Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 05:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f6fb5b7c50fa7773545c8c2112189a0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
7f6fb5b7c50fa7773545c8c2112189a0N.exe
-
Size
82KB
-
MD5
7f6fb5b7c50fa7773545c8c2112189a0
-
SHA1
529b3c9ad72c977c5ad64a765c07b3ed64f0e58f
-
SHA256
a5a1c4fcf2518b4d73d53569fdaa1f36773836081975ab35080769c55461b667
-
SHA512
0aea601c91b5f4212b6f5e723557f00447c81d7284f828c7068e90e031931b5a08c1face0179fb49205f87cc3e4d8806ffb1df8e22e188df7eef4a37fdf0bacf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QFq:ymb3NkkiQ3mdBjFIIp9L9QrrA8T
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4456-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5012 nhnhbb.exe 60 vddvp.exe 2520 pjdpj.exe 2940 nbnhbt.exe 4696 5dvpj.exe 2104 jddvv.exe 184 lxlxrrl.exe 4976 thnthh.exe 1680 fxfxllf.exe 1152 tnbtnn.exe 4440 btthhb.exe 3792 5dpjd.exe 3468 5jdvp.exe 3576 7rxxllf.exe 3052 tttnhh.exe 1500 djdvp.exe 3924 vjppj.exe 2552 ffxlfff.exe 2764 tbbtnh.exe 3840 nbbnbb.exe 3640 jdjjv.exe 4772 rllfrll.exe 5096 btnhbb.exe 3216 1tnhbb.exe 1928 pdpjv.exe 3704 jvdvj.exe 4572 lfxrllr.exe 3892 btbhnb.exe 4988 vjpdd.exe 2188 7ppjj.exe 4036 lffrllf.exe 3160 bnttnh.exe 624 pvpjd.exe 4532 3ppjv.exe 4244 lxfrfxl.exe 3028 ntnbtn.exe 2576 hhbhtn.exe 2244 pvpdv.exe 4336 vddvp.exe 4612 rllflfr.exe 3092 nhhbtt.exe 2384 tbhhnb.exe 1740 jppjj.exe 1596 pdvvp.exe 1256 7fffxrl.exe 3516 llfllfr.exe 2900 bntnhb.exe 1032 bbtnhh.exe 3592 jvvjv.exe 2160 vpddd.exe 4704 1xxrlfx.exe 2456 flxxxff.exe 840 3hnhnh.exe 1680 tbhbnb.exe 2412 vpppj.exe 4592 pvppj.exe 2388 lffxfxf.exe 3952 rrrrlll.exe 3468 7btnhb.exe 3940 pjddd.exe 3464 pvdpj.exe 2548 7xxxlxr.exe 640 rlxxrrl.exe 4368 bhhbhh.exe -
resource yara_rule behavioral2/memory/4456-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 5012 4456 7f6fb5b7c50fa7773545c8c2112189a0N.exe 84 PID 4456 wrote to memory of 5012 4456 7f6fb5b7c50fa7773545c8c2112189a0N.exe 84 PID 4456 wrote to memory of 5012 4456 7f6fb5b7c50fa7773545c8c2112189a0N.exe 84 PID 5012 wrote to memory of 60 5012 nhnhbb.exe 85 PID 5012 wrote to memory of 60 5012 nhnhbb.exe 85 PID 5012 wrote to memory of 60 5012 nhnhbb.exe 85 PID 60 wrote to memory of 2520 60 vddvp.exe 86 PID 60 wrote to memory of 2520 60 vddvp.exe 86 PID 60 wrote to memory of 2520 60 vddvp.exe 86 PID 2520 wrote to memory of 2940 2520 pjdpj.exe 87 PID 2520 wrote to memory of 2940 2520 pjdpj.exe 87 PID 2520 wrote to memory of 2940 2520 pjdpj.exe 87 PID 2940 wrote to memory of 4696 2940 nbnhbt.exe 88 PID 2940 wrote to memory of 4696 2940 nbnhbt.exe 88 PID 2940 wrote to memory of 4696 2940 nbnhbt.exe 88 PID 4696 wrote to memory of 2104 4696 5dvpj.exe 89 PID 4696 wrote to memory of 2104 4696 5dvpj.exe 89 PID 4696 wrote to memory of 2104 4696 5dvpj.exe 89 PID 2104 wrote to memory of 184 2104 jddvv.exe 90 PID 2104 wrote to memory of 184 2104 jddvv.exe 90 PID 2104 wrote to memory of 184 2104 jddvv.exe 90 PID 184 wrote to memory of 4976 184 lxlxrrl.exe 91 PID 184 wrote to memory of 4976 184 lxlxrrl.exe 91 PID 184 wrote to memory of 4976 184 lxlxrrl.exe 91 PID 4976 wrote to memory of 1680 4976 thnthh.exe 93 PID 