Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe
Resource
win7-20240903-en
General
-
Target
1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe
-
Size
230KB
-
MD5
517281f7bd56a43094ec1300f76f4e2f
-
SHA1
26235c95e67a2e5cd3869d5e0c49658c9f6bbef6
-
SHA256
1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b
-
SHA512
d2b334d69248fe135cbbb75bd9145dc22b95ede8048302ac8bda138a16b2c3fdf60de55c531a6ced06bbfe1cd0ddc36169ebc12ac568fab67df5e043a7ac02ea
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fE:n3C9BRo7MlrWKo+lxKk1c
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2656-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/100-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3608 xrrlfxx.exe 3708 tnhbbt.exe 1216 jppvj.exe 2400 rrfflfr.exe 4780 xfrffxl.exe 1148 xxrxxxf.exe 4256 tnnntn.exe 3880 pdjvp.exe 5020 xrlfrrl.exe 456 ntnbhh.exe 4508 jvvpp.exe 3304 fxfxrrl.exe 4820 7thbhh.exe 2244 pjjdj.exe 2588 5jpdv.exe 5088 nntntb.exe 2044 bttnbb.exe 4424 pdpdv.exe 3856 lffxlrl.exe 4048 5tnhbb.exe 3004 rrffrxx.exe 4492 bhnnnn.exe 2084 bbbhbt.exe 4644 pvdpd.exe 3420 xrlfxxx.exe 824 3bnnhh.exe 544 jjjdv.exe 100 vpjdp.exe 3544 xrlfxxr.exe 4516 hbhbtt.exe 4832 dppjj.exe 864 lrxrfrr.exe 1696 hbbbtt.exe 2880 djvjd.exe 4412 dvpdp.exe 4496 1fxrllf.exe 4848 7ffxxxr.exe 2440 nhbbtt.exe 3608 vvjdp.exe 3840 ddvvp.exe 1216 7llffll.exe 3528 ffffxxr.exe 3872 bbbttn.exe 1716 5dvvj.exe 3996 rllfxxr.exe 2748 9ttnht.exe 1284 3vvpd.exe 1432 lffxrlf.exe 1556 lxrlxrl.exe 1592 hbnhnn.exe 944 9jjjd.exe 4672 vddpj.exe 1560 lfrlxrl.exe 3604 1xfxrrl.exe 3676 bhbnhb.exe 4568 thhhhh.exe 2312 pvdpv.exe 2344 jdvdv.exe 3028 rlffxrl.exe 5024 fxlxrrl.exe 2540 tnnhtn.exe 2044 bbhbbt.exe 888 dvjvd.exe 3856 jppjd.exe -
resource yara_rule behavioral2/memory/2656-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 3608 2656 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 86 PID 2656 wrote to memory of 3608 2656 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 86 PID 2656 wrote to memory of 3608 2656 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 86 PID 3608 wrote to memory of 3708 3608 xrrlfxx.exe 87 PID 3608 wrote to memory of 3708 3608 xrrlfxx.exe 87 PID 3608 wrote to memory of 3708 3608 xrrlfxx.exe 87 PID 3708 wrote to memory of 1216 3708 tnhbbt.exe 88 PID 3708 wrote to memory of 1216 3708 tnhbbt.exe 88 PID 3708 wrote to memory of 1216 3708 tnhbbt.exe 88 PID 1216 wrote to memory of 2400 1216 jppvj.exe 89 PID 1216 wrote to memory of 2400 1216 jppvj.exe 89 PID 1216 wrote to memory of 2400 1216 jppvj.exe 89 PID 2400 wrote to memory of 4780 2400 rrfflfr.exe 90 PID 2400 wrote to memory of 4780 2400 rrfflfr.exe 90 PID 2400 wrote to memory of 4780 2400 rrfflfr.exe 90 PID 4780 wrote to memory of 1148 4780 xfrffxl.exe 91 PID 4780 wrote to memory of 1148 4780 xfrffxl.exe 91 PID 4780 wrote to memory of 1148 4780 xfrffxl.exe 91 PID 1148 wrote to memory of 4256 1148 xxrxxxf.exe 92 PID 1148 wrote to memory of 4256 1148 xxrxxxf.exe 92 PID 1148 wrote to memory of 4256 1148 xxrxxxf.exe 92 PID 4256 wrote to memory of 3880 4256 tnnntn.exe 93 