Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 15:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce942a23ee4d054f0b06b091f109afd0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
ce942a23ee4d054f0b06b091f109afd0N.exe
-
Size
64KB
-
MD5
ce942a23ee4d054f0b06b091f109afd0
-
SHA1
aac0ef09d6cb1d16d51e1846c4f70ef186ab8607
-
SHA256
8c51a8ba9c64bf6e174c2817bc476b49b8d2c357280b7832c44d40186693d1a6
-
SHA512
f12c5fabd6eb2281cc0fa2e21d44cab75ab27dc653252fce83c0307005e5c4009fd79633ee157d1c970ac29cece2c59eeaa0c38aeebfc9a11fa0bc93edb82969
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPtW:ymb3NkkiQ3mdBjFIj+qA
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4976 vdvpd.exe 4052 lfxrffx.exe 3564 hbbhbh.exe 2872 hbnntt.exe 3112 vvvpd.exe 2980 llxflfl.exe 5112 nbbttn.exe 980 dddjj.exe 2688 vdjdv.exe 3524 rfxlffx.exe 2400 hbbnhb.exe 2240 pvddv.exe 2632 fffrrfx.exe 2760 fffxrrl.exe 4124 nhbtnn.exe 3292 dpdpj.exe 3684 1rxrrrf.exe 3412 vpdjv.exe 4544 rflfxxr.exe 4684 dpppp.exe 3080 jjdvd.exe 4392 xrrrlll.exe 528 hbhbtb.exe 1012 tnnnhn.exe 1436 pjpjv.exe 1264 vddvp.exe 1720 3frrllf.exe 5036 ttbtbb.exe 3744 bbhbtt.exe 4972 ddjvd.exe 4444 rlrlfff.exe 2228 1hnttt.exe 2752 bntthh.exe 4364 1dpjv.exe 4136 fxrfxfx.exe 4632 lffrlfx.exe 3564 fxxxlfx.exe 3432 9nnhnh.exe 5012 jvvvd.exe 1040 pjjdj.exe 624 dpjvj.exe 1700 lllxlfr.exe 4336 hhhhtn.exe 940 thhbhh.exe 1892 pdpdp.exe 1008 pdpvp.exe 3876 fffrrrl.exe 3716 fxxrfrr.exe 2736 tttnbt.exe 1404 tnhthb.exe 4900 tnnbbb.exe 912 5vvjv.exe 4124 djjpv.exe 4328 ffxrllf.exe 1992 7ffxrlf.exe 3228 thhbbh.exe 860 nnhbnn.exe 2552 3djjd.exe 636 pjpjd.exe 2392 xxrrllr.exe 2104 lxxrrxr.exe 1560 htntnh.exe 2060 btbttt.exe 3664 ddpjd.exe -
resource yara_rule behavioral2/memory/4020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4976 4020 ce942a23ee4d054f0b06b091f109afd0N.exe 86 PID 4020 wrote to memory of 4976 4020 ce942a23ee4d054f0b06b091f109afd0N.exe 86 PID 4020 wrote to memory of 4976 4020 ce942a23ee4d054f0b06b091f109afd0N.exe 86 PID 4976 wrote to memory of 4052 4976 vdvpd.exe 87 PID 4976 wrote to memory of 4052 4976 vdvpd.exe 87 PID 4976 wrote to memory of 4052 4976 vdvpd.exe 87 PID 4052 wrote to memory of 3564 4052 lfxrffx.exe 88 PID 4052 wrote to memory of 3564 4052 lfxrffx.exe 88 PID 4052 wrote to memory of 3564 4052 lfxrffx.exe 88 PID 3564 wrote to memory of 2872 3564 hbbhbh.exe 89 PID 3564 wrote to memory of 2872 3564 hbbhbh.exe 89 PID 3564 wrote to memory of 2872 3564 hbbhbh.exe 89 PID 2872 wrote to memory of 3112 2872 hbnntt.exe 90 PID 2872 wrote to memory of 3112 2872 hbnntt.exe 90 PID 2872 wrote to memory of 3112 2872 hbnntt.exe 90 PID 3112 wrote to memory of 2980 3112 vvvpd.exe 91 PID 3112 wrote to memory of 2980 3112 vvvpd.exe 91 PID 3112 wrote to memory of 2980 3112 vvvpd.exe 91 PID 2980 wrote to memory of 5112 2980 llxflfl.exe 92 PID 2980 wrote to memory of 5112 2980 llxflfl.exe 92 PID 2980 wrote to memory of 5112 2980 llxflfl.exe 92 PID 5112 wrote to memory of 980 5112 nbbttn.exe 93 PID 5112 wrote to memory of 980 5112 nbbttn.exe 93 PID 5112 wrote to memory of 980 5112 nbbttn.exe 93 PID 980 wrote to memory of 2688 980 dddjj.exe 