4976 wrote to memory of 1680 4976 thnthh.exe 93 PID 4976 wrote to memory of 1680 4976 thnthh.exe 93 PID 1680 wrote to memory of 1152 1680 fxfxllf.exe 94 PID 1680 wrote to memory of 1152 1680 fxfxllf.exe 94 PID 1680 wrote to memory of 1152 1680 fxfxllf.exe 94 PID 1152 wrote to memory of 4440 1152 tnbtnn.exe 95 PID 1152 wrote to memory of 4440 1152 tnbtnn.exe 95 PID 1152 wrote to memory of 4440 1152 tnbtnn.exe 95 PID 4440 wrote to memory of 3792 4440 btthhb.exe 96 PID 4440 wrote to memory of 3792 4440 btthhb.exe 96 PID 4440 wrote to memory of 3792 4440 btthhb.exe 96 PID 3792 wrote to memory of 3468 3792 5dpjd.exe 97 PID 3792 wrote to memory of 3468 3792 5dpjd.exe 97 PID 3792 wrote to memory of 3468 3792 5dpjd.exe 97 PID 3468 wrote to memory of 3576 3468 5jdvp.exe 99 PID 3468 wrote to memory of 3576 3468 5jdvp.exe 99 PID 3468 wrote to memory of 3576 3468 5jdvp.exe 99 PID 3576 wrote to memory of 3052 3576 7rxxllf.exe 100 PID 3576 wrote to memory of 3052 3576 7rxxllf.exe 100 PID 3576 wrote to memory of 3052 3576 7rxxllf.exe 100 PID 3052 wrote to memory of 1500 3052 tttnhh.exe 101 PID 3052 wrote to memory of 1500 3052 tttnhh.exe 101 PID 3052 wrote to memory of 1500 3052 tttnhh.exe 101 PID 1500 wrote to memory of 3924 1500 djdvp.exe 102 PID 1500 wrote to memory of 3924 1500 djdvp.exe 102 PID 1500 wrote to memory of 3924 1500 djdvp.exe 102 PID 3924 wrote to memory of 2552 3924 vjppj.exe 103 PID 3924 wrote to memory of 2552 3924 vjppj.exe 103 PID 3924 wrote to memory of 2552 3924 vjppj.exe 103 PID 2552 wrote to memory of 2764 2552 ffxlfff.exe 104 PID 2552 wrote to memory of 2764 2552 ffxlfff.exe 104 PID 2552 wrote to memory of 2764 2552 ffxlfff.exe 104 PID 2764 wrote to memory of 3840 2764 tbbtnh.exe 105 PID 2764 wrote to memory of 3840 2764 tbbtnh.exe 105 PID 2764 wrote to memory of 3840 2764 tbbtnh.exe 105 PID 3840 wrote to memory of 3640 3840 nbbnbb.exe 106 PID 3840 wrote to memory of 3640 3840 nbbnbb.exe 106 PID 3840 wrote to memory of 3640 3840 nbbnbb.exe 106 PID 3640 wrote to memory of 4772 3640 jdjjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f6fb5b7c50fa7773545c8c2112189a0N.exe"C:\Users\Admin\AppData\Local\Temp\7f6fb5b7c50fa7773545c8c2112189a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\nhnhbb.exec:\nhnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vddvp.exec:\vddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\pjdpj.exec:\pjdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nbnhbt.exec:\nbnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5dvpj.exec:\5dvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\jddvv.exec:\jddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lxlxrrl.exec:\lxlxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\thnthh.exec:\thnthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\fxfxllf.exec:\fxfxllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\tnbtnn.exec:\tnbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\btthhb.exec:\btthhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\5dpjd.exec:\5dpjd.