PID 4256 wrote to memory of 3880 4256 tnnntn.exe 93 PID 4256 wrote to memory of 3880 4256 tnnntn.exe 93 PID 3880 wrote to memory of 5020 3880 pdjvp.exe 94 PID 3880 wrote to memory of 5020 3880 pdjvp.exe 94 PID 3880 wrote to memory of 5020 3880 pdjvp.exe 94 PID 5020 wrote to memory of 456 5020 xrlfrrl.exe 96 PID 5020 wrote to memory of 456 5020 xrlfrrl.exe 96 PID 5020 wrote to memory of 456 5020 xrlfrrl.exe 96 PID 456 wrote to memory of 4508 456 ntnbhh.exe 97 PID 456 wrote to memory of 4508 456 ntnbhh.exe 97 PID 456 wrote to memory of 4508 456 ntnbhh.exe 97 PID 4508 wrote to memory of 3304 4508 jvvpp.exe 98 PID 4508 wrote to memory of 3304 4508 jvvpp.exe 98 PID 4508 wrote to memory of 3304 4508 jvvpp.exe 98 PID 3304 wrote to memory of 4820 3304 fxfxrrl.exe 99 PID 3304 wrote to memory of 4820 3304 fxfxrrl.exe 99 PID 3304 wrote to memory of 4820 3304 fxfxrrl.exe 99 PID 4820 wrote to memory of 2244 4820 7thbhh.exe 101 PID 4820 wrote to memory of 2244 4820 7thbhh.exe 101 PID 4820 wrote to memory of 2244 4820 7thbhh.exe 101 PID 2244 wrote to memory of 2588 2244 pjjdj.exe 102 PID 2244 wrote to memory of 2588 2244 pjjdj.exe 102 PID 2244 wrote to memory of 2588 2244 pjjdj.exe 102 PID 2588 wrote to memory of 5088 2588 5jpdv.exe 103 PID 2588 wrote to memory of 5088 2588 5jpdv.exe 103 PID 2588 wrote to memory of 5088 2588 5jpdv.exe 103 PID 5088 wrote to memory of 2044 5088 nntntb.exe 104 PID 5088 wrote to memory of 2044 5088 nntntb.exe 104 PID 5088 wrote to memory of 2044 5088 nntntb.exe 104 PID 2044 wrote to memory of 4424 2044 bttnbb.exe 106 PID 2044 wrote to memory of 4424 2044 bttnbb.exe 106 PID 2044 wrote to memory of 4424 2044 bttnbb.exe 106 PID 4424 wrote to memory of 3856 4424 pdpdv.exe 107 PID 4424 wrote to memory of 3856 4424 pdpdv.exe 107 PID 4424 wrote to memory of 3856 4424 pdpdv.exe 107 PID 3856 wrote to memory of 4048 3856 lffxlrl.exe 108 PID 3856 wrote to memory of 4048 3856 lffxlrl.exe 108 PID 3856 wrote to memory of 4048 3856 lffxlrl.exe 108 PID 4048 wrote to memory of 3004 4048 5tnhbb.exe 109 PID 4048 wrote to memory of 3004 4048 5tnhbb.exe 109 PID 4048 wrote to memory of 3004 4048 5tnhbb.exe 109 PID 3004 wrote to memory of 4492 3004 rrffrxx.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe"C:\Users\Admin\AppData\Local\Temp\1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\tnhbbt.exec:\tnhbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jppvj.exec:\jppvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\rrfflfr.exec:\rrfflfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\xfrffxl.exec:\xfrffxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\xxrxxxf.exec:\xxrxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\tnnntn.exec:\tnnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\pdjvp.exec:\pdjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\ntnbhh.exec:\ntnbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\jvvpp.exec:\jvvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\7thbhh.exec:\7thbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\pjjdj.exec:\pjjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\5jpdv.exec:\5jpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nntntb.exec:\nntntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\bttnbb.exec:\bttnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\pdpdv.exec:\pdpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\lffxlrl.exec:\lffxlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\5tnhbb.exec:\5tnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\rrffrxx.exec:\rrffrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bhnnnn.exec:\bhnnnn.exe23⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bbbhbt.exec:\bbbhbt.exe24⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pvdpd.exec:\pvdpd.exe25⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe26⤵
- Executes dropped EXE
PID:3420 -
\??\c:\3bnnhh.exec:\3bnnhh.exe27⤵
- Executes dropped EXE
PID:824 -
\??\c:\jjjdv.exec:\jjjdv.exe28⤵
- Executes dropped EXE
PID:544 -
\??\c:\vpjdp.exec:\vpjdp.exe29⤵
- Executes dropped EXE
PID:100 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe30⤵
- Executes dropped EXE
PID:3544 -
\??\c:\hbhbtt.exec:\hbhbtt.exe31⤵
- Executes dropped EXE
PID:4516 -
\??\c:\dppjj.exec:\dppjj.exe32⤵
- Executes dropped EXE
PID:4832 -
\??\c:\lrxrfrr.exec:\lrxrfrr.exe33⤵
- Executes dropped EXE
PID:864 -
\??\c:\hbbbtt.exec:\hbbbtt.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\djvjd.exec:\djvjd.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dvpdp.exec:\dvpdp.exe36⤵
- Executes dropped EXE
PID:4412 -
\??\c:\1fxrllf.exec:\1fxrllf.exe37⤵
- Executes dropped EXE
PID:4496 -
\??\c:\7ffxxxr.exec:\7ffxxxr.exe38⤵
- Executes dropped EXE
PID:4848 -
\??\c:\nhbbtt.exec:\nhbbtt.exe39⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvjdp.exec:\vvjdp.exe40⤵
- Executes dropped EXE
PID:3608 -
\??\c:\ddvvp.exec:\ddvvp.exe41⤵
- Executes dropped EXE
PID:3840 -
\??\c:\7llffll.exec:\7llffll.exe42⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ffffxxr.exec:\ffffxxr.exe43⤵
- Executes dropped EXE
PID:3528 -
\??\c:\bbbttn.exec:\bbbttn.exe44⤵
- Executes dropped EXE
PID:3872 -
\??\c:\5dvvj.exec:\5dvvj.exe45⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rllfxxr.exec:\rllfxxr.exe46⤵
- Executes dropped EXE
PID:3996 -
\??\c:\9ttnht.exec:\9ttnht.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3vvpd.exec:\3vvpd.exe48⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lffxrlf.exec:\lffxrlf.exe49⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe50⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbnhnn.exec:\hbnhnn.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9jjjd.exec:\9jjjd.exe52⤵
- Executes dropped EXE
PID:944 -
\??\c:\vddpj.exec:\vddpj.exe53⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe54⤵
- Executes dropped EXE
PID:1560 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe55⤵
- Executes dropped EXE
PID:3604 -
\??\c:\bhbnhb.exec:\bhbnhb.exe56⤵
- Executes dropped EXE
PID:3676 -
\??\c:\thhhhh.exec:\thhhhh.exe57⤵
- Executes dropped EXE
PID:4568 -
