Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
08c44d1a75249042fbe0bc3e51b9a920N.exe
Resource
win7-20240729-en
General
-
Target
08c44d1a75249042fbe0bc3e51b9a920N.exe
-
Size
96KB
-
MD5
08c44d1a75249042fbe0bc3e51b9a920
-
SHA1
6839c9eb592d17f7dee22a46ead58aa4b6c1eb82
-
SHA256
448b1d4924c92b17a3c120875e623a6af0c0fca822df9f749dd56a8349ef91a3
-
SHA512
031340d9f2e77654a3d11b1964b32e104cee2d96a09e8255381e735fd86d08c4d18690c2905e572c1b248245b2dd46760174e73c84f7e1b1a9c08e222b827fd1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrp:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfw4jr
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3584-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 984 rxrlrrx.exe 4964 hbtttt.exe 2000 thbhbn.exe 4168 rrxxfff.exe 4896 hbbttb.exe 4296 djdjd.exe 1236 xlrrllf.exe 4776 thnnhh.exe 2256 nthbhh.exe 932 dpdjv.exe 3168 hthbnb.exe 4432 vvpvp.exe 4532 rxlffff.exe 4972 9tbbhh.exe 532 3pjvd.exe 3064 ddvjd.exe 5108 lfxrllf.exe 456 tttnhh.exe 1536 jppvp.exe 4652 frrlfxx.exe 1396 thbbth.exe 1176 jvppp.exe 2832 rllfrrr.exe 4400 bbtnhh.exe 2812 ddvvp.exe 3696 ppjvd.exe 4264 ffrrlll.exe 4064 3rfrlxr.exe 836 nntnnn.exe 4376 vvpdj.exe 1332 rrrffll.exe 2384 nthttn.exe 4472 vvdjd.exe 4880 3vvvj.exe 408 rfxrffx.exe 4344 lflffff.exe 4212 hthntb.exe 2404 vpvvv.exe 1676 dpvpj.exe 2412 lfxrrlx.exe 2076 tnbbbh.exe 4896 9nbtnt.exe 712 jpvjv.exe 1512 jdpjv.exe 2300 dvvdd.exe 4528 fffxrrl.exe 1956 hhntbb.exe 4320 pdvvv.exe 3076 ddjdv.exe 64 flrlfll.exe 3732 rrffxxx.exe 1804 3htnhh.exe 3168 pjvpj.exe 4432 9djjd.exe 4668 xrxlffl.exe 4828 frxxxxx.exe 1192 tnnhhh.exe 2140 3bnhhb.exe 1148 pvpvj.exe 2516 9fffxrr.exe 3880 rrxrrrl.exe 640 7xffxxr.exe 4332 bhhhhh.exe 3412 dvvvp.exe -
resource yara_rule behavioral2/memory/3584-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3584 wrote to memory of 984 3584 08c44d1a75249042fbe0bc3e51b9a920N.exe 84 PID 3584 wrote to memory of 984 3584 08c44d1a75249042fbe0bc3e51b9a920N.exe 84 PID 3584 wrote to memory of 984 3584 08c44d1a75249042fbe0bc3e51b9a920N.exe 84 PID 984 wrote to memory of 4964 984 rxrlrrx.exe 85 PID 984 wrote to memory of 4964 984 rxrlrrx.exe 85 PID 984 wrote to memory of 4964 984 rxrlrrx.exe 85 PID 4964 wrote to memory of 2000 4964 hbtttt.exe 86 PID 4964 wrote to memory of 2000 4964 hbtttt.exe 86 PID 4964 wrote to memory of 2000 4964 hbtttt.exe 86 PID 2000 wrote to memory of 4168 2000 thbhbn.exe 87 PID 2000 wrote to memory of 4168 2000 thbhbn.exe 87 PID 2000 wrote to memory of 4168 2000 thbhbn.exe 87 PID 4168 wrote to memory of 4896 4168 rrxxfff.exe 88 PID 4168 wrote to memory of 4896 4168 rrxxfff.exe 88 PID 4168 wrote to memory of 4896 4168 rrxxfff.exe 88 PID 4896 wrote to memory of 4296 4896 hbbttb.exe 89 PID 4896 wrote to memory of 4296 4896 hbbttb.exe 89 PID 4896 wrote to memory of 4296 4896 hbbttb.exe 89 PID 4296 wrote to memory of 1236 4296 djdjd.exe 90 PID 4296 wrote to memory of 1236 4296 djdjd.exe 90 PID 4296 wrote to memory of 1236 4296 djdjd.exe 90 PID 1236 wrote to memory of 4776 1236 xlrrllf.exe 91 PID 1236 wrote to memory of 4776 1236 xlrrllf.exe 91 PID 1236 wrote to memory of 4776 1236 xlrrllf.exe 91 PID 4776 wrote to memory of 2256 4776 thnnhh.exe 92 PID 4776 