Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2e5b9f12497d50407f5581dc4e9d4e0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
f2e5b9f12497d50407f5581dc4e9d4e0N.exe
-
Size
86KB
-
MD5
f2e5b9f12497d50407f5581dc4e9d4e0
-
SHA1
51013be31cfdc31724009052c1f85caf69d8bb05
-
SHA256
5e95509de25fbbfc03d6a9606bbc9abe5c3fb1c4990b8e2881118de2e9ef5534
-
SHA512
9e4c83527421c19365ba774d8e92a81899d7ead9024dee5469146e6b7e158fe0d1893062179734cb7c6c7b4f542861f4cebc7c5108ea465d15445275f28634af
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufT7Y:ymb3NkkiQ3mdBjFodt27HobvcyLuf4
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4704-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4912 lflfxxx.exe 3724 jdjvv.exe 4988 xxrlxxl.exe 2292 nnttbn.exe 1604 jvvvp.exe 3004 rllrrxr.exe 1560 9tnhhh.exe 2792 5ddvv.exe 2116 jjjdd.exe 4736 7xffrrx.exe 388 btbbhh.exe 4960 dpjdj.exe 772 7rxxrrl.exe 4804 nhbtbh.exe 1532 7btnbb.exe 880 vvjdp.exe 2836 llfxlrr.exe 1652 bbnnhh.exe 3616 9bhbtb.exe 1668 dvvvp.exe 4236 xxxxlrl.exe 3956 hhtnhh.exe 1888 1jjdv.exe 4044 rlrlffx.exe 1148 thnnbh.exe 4456 nntnhh.exe 4344 llxrlll.exe 1284 9rxrllf.exe 3144 bnbbhb.exe 1900 jjvpj.exe 3832 7ddvp.exe 4256 lflfrrr.exe 2540 thhbtt.exe 1136 nhhhbt.exe 4348 3pjjd.exe 2548 3xxrrrf.exe 3432 5rffllx.exe 4312 7lxfflf.exe 4356 hhhhhh.exe 2024 7htnhh.exe 2312 dpdvp.exe 4912 lxxrffx.exe 4404 lrrlfff.exe 3444 lfxxrxx.exe 3996 bbtnhh.exe 4280 tnbthh.exe 2796 vdjvj.exe 3240 1lfrlxr.exe 1948 llffxrr.exe 2896 thhtnh.exe 4832 tbtnbb.exe 5000 3vpjd.exe 1512 jvjdv.exe 3112 5rrlxfx.exe 4172 5bhbbb.exe 2012 7tnhbt.exe 1540 vpjdv.exe 4148 3fxrffx.exe 4908 rlrxfxf.exe 4804 nnbtnn.exe 4504 vdpjj.exe 4756 pjvpj.exe 944 lfffxxr.exe 1100 xlllxrx.exe -
resource yara_rule behavioral2/memory/4704-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4912 4704 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 84 PID 4704 wrote to memory of 4912 4704 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 84 PID 4704 wrote to memory of 4912 4704 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 84 PID 4912 wrote to memory of 3724 4912 lflfxxx.exe 85 PID 4912 wrote to memory of 3724 4912 lflfxxx.exe 85 PID 4912 wrote to memory of 3724 4912 lflfxxx.exe 85 PID 3724 wrote to memory of 4988 3724 jdjvv.exe 86 PID 3724 wrote to memory of 4988 3724 jdjvv.exe 86 PID 3724 wrote to memory of 4988 3724 jdjvv.exe 86 PID 4988 wrote to memory of 2292 4988 xxrlxxl.exe 87 PID 4988 wrote to memory of 2292 4988 xxrlxxl.exe 87 PID 4988 wrote to memory of 2292 4988 xxrlxxl.exe 87 PID 2292 wrote to memory of 1604 2292 nnttbn.exe 88 PID 2292 wrote to memory of 1604 2292 nnttbn.exe 88 PID 2292 wrote to memory of 1604 2292 nnttbn.exe 88 PID 1604 wrote to memory of 3004 1604 jvvvp.exe 89 PID 1604 wrote to memory of 3004 1604 jvvvp.exe 89 PID 1604 wrote to memory of 3004 1604 jvvvp.exe 89 PID 3004 wrote to memory of 1560 3004 rllrrxr.exe 90 PID 3004 wrote to memory of 1560 3004 rllrrxr.exe 90 PID 3004 wrote to memory of 1560 3004 rllrrxr.exe 90 PID 1560 wrote to memory of 2792 1560 9tnhhh.exe 91 PID 1560 wrote to memory of 2792 1560 9tnhhh.exe 91 PID 1560 wrote to memory of 2792 1560 9tnhhh.exe 91 PID 2792 wrote