Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abefdeacfb2be9da20f2ce9361402060N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
abefdeacfb2be9da20f2ce9361402060N.exe
-
Size
64KB
-
MD5
abefdeacfb2be9da20f2ce9361402060
-
SHA1
d9946c952de2e1183d367f728d35218a45da2537
-
SHA256
df12688ebb6ea87fff1694dfdee51aaf1bcdea3f8062cad3ca32074de65d3c67
-
SHA512
e5fcd61ef726dc1a526e58ff56e64f8b8a64a3c448582abcc807fbfae9afba0a85e8f334474e9167e8371e479392eff2d8cc48f33849a73a066351771c2f9937
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNr:ymb3NkkiQ3mdBjFIvlpr
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2008-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4820 vdjvp.exe 2456 ppjvj.exe 4008 3nbnnh.exe 792 ddjpd.exe 4896 xxllxrx.exe 3720 xxxlxrl.exe 4048 1tbntt.exe 1300 5bthtn.exe 5060 jjdpd.exe 1476 9xlxlxr.exe 2732 flrlxfx.exe 3428 bbhbnh.exe 2932 vpjdj.exe 1308 dpjpd.exe 2536 3lfxrlr.exe 1536 btbnbh.exe 3492 nhtbtb.exe 3676 5dpjv.exe 3452 rrlfrxr.exe 4444 lxxrfxr.exe 860 tbhhbt.exe 4536 nhhbnn.exe 4412 3vjdv.exe 5068 fflxlfl.exe 1600 9thtnh.exe 3196 ppvpv.exe 3040 9lrlfxf.exe 1436 lfrxrlx.exe 2488 bbbttn.exe 4516 pjvpv.exe 4280 dvpdp.exe 2064 frfrlff.exe 3176 btttnn.exe 3172 bhhnbb.exe 3988 ttbbbb.exe 1208 dvpjp.exe 2824 7jjpj.exe 4328 xxfrrll.exe 4820 xrxrrlx.exe 1800 tnhbtn.exe 4792 bttnbb.exe 3984 jpjdp.exe 2844 3pdvj.exe 2360 9xlxxrr.exe 2516 rlfxlfr.exe 3720 7bbnht.exe 1332 bttnnh.exe 928 dvvpp.exe 2316 dddjd.exe 5060 vvddv.exe 3556 lxfrlfl.exe 4628 3rrrlfx.exe 1928 tnnnhh.exe 4844 3thbbt.exe 4604 9hthhb.exe 1480 jpdpd.exe 3560 flfllll.exe 1660 rxfrfxf.exe 3448 7nttnh.exe 3608 9ttnbt.exe 3492 5ppjv.exe 3676 1flxlfl.exe 4320 rflfxrl.exe 4176 1bhbtn.exe -
resource yara_rule behavioral2/memory/2008-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 4820 2008 abefdeacfb2be9da20f2ce9361402060N.exe 84 PID 2008 wrote to memory of 4820 2008 abefdeacfb2be9da20f2ce9361402060N.exe 84 PID 2008 wrote to memory of 4820 2008 abefdeacfb2be9da20f2ce9361402060N.exe 84 PID 4820 wrote to memory of 2456 4820 vdjvp.exe 85 PID 4820 wrote to memory of 2456 4820 vdjvp.exe 85 PID 4820 wrote to memory of 2456 4820 vdjvp.exe 85 PID 2456 wrote to memory of 4008 2456 ppjvj.exe 86 PID 2456 wrote to memory of 4008 2456 ppjvj.exe 86 PID 2456 wrote to memory of 4008 2456 ppjvj.exe 86 PID 4008 wrote to memory of 792 4008 3nbnnh.exe 87 PID 4008 wrote to memory of 792 4008 3nbnnh.exe 87 PID 4008 wrote to memory of 792 4008 3nbnnh.exe 87 PID 792 wrote to memory of 4896 792 ddjpd.exe 88 PID 792 wrote to memory of 4896 792 ddjpd.exe 88 PID 792 wrote to memory of 4896 792 ddjpd.exe 88 PID 4896 wrote to memory of 3720 4896 xxllxrx.exe 89 PID 4896 wrote to memory of 3720 4896 xxllxrx.exe 89 PID 4896 wrote to memory of 3720 4896 xxllxrx.exe 89 PID 3720 wrote to memory of 4048 3720 xxxlxrl.exe 90 PID 3720 wrote to memory of 4048 3720 xxxlxrl.exe 90 PID 3720 wrote to memory of 4048 3720 xxxlxrl.exe 90 PID 4048 wrote to memory of 1300 4048 1tbntt.exe 91 PID 4048 wrote to memory of 1300 4048 1tbntt.exe 91 PID 4048 wrote to memory of 1300 4048 