Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ea8b37bcc1773f9f6a997e74e8f59c0N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
6ea8b37bcc1773f9f6a997e74e8f59c0N.exe
-
Size
49KB
-
MD5
6ea8b37bcc1773f9f6a997e74e8f59c0
-
SHA1
3e55fd32f6d35ae46d39d89f3d3d744ac6cc7af1
-
SHA256
6883d281ef6305f9355e5abfd25100c446b7048656066eb14608db4f5cdf9efa
-
SHA512
1f6334da18553eeb4b2afce045cb42d92d67cbbf7b476aed3b3f36617edb7adc4459fa05fec981c45d438dbce3c80edf0d91d5e2fad7999b9b17425732ec3951
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvq:0cdpeeBSHHMHLf9RyIh
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1876-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-395-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-431-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-461-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/32-556-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-581-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-683-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-714-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-772-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-926-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-1237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-1285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 pvpdp.exe 1600 rflflfr.exe 856 nntnnt.exe 3584 pvdpd.exe 5100 3fxlfrl.exe 220 lrlfrlf.exe 2976 thbhth.exe 3856 vjddj.exe 4780 dvjvd.exe 2860 lrlrllr.exe 4416 rxfxrfx.exe 4616 nnnhbn.exe 436 jdvjp.exe 4396 dpvvd.exe 3116 xrrlxfx.exe 1444 bnbnnn.exe 3948 3nnbnh.exe 2628 5rlrlxl.exe 396 lfxrfrr.exe 556 tnhtbt.exe 2060 djpdj.exe 468 vjjvd.exe 3476 rxrrfxr.exe 5092 bhbthb.exe 2200 vpvpp.exe 4884 rxrflfr.exe 3864 rlxlxlx.exe 3536 9xxllff.exe 1920 3nhbnb.exe 3516 vdvjp.exe 1004 lxlxlrf.exe 4564 rfxrllx.exe 1740 thhnbt.exe 5076 nhthnh.exe 1520 ppdpv.exe 4428 lrllfff.exe 1528 llfxrxl.exe 2084 1pppv.exe 740 3ppdj.exe 4332 lrxlxrf.exe 212 5rlfrfr.exe 2512 htnhtn.exe 116 tnnbhb.exe 1448 vpjpd.exe 4200 rxxlxrl.exe 3644 thhbtn.exe 3176 7thnbn.exe 4500 jpvjd.exe 3792 ppjdp.exe 2532 rrxllfx.exe 2888 1xrrlxr.exe 4144 rlxrfxr.exe 4780 bttnbb.exe 2776 vpjdv.exe 3332 7vjvj.exe 2036 1lfxlfx.exe 2140 llrfxrr.exe 4620 5nbtnh.exe 880 ppvjd.exe 1908 vvdvj.exe 4816 lrlfrlf.exe 1736 5fflfrr.exe 4808 nbtntn.exe 1140 1tbtht.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1524 1876 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 83 PID 1876 wrote to memory of 1524 1876 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 83 PID 1876 wrote to memory of 1524 1876 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 83 PID 1524 wrote to memory of 1600 1524 pvpdp.exe 84 PID 1524 wrote to memory of 1600 1524 pvpdp.exe 84 PID 1524 wrote to memory of 1600 1524 pvpdp.exe 84 PID 1600 wrote to memory of 856 1600 rflflfr.exe 85 PID 1600 wrote to memory of 856 1600 rflflfr.exe 85 PID 1600 wrote to memory of 856 1600 rflflfr.exe 85 PID 856 wrote to memory of 3584 856 nntnnt.exe 86 PID 856 wrote to memory of 3584 856 nntnnt.exe 86 PID 856 wrote to memory of 3584 856 nntnnt.exe 86 PID 3584 wrote to memory of 5100 3584 pvdpd.exe 87 PID 3584 wrote to memory of 5100 3584 pvdpd.exe 87 PID 3584 wrote to memory of 5100 3584 pvdpd.exe 87 PID 5100 wrote to memory