Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe
Resource
win7-20240729-en
General
-
Target
71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe
-
Size
82KB
-
MD5
43fece1f89a797acee543c174ed7abf0
-
SHA1
a9a0b33b8dcca231929cbcc49cf912054a5c4c59
-
SHA256
71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764
-
SHA512
0d289313da1bece1d747daf206017e5aeaf4fc2b3579c86d731e68a14d765a802744bec08bf247af4a39f23bee284276b26670861382b4c785f07111893416f8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QE:ymb3NkkiQ3mdBjFIIp9L9QrrA8l
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3660-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5116 thnbtn.exe 1972 tnbtht.exe 1372 vppdp.exe 2296 9xxlrrl.exe 2644 rllfrlf.exe 4944 btttbh.exe 3336 jdvpd.exe 4708 jjvpv.exe 3796 xrfxrrx.exe 1640 htnbbt.exe 4880 vvdvv.exe 2292 xrlfrlf.exe 3284 rffrlfr.exe 1636 hnnbbn.exe 1732 hhhthb.exe 2368 jpppj.exe 2300 llxlffl.exe 2280 btnbhn.exe 1980 vjppd.exe 1524 1djdp.exe 4536 hnnbtn.exe 4660 7pvvj.exe 2968 lxffxrr.exe 2456 dvjjd.exe 3908 jdjjd.exe 4520 5rrrlrl.exe 3404 3bnhnn.exe 4612 djpjv.exe 4364 rfxrfff.exe 4296 xlllfxx.exe 1844 nnntnn.exe 4468 ppjjv.exe 2380 jdjjj.exe 812 rlrlxxr.exe 1208 hnbbbb.exe 3860 ttbtbb.exe 2020 vdpdp.exe 1200 3vvpd.exe 968 xxlxxlx.exe 4064 5rrrllf.exe 656 ttbbbb.exe 1956 jvddv.exe 228 jdjpp.exe 3664 9flfxrr.exe 640 3bhhbt.exe 4504 3ntttb.exe 3032 pjppp.exe 2340 lfrlflf.exe 1020 3bhbtn.exe 3416 nnbbbh.exe 2564 ppjdd.exe 2952 dvvvp.exe 2296 rrlfxrr.exe 4176 xxxrrlx.exe 4944 7rrffrx.exe 436 nbthnt.exe 4452 9pvpj.exe 3612 xxrlffx.exe 2964 xxffxrl.exe 1928 tbbhht.exe 552 nthhtt.exe 2736 jjjdv.exe 2412 fffxrrl.exe 4784 xfxflfr.exe -
resource yara_rule behavioral2/memory/3660-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 5116 3660 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 82 PID 3660 wrote to memory of 5116 3660 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 82 PID 3660 wrote to memory of 5116 3660 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 82 PID 5116 wrote to memory of 1972 5116 thnbtn.exe 83 PID 5116 wrote to memory of 1972 5116 thnbtn.exe 83 PID 5116 wrote to memory of 1972 5116 thnbtn.exe 83 PID 1972 wrote to memory of 1372 1972 tnbtht.exe 84 PID 1972 wrote to memory of 1372 1972 tnbtht.exe 84 PID 1972 wrote to memory of 1372 1972 tnbtht.exe 84 PID 1372 wrote to memory of 2296 1372 vppdp.exe 85 PID 1372 wrote to memory of 2296 1372 vppdp.exe 85 PID 1372 wrote to memory of 2296 1372 vppdp.exe 85 PID 2296 wrote to memory of 2644 2296 9xxlrrl.exe 86 PID 2296 wrote to memory of 2644 2296 9xxlrrl.exe 86 PID 2296 wrote to memory of 2644 2296 9xxlrrl.exe 86 PID 2644 wrote to memory of 4944 2644 rllfrlf.exe 87 PID 2644 wrote to memory of 4944 2644 rllfrlf.exe 87 PID 2644 wrote to memory of 4944 2644 rllfrlf.exe 87 PID 4944 wrote to memory of 3336 4944 btttbh.exe 88 PID 4944 wrote to memory of 3336 4944 btttbh.exe 88 PID 4944 wrote to memory of 3336 4944 btttbh.exe 88 PID 3336 wrote to memory of 4708 3336 jdvpd.exe 89 PID 3336 wrote to memory of 4708 3336 jdvpd.exe 89 PID 3336 wrote to memory of 4708 3336 jdvpd.exe 89 PID 4708 wrote to memory of 