Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 14:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fef84f1303aebad11cfcadb00d040540N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
fef84f1303aebad11cfcadb00d040540N.exe
-
Size
316KB
-
MD5
fef84f1303aebad11cfcadb00d040540
-
SHA1
3e5da9fe11dc42bb8e23a8af090f75550dffcb45
-
SHA256
3ffbaef5883013b0235655a7bbb5f430bb72c7485da620e7768b67f238f17c5a
-
SHA512
cfb334a1e6ce1a77d2743b12e587a6e7fbe867f53f863e621bd6c21a664b6e079e1c611a70720324ea6d1dcfad118a857208133ed77119e450628fbe49ef9e55
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwm8:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q74
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2424-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4212 rrxxxxx.exe 452 5rflfrl.exe 3684 hbbttt.exe 4520 hbbbnn.exe 3020 dpvjd.exe 2168 rfrrrrl.exe 2796 bhhhbb.exe 2000 7rlllll.exe 1452 lxfrlll.exe 1196 pjjjd.exe 4948 vjjvj.exe 1192 1xfrlfr.exe 4180 nbhbtn.exe 1832 flrlrlx.exe 1736 rxrxfxl.exe 3212 9bbnht.exe 2020 xflrfxl.exe 2956 5fxrlfx.exe 4456 bhhbnb.exe 448 jvdpd.exe 4904 rxffllr.exe 3632 ppvpv.exe 2996 djjpd.exe 5008 ttbtht.exe 4280 hbthth.exe 856 jvvvj.exe 1760 9ttnbt.exe 3624 ppdvj.exe 4912 rrrfrfr.exe 1812 lrlxlxl.exe 3816 btbttn.exe 4764 7pvvp.exe 3580 lrxfrll.exe 3636 hnbttt.exe 2860 jjpvp.exe 3000 lfrlrrx.exe 1656 1hnhbt.exe 4572 bbnbhb.exe 1860 1dvjd.exe 4812 frrlrfx.exe 4860 bnnhbt.exe 3480 bbnntn.exe 3492 jdpdj.exe 1564 5rxxxxx.exe 1676 lrflrxf.exe 4060 tnbbhh.exe 3628 dvvpj.exe 744 frxfrxx.exe 3292 llfrlrr.exe 2404 nttnhb.exe 4244 vpjjd.exe 4856 lrxlxxr.exe 1452 frxrllf.exe 2400 thhbtt.exe 4752 dvjdj.exe 3912 dvjdd.exe 1192 rrllfxx.exe 4616 bthbbb.exe 1952 nbhbtb.exe 5092 jvjdd.exe 1832 nnhhhh.exe 1556 9pvpv.exe 4732 9rrrlxx.exe 3752 rrxrxxr.exe -
resource yara_rule behavioral2/memory/2424-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 4212 2424 fef84f1303aebad11cfcadb00d040540N.exe 83 PID 2424 wrote to memory of 4212 2424 fef84f1303aebad11cfcadb00d040540N.exe 83 PID 2424 wrote to memory of 4212 2424 fef84f1303aebad11cfcadb00d040540N.exe 83 PID 4212 wrote to memory of 452 4212 rrxxxxx.exe 84 PID 4212 wrote to memory of 452 4212 rrxxxxx.exe 84 PID 4212 wrote to memory of 452 4212 rrxxxxx.exe 84 PID 452 wrote to memory of 3684 452 5rflfrl.exe 85 PID 452 wrote to memory of 3684 452 5rflfrl.exe 85 PID 452 wrote to memory of 3684 452 5rflfrl.exe 85 PID 3684 wrote to memory of 4520 3684 hbbttt.exe 87 PID 3684 wrote to memory of 4520 3684 hbbttt.exe 87 PID 3684 wrote to memory of 4520 3684 hbbttt.exe 87 PID 4520 wrote to memory of 3020 4520 hbbbnn.exe 88 PID 4520 wrote to memory of 3020 4520 hbbbnn.exe 88 PID 4520 wrote to memory of 3020 4520 hbbbnn.exe 88 PID 3020 wrote to memory of 2168 3020 dpvjd.exe 89 PID 3020 wrote to memory of 2168 3020 dpvjd.exe 89 PID 3020 wrote to memory of 2168 3020 dpvjd.exe 89 PID 2168 wrote to memory of 2796 2168 rfrrrrl.exe 91 PID 2168 wrote to memory of 2796 2168 rfrrrrl.exe 91 PID 2168 wrote to memory of 2796 2168 rfrrrrl.exe 91 PID 2796 wrote to memory of 2000 2796 bhhhbb.exe 92 PID 2796 wrote to memory of 2000 2796 bhhhbb.exe 92 PID 2796 wrote to memory of 