wrote to memory of 2256 4776 thnnhh.exe 92 PID 4776 wrote to memory of 2256 4776 thnnhh.exe 92 PID 2256 wrote to memory of 932 2256 nthbhh.exe 93 PID 2256 wrote to memory of 932 2256 nthbhh.exe 93 PID 2256 wrote to memory of 932 2256 nthbhh.exe 93 PID 932 wrote to memory of 3168 932 dpdjv.exe 94 PID 932 wrote to memory of 3168 932 dpdjv.exe 94 PID 932 wrote to memory of 3168 932 dpdjv.exe 94 PID 3168 wrote to memory of 4432 3168 hthbnb.exe 96 PID 3168 wrote to memory of 4432 3168 hthbnb.exe 96 PID 3168 wrote to memory of 4432 3168 hthbnb.exe 96 PID 4432 wrote to memory of 4532 4432 vvpvp.exe 97 PID 4432 wrote to memory of 4532 4432 vvpvp.exe 97 PID 4432 wrote to memory of 4532 4432 vvpvp.exe 97 PID 4532 wrote to memory of 4972 4532 rxlffff.exe 98 PID 4532 wrote to memory of 4972 4532 rxlffff.exe 98 PID 4532 wrote to memory of 4972 4532 rxlffff.exe 98 PID 4972 wrote to memory of 532 4972 9tbbhh.exe 99 PID 4972 wrote to memory of 532 4972 9tbbhh.exe 99 PID 4972 wrote to memory of 532 4972 9tbbhh.exe 99 PID 532 wrote to memory of 3064 532 3pjvd.exe 100 PID 532 wrote to memory of 3064 532 3pjvd.exe 100 PID 532 wrote to memory of 3064 532 3pjvd.exe 100 PID 3064 wrote to memory of 5108 3064 ddvjd.exe 102 PID 3064 wrote to memory of 5108 3064 ddvjd.exe 102 PID 3064 wrote to memory of 5108 3064 ddvjd.exe 102 PID 5108 wrote to memory of 456 5108 lfxrllf.exe 103 PID 5108 wrote to memory of 456 5108 lfxrllf.exe 103 PID 5108 wrote to memory of 456 5108 lfxrllf.exe 103 PID 456 wrote to memory of 1536 456 tttnhh.exe 104 PID 456 wrote to memory of 1536 456 tttnhh.exe 104 PID 456 wrote to memory of 1536 456 tttnhh.exe 104 PID 1536 wrote to memory of 4652 1536 jppvp.exe 105 PID 1536 wrote to memory of 4652 1536 jppvp.exe 105 PID 1536 wrote to memory of 4652 1536 jppvp.exe 105 PID 4652 wrote to memory of 1396 4652 frrlfxx.exe 106 PID 4652 wrote to memory of 1396 4652 frrlfxx.exe 106 PID 4652 wrote to memory of 1396 4652 frrlfxx.exe 106 PID 1396 wrote to memory of 1176 1396 thbbth.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c44d1a75249042fbe0bc3e51b9a920N.exe"C:\Users\Admin\AppData\Local\Temp\08c44d1a75249042fbe0bc3e51b9a920N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\rxrlrrx.exec:\rxrlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\hbtttt.exec:\hbtttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\thbhbn.exec:\thbhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rrxxfff.exec:\rrxxfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\hbbttb.exec:\hbbttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\djdjd.exec:\djdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\xlrrllf.exec:\xlrrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\thnnhh.exec:\thnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\nthbhh.exec:\nthbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\dpdjv.exec:\dpdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\hthbnb.exec:\hthbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vvpvp.exec:\vvpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\rxlffff.exec:\rxlffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\9tbbhh.exec:\9tbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\3pjvd.exec:\3pjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\ddvjd.exec:\ddvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lfxrllf.exec:\lfxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\tttnhh.exec:\tttnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\jppvp.exec:\jppvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\frrlfxx.exec:\frrlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\thbbth.exec:\thbbth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\jvppp.exec:\jvppp.exe23⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rllfrrr.exec:\rllfrrr.exe24⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bbtnhh.exec:\bbtnhh.exe25⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ddvvp.exec:\ddvvp.exe26⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ppjvd.exec:\ppjvd.exe27⤵
- Executes dropped EXE
PID:3696 -
\??\c:\ffrrlll.exec:\ffrrlll.exe28⤵
- Executes dropped EXE
PID:4264 -
\??\c:\3rfrlxr.exec:\3rfrlxr.exe29⤵
- Executes dropped EXE
PID:4064 -
\??\c:\nntnnn.exec:\nntnnn.exe30⤵
- Executes dropped EXE
PID:836 -
\??\c:\vvpdj.exec:\vvpdj.exe31⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rrrffll.exec:\rrrffll.exe32⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nthttn.exec:\nthttn.exe33⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvdjd.exec:\vvdjd.exe34⤵
- Executes dropped EXE
PID:4472 -
\??\c:\3vvvj.exec:\3vvvj.exe35⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rfxrffx.exec:\rfxrffx.exe36⤵
- Executes dropped EXE
PID:408 -
\??\c:\lflffff.exec:\lflffff.exe37⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hthntb.exec:\hthntb.exe38⤵
- Executes dropped EXE
PID:4212 -
\??\c:\vpvvv.exec:\vpvvv.exe39⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dpvpj.exec:\dpvpj.exe40⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lfxrrlx.exec:\lfxrrlx.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tnbbbh.exec:\tnbbbh.exe42⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9nbtnt.exec:\9nbtnt.exe43⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jpvjv.exec:\jpvjv.exe44⤵
- Executes dropped EXE
PID:712 -
\??\c:\jdpjv.exec:\jdpjv.exe45⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dvvdd.exec:\dvvdd.exe46⤵
- Executes dropped EXE
PID:2300 -
\??\c:\fffxrrl.exec:\fffxrrl.exe47⤵
- Executes dropped EXE
PID:4528 -
\??\c:\hhntbb.exec:\hhntbb.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pdvvv.exec:\pdvvv.exe49⤵
- Executes dropped EXE
PID:4320 -
\??\c:\ddjdv.exec:\ddjdv.exe50⤵
- Executes dropped EXE
PID:3076 -
\??\c:\flrlfll.exec:\flrlfll.exe51⤵
- Executes dropped EXE
PID:64 -
\??\c:\rrffxxx.exec:\rrffxxx.exe52⤵
- Executes dropped EXE
PID:3732 -
\??\c:\3htnhh.exec:\3htnhh.exe53⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pjvpj.exec:\pjvpj.exe54⤵
- Executes dropped EXE
PID:3168 -
\??\c:\9djjd.exec:\9djjd.exe55⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xrxlffl.exec:\xrxlffl.exe56⤵
- Executes dropped EXE
PID:4668 -
\??\c:\frxxxxx.exec:\frxxxxx.exe57⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tnnhhh.exec:\tnnhhh.exe58⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3bnhhb.exec:\3bnhhb.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pvpvj.exec:\pvpvj.exe60⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9fffxrr.exec:\9fffxrr.exe61⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe62⤵