94 PID 980 wrote to memory of 2688 980 dddjj.exe 94 PID 980 wrote to memory of 2688 980 dddjj.exe 94 PID 2688 wrote to memory of 3524 2688 vdjdv.exe 95 PID 2688 wrote to memory of 3524 2688 vdjdv.exe 95 PID 2688 wrote to memory of 3524 2688 vdjdv.exe 95 PID 3524 wrote to memory of 2400 3524 rfxlffx.exe 96 PID 3524 wrote to memory of 2400 3524 rfxlffx.exe 96 PID 3524 wrote to memory of 2400 3524 rfxlffx.exe 96 PID 2400 wrote to memory of 2240 2400 hbbnhb.exe 97 PID 2400 wrote to memory of 2240 2400 hbbnhb.exe 97 PID 2400 wrote to memory of 2240 2400 hbbnhb.exe 97 PID 2240 wrote to memory of 2632 2240 pvddv.exe 98 PID 2240 wrote to memory of 2632 2240 pvddv.exe 98 PID 2240 wrote to memory of 2632 2240 pvddv.exe 98 PID 2632 wrote to memory of 2760 2632 fffrrfx.exe 99 PID 2632 wrote to memory of 2760 2632 fffrrfx.exe 99 PID 2632 wrote to memory of 2760 2632 fffrrfx.exe 99 PID 2760 wrote to memory of 4124 2760 fffxrrl.exe 100 PID 2760 wrote to memory of 4124 2760 fffxrrl.exe 100 PID 2760 wrote to memory of 4124 2760 fffxrrl.exe 100 PID 4124 wrote to memory of 3292 4124 nhbtnn.exe 101 PID 4124 wrote to memory of 3292 4124 nhbtnn.exe 101 PID 4124 wrote to memory of 3292 4124 nhbtnn.exe 101 PID 3292 wrote to memory of 3684 3292 dpdpj.exe 102 PID 3292 wrote to memory of 3684 3292 dpdpj.exe 102 PID 3292 wrote to memory of 3684 3292 dpdpj.exe 102 PID 3684 wrote to memory of 3412 3684 1rxrrrf.exe 103 PID 3684 wrote to memory of 3412 3684 1rxrrrf.exe 103 PID 3684 wrote to memory of 3412 3684 1rxrrrf.exe 103 PID 3412 wrote to memory of 4544 3412 vpdjv.exe 104 PID 3412 wrote to memory of 4544 3412 vpdjv.exe 104 PID 3412 wrote to memory of 4544 3412 vpdjv.exe 104 PID 4544 wrote to memory of 4684 4544 rflfxxr.exe 105 PID 4544 wrote to memory of 4684 4544 rflfxxr.exe 105 PID 4544 wrote to memory of 4684 4544 rflfxxr.exe 105 PID 4684 wrote to memory of 3080 4684 dpppp.exe 106 PID 4684 wrote to memory of 3080 4684 dpppp.exe 106 PID 4684 wrote to memory of 3080 4684 dpppp.exe 106 PID 3080 wrote to memory of 4392 3080 jjdvd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce942a23ee4d054f0b06b091f109afd0N.exe"C:\Users\Admin\AppData\Local\Temp\ce942a23ee4d054f0b06b091f109afd0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\vdvpd.exec:\vdvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\lfxrffx.exec:\lfxrffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\hbbhbh.exec:\hbbhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\hbnntt.exec:\hbnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vvvpd.exec:\vvvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\llxflfl.exec:\llxflfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nbbttn.exec:\nbbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\dddjj.exec:\dddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\vdjdv.exec:\vdjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rfxlffx.exec:\rfxlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\hbbnhb.exec:\hbbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pvddv.exec:\pvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\fffrrfx.exec:\fffrrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fffxrrl.exec:\fffxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nhbtnn.exec:\nhbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\dpdpj.exec:\dpdpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\1rxrrrf.exec:\1rxrrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\vpdjv.exec:\vpdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\rflfxxr.exec:\rflfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\dpppp.exec:\dpppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\jjdvd.exec:\jjdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\xrrrlll.exec:\xrrrlll.exe23⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hbhbtb.exec:\hbhbtb.exe24⤵
- Executes dropped EXE
PID:528 -
\??\c:\tnnnhn.exec:\tnnnhn.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pjpjv.exec:\pjpjv.exe26⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vddvp.exec:\vddvp.exe27⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3frrllf.exec:\3frrllf.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ttbtbb.exec:\ttbtbb.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\bbhbtt.exec:\bbhbtt.exe30⤵
- Executes dropped EXE
PID:3744 -
\??\c:\ddjvd.exec:\ddjvd.exe31⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rlrlfff.exec:\rlrlfff.exe32⤵
- Executes dropped EXE
PID:4444 -
\??\c:\1hnttt.exec:\1hnttt.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bntthh.exec:\bntthh.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1dpjv.exec:\1dpjv.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\fxrfxfx.exec:\fxrfxfx.exe36⤵
- Executes dropped EXE
PID:4136 -
\??\c:\lffrlfx.exec:\lffrlfx.exe37⤵
- Executes dropped EXE
PID:4632 -
\??\c:\fxxxlfx.exec:\fxxxlfx.exe38⤵
- Executes dropped EXE
PID:3564 -
\??\c:\9nnhnh.exec:\9nnhnh.exe39⤵
- Executes dropped EXE
PID:3432 -
\??\c:\jvvvd.exec:\jvvvd.exe40⤵
- Executes dropped EXE
PID:5012 -
\??\c:\pjjdj.exec:\pjjdj.exe41⤵
- Executes dropped EXE
PID:1040 -
\??\c:\dpjvj.exec:\dpjvj.exe42⤵
- Executes dropped EXE
PID:624 -
\??\c:\lllxlfr.exec:\lllxlfr.exe43⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hhhhtn.exec:\hhhhtn.exe44⤵
- Executes dropped EXE
PID:4336 -
\??\c:\thhbhh.exec:\thhbhh.exe45⤵
- Executes dropped EXE
PID:940 -
\??\c:\pdpdp.exec:\pdpdp.exe46⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pdpvp.exec:\pdpvp.exe47⤵
- Executes dropped EXE
PID:1008 -
\??\c:\fffrrrl.exec:\fffrrrl.exe48⤵
- Executes dropped EXE
PID:3876 -
\??\c:\fxxrfrr.exec:\fxxrfrr.exe49⤵
- Executes dropped EXE
PID:3716 -
\??\c:\tttnbt.exec:\tttnbt.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tnhthb.exec:\tnhthb.exe51⤵
- Executes dropped EXE
PID:1404 -
\??\c:\tnnbbb.exec:\tnnbbb.exe52⤵
- Executes dropped EXE
PID:4900 -
\??\c:\5vvjv.exec:\5vvjv.exe53⤵
- Executes dropped EXE
PID:912 -
\??\c:\djjpv.exec:\djjpv.exe54⤵
- Executes dropped EXE
PID:4124 -
\??\c:\ffxrllf.exec:\ffxrllf.exe55⤵
- Executes dropped EXE
PID:4328 -
\??\c:\7ffxrlf.exec:\7ffxrlf.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\thhbbh.exec:\thhbbh.exe57⤵
- Executes dropped EXE
PID:3228 -
\??\c:\nnhbnn.exec:\nnhbnn.exe58⤵