2000 2796 bhhhbb.exe 92 PID 2000 wrote to memory of 1452 2000 7rlllll.exe 93 PID 2000 wrote to memory of 1452 2000 7rlllll.exe 93 PID 2000 wrote to memory of 1452 2000 7rlllll.exe 93 PID 1452 wrote to memory of 1196 1452 lxfrlll.exe 94 PID 1452 wrote to memory of 1196 1452 lxfrlll.exe 94 PID 1452 wrote to memory of 1196 1452 lxfrlll.exe 94 PID 1196 wrote to memory of 4948 1196 pjjjd.exe 95 PID 1196 wrote to memory of 4948 1196 pjjjd.exe 95 PID 1196 wrote to memory of 4948 1196 pjjjd.exe 95 PID 4948 wrote to memory of 1192 4948 vjjvj.exe 97 PID 4948 wrote to memory of 1192 4948 vjjvj.exe 97 PID 4948 wrote to memory of 1192 4948 vjjvj.exe 97 PID 1192 wrote to memory of 4180 1192 1xfrlfr.exe 98 PID 1192 wrote to memory of 4180 1192 1xfrlfr.exe 98 PID 1192 wrote to memory of 4180 1192 1xfrlfr.exe 98 PID 4180 wrote to memory of 1832 4180 nbhbtn.exe 99 PID 4180 wrote to memory of 1832 4180 nbhbtn.exe 99 PID 4180 wrote to memory of 1832 4180 nbhbtn.exe 99 PID 1832 wrote to memory of 1736 1832 flrlrlx.exe 100 PID 1832 wrote to memory of 1736 1832 flrlrlx.exe 100 PID 1832 wrote to memory of 1736 1832 flrlrlx.exe 100 PID 1736 wrote to memory of 3212 1736 rxrxfxl.exe 101 PID 1736 wrote to memory of 3212 1736 rxrxfxl.exe 101 PID 1736 wrote to memory of 3212 1736 rxrxfxl.exe 101 PID 3212 wrote to memory of 2020 3212 9bbnht.exe 102 PID 3212 wrote to memory of 2020 3212 9bbnht.exe 102 PID 3212 wrote to memory of 2020 3212 9bbnht.exe 102 PID 2020 wrote to memory of 2956 2020 xflrfxl.exe 103 PID 2020 wrote to memory of 2956 2020 xflrfxl.exe 103 PID 2020 wrote to memory of 2956 2020 xflrfxl.exe 103 PID 2956 wrote to memory of 4456 2956 5fxrlfx.exe 104 PID 2956 wrote to memory of 4456 2956 5fxrlfx.exe 104 PID 2956 wrote to memory of 4456 2956 5fxrlfx.exe 104 PID 4456 wrote to memory of 448 4456 bhhbnb.exe 105 PID 4456 wrote to memory of 448 4456 bhhbnb.exe 105 PID 4456 wrote to memory of 448 4456 bhhbnb.exe 105 PID 448 wrote to memory of 4904 448 jvdpd.exe 106 PID 448 wrote to memory of 4904 448 jvdpd.exe 106 PID 448 wrote to memory of 4904 448 jvdpd.exe 106 PID 4904 wrote to memory of 3632 4904 rxffllr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\fef84f1303aebad11cfcadb00d040540N.exe"C:\Users\Admin\AppData\Local\Temp\fef84f1303aebad11cfcadb00d040540N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\5rflfrl.exec:\5rflfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\hbbttt.exec:\hbbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\hbbbnn.exec:\hbbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\dpvjd.exec:\dpvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rfrrrrl.exec:\rfrrrrl.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bhhhbb.exec:\bhhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7rlllll.exec:\7rlllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lxfrlll.exec:\lxfrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pjjjd.exec:\pjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\vjjvj.exec:\vjjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\1xfrlfr.exec:\1xfrlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\nbhbtn.exec:\nbhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