- Executes dropped EXE
PID:3880 -
\??\c:\7xffxxr.exec:\7xffxxr.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\bhhhhh.exec:\bhhhhh.exe64⤵
- Executes dropped EXE
PID:4332 -
\??\c:\dvvvp.exec:\dvvvp.exe65⤵
- Executes dropped EXE
PID:3412 -
\??\c:\vvjdj.exec:\vvjdj.exe66⤵PID:3452
-
\??\c:\rlxlrrr.exec:\rlxlrrr.exe67⤵PID:2308
-
\??\c:\hnttnn.exec:\hnttnn.exe68⤵PID:3692
-
\??\c:\tnbhbn.exec:\tnbhbn.exe69⤵PID:332
-
\??\c:\pjddv.exec:\pjddv.exe70⤵PID:3688
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe71⤵PID:1176
-
\??\c:\xllrrff.exec:\xllrrff.exe72⤵PID:4732
-
\??\c:\ntnbbb.exec:\ntnbbb.exe73⤵PID:944
-
\??\c:\ddvpd.exec:\ddvpd.exe74⤵PID:216
-
\??\c:\9pvpd.exec:\9pvpd.exe75⤵PID:3932
-
\??\c:\lffxllf.exec:\lffxllf.exe76⤵PID:464
-
\??\c:\xrllllr.exec:\xrllllr.exe77⤵
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\nnnhnn.exec:\nnnhnn.exe78⤵PID:1528
-
\??\c:\hnbbth.exec:\hnbbth.exe79⤵PID:388
-
\??\c:\vpddp.exec:\vpddp.exe80⤵PID:2772
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe81⤵PID:4396
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe82⤵PID:2120
-
\??\c:\nhtnbh.exec:\nhtnbh.exe83⤵PID:4372
-
\??\c:\hntnnn.exec:\hntnnn.exe84⤵PID:984
-
\??\c:\vpdvj.exec:\vpdvj.exe85⤵PID:1560
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe86⤵PID:4964
-
\??\c:\flllfxr.exec:\flllfxr.exe87⤵PID:4360
-
\??\c:\hbhnnt.exec:\hbhnnt.exe88⤵PID:952
-
\??\c:\thhbnn.exec:\thhbnn.exe89⤵PID:2864
-
\??\c:\vpdvv.exec:\vpdvv.exe90⤵PID:4220
-
\??\c:\vjpjd.exec:\vjpjd.exe91⤵PID:2076
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe92⤵PID:4088
-
\??\c:\hnthtn.exec:\hnthtn.exe93⤵PID:3172
-
\??\c:\dvddd.exec:\dvddd.exe94⤵PID:5044
-
\??\c:\vdpjp.exec:\vdpjp.exe95⤵PID:4496
-
\??\c:\frfrfll.exec:\frfrfll.exe96⤵PID:3480
-
\??\c:\hbnhbn.exec:\hbnhbn.exe97⤵PID:3548
-
\??\c:\jvdvp.exec:\jvdvp.exe98⤵PID:4084
-
\??\c:\dvvpp.exec:\dvvpp.exe99⤵PID:3612
-
\??\c:\flrffxx.exec:\flrffxx.exe100⤵PID:64
-
\??\c:\bbbbbb.exec:\bbbbbb.exe101⤵PID:780
-
\??\c:\hnhhtn.exec:\hnhhtn.exe102⤵PID:4636
-
\??\c:\vpvvp.exec:\vpvvp.exe103⤵PID:3168
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe104⤵PID:2524
-
\??\c:\7lllffx.exec:\7lllffx.exe105⤵PID:4196
-
\??\c:\bbbttn.exec:\bbbttn.exe106⤵PID:4828
-
\??\c:\7ntntt.exec:\7ntntt.exe107⤵PID:2656
-
\??\c:\jdddv.exec:\jdddv.exe108⤵PID:4520
-
\??\c:\dvvpj.exec:\dvvpj.exe109⤵PID:4324
-
\??\c:\fxlfxlf.exec:\fxlfxlf.exe110⤵PID:5108
-
\??\c:\ffffffr.exec:\ffffffr.exe111⤵PID:4544
-
\??\c:\nbhhbb.exec:\nbhhbb.exe112⤵PID:2332
-
\??\c:\7hnhnn.exec:\7hnhnn.exe113⤵PID:1160
-
\??\c:\7dddv.exec:\7dddv.exe114⤵
- System Location Discovery: System Language Discovery
PID:3824 -
\??\c:\pvpdv.exec:\pvpdv.exe115⤵PID:2904
-
\??\c:\9lfxlrl.exec:\9lfxlrl.exe116⤵PID:3424
-
\??\c:\xrlffxr.exec:\xrlffxr.exe117⤵PID:1040
-
\??\c:\tbbtbb.exec:\tbbtbb.exe118⤵PID:1056
-
\??\c:\bttnhh.exec:\bttnhh.exe119⤵PID:2152
-
\??\c:\vpjjd.exec:\vpjjd.exe120⤵PID:3780
-
\??\c:\rllllfx.exec:\rllllfx.exe121⤵PID:2812
-
\??\c:\frrrrlf.exec:\frrrrlf.exe122⤵PID:700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-