to memory of 2116 2792 5ddvv.exe 93 PID 2792 wrote to memory of 2116 2792 5ddvv.exe 93 PID 2792 wrote to memory of 2116 2792 5ddvv.exe 93 PID 2116 wrote to memory of 4736 2116 jjjdd.exe 94 PID 2116 wrote to memory of 4736 2116 jjjdd.exe 94 PID 2116 wrote to memory of 4736 2116 jjjdd.exe 94 PID 4736 wrote to memory of 388 4736 7xffrrx.exe 95 PID 4736 wrote to memory of 388 4736 7xffrrx.exe 95 PID 4736 wrote to memory of 388 4736 7xffrrx.exe 95 PID 388 wrote to memory of 4960 388 btbbhh.exe 96 PID 388 wrote to memory of 4960 388 btbbhh.exe 96 PID 388 wrote to memory of 4960 388 btbbhh.exe 96 PID 4960 wrote to memory of 772 4960 dpjdj.exe 97 PID 4960 wrote to memory of 772 4960 dpjdj.exe 97 PID 4960 wrote to memory of 772 4960 dpjdj.exe 97 PID 772 wrote to memory of 4804 772 7rxxrrl.exe 99 PID 772 wrote to memory of 4804 772 7rxxrrl.exe 99 PID 772 wrote to memory of 4804 772 7rxxrrl.exe 99 PID 4804 wrote to memory of 1532 4804 nhbtbh.exe 100 PID 4804 wrote to memory of 1532 4804 nhbtbh.exe 100 PID 4804 wrote to memory of 1532 4804 nhbtbh.exe 100 PID 1532 wrote to memory of 880 1532 7btnbb.exe 101 PID 1532 wrote to memory of 880 1532 7btnbb.exe 101 PID 1532 wrote to memory of 880 1532 7btnbb.exe 101 PID 880 wrote to memory of 2836 880 vvjdp.exe 102 PID 880 wrote to memory of 2836 880 vvjdp.exe 102 PID 880 wrote to memory of 2836 880 vvjdp.exe 102 PID 2836 wrote to memory of 1652 2836 llfxlrr.exe 103 PID 2836 wrote to memory of 1652 2836 llfxlrr.exe 103 PID 2836 wrote to memory of 1652 2836 llfxlrr.exe 103 PID 1652 wrote to memory of 3616 1652 bbnnhh.exe 104 PID 1652 wrote to memory of 3616 1652 bbnnhh.exe 104 PID 1652 wrote to memory of 3616 1652 bbnnhh.exe 104 PID 3616 wrote to memory of 1668 3616 9bhbtb.exe 106 PID 3616 wrote to memory of 1668 3616 9bhbtb.exe 106 PID 3616 wrote to memory of 1668 3616 9bhbtb.exe 106 PID 1668 wrote to memory of 4236 1668 dvvvp.exe 107 PID 1668 wrote to memory of 4236 1668 dvvvp.exe 107 PID 1668 wrote to memory of 4236 1668 dvvvp.exe 107 PID 4236 wrote to memory of 3956 4236 xxxxlrl.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2e5b9f12497d50407f5581dc4e9d4e0N.exe"C:\Users\Admin\AppData\Local\Temp\f2e5b9f12497d50407f5581dc4e9d4e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\lflfxxx.exec:\lflfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\jdjvv.exec:\jdjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\nnttbn.exec:\nnttbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jvvvp.exec:\jvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rllrrxr.exec:\rllrrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\9tnhhh.exec:\9tnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\5ddvv.exec:\5ddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjjdd.exec:\jjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7xffrrx.exec:\7xffrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\btbbhh.exec:\btbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\dpjdj.exec:\dpjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\7rxxrrl.exec:\7rxxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\nhbtbh.exec:\nhbtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\7btnbb.exec