Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe
Resource
win7-20240903-en
General
-
Target
e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe
-
Size
65KB
-
MD5
425d153dd998d24be8e9061f34c1a380
-
SHA1
0ad1b971c8669997acd409e09534d6ba00f4e6e4
-
SHA256
e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34
-
SHA512
8762966a6c863910bd8a232b0263633ef7c8a6c614d5c44dfb6007083a4478fdb46277848d7e256956d045f91824cb4e08ed53e6b6c83f1fb83b7de369ab39bf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxij:ymb3NkkiQ3mdBjF0y7kbA
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/5072-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 232 pdjvp.exe 4832 lrrrlll.exe 1784 fxxlxxf.exe 2116 bbtbtn.exe 4812 vjvpd.exe 404 rxfrrlf.exe 3436 7ttntt.exe 548 3hnnbb.exe 1276 ddjpp.exe 1880 fffxxrr.exe 3228 rffrlxr.exe 1528 btnbtn.exe 2588 jpjdj.exe 2164 pjjdp.exe 1288 rlfxlfx.exe 4000 tnnbhb.exe 1868 3xlllrl.exe 3636 dpjpd.exe 2324 btbbtt.exe 1120 bhhthb.exe 1236 dvpjv.exe 2988 jvpjv.exe 532 xrfxffx.exe 4756 rfrlfxf.exe 4804 btttth.exe 3248 bhbnbt.exe 1656 vjjdd.exe 1564 9lrlllx.exe 3496 xxlfxxx.exe 4136 tnnnhn.exe 1580 dppdv.exe 2620 fxffffx.exe 3428 ntthbb.exe 3920 nbhbtb.exe 4480 pjpjd.exe 3432 llxfflf.exe 2848 bttttt.exe 4012 ddddj.exe 1480 djvvd.exe 4340 rlrlffx.exe 4708 bttnnt.exe 1928 bnhbbb.exe 4496 dvvvp.exe 1400 lfffxff.exe 4716 rxxrrrl.exe 4312 bnttnn.exe 4004 pdppj.exe 1452 vvvpj.exe 2492 xrxrfff.exe 3456 lfrxrxx.exe 1260 tnttbh.exe 3044 tnnnnb.exe 548 vvjdj.exe 748 jdjjv.exe 1104 xxlllxx.exe 1880 5btnnh.exe 3960 nbhhtn.exe 1796 dvjjd.exe 4408 jdpvd.exe 1528 rffxlll.exe 4960 hhttbb.exe 1532 nnnbtb.exe 1696 nhbttt.exe 4536 dpjjj.exe -
resource yara_rule behavioral2/memory/5072-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5072 wrote to memory of 232 5072 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 82 PID 5072 wrote to memory of 232 5072 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 82 PID 5072 wrote to memory of 232 5072 e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe 82 PID 232 wrote to memory of 4832 232 pdjvp.exe 83 PID 232 wrote to memory of 4832 232 pdjvp.exe 83 PID 232 wrote to memory of 4832 232 pdjvp.exe 83 PID 4832 wrote to memory of 1784 4832 lrrrlll.exe 84 PID 4832 wrote to memory of 1784 4832 lrrrlll.exe 84 PID 4832 wrote to memory of 1784 4832 lrrrlll.exe 84 PID 1784 wrote to memory of 2116 1784 fxxlxxf.exe 85 PID 1784 wrote to memory of 2116 1784 fxxlxxf.exe 85 PID 1784 wrote to memory of 2116 1784 fxxlxxf.exe 85 PID 2116 wrote to memory of 4812 2116 bbtbtn.exe 86 PID 2116 wrote to memory of 4812 2116 bbtbtn.exe 86 PID 2116 wrote to memory of 4812 2116 bbtbtn.exe 86 PID 4812 wrote to memory of 404 4812 vjvpd.exe 87 PID 4812 wrote to memory of 404 4812 vjvpd.exe 87 PID 4812 wrote to memory of 404 4812 vjvpd.exe 87 PID 404 wrote to memory of 3436 404 rxfrrlf.exe 88 PID 404 wrote to memory of 3436 404 rxfrrlf.exe 88 PID 404 wrote to memory of 3436 404 rxfrrlf.exe 88 PID 3436 wrote to memory of 548 3436 7ttntt.exe 89 PID 3436 wrote to memory of 548 3436 7ttntt.exe 89 PID 3436 wrote to memory of 548 3436 7ttntt.exe 89 PID 548 wrote to memory of 1276 548 