\flrlrlx.exec:\flrlrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\rxrxfxl.exec:\rxrxfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\9bbnht.exec:\9bbnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\xflrfxl.exec:\xflrfxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\5fxrlfx.exec:\5fxrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bhhbnb.exec:\bhhbnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\jvdpd.exec:\jvdpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\rxffllr.exec:\rxffllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\ppvpv.exec:\ppvpv.exe23⤵
- Executes dropped EXE
PID:3632 -
\??\c:\djjpd.exec:\djjpd.exe24⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ttbtht.exec:\ttbtht.exe25⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hbthth.exec:\hbthth.exe26⤵
- Executes dropped EXE
PID:4280 -
\??\c:\jvvvj.exec:\jvvvj.exe27⤵
- Executes dropped EXE
PID:856 -
\??\c:\9ttnbt.exec:\9ttnbt.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ppdvj.exec:\ppdvj.exe29⤵
- Executes dropped EXE
PID:3624 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe30⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe31⤵
- Executes dropped EXE
PID:1812 -
\??\c:\btbttn.exec:\btbttn.exe32⤵
- Executes dropped EXE
PID:3816 -
\??\c:\7pvvp.exec:\7pvvp.exe33⤵
- Executes dropped EXE
PID:4764 -
\??\c:\lrxfrll.exec:\lrxfrll.exe34⤵
- Executes dropped EXE
PID:3580 -
\??\c:\hnbttt.exec:\hnbttt.exe35⤵
- Executes dropped EXE
PID:3636 -
\??\c:\jjpvp.exec:\jjpvp.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe37⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1hnhbt.exec:\1hnhbt.exe38⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbnbhb.exec:\bbnbhb.exe39⤵
- Executes dropped EXE
PID:4572 -
\??\c:\1dvjd.exec:\1dvjd.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\frrlrfx.exec:\frrlrfx.exe41⤵
- Executes dropped EXE
PID:4812 -
\??\c:\bnnhbt.exec:\bnnhbt.exe42⤵
- Executes dropped EXE
PID:4860 -
\??\c:\bbnntn.exec:\bbnntn.exe43⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jdpdj.exec:\jdpdj.exe44⤵
- Executes dropped EXE
PID:3492 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe45⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lrflrxf.exec:\lrflrxf.exe46⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tnbbhh.exec:\tnbbhh.exe47⤵
- Executes dropped EXE
PID:4060 -
\??\c:\dvvpj.exec:\dvvpj.exe48⤵
- Executes dropped EXE
PID:3628 -
\??\c:\frxfrxx.exec:\frxfrxx.exe49⤵
- Executes dropped EXE
PID:744 -
\??\c:\llfrlrr.exec:\llfrlrr.exe50⤵
- Executes dropped EXE
PID:3292 -
\??\c:\nttnhb.exec:\nttnhb.exe51⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vpjjd.exec:\vpjjd.exe52⤵
- Executes dropped EXE
PID:4244 -
\??\c:\lrxlxxr.exec:\lrxlxxr.exe53⤵
- Executes dropped EXE
PID:4856 -
\??\c:\frxrllf.exec:\frxrllf.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\thhbtt.exec:\thhbtt.exe55⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dvjdj.exec:\dvjdj.exe56⤵
- Executes dropped EXE
PID:4752 -
\??\c:\dvjdd.exec:\dvjdd.exe57⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rrllfxx.exec:\rrllfxx.exe58⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bthbbb.exec:\bthbbb.exe59⤵