3796 4708 jjvpv.exe 90 PID 4708 wrote to memory of 3796 4708 jjvpv.exe 90 PID 4708 wrote to memory of 3796 4708 jjvpv.exe 90 PID 3796 wrote to memory of 1640 3796 xrfxrrx.exe 91 PID 3796 wrote to memory of 1640 3796 xrfxrrx.exe 91 PID 3796 wrote to memory of 1640 3796 xrfxrrx.exe 91 PID 1640 wrote to memory of 4880 1640 htnbbt.exe 92 PID 1640 wrote to memory of 4880 1640 htnbbt.exe 92 PID 1640 wrote to memory of 4880 1640 htnbbt.exe 92 PID 4880 wrote to memory of 2292 4880 vvdvv.exe 93 PID 4880 wrote to memory of 2292 4880 vvdvv.exe 93 PID 4880 wrote to memory of 2292 4880 vvdvv.exe 93 PID 2292 wrote to memory of 3284 2292 xrlfrlf.exe 94 PID 2292 wrote to memory of 3284 2292 xrlfrlf.exe 94 PID 2292 wrote to memory of 3284 2292 xrlfrlf.exe 94 PID 3284 wrote to memory of 1636 3284 rffrlfr.exe 95 PID 3284 wrote to memory of 1636 3284 rffrlfr.exe 95 PID 3284 wrote to memory of 1636 3284 rffrlfr.exe 95 PID 1636 wrote to memory of 1732 1636 hnnbbn.exe 96 PID 1636 wrote to memory of 1732 1636 hnnbbn.exe 96 PID 1636 wrote to memory of 1732 1636 hnnbbn.exe 96 PID 1732 wrote to memory of 2368 1732 hhhthb.exe 97 PID 1732 wrote to memory of 2368 1732 hhhthb.exe 97 PID 1732 wrote to memory of 2368 1732 hhhthb.exe 97 PID 2368 wrote to memory of 2300 2368 jpppj.exe 98 PID 2368 wrote to memory of 2300 2368 jpppj.exe 98 PID 2368 wrote to memory of 2300 2368 jpppj.exe 98 PID 2300 wrote to memory of 2280 2300 llxlffl.exe 99 PID 2300 wrote to memory of 2280 2300 llxlffl.exe 99 PID 2300 wrote to memory of 2280 2300 llxlffl.exe 99 PID 2280 wrote to memory of 1980 2280 btnbhn.exe 100 PID 2280 wrote to memory of 1980 2280 btnbhn.exe 100 PID 2280 wrote to memory of 1980 2280 btnbhn.exe 100 PID 1980 wrote to memory of 1524 1980 vjppd.exe 101 PID 1980 wrote to memory of 1524 1980 vjppd.exe 101 PID 1980 wrote to memory of 1524 1980 vjppd.exe 101 PID 1524 wrote to memory of 4536 1524 1djdp.exe 102 PID 1524 wrote to memory of 4536 1524 1djdp.exe 102 PID 1524 wrote to memory of 4536 1524 1djdp.exe 102 PID 4536 wrote to memory of 4660 4536 hnnbtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe"C:\Users\Admin\AppData\Local\Temp\71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\thnbtn.exec:\thnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\tnbtht.exec:\tnbtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vppdp.exec:\vppdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\9xxlrrl.exec:\9xxlrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rllfrlf.exec:\rllfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\btttbh.exec:\btttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\jdvpd.exec:\jdvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\jjvpv.exec:\jjvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\xrfxrrx.exec:\xrfxrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\htnbbt.exec:\htnbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\vvdvv.exec:\vvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rffrlfr.exec:\rffrlfr.