\??\c:\pvdpv.exec:\pvdpv.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jdvdv.exec:\jdvdv.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlffxrl.exec:\rlffxrl.exe60⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024 -
\??\c:\tnnhtn.exec:\tnnhtn.exe62⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bbhbbt.exec:\bbhbbt.exe63⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvjvd.exec:\dvjvd.exe64⤵
- Executes dropped EXE
PID:888 -
\??\c:\jppjd.exec:\jppjd.exe65⤵
- Executes dropped EXE
PID:3856 -
\??\c:\xrrfllr.exec:\xrrfllr.exe66⤵PID:1132
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe67⤵PID:5084
-
\??\c:\bbbthb.exec:\bbbthb.exe68⤵PID:4180
-
\??\c:\nbhbnn.exec:\nbhbnn.exe69⤵PID:1536
-
\??\c:\5vvpd.exec:\5vvpd.exe70⤵PID:2712
-
\??\c:\bthbtt.exec:\bthbtt.exe71⤵PID:3432
-
\??\c:\bhhbnh.exec:\bhhbnh.exe72⤵PID:3420
-
\??\c:\pjjdv.exec:\pjjdv.exe73⤵PID:824
-
\??\c:\rllfxrr.exec:\rllfxrr.exe74⤵PID:3712
-
\??\c:\rrffxxf.exec:\rrffxxf.exe75⤵PID:1136
-
\??\c:\bthbnn.exec:\bthbnn.exe76⤵PID:100
-
\??\c:\btnnbt.exec:\btnnbt.exe77⤵PID:4888
-
\??\c:\1vpjv.exec:\1vpjv.exe78⤵PID:4244
-
\??\c:\3pjdd.exec:\3pjdd.exe79⤵PID:4404
-
\??\c:\5flfrlx.exec:\5flfrlx.exe80⤵PID:2176
-
\??\c:\xflfxrl.exec:\xflfxrl.exe81⤵PID:1256
-
\??\c:\9btnbh.exec:\9btnbh.exe82⤵PID:4308
-
\??\c:\7jjdp.exec:\7jjdp.exe83⤵PID:3052
-
\??\c:\5rlrffx.exec:\5rlrffx.exe84⤵PID:1588
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe85⤵PID:4720
-
\??\c:\bthhbh.exec:\bthhbh.exe86⤵PID:432
-
\??\c:\bbhbhh.exec:\bbhbhh.exe87⤵PID:1784
-
\??\c:\vdvdv.exec:\vdvdv.exe88⤵PID:2412
-
\??\c:\1vpjv.exec:\1vpjv.exe89⤵PID:3484
-
\??\c:\llrrfxl.exec:\llrrfxl.exe90⤵PID:3916
-
\??\c:\flxrrrr.exec:\flxrrrr.exe91⤵PID:4836
-
\??\c:\htbhhh.exec:\htbhhh.exe92⤵PID:5044
-
\??\c:\dppjv.exec:\dppjv.exe93⤵PID:3412
-
\??\c:\vppvj.exec:\vppvj.exe94⤵PID:3100
-
\??\c:\3jjdv.exec:\3jjdv.exe95⤵PID:2220
-
\??\c:\5lfxlfr.exec:\5lfxlfr.exe96⤵PID:5020
-
\??\c:\3tbnhh.exec:\3tbnhh.exe97⤵PID:2356
-
\??\c:\tthhtt.exec:\tthhtt.exe98⤵PID:1992
-
\??\c:\jpdpj.exec:\jpdpj.exe99⤵PID:4508
-
\??\c:\vddpd.exec:\vddpd.exe100⤵PID:3788
-
\??\c:\xrxllfr.exec:\xrxllfr.exe101⤵PID:3704
-
\??\c:\fxxrllf.exec:\fxxrllf.exe102⤵PID:4544
-
\??\c:\tbthbt.exec:\tbthbt.exe103⤵PID:5064
-
\??\c:\pvdpj.exec:\pvdpj.exe104⤵PID:3496
-
\??\c:\vjjvp.exec:\vjjvp.exe105⤵PID:4020
-
\??\c:\flrlfff.exec:\flrlfff.exe106⤵PID:1724
-
\??\c:\bthbnh.exec:\bthbnh.exe107⤵PID:5088
-
\??\c:\nhhbnn.exec:\nhhbnn.exe108⤵PID:1032
-
\??\c:\1jvpd.exec:\1jvpd.exe109⤵PID:3964
-
\??\c:\lrrlllf.exec:\lrrlllf.exe110⤵PID:3940
-
\??\c:\xffrlfx.exec:\xffrlfx.exe111⤵PID:3148
-
\??\c:\nnhtnb.exec:\nnhtnb.exe112⤵PID:4784
-
\??\c:\tnthtt.exec:\tnthtt.exe113⤵PID:3004
-
\??\c:\pddpd.exec:\pddpd.exe114⤵PID:2912
-
\??\c:\pdvpd.exec:\pdvpd.exe115⤵PID:208
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe116⤵PID:4480
-
\??\c:\lxlfxlf.exec:\lxlfxlf.exe117⤵PID:4804
-
\??\c:\9ttnhb.exec:\9ttnhb.exe118⤵PID:4348
-
\??\c:\nhtbnt.exec:\nhtbnt.exe119⤵PID:2088
-
\??\c:\vpvvp.exec:\vpvvp.exe120⤵PID:3184
-
\??\c:\vjpvj.exec:\vjpvj.exe121⤵PID:2952
-
\??\c:\fxfxflr.exec:\fxfxflr.exe122⤵PID:612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-