- Executes dropped EXE
PID:4616 -
\??\c:\nbhbtb.exec:\nbhbtb.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jvjdd.exec:\jvjdd.exe61⤵
- Executes dropped EXE
PID:5092 -
\??\c:\nnhhhh.exec:\nnhhhh.exe62⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9pvpv.exec:\9pvpv.exe63⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9rrrlxx.exec:\9rrrlxx.exe64⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rrxrxxr.exec:\rrxrxxr.exe65⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bttnnn.exec:\bttnnn.exe66⤵PID:3768
-
\??\c:\jjvpj.exec:\jjvpj.exe67⤵PID:4488
-
\??\c:\7vjdd.exec:\7vjdd.exe68⤵PID:520
-
\??\c:\frxxrrr.exec:\frxxrrr.exe69⤵PID:1428
-
\??\c:\btbbbt.exec:\btbbbt.exe70⤵PID:4904
-
\??\c:\bbhbhh.exec:\bbhbhh.exe71⤵PID:1920
-
\??\c:\jdvvj.exec:\jdvvj.exe72⤵PID:2864
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe73⤵PID:868
-
\??\c:\frffxxx.exec:\frffxxx.exe74⤵PID:5008
-
\??\c:\9ntnhh.exec:\9ntnhh.exe75⤵PID:4280
-
\??\c:\7bnhnt.exec:\7bnhnt.exe76⤵PID:1880
-
\??\c:\vppjd.exec:\vppjd.exe77⤵PID:4360
-
\??\c:\vjddv.exec:\vjddv.exe78⤵PID:2784
-
\??\c:\3llfxrl.exec:\3llfxrl.exe79⤵PID:772
-
\??\c:\btbtbt.exec:\btbtbt.exe80⤵PID:648
-
\??\c:\thhbbt.exec:\thhbbt.exe81⤵PID:2976
-
\??\c:\5vpjd.exec:\5vpjd.exe82⤵PID:388
-
\??\c:\vvjdj.exec:\vvjdj.exe83⤵PID:3816
-
\??\c:\5rrfxxx.exec:\5rrfxxx.exe84⤵PID:3284
-
\??\c:\3frlffx.exec:\3frlffx.exe85⤵PID:976
-
\??\c:\hnbbbb.exec:\hnbbbb.exe86⤵PID:2288
-
\??\c:\pjjdv.exec:\pjjdv.exe87⤵PID:2860
-
\??\c:\vjvpj.exec:\vjvpj.exe88⤵PID:4432
-
\??\c:\rlxfffx.exec:\rlxfffx.exe89⤵PID:3348
-
\??\c:\hbhbtt.exec:\hbhbtt.exe90⤵PID:3776
-
\??\c:\hbhbtb.exec:\hbhbtb.exe91⤵PID:3048
-
\??\c:\vvvvv.exec:\vvvvv.exe92⤵PID:4812
-
\??\c:\pjpjj.exec:\pjpjj.exe93⤵PID:1644
-
\??\c:\ttthbb.exec:\ttthbb.exe94⤵PID:4308
-
\??\c:\hthbtt.exec:\hthbtt.exe95⤵PID:3492
-
\??\c:\jpdvp.exec:\jpdvp.exe96⤵PID:2012
-
\??\c:\9dddv.exec:\9dddv.exe97⤵PID:3972
-
\??\c:\fxxxxrx.exec:\fxxxxrx.exe98⤵PID:4172
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe99⤵PID:4200
-
\??\c:\tnbbht.exec:\tnbbht.exe100⤵PID:3100
-
\??\c:\vpppj.exec:\vpppj.exe101⤵PID:5028
-
\??\c:\vjvvv.exec:\vjvvv.exe102⤵PID:4728
-
\??\c:\jpjdj.exec:\jpjdj.exe103⤵PID:3756
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe104⤵PID:432
-
\??\c:\hhhbbb.exec:\hhhbbb.exe105⤵PID:2208
-
\??\c:\nhbhhh.exec:\nhbhhh.exe106⤵PID:4648
-
\??\c:\vvpdp.exec:\vvpdp.exe107⤵PID:4592
-
\??\c:\nhtntt.exec:\nhtntt.exe108⤵PID:4824
-
\??\c:\jdvpp.exec:\jdvpp.exe109⤵PID:4220
-
\??\c:\pjjjj.exec:\pjjjj.exe110⤵PID:2092
-
\??\c:\lffxxrl.exec:\lffxxrl.exe111⤵PID:1436
-
\??\c:\xllffxx.exec:\xllffxx.exe112⤵PID:5044
-
\??\c:\hbhbbt.exec:\hbhbbt.exe113⤵PID:1420
-
\??\c:\vvvpp.exec:\vvvpp.exe114⤵PID:1108
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe115⤵PID:4748
-
\??\c:\lffxrrl.exec:\lffxrrl.exe116⤵PID:1284
-
\??\c:\nbhbbn.exec:\nbhbbn.exe117⤵PID:4032
-
\??\c:\dvdvd.exec:\dvdvd.exe118⤵PID:1448
-
\??\c:\jdpjd.exec:\jdpjd.exe119⤵PID:892
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe120⤵PID:944
-
\??\c:\5xrfxfl.exec:\5xrfxfl.exe121⤵PID:4044
-
\??\c:\nnnttt.exec:\nnnttt.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-