Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe
Resource
win7-20240903-en
General
-
Target
63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe
-
Size
78KB
-
MD5
8bee09cfc2c228897bd40f42b83b661d
-
SHA1
23167dd6efe8fc926b9609da1eef3aa90b942307
-
SHA256
63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a
-
SHA512
36274662c2b50216f47957f242b61d845e55cf91d0a77f4487266c37f4834beeee7a28d3d946d87d8c69703126c7ebca8010e801e93aa979557d0bbadcea627c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAwHSYq0:ymb3NkkiQ3mdBjFIpkPcy8qsHSH0
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3364-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1440 rfxrlll.exe 448 nbhbtt.exe 4120 jdddd.exe 1060 rlrrlff.exe 1724 httnnb.exe 1720 dpddv.exe 1760 xffxxxx.exe 5032 nhhbtt.exe 3452 bbtnnh.exe 3844 vdpdj.exe 4224 xfxxrxr.exe 1552 btbtnn.exe 5068 pdjdp.exe 2292 5llfxfx.exe 1220 btnhtb.exe 4988 bnhbbb.exe 976 pdddv.exe 4536 9djdv.exe 3036 lffxxxr.exe 4984 7bttnn.exe 1808 dpppj.exe 1816 frrxrrf.exe 3972 rxlrrxl.exe 1012 5nnhhh.exe 2508 vppjp.exe 2672 vpvpd.exe 4452 tnthth.exe 3788 9hnhbb.exe 4460 7lxrxxx.exe 388 hhbtnn.exe 2132 nnnttt.exe 812 7ppvj.exe 3932 xflfxxr.exe 3256 xrlfrlf.exe 1392 5nbhtb.exe 3796 bntttt.exe 4432 vvppj.exe 964 djpjd.exe 3364 vdjdd.exe 1440 frrrlll.exe 3952 hhnnnh.exe 4496 hhntbn.exe 1864 1ppjv.exe 1860 dvdvv.exe 1204 rxflxfx.exe 2592 flllffx.exe 2768 tthbbb.exe 3408 9nnhbb.exe 1312 pvddd.exe 3668 ppvvv.exe 3520 frxrllr.exe 3444 lxflffl.exe 3468 httnnh.exe 2660 bttnhh.exe 2468 jddvp.exe 4980 xrxrxrx.exe 4236 xxxxrrr.exe 5092 tbbtth.exe 2292 hhtnnn.exe 2616 vppjd.exe 1556 ddjjj.exe 1452 lflfxxx.exe 4988 xlfxrll.exe 976 5bhbhh.exe -
resource yara_rule behavioral2/memory/3364-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3364 wrote to memory of 1440 3364 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 83 PID 3364 wrote to memory of 1440 3364 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 83 PID 3364 wrote to memory of 1440 3364 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 83 PID 1440 wrote to memory of 448 1440 rfxrlll.exe 84 PID 1440 wrote to memory of 448 1440 rfxrlll.exe 84 PID 1440 wrote to memory of 448 1440 rfxrlll.exe 84 PID 448 wrote to memory of 4120 448 nbhbtt.exe 85 PID 448 wrote to memory of 4120 448 nbhbtt.exe 85 PID 448 wrote to memory of 4120 448 nbhbtt.exe 85 PID 4120 wrote to memory of 1060 4120 jdddd.exe 87 PID 4120 wrote to memory of 1060 4120 jdddd.exe 87 PID 4120 wrote to memory of 1060 4120 jdddd.exe 87 PID 1060 wrote to memory of 1724 1060 rlrrlff.exe 88 PID 1060 wrote to memory of 1724 1060 rlrrlff.exe 88 PID 1060 wrote to memory of 1724 1060 rlrrlff.exe 88 PID 1724 wrote to memory of 1720 1724 httnnb.exe 89 PID 1724 wrote to memory of 1720 1724 httnnb.exe 89 PID 1724 wrote to memory of 1720 1724 httnnb.exe 89 PID 1720 wrote to memory of 1760 1720 dpddv.exe 90 PID 1720 wrote to memory of 1760 1720 dpddv.exe 90 PID 1720 wrote to memory of 1760 1720 dpddv.exe 90 PID 1760 wrote to memory of 5032 1760 xffxxxx.exe 91 PID 1760 wrote to memory of 5032 1760 xffxxxx.exe 91 PID 1760 wrote to memory of 5032 1760 xffxxxx.exe 91 PID 