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\5jdvp.exec:\5jdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\7rxxllf.exec:\7rxxllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\tttnhh.exec:\tttnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\djdvp.exec:\djdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\vjppj.exec:\vjppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\ffxlfff.exec:\ffxlfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tbbtnh.exec:\tbbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nbbnbb.exec:\nbbnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\jdjjv.exec:\jdjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\rllfrll.exec:\rllfrll.exe23⤵
- Executes dropped EXE
PID:4772 -
\??\c:\btnhbb.exec:\btnhbb.exe24⤵
- Executes dropped EXE
PID:5096 -
\??\c:\1tnhbb.exec:\1tnhbb.exe25⤵
- Executes dropped EXE
PID:3216 -
\??\c:\pdpjv.exec:\pdpjv.exe26⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jvdvj.exec:\jvdvj.exe27⤵
- Executes dropped EXE
PID:3704 -
\??\c:\lfxrllr.exec:\lfxrllr.exe28⤵
- Executes dropped EXE
PID:4572 -
\??\c:\btbhnb.exec:\btbhnb.exe29⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vjpdd.exec:\vjpdd.exe30⤵
- Executes dropped EXE
PID:4988 -
\??\c:\7ppjj.exec:\7ppjj.exe31⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lffrllf.exec:\lffrllf.exe32⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bnttnh.exec:\bnttnh.exe33⤵
- Executes dropped EXE
PID:3160 -
\??\c:\pvpjd.exec:\pvpjd.exe34⤵
- Executes dropped EXE
PID:624 -
\??\c:\3ppjv.exec:\3ppjv.exe35⤵
- Executes dropped EXE
PID:4532 -
\??\c:\lxfrfxl.exec:\lxfrfxl.exe36⤵
- Executes dropped EXE
PID:4244 -
\??\c:\ntnbtn.exec:\ntnbtn.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhbhtn.exec:\hhbhtn.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pvpdv.exec:\pvpdv.exe39⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vddvp.exec:\vddvp.exe40⤵
- Executes dropped EXE
PID:4336 -
\??\c:\rllflfr.exec:\rllflfr.exe41⤵
- Executes dropped EXE
PID:4612 -
\??\c:\nhhbtt.exec:\nhhbtt.exe42⤵
- Executes dropped EXE
PID:3092 -
\??\c:\tbhhnb.exec:\tbhhnb.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jppjj.exec:\jppjj.exe44⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pdvvp.exec:\pdvvp.exe45⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7fffxrl.exec:\7fffxrl.exe46⤵
- Executes dropped EXE
PID:1256 -
\??\c:\llfllfr.exec:\llfllfr.exe47⤵
- Executes dropped EXE
PID:3516 -
\??\c:\bntnhb.exec:\bntnhb.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bbtnhh.exec:\bbtnhh.exe49⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jvvjv.exec:\jvvjv.exe50⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vpddd.exec:\vpddd.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1xxrlfx.exec:\1xxrlfx.exe52⤵
- Executes dropped EXE
PID:4704 -
\??\c:\flxxxff.exec:\flxxxff.exe53⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3hnhnh.exec:\3hnhnh.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\tbhbnb.exec:\tbhbnb.exe55⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vpppj.exec:\vpppj.exe56⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pvppj.exec:\pvppj.exe57⤵
- Executes dropped EXE
PID:4592 -