1tbntt.exe 91 PID 1300 wrote to memory of 5060 1300 5bthtn.exe 92 PID 1300 wrote to memory of 5060 1300 5bthtn.exe 92 PID 1300 wrote to memory of 5060 1300 5bthtn.exe 92 PID 5060 wrote to memory of 1476 5060 jjdpd.exe 93 PID 5060 wrote to memory of 1476 5060 jjdpd.exe 93 PID 5060 wrote to memory of 1476 5060 jjdpd.exe 93 PID 1476 wrote to memory of 2732 1476 9xlxlxr.exe 94 PID 1476 wrote to memory of 2732 1476 9xlxlxr.exe 94 PID 1476 wrote to memory of 2732 1476 9xlxlxr.exe 94 PID 2732 wrote to memory of 3428 2732 flrlxfx.exe 95 PID 2732 wrote to memory of 3428 2732 flrlxfx.exe 95 PID 2732 wrote to memory of 3428 2732 flrlxfx.exe 95 PID 3428 wrote to memory of 2932 3428 bbhbnh.exe 96 PID 3428 wrote to memory of 2932 3428 bbhbnh.exe 96 PID 3428 wrote to memory of 2932 3428 bbhbnh.exe 96 PID 2932 wrote to memory of 1308 2932 vpjdj.exe 97 PID 2932 wrote to memory of 1308 2932 vpjdj.exe 97 PID 2932 wrote to memory of 1308 2932 vpjdj.exe 97 PID 1308 wrote to memory of 2536 1308 dpjpd.exe 98 PID 1308 wrote to memory of 2536 1308 dpjpd.exe 98 PID 1308 wrote to memory of 2536 1308 dpjpd.exe 98 PID 2536 wrote to memory of 1536 2536 3lfxrlr.exe 99 PID 2536 wrote to memory of 1536 2536 3lfxrlr.exe 99 PID 2536 wrote to memory of 1536 2536 3lfxrlr.exe 99 PID 1536 wrote to memory of 3492 1536 btbnbh.exe 101 PID 1536 wrote to memory of 3492 1536 btbnbh.exe 101 PID 1536 wrote to memory of 3492 1536 btbnbh.exe 101 PID 3492 wrote to memory of 3676 3492 nhtbtb.exe 102 PID 3492 wrote to memory of 3676 3492 nhtbtb.exe 102 PID 3492 wrote to memory of 3676 3492 nhtbtb.exe 102 PID 3676 wrote to memory of 3452 3676 5dpjv.exe 103 PID 3676 wrote to memory of 3452 3676 5dpjv.exe 103 PID 3676 wrote to memory of 3452 3676 5dpjv.exe 103 PID 3452 wrote to memory of 4444 3452 rrlfrxr.exe 104 PID 3452 wrote to memory of 4444 3452 rrlfrxr.exe 104 PID 3452 wrote to memory of 4444 3452 rrlfrxr.exe 104 PID 4444 wrote to memory of 860 4444 lxxrfxr.exe 105 PID 4444 wrote to memory of 860 4444 lxxrfxr.exe 105 PID 4444 wrote to memory of 860 4444 lxxrfxr.exe 105 PID 860 wrote to memory of 4536 860 tbhhbt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\abefdeacfb2be9da20f2ce9361402060N.exe"C:\Users\Admin\AppData\Local\Temp\abefdeacfb2be9da20f2ce9361402060N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vdjvp.exec:\vdjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\ppjvj.exec:\ppjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\3nbnnh.exec:\3nbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\ddjpd.exec:\ddjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\xxllxrx.exec:\xxllxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\1tbntt.exec:\1tbntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\5bthtn.exec:\5bthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\jjdpd.exec:\jjdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\9xlxlxr.exec:\9xlxlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\flrlxfx.exec:\flrlxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bbhbnh.exec:\bbhbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