:\7btnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\vvjdp.exec:\vvjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\llfxlrr.exec:\llfxlrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bbnnhh.exec:\bbnnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\9bhbtb.exec:\9bhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\dvvvp.exec:\dvvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xxxxlrl.exec:\xxxxlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\hhtnhh.exec:\hhtnhh.exe23⤵
- Executes dropped EXE
PID:3956 -
\??\c:\1jjdv.exec:\1jjdv.exe24⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlrlffx.exec:\rlrlffx.exe25⤵
- Executes dropped EXE
PID:4044 -
\??\c:\thnnbh.exec:\thnnbh.exe26⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nntnhh.exec:\nntnhh.exe27⤵
- Executes dropped EXE
PID:4456 -
\??\c:\llxrlll.exec:\llxrlll.exe28⤵
- Executes dropped EXE
PID:4344 -
\??\c:\9rxrllf.exec:\9rxrllf.exe29⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bnbbhb.exec:\bnbbhb.exe30⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jjvpj.exec:\jjvpj.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\7ddvp.exec:\7ddvp.exe32⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lflfrrr.exec:\lflfrrr.exe33⤵
- Executes dropped EXE
PID:4256 -
\??\c:\thhbtt.exec:\thhbtt.exe34⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhhhbt.exec:\nhhhbt.exe35⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3pjjd.exec:\3pjjd.exe36⤵
- Executes dropped EXE
PID:4348 -
\??\c:\3xxrrrf.exec:\3xxrrrf.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5rffllx.exec:\5rffllx.exe38⤵
- Executes dropped EXE
PID:3432 -
\??\c:\7lxfflf.exec:\7lxfflf.exe39⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hhhhhh.exec:\hhhhhh.exe40⤵
- Executes dropped EXE
PID:4356 -
\??\c:\7htnhh.exec:\7htnhh.exe41⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dpdvp.exec:\dpdvp.exe42⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lxxrffx.exec:\lxxrffx.exe43⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lrrlfff.exec:\lrrlfff.exe44⤵
- Executes dropped EXE
PID:4404 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe45⤵
- Executes dropped EXE
PID:3444 -
\??\c:\bbtnhh.exec:\bbtnhh.exe46⤵
- Executes dropped EXE
PID:3996 -
\??\c:\tnbthh.exec:\tnbthh.exe47⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vdjvj.exec:\vdjvj.exe48⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1lfrlxr.exec:\1lfrlxr.exe49⤵
- Executes dropped EXE
PID:3240 -
\??\c:\llffxrr.exec:\llffxrr.exe50⤵
- Executes dropped EXE
PID:1948 -
\??\c:\thhtnh.exec:\thhtnh.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\tbtnbb.exec:\tbtnbb.exe52⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3vpjd.exec:\3vpjd.exe53⤵
- Executes dropped EXE
PID:5000 -
\??\c:\jvjdv.exec:\jvjdv.exe54⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5rrlxfx.exec:\5rrlxfx.exe55⤵
- Executes dropped EXE
PID:3112 -
\??\c:\5bhbbb.exec:\5bhbbb.exe56⤵
- Executes dropped EXE
PID:4172 -
\??\c:\7tnhbt.exec:\7tnhbt.exe57⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vpjdv.exec:\vpjdv.exe58⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3fxrffx.exec:\3fxrffx.exe59⤵