3hnnbb.exe 90 PID 548 wrote to memory of 1276 548 3hnnbb.exe 90 PID 548 wrote to memory of 1276 548 3hnnbb.exe 90 PID 1276 wrote to memory of 1880 1276 ddjpp.exe 91 PID 1276 wrote to memory of 1880 1276 ddjpp.exe 91 PID 1276 wrote to memory of 1880 1276 ddjpp.exe 91 PID 1880 wrote to memory of 3228 1880 fffxxrr.exe 92 PID 1880 wrote to memory of 3228 1880 fffxxrr.exe 92 PID 1880 wrote to memory of 3228 1880 fffxxrr.exe 92 PID 3228 wrote to memory of 1528 3228 rffrlxr.exe 93 PID 3228 wrote to memory of 1528 3228 rffrlxr.exe 93 PID 3228 wrote to memory of 1528 3228 rffrlxr.exe 93 PID 1528 wrote to memory of 2588 1528 btnbtn.exe 94 PID 1528 wrote to memory of 2588 1528 btnbtn.exe 94 PID 1528 wrote to memory of 2588 1528 btnbtn.exe 94 PID 2588 wrote to memory of 2164 2588 jpjdj.exe 95 PID 2588 wrote to memory of 2164 2588 jpjdj.exe 95 PID 2588 wrote to memory of 2164 2588 jpjdj.exe 95 PID 2164 wrote to memory of 1288 2164 pjjdp.exe 96 PID 2164 wrote to memory of 1288 2164 pjjdp.exe 96 PID 2164 wrote to memory of 1288 2164 pjjdp.exe 96 PID 1288 wrote to memory of 4000 1288 rlfxlfx.exe 97 PID 1288 wrote to memory of 4000 1288 rlfxlfx.exe 97 PID 1288 wrote to memory of 4000 1288 rlfxlfx.exe 97 PID 4000 wrote to memory of 1868 4000 tnnbhb.exe 98 PID 4000 wrote to memory of 1868 4000 tnnbhb.exe 98 PID 4000 wrote to memory of 1868 4000 tnnbhb.exe 98 PID 1868 wrote to memory of 3636 1868 3xlllrl.exe 99 PID 1868 wrote to memory of 3636 1868 3xlllrl.exe 99 PID 1868 wrote to memory of 3636 1868 3xlllrl.exe 99 PID 3636 wrote to memory of 2324 3636 dpjpd.exe 100 PID 3636 wrote to memory of 2324 3636 dpjpd.exe 100 PID 3636 wrote to memory of 2324 3636 dpjpd.exe 100 PID 2324 wrote to memory of 1120 2324 btbbtt.exe 101 PID 2324 wrote to memory of 1120 2324 btbbtt.exe 101 PID 2324 wrote to memory of 1120 2324 btbbtt.exe 101 PID 1120 wrote to memory of 1236 1120 bhhthb.exe 102 PID 1120 wrote to memory of 1236 1120 bhhthb.exe 102 PID 1120 wrote to memory of 1236 1120 bhhthb.exe 102 PID 1236 wrote to memory of 2988 1236 dvpjv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe"C:\Users\Admin\AppData\Local\Temp\e8617478199895ce265feb19ff938eaeb195c5751190fe034092d6c12bee1c34N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\pdjvp.exec:\pdjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\lrrrlll.exec:\lrrrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\fxxlxxf.exec:\fxxlxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\bbtbtn.exec:\bbtbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vjvpd.exec:\vjvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\rxfrrlf.exec:\rxfrrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\7ttntt.exec:\7ttntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\3hnnbb.exec:\3hnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ddjpp.exec:\ddjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\fffxxrr.exec:\fffxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\rffrlxr.exec:\rffrlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\btnbtn.exec:\btnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\jpjdj.exec:\jpjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjjdp.exec:\pjjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\tnnbhb.exec:\tnnbhb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\3xlllrl.exec:\3xlllrl.