj.exe98⤵PID:3456
-
\??\c:\7ppjv.exec:\7ppjv.exe99⤵PID:5096
-
\??\c:\xlfrfrx.exec:\xlfrfrx.exe100⤵PID:3744
-
\??\c:\hbtnbb.exec:\hbtnbb.exe101⤵PID:1600
-
\??\c:\thhhtb.exec:\thhhtb.exe102⤵PID:1840
-
\??\c:\5pddj.exec:\5pddj.exe103⤵PID:740
-
\??\c:\llfffff.exec:\llfffff.exe104⤵PID:4172
-
\??\c:\rxffxxf.exec:\rxffxxf.exe105⤵PID:3436
-
\??\c:\7tnttn.exec:\7tnttn.exe106⤵PID:1644
-
\??\c:\pvddd.exec:\pvddd.exe107⤵PID:3400
-
\??\c:\jjdjj.exec:\jjdjj.exe108⤵PID:4408
-
\??\c:\rlfflrr.exec:\rlfflrr.exe109⤵PID:4532
-
\??\c:\rllrrrl.exec:\rllrrrl.exe110⤵PID:1048
-
\??\c:\hhhttb.exec:\hhhttb.exe111⤵PID:4376
-
\??\c:\1jjjv.exec:\1jjjv.exe112⤵PID:4816
-
\??\c:\9lllfff.exec:\9lllfff.exe113⤵PID:4228
-
\??\c:\lxffxff.exec:\lxffxff.exe114⤵PID:1464
-
\??\c:\hbhhbb.exec:\hbhhbb.exe115⤵PID:3680
-
\??\c:\vvvpj.exec:\vvvpj.exe116⤵PID:4256
-
\??\c:\3jpjd.exec:\3jpjd.exe117⤵PID:2960
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe118⤵PID:672
-
\??\c:\htbttt.exec:\htbttt.exe119⤵PID:1788
-
\??\c:\thhhbh.exec:\thhhbh.exe120⤵PID:1036
-
\??\c:\hbnntb.exec:\hbnntb.exe121⤵PID:912
-
\??\c:\1vpdv.exec:\1vpdv.exe122⤵PID:3484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-