of 220 5100 3fxlfrl.exe 88 PID 5100 wrote to memory of 220 5100 3fxlfrl.exe 88 PID 5100 wrote to memory of 220 5100 3fxlfrl.exe 88 PID 220 wrote to memory of 2976 220 lrlfrlf.exe 89 PID 220 wrote to memory of 2976 220 lrlfrlf.exe 89 PID 220 wrote to memory of 2976 220 lrlfrlf.exe 89 PID 2976 wrote to memory of 3856 2976 thbhth.exe 90 PID 2976 wrote to memory of 3856 2976 thbhth.exe 90 PID 2976 wrote to memory of 3856 2976 thbhth.exe 90 PID 3856 wrote to memory of 4780 3856 vjddj.exe 91 PID 3856 wrote to memory of 4780 3856 vjddj.exe 91 PID 3856 wrote to memory of 4780 3856 vjddj.exe 91 PID 4780 wrote to memory of 2860 4780 dvjvd.exe 92 PID 4780 wrote to memory of 2860 4780 dvjvd.exe 92 PID 4780 wrote to memory of 2860 4780 dvjvd.exe 92 PID 2860 wrote to memory of 4416 2860 lrlrllr.exe 93 PID 2860 wrote to memory of 4416 2860 lrlrllr.exe 93 PID 2860 wrote to memory of 4416 2860 lrlrllr.exe 93 PID 4416 wrote to memory of 4616 4416 rxfxrfx.exe 94 PID 4416 wrote to memory of 4616 4416 rxfxrfx.exe 94 PID 4416 wrote to memory of 4616 4416 rxfxrfx.exe 94 PID 4616 wrote to memory of 436 4616 nnnhbn.exe 95 PID 4616 wrote to memory of 436 4616 nnnhbn.exe 95 PID 4616 wrote to memory of 436 4616 nnnhbn.exe 95 PID 436 wrote to memory of 4396 436 jdvjp.exe 97 PID 436 wrote to memory of 4396 436 jdvjp.exe 97 PID 436 wrote to memory of 4396 436 jdvjp.exe 97 PID 4396 wrote to memory of 3116 4396 dpvvd.exe 98 PID 4396 wrote to memory of 3116 4396 dpvvd.exe 98 PID 4396 wrote to memory of 3116 4396 dpvvd.exe 98 PID 3116 wrote to memory of 1444 3116 xrrlxfx.exe 99 PID 3116 wrote to memory of 1444 3116 xrrlxfx.exe 99 PID 3116 wrote to memory of 1444 3116 xrrlxfx.exe 99 PID 1444 wrote to memory of 3948 1444 bnbnnn.exe 100 PID 1444 wrote to memory of 3948 1444 bnbnnn.exe 100 PID 1444 wrote to memory of 3948 1444 bnbnnn.exe 100 PID 3948 wrote to memory of 2628 3948 3nnbnh.exe 102 PID 3948 wrote to memory of 2628 3948 3nnbnh.exe 102 PID 3948 wrote to memory of 2628 3948 3nnbnh.exe 102 PID 2628 wrote to memory of 396 2628 5rlrlxl.exe 103 PID 2628 wrote to memory of 396 2628 5rlrlxl.exe 103 PID 2628 wrote to memory of 396 2628 5rlrlxl.exe 103 PID 396 wrote to memory of 556 396 lfxrfrr.exe 104 PID 396 wrote to memory of 556 396 lfxrfrr.exe 104 PID 396 wrote to memory of 556 396 lfxrfrr.exe 104 PID 556 wrote to memory of 2060 556 tnhtbt.exe 105 PID 556 wrote to memory of 2060 556 tnhtbt.exe 105 PID 556 wrote to memory of 2060 556 tnhtbt.exe 105 PID 2060 wrote to memory of 468 2060 djpdj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea8b37bcc1773f9f6a997e74e8f59c0N.exe"C:\Users\Admin\AppData\Local\Temp\6ea8b37bcc1773f9f6a997e74e8f59c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\pvpdp.exec:\pvpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\rflflfr.exec:\rflflfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\nntnnt.exec:\nntnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\pvdpd.exec:\pvdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\3fxlfrl.exec:\3fxlfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\thbhth.exec:\thbhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vjddj.exec:\vjddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\dvjvd.exec:\dvjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