\vpjdj.exec:\vpjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dpjpd.exec:\dpjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\3lfxrlr.exec:\3lfxrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\btbnbh.exec:\btbnbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\nhtbtb.exec:\nhtbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\5dpjv.exec:\5dpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\tbhhbt.exec:\tbhhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\nhhbnn.exec:\nhhbnn.exe23⤵
- Executes dropped EXE
PID:4536 -
\??\c:\3vjdv.exec:\3vjdv.exe24⤵
- Executes dropped EXE
PID:4412 -
\??\c:\fflxlfl.exec:\fflxlfl.exe25⤵
- Executes dropped EXE
PID:5068 -
\??\c:\9thtnh.exec:\9thtnh.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ppvpv.exec:\ppvpv.exe27⤵
- Executes dropped EXE
PID:3196 -
\??\c:\9lrlfxf.exec:\9lrlfxf.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lfrxrlx.exec:\lfrxrlx.exe29⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bbbttn.exec:\bbbttn.exe30⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjvpv.exec:\pjvpv.exe31⤵
- Executes dropped EXE
PID:4516 -
\??\c:\dvpdp.exec:\dvpdp.exe32⤵
- Executes dropped EXE
PID:4280 -
\??\c:\frfrlff.exec:\frfrlff.exe33⤵
- Executes dropped EXE
PID:2064 -
\??\c:\btttnn.exec:\btttnn.exe34⤵
- Executes dropped EXE
PID:3176 -
\??\c:\bhhnbb.exec:\bhhnbb.exe35⤵
- Executes dropped EXE
PID:3172 -
\??\c:\ttbbbb.exec:\ttbbbb.exe36⤵
- Executes dropped EXE
PID:3988 -
\??\c:\dvpjp.exec:\dvpjp.exe37⤵
- Executes dropped EXE
PID:1208 -
\??\c:\7jjpj.exec:\7jjpj.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xxfrrll.exec:\xxfrrll.exe39⤵
- Executes dropped EXE
PID:4328 -
\??\c:\xrxrrlx.exec:\xrxrrlx.exe40⤵
- Executes dropped EXE
PID:4820 -
\??\c:\tnhbtn.exec:\tnhbtn.exe41⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bttnbb.exec:\bttnbb.exe42⤵
- Executes dropped EXE
PID:4792 -
\??\c:\jpjdp.exec:\jpjdp.exe43⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3pdvj.exec:\3pdvj.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9xlxxrr.exec:\9xlxxrr.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7bbnht.exec:\7bbnht.exe47⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bttnnh.exec:\bttnnh.exe48⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dvvpp.exec:\dvvpp.exe49⤵
- Executes dropped EXE
PID:928 -
\??\c:\dddjd.exec:\dddjd.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vvddv.exec:\vvddv.exe51⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lxfrlfl.exec:\lxfrlfl.exe52⤵
- Executes dropped EXE
PID:3556 -
\??\c:\3rrrlfx.exec:\3rrrlfx.exe53⤵
- Executes dropped EXE
PID:4628 -
\??\c:\tnnnhh.exec:\tnnnhh.exe54⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3thbbt.exec:\3thbbt.exe55⤵
- Executes dropped EXE
PID:4844 -
\??\c:\9hthhb.exec:\9hthhb.exe56⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jpdpd.exec:\jpdpd.exe57⤵
- Executes dropped EXE
PID:1480 -
\??\c:\flfllll.exec:\flfllll.exe58⤵
- Executes dropped EXE
PID:3560 -
\??\c:\rxfrfxf.exec:\rxfrfxf.exe59⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7nttnh.exec:\7nttnh.exe60⤵