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\hnnbbn.exec:\hnnbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\hhhthb.exec:\hhhthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jpppj.exec:\jpppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\llxlffl.exec:\llxlffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\btnbhn.exec:\btnbhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vjppd.exec:\vjppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\1djdp.exec:\1djdp.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\hnnbtn.exec:\hnnbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\7pvvj.exec:\7pvvj.exe23⤵
- Executes dropped EXE
PID:4660 -
\??\c:\lxffxrr.exec:\lxffxrr.exe24⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dvjjd.exec:\dvjjd.exe25⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdjjd.exec:\jdjjd.exe26⤵
- Executes dropped EXE
PID:3908 -
\??\c:\5rrrlrl.exec:\5rrrlrl.exe27⤵
- Executes dropped EXE
PID:4520 -
\??\c:\3bnhnn.exec:\3bnhnn.exe28⤵
- Executes dropped EXE
PID:3404 -
\??\c:\djpjv.exec:\djpjv.exe29⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rfxrfff.exec:\rfxrfff.exe30⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xlllfxx.exec:\xlllfxx.exe31⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nnntnn.exec:\nnntnn.exe32⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ppjjv.exec:\ppjjv.exe33⤵
- Executes dropped EXE
PID:4468 -
\??\c:\jdjjj.exec:\jdjjj.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe35⤵
- Executes dropped EXE
PID:812 -
\??\c:\hnbbbb.exec:\hnbbbb.exe36⤵
- Executes dropped EXE
PID:1208 -
\??\c:\ttbtbb.exec:\ttbtbb.exe37⤵
- Executes dropped EXE
PID:3860 -
\??\c:\vdpdp.exec:\vdpdp.exe38⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3vvpd.exec:\3vvpd.exe39⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xxlxxlx.exec:\xxlxxlx.exe40⤵
- Executes dropped EXE
PID:968 -
\??\c:\5rrrllf.exec:\5rrrllf.exe41⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ttbbbb.exec:\ttbbbb.exe42⤵
- Executes dropped EXE
PID:656 -
\??\c:\jvddv.exec:\jvddv.exe43⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jdjpp.exec:\jdjpp.exe44⤵
- Executes dropped EXE
PID:228 -
\??\c:\9flfxrr.exec:\9flfxrr.exe45⤵
- Executes dropped EXE
PID:3664 -
\??\c:\3bhhbt.exec:\3bhhbt.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\3ntttb.exec:\3ntttb.exe47⤵
- Executes dropped EXE
PID:4504 -
\??\c:\pjppp.exec:\pjppp.exe48⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lfrlflf.exec:\lfrlflf.exe49⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3bhbtn.exec:\3bhbtn.exe50⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nnbbbh.exec:\nnbbbh.exe51⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ppjdd.exec:\ppjdd.exe52⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dvvvp.exec:\dvvvp.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952 -
\??\c:\rrlfxrr.exec:\rrlfxrr.exe54⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xxxrrlx.exec:\xxxrrlx.exe55⤵
- Executes dropped EXE
PID:4176 -
\??\c:\7rrffrx.exec:\7rrffrx.exe56⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nbthnt.exec:\nbthnt.exe57⤵
- Executes dropped EXE
PID:436 -
\??\c:\9pvpj.exec:\9pvpj.exe58⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xxrlffx.exec:\xxrlffx.exe59⤵
- Executes dropped EXE