\lrlrllr.exec:\lrlrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rxfxrfx.exec:\rxfxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\nnnhbn.exec:\nnnhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\jdvjp.exec:\jdvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\dpvvd.exec:\dpvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\bnbnnn.exec:\bnbnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\3nnbnh.exec:\3nnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\5rlrlxl.exec:\5rlrlxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\lfxrfrr.exec:\lfxrfrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\tnhtbt.exec:\tnhtbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\djpdj.exec:\djpdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\vjjvd.exec:\vjjvd.exe23⤵
- Executes dropped EXE
PID:468 -
\??\c:\rxrrfxr.exec:\rxrrfxr.exe24⤵
- Executes dropped EXE
PID:3476 -
\??\c:\bhbthb.exec:\bhbthb.exe25⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vpvpp.exec:\vpvpp.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rxrflfr.exec:\rxrflfr.exe27⤵
- Executes dropped EXE
PID:4884 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe28⤵
- Executes dropped EXE
PID:3864 -
\??\c:\9xxllff.exec:\9xxllff.exe29⤵
- Executes dropped EXE
PID:3536 -
\??\c:\3nhbnb.exec:\3nhbnb.exe30⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vdvjp.exec:\vdvjp.exe31⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe32⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rfxrllx.exec:\rfxrllx.exe33⤵
- Executes dropped EXE
PID:4564 -
\??\c:\thhnbt.exec:\thhnbt.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhthnh.exec:\nhthnh.exe35⤵
- Executes dropped EXE
PID:5076 -
\??\c:\ppdpv.exec:\ppdpv.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lrllfff.exec:\lrllfff.exe37⤵
- Executes dropped EXE
PID:4428 -
\??\c:\llfxrxl.exec:\llfxrxl.exe38⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1pppv.exec:\1pppv.exe39⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3ppdj.exec:\3ppdj.exe40⤵
- Executes dropped EXE
PID:740 -
\??\c:\lrxlxrf.exec:\lrxlxrf.exe41⤵
- Executes dropped EXE
PID:4332 -
\??\c:\5rlfrfr.exec:\5rlfrfr.exe42⤵
- Executes dropped EXE
PID:212 -
\??\c:\htnhtn.exec:\htnhtn.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tnnbhb.exec:\tnnbhb.exe44⤵
- Executes dropped EXE
PID:116 -
\??\c:\vpjpd.exec:\vpjpd.exe45⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe46⤵
- Executes dropped EXE
PID:4200 -
\??\c:\thhbtn.exec:\thhbtn.exe47⤵
- Executes dropped EXE
PID:3644 -
\??\c:\7thnbn.exec:\7thnbn.exe48⤵
- Executes dropped EXE
PID:3176 -
\??\c:\jpvjd.exec:\jpvjd.exe49⤵
- Executes dropped EXE
PID:4500 -
\??\c:\ppjdp.exec:\ppjdp.exe50⤵
- Executes dropped EXE
PID:3792 -
\??\c:\rrxllfx.exec:\rrxllfx.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1xrrlxr.exec:\1xrrlxr.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlxrfxr.exec:\rlxrfxr.exe53⤵
- Executes dropped EXE
PID:4144 -
\??\c:\bttnbb.exec:\bttnbb.exe54⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vpjdv.exec:\vpjdv.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7vjvj.exec:\7vjvj.exe56⤵
- Executes dropped EXE
PID:3332 -