5032 wrote to memory of 3452 5032 nhhbtt.exe 92 PID 5032 wrote to memory of 3452 5032 nhhbtt.exe 92 PID 5032 wrote to memory of 3452 5032 nhhbtt.exe 92 PID 3452 wrote to memory of 3844 3452 bbtnnh.exe 93 PID 3452 wrote to memory of 3844 3452 bbtnnh.exe 93 PID 3452 wrote to memory of 3844 3452 bbtnnh.exe 93 PID 3844 wrote to memory of 4224 3844 vdpdj.exe 94 PID 3844 wrote to memory of 4224 3844 vdpdj.exe 94 PID 3844 wrote to memory of 4224 3844 vdpdj.exe 94 PID 4224 wrote to memory of 1552 4224 xfxxrxr.exe 96 PID 4224 wrote to memory of 1552 4224 xfxxrxr.exe 96 PID 4224 wrote to memory of 1552 4224 xfxxrxr.exe 96 PID 1552 wrote to memory of 5068 1552 btbtnn.exe 97 PID 1552 wrote to memory of 5068 1552 btbtnn.exe 97 PID 1552 wrote to memory of 5068 1552 btbtnn.exe 97 PID 5068 wrote to memory of 2292 5068 pdjdp.exe 98 PID 5068 wrote to memory of 2292 5068 pdjdp.exe 98 PID 5068 wrote to memory of 2292 5068 pdjdp.exe 98 PID 2292 wrote to memory of 1220 2292 5llfxfx.exe 99 PID 2292 wrote to memory of 1220 2292 5llfxfx.exe 99 PID 2292 wrote to memory of 1220 2292 5llfxfx.exe 99 PID 1220 wrote to memory of 4988 1220 btnhtb.exe 100 PID 1220 wrote to memory of 4988 1220 btnhtb.exe 100 PID 1220 wrote to memory of 4988 1220 btnhtb.exe 100 PID 4988 wrote to memory of 976 4988 bnhbbb.exe 102 PID 4988 wrote to memory of 976 4988 bnhbbb.exe 102 PID 4988 wrote to memory of 976 4988 bnhbbb.exe 102 PID 976 wrote to memory of 4536 976 pdddv.exe 103 PID 976 wrote to memory of 4536 976 pdddv.exe 103 PID 976 wrote to memory of 4536 976 pdddv.exe 103 PID 4536 wrote to memory of 3036 4536 9djdv.exe 104 PID 4536 wrote to memory of 3036 4536 9djdv.exe 104 PID 4536 wrote to memory of 3036 4536 9djdv.exe 104 PID 3036 wrote to memory of 4984 3036 lffxxxr.exe 105 PID 3036 wrote to memory of 4984 3036 lffxxxr.exe 105 PID 3036 wrote to memory of 4984 3036 lffxxxr.exe 105 PID 4984 wrote to memory of 1808 4984 7bttnn.exe 106 PID 4984 wrote to memory of 1808 4984 7bttnn.exe 106 PID 4984 wrote to memory of 1808 4984 7bttnn.exe 106 PID 1808 wrote to memory of 1816 1808 dpppj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe"C:\Users\Admin\AppData\Local\Temp\63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\rfxrlll.exec:\rfxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\nbhbtt.exec:\nbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\jdddd.exec:\jdddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\rlrrlff.exec:\rlrrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\httnnb.exec:\httnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\dpddv.exec:\dpddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\xffxxxx.exec:\xffxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\nhhbtt.exec:\nhhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\bbtnnh.exec:\bbtnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\vdpdj.exec:\vdpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\btbtnn.exec:\btbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pdjdp.exec:\pdjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\5llfxfx.exec:\5llfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\btnhtb.exec:\btnhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\bnhbbb.exec:\bnhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\pdddv.exec:\pdddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\9djdv.exec:\9djdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\lffxxxr.exec:\lffxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7bttnn.exec:\7bttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\dpppj.exec:\dpppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\frrxrrf.exec:\frrxrrf.exe23⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rxlrrxl.exec:\rxlrrxl.exe24⤵
- Executes dropped EXE
PID:3972 -
\??\c:\5nnhhh.exec:\5nnhhh.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vppjp.exec:\vppjp.exe26⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpvpd.exec:\vpvpd.exe27⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnthth.exec:\tnthth.exe28⤵
- Executes dropped EXE
PID:4452 -
\??\c:\9hnhbb.exec:\9hnhbb.exe29⤵
- Executes dropped EXE
PID:3788 -
\??\c:\7lxrxxx.exec:\7lxrxxx.exe30⤵
- Executes dropped EXE
PID:4460 -
\??\c:\hhbtnn.exec:\hhbtnn.exe31⤵
- Executes dropped EXE
PID:388 -
\??\c:\nnnttt.exec:\nnnttt.exe32⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7ppvj.exec:\7ppvj.exe33⤵
- Executes dropped EXE
PID:812 -
\??\c:\xflfxxr.exec:\xflfxxr.exe34⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe35⤵
- Executes dropped EXE
PID:3256 -
\??\c:\5nbhtb.exec:\5nbhtb.exe36⤵
- Executes dropped EXE
PID:1392 -
\??\c:\bntttt.exec:\bntttt.exe37⤵
- Executes dropped EXE
PID:3796 -
\??\c:\vvppj.exec:\vvppj.exe38⤵
- Executes dropped EXE
PID:4432 -
\??\c:\djpjd.exec:\djpjd.exe39⤵
- Executes dropped EXE
PID:964 -
\??\c:\vdjdd.exec:\vdjdd.exe40⤵
- Executes dropped EXE
PID:3364 -
\??\c:\frrrlll.exec:\frrrlll.exe41⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hhnnnh.exec:\hhnnnh.exe42⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hhntbn.exec:\hhntbn.exe43⤵
- Executes dropped EXE
PID:4496 -
\??\c:\1ppjv.exec:\1ppjv.exe44⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dvdvv.exec:\dvdvv.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rxflxfx.exec:\rxflxfx.exe46⤵
- Executes dropped EXE
PID:1204 -
\??\c:\flllffx.exec:\flllffx.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tthbbb.exec:\tthbbb.exe48⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9nnhbb.exec:\9nnhbb.exe49⤵
- Executes dropped EXE
PID:3408 -
\??\c:\pvddd.exec:\pvddd.exe50⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ppvvv.exec:\ppvvv.exe51⤵
- Executes dropped EXE
PID:3668 -
\??\c:\frxrllr.exec:\frxrllr.exe52⤵
- Executes dropped EXE
PID:3520 -
\??\c:\lxflffl.exec:\lxflffl.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3444 -
\??\c:\httnnh.exec:\httnnh.exe54⤵
- Executes dropped EXE
PID:3468 -
\??\c:\bttnhh.exec:\bttnhh.exe55⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jddvp.exec:\jddvp.exe56⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe57⤵
- Executes dropped EXE
PID:4980 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe58⤵
- Executes dropped EXE
PID:4236 -