- Executes dropped EXE
PID:860 -
\??\c:\3djjd.exec:\3djjd.exe59⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pjpjd.exec:\pjpjd.exe60⤵
- Executes dropped EXE
PID:636 -
\??\c:\xxrrllr.exec:\xxrrllr.exe61⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\htntnh.exec:\htntnh.exe63⤵
- Executes dropped EXE
PID:1560 -
\??\c:\btbttt.exec:\btbttt.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddpjd.exec:\ddpjd.exe65⤵
- Executes dropped EXE
PID:3664 -
\??\c:\1xrrlll.exec:\1xrrlll.exe66⤵PID:2164
-
\??\c:\rlfrlll.exec:\rlfrlll.exe67⤵PID:4016
-
\??\c:\bntnhh.exec:\bntnhh.exe68⤵PID:3324
-
\??\c:\jpjjp.exec:\jpjjp.exe69⤵PID:4836
-
\??\c:\1jjvj.exec:\1jjvj.exe70⤵PID:4928
-
\??\c:\rrllrrx.exec:\rrllrrx.exe71⤵PID:5116
-
\??\c:\rflfxxr.exec:\rflfxxr.exe72⤵PID:5100
-
\??\c:\7nbhbn.exec:\7nbhbn.exe73⤵PID:3744
-
\??\c:\5bhbtt.exec:\5bhbtt.exe74⤵PID:3004
-
\??\c:\nnbttt.exec:\nnbttt.exe75⤵PID:4892
-
\??\c:\vvddp.exec:\vvddp.exe76⤵PID:2092
-
\??\c:\vpjpj.exec:\vpjpj.exe77⤵PID:1808
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe78⤵PID:2752
-
\??\c:\7tnnnb.exec:\7tnnnb.exe79⤵PID:1776
-
\??\c:\3hnbbt.exec:\3hnbbt.exe80⤵PID:4784
-
\??\c:\vjjdd.exec:\vjjdd.exe81⤵PID:4844
-
\??\c:\vpjdd.exec:\vpjdd.exe82⤵PID:4860
-
\??\c:\lfxrlll.exec:\lfxrlll.exe83⤵PID:548
-
\??\c:\rlflrff.exec:\rlflrff.exe84⤵PID:1816
-
\??\c:\nhhbtt.exec:\nhhbtt.exe85⤵PID:4500
-
\??\c:\btnhhh.exec:\btnhhh.exe86⤵PID:4172
-
\??\c:\nhbntt.exec:\nhbntt.exe87⤵PID:3128
-
\??\c:\dvpjj.exec:\dvpjj.exe88⤵PID:1188
-
\??\c:\vppjd.exec:\vppjd.exe89⤵PID:4216
-
\??\c:\xlfxllf.exec:\xlfxllf.exe90⤵PID:2292
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe91⤵PID:3204
-
\??\c:\hnbhht.exec:\hnbhht.exe92⤵PID:3524
-
\??\c:\nbbtnn.exec:\nbbtnn.exe93⤵PID:4100
-
\??\c:\vpjpj.exec:\vpjpj.exe94⤵PID:1424
-
\??\c:\ddvpj.exec:\ddvpj.exe95⤵PID:3996
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe96⤵PID:3600
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe97⤵PID:2172
-
\??\c:\lfxlllf.exec:\lfxlllf.exe98⤵PID:4160
-
\??\c:\ttnhbb.exec:\ttnhbb.exe99⤵PID:4048
-
\??\c:\thbtnn.exec:\thbtnn.exe100⤵PID:3292
-
\??\c:\dvvvj.exec:\dvvvj.exe101⤵PID:4040
-
\??\c:\pjdvp.exec:\pjdvp.exe102⤵PID:3192
-
\??\c:\fxxrlll.exec:\fxxrlll.exe103⤵PID:2312
-
\??\c:\rlxxfll.exec:\rlxxfll.exe104⤵PID:1084
-
\??\c:\frlfxrl.exec:\frlfxrl.exe105⤵PID:4168
-
\??\c:\pvppd.exec:\pvppd.exe106⤵PID:3544
-
\??\c:\3lfxfxr.exec:\3lfxfxr.exe107⤵PID:2444
-
\??\c:\7lfrrxf.exec:\7lfrrxf.exe108⤵PID:4392
-
\??\c:\tnbtbt.exec:\tnbtbt.exe109⤵PID:4548
-
\??\c:\nbbthh.exec:\nbbthh.exe110⤵PID:1312
-
\??\c:\vjdvd.exec:\vjdvd.exe111⤵PID:1432
-
\??\c:\vjdpp.exec:\vjdpp.exe112⤵PID:2164
-
\??\c:\3ffrfxx.exec:\3ffrfxx.exe113⤵PID:4372
-
\??\c:\lffrlfx.exec:\lffrlfx.exe114⤵PID:868
-
\??\c:\xxllrxf.exec:\xxllrxf.exe115⤵PID:4524
-
\??\c:\nbbtnn.exec:\nbbtnn.exe116⤵PID:4908
-
\??\c:\3nbttn.exec:\3nbttn.exe117⤵PID:2744
-
\??\c:\vppjd.exec:\vppjd.exe118⤵PID:1692
-
\??\c:\rrrrrlf.exec:\rrrrrlf.exe119⤵PID:4972
-
\??\c:\rfrllfl.exec:\rfrllfl.exe120⤵PID:380
-
\??\c:\lxrlxlx.exec:\lxrlxlx.exe121⤵PID:1420
-
\??\c:\hbhbhh.exec:\hbhbhh.exe122⤵PID:1060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-