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\dpjpd.exec:\dpjpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\btbbtt.exec:\btbbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bhhthb.exec:\bhhthb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\dvpjv.exec:\dvpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\jvpjv.exec:\jvpjv.exe23⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrfxffx.exec:\xrfxffx.exe24⤵
- Executes dropped EXE
PID:532 -
\??\c:\rfrlfxf.exec:\rfrlfxf.exe25⤵
- Executes dropped EXE
PID:4756 -
\??\c:\btttth.exec:\btttth.exe26⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bhbnbt.exec:\bhbnbt.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\vjjdd.exec:\vjjdd.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9lrlllx.exec:\9lrlllx.exe29⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xxlfxxx.exec:\xxlfxxx.exe30⤵
- Executes dropped EXE
PID:3496 -
\??\c:\tnnnhn.exec:\tnnnhn.exe31⤵
- Executes dropped EXE
PID:4136 -
\??\c:\dppdv.exec:\dppdv.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fxffffx.exec:\fxffffx.exe33⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ntthbb.exec:\ntthbb.exe34⤵
- Executes dropped EXE
PID:3428 -
\??\c:\nbhbtb.exec:\nbhbtb.exe35⤵
- Executes dropped EXE
PID:3920 -
\??\c:\pjpjd.exec:\pjpjd.exe36⤵
- Executes dropped EXE
PID:4480 -
\??\c:\llxfflf.exec:\llxfflf.exe37⤵
- Executes dropped EXE
PID:3432 -
\??\c:\bttttt.exec:\bttttt.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ddddj.exec:\ddddj.exe39⤵
- Executes dropped EXE
PID:4012 -
\??\c:\djvvd.exec:\djvvd.exe40⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rlrlffx.exec:\rlrlffx.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\bttnnt.exec:\bttnnt.exe42⤵
- Executes dropped EXE
PID:4708 -
\??\c:\bnhbbb.exec:\bnhbbb.exe43⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvvvp.exec:\dvvvp.exe44⤵
- Executes dropped EXE
PID:4496 -
\??\c:\lfffxff.exec:\lfffxff.exe45⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe46⤵
- Executes dropped EXE
PID:4716 -
\??\c:\bnttnn.exec:\bnttnn.exe47⤵
- Executes dropped EXE
PID:4312 -
\??\c:\pdppj.exec:\pdppj.exe48⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vvvpj.exec:\vvvpj.exe49⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xrxrfff.exec:\xrxrfff.exe50⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lfrxrxx.exec:\lfrxrxx.exe51⤵
- Executes dropped EXE
PID:3456 -
\??\c:\tnttbh.exec:\tnttbh.exe52⤵
- Executes dropped EXE
PID:1260 -
\??\c:\tnnnnb.exec:\tnnnnb.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vvjdj.exec:\vvjdj.exe54⤵
- Executes dropped EXE
PID:548 -
\??\c:\jdjjv.exec:\jdjjv.exe55⤵
- Executes dropped EXE
PID:748 -
\??\c:\xxlllxx.exec:\xxlllxx.exe56⤵
- Executes dropped EXE
PID:1104 -