\??\c:\lffxfxf.exec:\lffxfxf.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rrrrlll.exec:\rrrrlll.exe59⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7btnhb.exec:\7btnhb.exe60⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pjddd.exec:\pjddd.exe61⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pvdpj.exec:\pvdpj.exe62⤵
- Executes dropped EXE
PID:3464 -
\??\c:\7xxxlxr.exec:\7xxxlxr.exe63⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe64⤵
- Executes dropped EXE
PID:640 -
\??\c:\bhhbhh.exec:\bhhbhh.exe65⤵
- Executes dropped EXE
PID:4368 -
\??\c:\hnttbt.exec:\hnttbt.exe66⤵PID:4684
-
\??\c:\7djdj.exec:\7djdj.exe67⤵PID:1684
-
\??\c:\pdjdv.exec:\pdjdv.exe68⤵PID:3200
-
\??\c:\xllfxxr.exec:\xllfxxr.exe69⤵PID:2084
-
\??\c:\7bnnnn.exec:\7bnnnn.exe70⤵PID:4908
-
\??\c:\hbtnhn.exec:\hbtnhn.exe71⤵PID:3552
-
\??\c:\bbhbnn.exec:\bbhbnn.exe72⤵PID:5104
-
\??\c:\9pvjd.exec:\9pvjd.exe73⤵PID:1404
-
\??\c:\5fxrffx.exec:\5fxrffx.exe74⤵PID:844
-
\??\c:\1rxxrrx.exec:\1rxxrrx.exe75⤵PID:756
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe76⤵PID:5116
-
\??\c:\hnnnhb.exec:\hnnnhb.exe77⤵PID:1632
-
\??\c:\jpvdj.exec:\jpvdj.exe78⤵PID:2316
-
\??\c:\vjdpj.exec:\vjdpj.exe79⤵PID:1604
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe80⤵PID:2148
-
\??\c:\5rlffff.exec:\5rlffff.exe81⤵PID:2032
-
\??\c:\tbhhbb.exec:\tbhhbb.exe82⤵PID:1776
-
\??\c:\nntntn.exec:\nntntn.exe83⤵PID:4988
-
\??\c:\dvjdd.exec:\dvjdd.exe84⤵PID:2188
-
\??\c:\vjdvj.exec:\vjdvj.exe85⤵PID:1548
-
\??\c:\9frlxxr.exec:\9frlxxr.exe86⤵PID:3972
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe87⤵PID:2208
-
\??\c:\nttnhb.exec:\nttnhb.exe88⤵PID:3460
-
\??\c:\1nnhtt.exec:\1nnhtt.exe89⤵PID:1784
-
\??\c:\dpjjv.exec:\dpjjv.exe90⤵PID:2796
-
\??\c:\vjjpd.exec:\vjjpd.exe91⤵PID:1380
-
\??\c:\rrxrffx.exec:\rrxrffx.exe92⤵PID:4344
-
\??\c:\xlflllx.exec:\xlflllx.exe93⤵PID:2828
-
\??\c:\nhbbtn.exec:\nhbbtn.exe94⤵PID:628
-
\??\c:\hbhhbh.exec:\hbhhbh.exe95⤵PID:4600
-
\??\c:\ppddp.exec:\ppddp.exe96⤵PID:3092
-
\??\c:\dpvpj.exec:\dpvpj.exe97⤵PID:2384
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe98⤵PID:1740
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe99⤵PID:2704
-
\??\c:\tnhbbt.exec:\tnhbbt.exe100⤵PID:4320
-
\??\c:\bttntt.exec:\bttntt.exe101⤵PID:3516
-
\??\c:\9vdvp.exec:\9vdvp.exe102⤵PID:2900
-
\??\c:\3ppjd.exec:\3ppjd.exe103⤵PID:5112
-
\??\c:\lrxrrlf.exec:\lrxrrlf.exe104⤵PID:4948
-
\??\c:\lfllfrl.exec:\lfllfrl.exe105⤵PID:3396
-
\??\c:\xxlxffx.exec:\xxlxffx.exe106⤵PID:4596
-
\??\c:\nhnnhh.exec:\nhnnhh.exe107⤵PID:2456
-
\??\c:\ppdpj.exec:\ppdpj.exe108⤵PID:4580
-
\??\c:\jdjjv.exec:\jdjjv.exe109⤵PID:1680
-
\??\c:\dvddp.exec:\dvddp.exe110⤵PID:1476
-
\??\c:\lrlfflx.exec:\lrlfflx.exe111⤵PID:4960
-
\??\c:\bttbtt.exec:\bttbtt.exe112⤵PID:3148
-
\??\c:\nhbttn.exec:\nhbttn.exe113⤵PID:1728
-
\??\c:\pjpjv.exec:\pjpjv.exe114⤵PID:3964
-
\??\c:\jpppj.exec:\jpppj.exe115⤵PID:2944
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe116⤵PID:3464
-
\??\c:\xfllfll.exec:\xfllfll.exe117⤵PID:1652
-
\??\c:\nhbhbb.exec:\nhbhbb.exe118⤵PID:640
-
\??\c:\vvpjv.exec:\vvpjv.exe119⤵PID:4756
-
\??\c:\vpvjd.exec:\vpvjd.exe120⤵PID:2552
-
\??\c:\ddpjv.exec:\ddpjv.exe121⤵PID:2764
-
\??\c:\7lrfxxr.exec:\7lrfxxr.exe122⤵PID:1008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-