- Executes dropped EXE
PID:3448 -
\??\c:\9ttnbt.exec:\9ttnbt.exe61⤵
- Executes dropped EXE
PID:3608 -
\??\c:\5ppjv.exec:\5ppjv.exe62⤵
- Executes dropped EXE
PID:3492 -
\??\c:\1flxlfl.exec:\1flxlfl.exe63⤵
- Executes dropped EXE
PID:3676 -
\??\c:\rflfxrl.exec:\rflfxrl.exe64⤵
- Executes dropped EXE
PID:4320 -
\??\c:\1bhbtn.exec:\1bhbtn.exe65⤵
- Executes dropped EXE
PID:4176 -
\??\c:\nhhbtn.exec:\nhhbtn.exe66⤵PID:1756
-
\??\c:\vpvvd.exec:\vpvvd.exe67⤵PID:2964
-
\??\c:\pdjvd.exec:\pdjvd.exe68⤵PID:376
-
\??\c:\1fxrxrl.exec:\1fxrxrl.exe69⤵PID:2832
-
\??\c:\3flxrlf.exec:\3flxrlf.exe70⤵PID:2432
-
\??\c:\nhhbtt.exec:\nhhbtt.exe71⤵PID:4432
-
\??\c:\nbbthh.exec:\nbbthh.exe72⤵PID:3376
-
\??\c:\thbtth.exec:\thbtth.exe73⤵PID:3500
-
\??\c:\jpvvd.exec:\jpvvd.exe74⤵PID:3540
-
\??\c:\1pvjv.exec:\1pvjv.exe75⤵PID:3320
-
\??\c:\7frlrrx.exec:\7frlrrx.exe76⤵PID:1920
-
\??\c:\3xrlfxl.exec:\3xrlfxl.exe77⤵PID:4544
-
\??\c:\tttnbt.exec:\tttnbt.exe78⤵PID:1228
-
\??\c:\tnttnn.exec:\tnttnn.exe79⤵PID:456
-
\??\c:\ppjdd.exec:\ppjdd.exe80⤵PID:4516
-
\??\c:\jvvjv.exec:\jvvjv.exe81⤵PID:3436
-
\??\c:\llfflrx.exec:\llfflrx.exe82⤵PID:2820
-
\??\c:\rfrlfff.exec:\rfrlfff.exe83⤵PID:544
-
\??\c:\nttnnn.exec:\nttnnn.exe84⤵PID:4368
-
\??\c:\bnnnnt.exec:\bnnnnt.exe85⤵PID:2312
-
\??\c:\jjddd.exec:\jjddd.exe86⤵PID:2728
-
\??\c:\jdjdp.exec:\jdjdp.exe87⤵PID:320
-
\??\c:\5lrlffx.exec:\5lrlffx.exe88⤵PID:4328
-
\??\c:\hhttbh.exec:\hhttbh.exe89⤵PID:4820
-
\??\c:\bhhhnt.exec:\bhhhnt.exe90⤵PID:3364
-
\??\c:\vpjvv.exec:\vpjvv.exe91⤵PID:3844
-
\??\c:\vjjdv.exec:\vjjdv.exe92⤵PID:432
-
\??\c:\9xrxlll.exec:\9xrxlll.exe93⤵PID:2672
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe94⤵PID:2464
-
\??\c:\ttttnn.exec:\ttttnn.exe95⤵PID:4660
-
\??\c:\nbtnnh.exec:\nbtnnh.exe96⤵PID:1704
-
\??\c:\llrrlll.exec:\llrrlll.exe97⤵PID:5092
-
\??\c:\hhbnth.exec:\hhbnth.exe98⤵PID:1428
-
\??\c:\bhnttn.exec:\bhnttn.exe99⤵PID:3336
-
\??\c:\pjvvj.exec:\pjvvj.exe100⤵PID:1612
-
\??\c:\dvjjj.exec:\dvjjj.exe101⤵PID:2856
-
\??\c:\9xrrfff.exec:\9xrrfff.exe102⤵PID:3992
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe103⤵PID:3428
-
\??\c:\hbtnnb.exec:\hbtnnb.exe104⤵PID:4604
-
\??\c:\jpjjj.exec:\jpjjj.exe105⤵PID:3052
-
\??\c:\3vpjd.exec:\3vpjd.exe106⤵PID:3144
-
\??\c:\jvppp.exec:\jvppp.exe107⤵PID:5040
-
\??\c:\xfrlxlr.exec:\xfrlxlr.exe108⤵PID:1536
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe109⤵PID:3608
-
\??\c:\rfrlrff.exec:\rfrlrff.exe110⤵PID:1988
-
\??\c:\3nbtnt.exec:\3nbtnt.exe111⤵PID:1400
-
\??\c:\jpdjd.exec:\jpdjd.exe112⤵PID:4508
-
\??\c:\9lxrlrl.exec:\9lxrlrl.exe113⤵PID:3248
-
\??\c:\9rxrxlf.exec:\9rxrxlf.exe114⤵PID:4400
-
\??\c:\nhhhtt.exec:\nhhhtt.exe115⤵PID:2396
-
\??\c:\nnhbhh.exec:\nnhbhh.exe116⤵PID:1620
-
\??\c:\jdjpj.exec:\jdjpj.exe117⤵PID:4668
-
\??\c:\jjjjd.exec:\jjjjd.exe118⤵PID:5068
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe119⤵PID:2092
-
\??\c:\xxffxfx.exec:\xxffxfx.exe120⤵PID:996
-
\??\c:\llxfxxx.exec:\llxfxxx.exe121⤵PID:3028
-
\??\c:\hnnnnn.exec:\hnnnnn.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-