- Executes dropped EXE
PID:4148 -
\??\c:\rlrxfxf.exec:\rlrxfxf.exe60⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nnbtnn.exec:\nnbtnn.exe61⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vdpjj.exec:\vdpjj.exe62⤵
- Executes dropped EXE
PID:4504 -
\??\c:\pjvpj.exec:\pjvpj.exe63⤵
- Executes dropped EXE
PID:4756 -
\??\c:\lfffxxr.exec:\lfffxxr.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\xlllxrx.exec:\xlllxrx.exe65⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9hbbtn.exec:\9hbbtn.exe66⤵PID:228
-
\??\c:\hbnhbt.exec:\hbnhbt.exe67⤵PID:532
-
\??\c:\7vvpp.exec:\7vvpp.exe68⤵PID:1652
-
\??\c:\vjpjv.exec:\vjpjv.exe69⤵PID:3616
-
\??\c:\frxrrlr.exec:\frxrrlr.exe70⤵PID:676
-
\??\c:\9nhbnn.exec:\9nhbnn.exe71⤵PID:4444
-
\??\c:\tbhthh.exec:\tbhthh.exe72⤵PID:2776
-
\??\c:\vjdvp.exec:\vjdvp.exe73⤵PID:4984
-
\??\c:\9jpjd.exec:\9jpjd.exe74⤵PID:2956
-
\??\c:\ffllfxx.exec:\ffllfxx.exe75⤵PID:1892
-
\??\c:\7rxrlfx.exec:\7rxrlfx.exe76⤵PID:2960
-
\??\c:\jjpjv.exec:\jjpjv.exe77⤵PID:2020
-
\??\c:\dddvj.exec:\dddvj.exe78⤵PID:4480
-
\??\c:\rxlxrlx.exec:\rxlxrlx.exe79⤵PID:3928
-
\??\c:\rllffxx.exec:\rllffxx.exe80⤵PID:2468
-
\??\c:\hnnnhb.exec:\hnnnhb.exe81⤵PID:3096
-
\??\c:\vpdvp.exec:\vpdvp.exe82⤵PID:2964
-
\??\c:\vppjp.exec:\vppjp.exe83⤵PID:3880
-
\??\c:\xfxflrr.exec:\xfxflrr.exe84⤵PID:4256
-
\??\c:\5fxxfff.exec:\5fxxfff.exe85⤵PID:2520
-
\??\c:\3hhbtt.exec:\3hhbtt.exe86⤵PID:808
-
\??\c:\jvvpj.exec:\jvvpj.exe87⤵PID:2264
-
\??\c:\9ddpd.exec:\9ddpd.exe88⤵PID:220
-
\??\c:\frxxlll.exec:\frxxlll.exe89⤵PID:3620
-
\??\c:\lfrrffx.exec:\lfrrffx.exe90⤵PID:4312
-
\??\c:\bthtnn.exec:\bthtnn.exe91⤵PID:4800
-
\??\c:\3vpjd.exec:\3vpjd.exe92⤵PID:2024
-
\??\c:\ddvpj.exec:\ddvpj.exe93⤵PID:2312
-
\??\c:\5llfrrl.exec:\5llfrrl.exe94⤵PID:4412
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe95⤵PID:3372
-
\??\c:\tnnhbb.exec:\tnnhbb.exe96⤵PID:116
-
\??\c:\pvpjv.exec:\pvpjv.exe97⤵PID:1988
-
\??\c:\pjvpp.exec:\pjvpp.exe98⤵PID:4280
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe99⤵PID:4264
-
\??\c:\bttttn.exec:\bttttn.exe100⤵PID:2132
-
\??\c:\hbhthh.exec:\hbhthh.exe101⤵PID:4580
-
\??\c:\bbtnnn.exec:\bbtnnn.exe102⤵
- System Location Discovery: System Language Discovery
PID:3264 -
\??\c:\dvjdd.exec:\dvjdd.exe103⤵PID:216
-
\??\c:\vpvpd.exec:\vpvpd.exe104⤵PID:4072
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe105⤵PID:1396
-
\??\c:\lffxxrx.exec:\lffxxrx.exe106⤵PID:4736
-
\??\c:\nhbbnn.exec:\nhbbnn.exe107⤵PID:5032
-
\??\c:\hhnhhb.exec:\hhnhhb.exe108⤵PID:4744
-
\??\c:\jdjdj.exec:\jdjdj.exe109⤵PID:4892
-
\??\c:\9djdp.exec:\9djdp.exe110⤵PID:2688
-
\??\c:\rllfxxx.exec:\rllfxxx.exe111⤵PID:3992
-
\??\c:\7rxlrrf.exec:\7rxlrrf.exe112⤵PID:880
-
\??\c:\hnnhbb.exec:\hnnhbb.exe113⤵PID:3104
-
\??\c:\3tnhbb.exec:\3tnhbb.exe114⤵PID:1564
-
\??\c:\ppjjd.exec:\ppjjd.exe115⤵PID:232
-
\??\c:\vvvvj.exec:\vvvvj.exe116⤵PID:4764
-
\??\c:\fxfrxrx.exec:\fxfrxrx.exe117⤵PID:4868
-
\??\c:\9frrrrr.exec:\9frrrrr.exe118⤵PID:4540
-
\??\c:\1bnbtt.exec:\1bnbtt.exe119⤵PID:3540
-
\??\c:\1hbbnh.exec:\1hbbnh.exe120⤵PID:676
-
\??\c:\vddvj.exec:\vddvj.exe121⤵PID:4444
-
\??\c:\7jvjd.exec:\7jvjd.exe122⤵PID:4004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-