\??\c:\tbbtth.exec:\tbbtth.exe59⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hhtnnn.exec:\hhtnnn.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vppjd.exec:\vppjd.exe61⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ddjjj.exec:\ddjjj.exe62⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lflfxxx.exec:\lflfxxx.exe63⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xlfxrll.exec:\xlfxrll.exe64⤵
- Executes dropped EXE
PID:4988 -
\??\c:\5bhbhh.exec:\5bhbhh.exe65⤵
- Executes dropped EXE
PID:976 -
\??\c:\hhthnh.exec:\hhthnh.exe66⤵PID:4592
-
\??\c:\dvjjp.exec:\dvjjp.exe67⤵PID:3968
-
\??\c:\7jvpv.exec:\7jvpv.exe68⤵PID:3508
-
\??\c:\xxrrlrx.exec:\xxrrlrx.exe69⤵PID:3040
-
\??\c:\rrxxxxr.exec:\rrxxxxr.exe70⤵PID:5108
-
\??\c:\tnhntb.exec:\tnhntb.exe71⤵PID:4284
-
\??\c:\nhnnhh.exec:\nhnnhh.exe72⤵PID:3748
-
\??\c:\ppjjj.exec:\ppjjj.exe73⤵PID:5044
-
\??\c:\9fxrllf.exec:\9fxrllf.exe74⤵PID:1012
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe75⤵PID:3012
-
\??\c:\bthtnn.exec:\bthtnn.exe76⤵PID:4368
-
\??\c:\7ddvp.exec:\7ddvp.exe77⤵PID:2612
-
\??\c:\vvvvj.exec:\vvvvj.exe78⤵PID:1280
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe79⤵PID:3760
-
\??\c:\bbtnth.exec:\bbtnth.exe80⤵PID:4828
-
\??\c:\hhbnhn.exec:\hhbnhn.exe81⤵PID:3064
-
\??\c:\pjjdd.exec:\pjjdd.exe82⤵PID:5072
-
\??\c:\1nntnn.exec:\1nntnn.exe83⤵PID:2884
-
\??\c:\jvvpp.exec:\jvvpp.exe84⤵PID:3648
-
\??\c:\pjdvv.exec:\pjdvv.exe85⤵PID:2452
-
\??\c:\3lrlllf.exec:\3lrlllf.exe86⤵PID:1180
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe87⤵PID:4320
-
\??\c:\nhnhht.exec:\nhnhht.exe88⤵PID:2840
-
\??\c:\dvppv.exec:\dvppv.exe89⤵PID:332
-
\??\c:\1pdvd.exec:\1pdvd.exe90⤵PID:320
-
\??\c:\lrflrfl.exec:\lrflrfl.exe91⤵PID:224
-
\??\c:\9nbtbb.exec:\9nbtbb.exe92⤵PID:1036
-
\??\c:\hhnhtt.exec:\hhnhtt.exe93⤵
- System Location Discovery: System Language Discovery
PID:4872 -
\??\c:\vvddv.exec:\vvddv.exe94⤵PID:2780
-
\??\c:\fllrllf.exec:\fllrllf.exe95⤵PID:3640
-
\??\c:\lxxfffx.exec:\lxxfffx.exe96⤵PID:5084
-
\??\c:\bhbhhh.exec:\bhbhhh.exe97⤵PID:2444
-
\??\c:\pjpjd.exec:\pjpjd.exe98⤵PID:4208
-
\??\c:\dpdvp.exec:\dpdvp.exe99⤵PID:1068
-
\??\c:\rffxxrl.exec:\rffxxrl.exe100⤵PID:5076
-
\??\c:\lllllll.exec:\lllllll.exe101⤵PID:2536
-
\??\c:\btbtnn.exec:\btbtnn.exe102⤵PID:3444
-
\??\c:\hhtntn.exec:\hhtntn.exe103⤵PID:3216
-
\??\c:\jpjjd.exec:\jpjjd.exe104⤵PID:2748
-
\??\c:\rllfxxx.exec:\rllfxxx.exe105⤵PID:3200
-
\??\c:\nbbthh.exec:\nbbthh.exe106⤵PID:1952
-
\??\c:\nbbbbh.exec:\nbbbbh.exe107⤵PID:5068
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe108⤵PID:2000
-
\??\c:\3tthbh.exec:\3tthbh.exe109⤵PID:996
-
\??\c:\tnnhhh.exec:\tnnhhh.exe110⤵PID:2916
-
\??\c:\vppjp.exec:\vppjp.exe111⤵PID:1220
-
\??\c:\pddpp.exec:\pddpp.exe112⤵PID:2288
-
\??\c:\frfxrrr.exec:\frfxrrr.exe113⤵PID:684
-
\??\c:\rfllrrx.exec:\rfllrrx.exe114⤵PID:4536
-
\??\c:\btnhbt.exec:\btnhbt.exe115⤵PID:728
-
\??\c:\7hnntt.exec:\7hnntt.exe116⤵PID:4000
-
\??\c:\9pvjd.exec:\9pvjd.exe117⤵PID:512
-
\??\c:\jvddv.exec:\jvddv.exe118⤵PID:1572
-
\??\c:\fllfxxr.exec:\fllfxxr.exe119⤵PID:2560
-
\??\c:\5flfxxr.exec:\5flfxxr.exe120⤵PID:3972
-
\??\c:\nnbbbb.exec:\nnbbbb.exe121⤵PID:1784
-
\??\c:\jddvp.exec:\jddvp.exe122⤵PID:1960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-