PID:3612 -
\??\c:\xxffxrl.exec:\xxffxrl.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tbbhht.exec:\tbbhht.exe61⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nthhtt.exec:\nthhtt.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\jjjdv.exec:\jjjdv.exe63⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fffxrrl.exec:\fffxrrl.exe64⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xfxflfr.exec:\xfxflfr.exe65⤵
- Executes dropped EXE
PID:4784 -
\??\c:\xfffrfr.exec:\xfffrfr.exe66⤵PID:2312
-
\??\c:\htttnn.exec:\htttnn.exe67⤵PID:4924
-
\??\c:\7ppjd.exec:\7ppjd.exe68⤵PID:1732
-
\??\c:\dvddd.exec:\dvddd.exe69⤵PID:628
-
\??\c:\xxrlllr.exec:\xxrlllr.exe70⤵PID:2284
-
\??\c:\9xfxffl.exec:\9xfxffl.exe71⤵PID:2756
-
\??\c:\tthbtn.exec:\tthbtn.exe72⤵PID:2692
-
\??\c:\vvvdp.exec:\vvvdp.exe73⤵PID:1556
-
\??\c:\vdjdp.exec:\vdjdp.exe74⤵PID:1524
-
\??\c:\1xxrrrx.exec:\1xxrrrx.exe75⤵PID:708
-
\??\c:\rlllffx.exec:\rlllffx.exe76⤵PID:4144
-
\??\c:\tnntnt.exec:\tnntnt.exe77⤵PID:3020
-
\??\c:\thhbtn.exec:\thhbtn.exe78⤵PID:2420
-
\??\c:\5ddvj.exec:\5ddvj.exe79⤵PID:2932
-
\??\c:\7llfrrl.exec:\7llfrrl.exe80⤵PID:3368
-
\??\c:\7ntnhn.exec:\7ntnhn.exe81⤵PID:3724
-
\??\c:\pvddv.exec:\pvddv.exe82⤵PID:3908
-
\??\c:\xrllfxr.exec:\xrllfxr.exe83⤵PID:3440
-
\??\c:\7rxfxrl.exec:\7rxfxrl.exe84⤵PID:2252
-
\??\c:\hbtnnt.exec:\hbtnnt.exe85⤵PID:4496
-
\??\c:\5thbtn.exec:\5thbtn.exe86⤵PID:3212
-
\??\c:\jddjd.exec:\jddjd.exe87⤵PID:3812
-
\??\c:\dpjjv.exec:\dpjjv.exe88⤵PID:4588
-
\??\c:\rlllxxr.exec:\rlllxxr.exe89⤵PID:2976
-
\??\c:\rlllfff.exec:\rlllfff.exe90⤵PID:2760
-
\??\c:\9tttbt.exec:\9tttbt.exe91⤵PID:3320
-
\??\c:\bntbnh.exec:\bntbnh.exe92⤵PID:3956
-
\??\c:\vpvdv.exec:\vpvdv.exe93⤵PID:1396
-
\??\c:\3vvpp.exec:\3vvpp.exe94⤵PID:3860
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe95⤵PID:2020
-
\??\c:\nbhhbb.exec:\nbhhbb.exe96⤵PID:536
-
\??\c:\5btnbb.exec:\5btnbb.exe97⤵PID:1236
-
\??\c:\9vpjd.exec:\9vpjd.exe98⤵PID:4064
-
\??\c:\vjpdv.exec:\vjpdv.exe99⤵PID:3848
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe100⤵PID:4552
-
\??\c:\bbbtnh.exec:\bbbtnh.exe101⤵PID:1392
-
\??\c:\5tnbht.exec:\5tnbht.exe102⤵PID:4856
-
\??\c:\dvjdj.exec:\dvjdj.exe103⤵PID:1520
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe104⤵PID:4620
-
\??\c:\1rfxrlf.exec:\1rfxrlf.exe105⤵PID:3756
-
\??\c:\bthnhb.exec:\bthnhb.exe106⤵PID:2616
-
\??\c:\vvjpd.exec:\vvjpd.exe107⤵PID:4632
-
\??\c:\vvjpd.exec:\vvjpd.exe108⤵PID:1148
-
\??\c:\rxxfxff.exec:\rxxfxff.exe109⤵PID:1372
-
\??\c:\xxrfxrl.exec:\xxrfxrl.exe110⤵PID:1364
-
\??\c:\ttnnnh.exec:\ttnnnh.exe111⤵PID:2644
-
\??\c:\3bnnth.exec:\3bnnth.exe112⤵PID:3960
-
\??\c:\jvjvj.exec:\jvjvj.exe113⤵PID:4200
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe114⤵PID:3336
-
\??\c:\rlflfrf.exec:\rlflfrf.exe115⤵PID:2540
-
\??\c:\1thbnt.exec:\1thbnt.exe116⤵PID:4148
-
\??\c:\thnhtb.exec:\thnhtb.exe117⤵PID:2192
-
\??\c:\jdvpd.exec:\jdvpd.exe118⤵PID:4280
-
\??\c:\vjjjv.exec:\vjjjv.exe119⤵PID:3124
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe120⤵PID:4196
-
\??\c:\5rxrflf.exec:\5rxrflf.exe121⤵PID:2292
-
\??\c:\htbttt.exec:\htbttt.exe122⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-