\??\c:\5btnnh.exec:\5btnnh.exe57⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nbhhtn.exec:\nbhhtn.exe58⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dvjjd.exec:\dvjjd.exe59⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jdpvd.exec:\jdpvd.exe60⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rffxlll.exec:\rffxlll.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hhttbb.exec:\hhttbb.exe62⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nnnbtb.exec:\nnnbtb.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nhbttt.exec:\nhbttt.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dpjjj.exec:\dpjjj.exe65⤵
- Executes dropped EXE
PID:4536 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe66⤵PID:1196
-
\??\c:\xrxrlll.exec:\xrxrlll.exe67⤵PID:3284
-
\??\c:\hhbhnt.exec:\hhbhnt.exe68⤵PID:2796
-
\??\c:\hbhhhh.exec:\hbhhhh.exe69⤵PID:2364
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:844
-
\??\c:\jdppv.exec:\jdppv.exe71⤵PID:1120
-
\??\c:\lfxxlll.exec:\lfxxlll.exe72⤵PID:3568
-
\??\c:\tntttb.exec:\tntttb.exe73⤵PID:1744
-
\??\c:\pjvvj.exec:\pjvvj.exe74⤵PID:1820
-
\??\c:\frrxrrr.exec:\frrxrrr.exe75⤵PID:4024
-
\??\c:\3xffxxr.exec:\3xffxxr.exe76⤵PID:220
-
\??\c:\tntntt.exec:\tntntt.exe77⤵PID:4804
-
\??\c:\7hhhtt.exec:\7hhhtt.exe78⤵PID:4848
-
\??\c:\jdvvj.exec:\jdvvj.exe79⤵PID:1656
-
\??\c:\rrllrrr.exec:\rrllrrr.exe80⤵PID:3468
-
\??\c:\flxxrff.exec:\flxxrff.exe81⤵PID:1000
-
\??\c:\thnbtb.exec:\thnbtb.exe82⤵PID:3112
-
\??\c:\hntnhh.exec:\hntnhh.exe83⤵PID:2776
-
\??\c:\jpjjd.exec:\jpjjd.exe84⤵PID:1892
-
\??\c:\vvjjj.exec:\vvjjj.exe85⤵PID:4608
-
\??\c:\fxxxlrr.exec:\fxxxlrr.exe86⤵PID:1404
-
\??\c:\xxflxxf.exec:\xxflxxf.exe87⤵PID:2416
-
\??\c:\hbbtnn.exec:\hbbtnn.exe88⤵PID:3920
-
\??\c:\bbbttt.exec:\bbbttt.exe89⤵PID:3748
-
\??\c:\pvppd.exec:\pvppd.exe90⤵PID:5008
-
\??\c:\1vvvp.exec:\1vvvp.exe91⤵PID:4084
-
\??\c:\fxffllx.exec:\fxffllx.exe92⤵PID:2144
-
\??\c:\nbbhbb.exec:\nbbhbb.exe93⤵PID:4356
-
\??\c:\nbnnhh.exec:\nbnnhh.exe94⤵PID:3988
-
\??\c:\hhbhbb.exec:\hhbhbb.exe95⤵PID:2928
-
\??\c:\vvjjd.exec:\vvjjd.exe96⤵PID:4808
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe97⤵PID:232
-
\??\c:\flxlrxf.exec:\flxlrxf.exe98⤵PID:2136
-
\??\c:\tbnnhh.exec:\tbnnhh.exe99⤵PID:1852
-
\??\c:\hhhhbb.exec:\hhhhbb.exe100⤵PID:1304
-
\??\c:\pvvvj.exec:\pvvvj.exe101⤵PID:732
-
\??\c:\rrrrlll.exec:\rrrrlll.exe102⤵PID:3732
-
\??\c:\lfrxllx.exec:\lfrxllx.exe103⤵PID:4812
-
\??\c:\bhbtnt.exec:\bhbtnt.exe104⤵PID:4516
-
\??\c:\3nnnbb.exec:\3nnnbb.exe105⤵PID:1020
-
\??\c:\pdddv.exec:\pdddv.exe106⤵PID:4788
-
\??\c:\dpvpj.exec:\dpvpj.exe107⤵
- System Location Discovery: System Language Discovery
PID:912 -
\??\c:\7rxrlxx.exec:\7rxrlxx.exe108⤵PID:1184
-
\??\c:\rxffxfx.exec:\rxffxfx.exe109⤵PID:2644
-
\??\c:\hhhhhh.exec:\hhhhhh.exe110⤵PID:4648
-
\??\c:\ntbttt.exec:\ntbttt.exe111⤵PID:2160
-
\??\c:\5dvpp.exec:\5dvpp.exe112⤵PID:1760
-
\??\c:\7ddpv.exec:\7ddpv.exe113⤵PID:5028
-
\??\c:\fxllrxf.exec:\fxllrxf.exe114⤵PID:4408
-
\??\c:\9thnnt.exec:\9thnnt.exe115⤵PID:3828
-
\??\c:\bttnhh.exec:\bttnhh.exe116⤵PID:4960
-
\??\c:\9btnht.exec:\9btnht.exe117⤵PID:1532
-
\??\c:\pjpjp.exec:\pjpjp.exe118⤵PID:1100
-
\??\c:\7frrxxx.exec:\7frrxxx.exe119⤵PID:4720
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe120⤵PID:2088
-
\??\c:\bbnbnn.exec:\bbnbnn.exe121⤵PID:3800
-
\??\c:\httttb.exec:\httttb.exe122⤵PID:3284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-