\??\c:\1lfxlfx.exec:\1lfxlfx.exe57⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llrfxrr.exec:\llrfxrr.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5nbtnh.exec:\5nbtnh.exe59⤵
- Executes dropped EXE
PID:4620 -
\??\c:\ppvjd.exec:\ppvjd.exe60⤵
- Executes dropped EXE
PID:880 -
\??\c:\vvdvj.exec:\vvdvj.exe61⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe62⤵
- Executes dropped EXE
PID:4816 -
\??\c:\5fflfrr.exec:\5fflfrr.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbtntn.exec:\nbtntn.exe64⤵
- Executes dropped EXE
PID:4808 -
\??\c:\1tbtht.exec:\1tbtht.exe65⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ddvjv.exec:\ddvjv.exe66⤵PID:3696
-
\??\c:\5rrflfx.exec:\5rrflfx.exe67⤵PID:1380
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe68⤵PID:748
-
\??\c:\htbnbb.exec:\htbnbb.exe69⤵PID:1552
-
\??\c:\hnnbtn.exec:\hnnbtn.exe70⤵PID:4504
-
\??\c:\dvvpd.exec:\dvvpd.exe71⤵PID:3320
-
\??\c:\xrlrflf.exec:\xrlrflf.exe72⤵PID:2984
-
\??\c:\xffxlfr.exec:\xffxlfr.exe73⤵PID:4612
-
\??\c:\3nnhnn.exec:\3nnhnn.exe74⤵PID:2656
-
\??\c:\9bbtnb.exec:\9bbtnb.exe75⤵PID:4456
-
\??\c:\vdpjd.exec:\vdpjd.exe76⤵PID:816
-
\??\c:\rlrlrlx.exec:\rlrlrlx.exe77⤵PID:3344
-
\??\c:\xlrrrlf.exec:\xlrrrlf.exe78⤵PID:3616
-
\??\c:\bnntnt.exec:\bnntnt.exe79⤵PID:4884
-
\??\c:\3tnnhh.exec:\3tnnhh.exe80⤵PID:3864
-
\??\c:\jddvj.exec:\jddvj.exe81⤵PID:552
-
\??\c:\jvvjd.exec:\jvvjd.exe82⤵PID:924
-
\??\c:\xrxlxlf.exec:\xrxlxlf.exe83⤵PID:2908
-
\??\c:\3xxxxrr.exec:\3xxxxrr.exe84⤵PID:864
-
\??\c:\ntnbhh.exec:\ntnbhh.exe85⤵PID:664
-
\??\c:\ttbtbh.exec:\ttbtbh.exe86⤵PID:4404
-
\??\c:\vdjdp.exec:\vdjdp.exe87⤵PID:3308
-
\??\c:\5vjvv.exec:\5vjvv.exe88⤵PID:3364
-
\??\c:\lffrrfl.exec:\lffrrfl.exe89⤵PID:4056
-
\??\c:\frrlfxr.exec:\frrlfxr.exe90⤵PID:4080
-
\??\c:\thnhbt.exec:\thnhbt.exe91⤵PID:4576
-
\??\c:\nnhthn.exec:\nnhthn.exe92⤵PID:1900
-
\??\c:\7vpjv.exec:\7vpjv.exe93⤵PID:4064
-
\??\c:\jpppd.exec:\jpppd.exe94⤵PID:4960
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe95⤵PID:2324
-
\??\c:\9rrfrlf.exec:\9rrfrlf.exe96⤵PID:4756
-
\??\c:\3ttnbt.exec:\3ttnbt.exe97⤵PID:4436
-
\??\c:\ntnbnh.exec:\ntnbnh.exe98⤵
- System Location Discovery: System Language Discovery
PID:4332 -
\??\c:\dddvj.exec:\dddvj.exe99⤵PID:1332
-
\??\c:\vppdp.exec:\vppdp.exe100⤵PID:1664
-
\??\c:\lxlfffl.exec:\lxlfffl.exe101⤵PID:3760
-
\??\c:\rffxrlx.exec:\rffxrlx.exe102⤵PID:1456
-
\??\c:\7hbnhb.exec:\7hbnhb.exe103⤵PID:3584
-
\??\c:\vppjp.exec:\vppjp.exe104⤵PID:3620
-
\??\c:\pvjvd.exec:\pvjvd.exe105⤵PID:5100
-
\??\c:\vpjdj.exec:\vpjdj.exe106⤵PID:3724
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe107⤵PID:4536
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe108⤵PID:3792
-
\??\c:\bbhbnh.exec:\bbhbnh.exe109⤵PID:4988
-
\??\c:\3bhbbt.exec:\3bhbbt.exe110⤵PID:3916
-
\??\c:\1pjdv.exec:\1pjdv.exe111⤵PID:1948
-
\??\c:\5pvjd.exec:\5pvjd.exe112⤵PID:3328
-
\??\c:\jpjpd.exec:\jpjpd.exe113⤵PID:3044
-
\??\c:\rxfxflf.exec:\rxfxflf.exe114⤵PID:4616
-
\??\c:\lffxlfx.exec:\lffxlfx.exe115⤵PID:2540
-
\??\c:\fffrfxr.exec:\fffrfxr.exe116⤵PID:2396
-
\??\c:\hbthbn.exec:\hbthbn.exe117⤵PID:1404
-
\??\c:\djdvj.exec:\djdvj.exe118⤵PID:3512
-
\??\c:\ppvjv.exec:\ppvjv.exe119⤵PID:2420
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe120⤵PID:3208
-
\??\c:\rlfxffr.exec:\rlfxffr.exe121⤵PID:5008
-
\??\c:\htttnh.exec:\htttnh.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-