Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe
Resource
win7-20240903-en
General
-
Target
9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe
-
Size
63KB
-
MD5
6a9b5806b1498d96e3312f0e3b145310
-
SHA1
408ee02773bfee08dac55cd60ce4523e5f375a75
-
SHA256
9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56
-
SHA512
1914c64910635f31aab40ff23473e6141a196aaff40d7df7a51f3f31598a4119f3732fc0fa8779f9c471a51b5595711c1a77bbb8530f337f07e6772d3c1ce945
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxi+:ymb3NkkiQ3mdBjF0y7kb/
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4304-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4484 pjddd.exe 3400 rffxfff.exe 4392 xffxrrl.exe 5044 7htnhh.exe 4628 nnnnhn.exe 2280 xrrlxxx.exe 4420 rlrrrrx.exe 2916 btttbb.exe 1084 ppjdv.exe 2688 5jvpj.exe 3300 fxrrrll.exe 2024 tbbttt.exe 1372 jpppp.exe 232 dvvpj.exe 4868 9rxrffx.exe 2484 xfllfrr.exe 2116 htnnnt.exe 4528 jdjdv.exe 2876 rrxxfxr.exe 4608 xllfxff.exe 2324 tnntnt.exe 1792 3hhntt.exe 4408 pjvpv.exe 920 vvjdd.exe 3728 ttnntt.exe 1376 hbbtnn.exe 1932 jdvvp.exe 624 ddvpp.exe 2692 fxfxrrx.exe 2488 xflllff.exe 3420 hbbnbt.exe 1336 jdjpj.exe 3316 xlllrrr.exe 2244 tbhhhn.exe 1808 jjvpp.exe 2136 pdpjj.exe 1948 1jpjd.exe 1928 xrlfxxr.exe 4884 tnnhhb.exe 3108 9ntnhh.exe 4244 9dppj.exe 4824 1xxfxxr.exe 3200 lfllfff.exe 4216 3tbnbn.exe 5092 lfflxrf.exe 2956 tnnhbb.exe 1120 htttnn.exe 2068 jvpvj.exe 1452 jdpjj.exe 2716 rrlfxxx.exe 1656 xrlffxx.exe 4180 bbhbbb.exe 3908 vvpjd.exe 2968 llflfrl.exe 4620 nhnbnh.exe 3332 rlfxrrl.exe 4252 tthnbn.exe 5116 3hnnhn.exe 224 jvdvj.exe 4760 xrrlxfl.exe 1692 1tbttt.exe 2000 bbbtnn.exe 4764 7ddvj.exe 3248 lrllflf.exe -
resource yara_rule behavioral2/memory/4304-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 4484 4304 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 82 PID 4304 wrote to memory of 4484 4304 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 82 PID 4304 wrote to memory of 4484 4304 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 82 PID 4484 wrote to memory of 3400 4484 pjddd.exe 83 PID 4484 wrote to memory of 3400 4484 pjddd.exe 83 PID 4484 wrote to memory of 3400 4484 pjddd.exe 83 PID 3400 wrote to memory of 4392 3400 rffxfff.exe 84 PID 3400 wrote to memory of 4392 3400 rffxfff.exe 84 PID 3400 wrote to memory of 4392 3400 rffxfff.exe 84 PID 4392 wrote to memory of 5044 4392 xffxrrl.exe 85 PID 4392 wrote to memory of 5044 4392 xffxrrl.exe 85 PID 4392 wrote to memory of 5044 4392 xffxrrl.exe 85 PID 5044 wrote to memory of 4628 5044 7htnhh.exe 86 PID 5044 wrote to memory of 4628 5044 7htnhh.exe 86 PID 5044 wrote to memory of 4628 5044 7htnhh.exe 86 PID 4628 wrote to memory of 2280 4628 nnnnhn.exe 87 PID 4628 wrote to memory of 2280 4628 nnnnhn.exe 87 PID 4628 wrote to memory of 2280 4628 nnnnhn.exe 87 PID 2280 wrote to memory of 4420 2280 xrrlxxx.exe 88 PID 2280 wrote to memory of 4420 2280 xrrlxxx.exe 88 PID 2280 wrote to memory of 4420 2280 xrrlxxx.exe 88 PID 4420 wrote to memory of 2916 4420 rlrrrrx.exe 89 PID 4420 wrote to memory of 2916 4420 rlrrrrx.exe 89 PID 4420 wrote to memory of 2916 4420 rlrrrrx.exe 89 PID 2916 wrote to memory of 1084 2916 btttbb.exe 90 PID 2916 wrote to memory of 1084 2916 btttbb.exe 90 PID 2916 wrote to memory of 1084 2916 btttbb.exe 90 PID 1084 wrote to memory of 2688 1084 ppjdv.exe 91 PID 1084 wrote to memory of 2688 1084 ppjdv.exe 91 PID 1084 wrote to memory of 2688 1084 ppjdv.exe 91 PID 2688 wrote to memory of 3300 2688 5jvpj.exe 92 PID 2688 wrote to memory of 3300 2688 5jvpj.exe 92 PID 2688 wrote to memory of 3300 2688 5jvpj.exe 92 PID 3300 wrote to memory of 2024 3300 fxrrrll.exe 93 PID 3300 wrote to memory of 2024 3300 fxrrrll.exe 93 PID 3300 wrote to memory of 2024 3300 fxrrrll.exe 93 PID 2024 wrote to memory of 1372 2024 tbbttt.exe 94 PID 2024 wrote to memory of 1372 2024 tbbttt.exe 94 PID 2024 wrote to memory of 1372 2024 tbbttt.exe 94 PID 1372 wrote to memory of 232 1372 jpppp.exe 95 PID 1372 wrote to memory of 232 1372 jpppp.exe 95 PID 1372 wrote to memory of 232 1372 jpppp.exe 95 PID 232 wrote to memory of 4868 232 dvvpj.exe 96 PID 232 wrote to memory of 4868 232 dvvpj.exe 96 PID 232 wrote to memory of 4868 232 dvvpj.exe 96 PID 4868 wrote to memory of 2484 4868 9rxrffx.exe 97 PID 4868 wrote to memory of 2484 4868 9rxrffx.exe 97 PID 4868 wrote to memory of 2484 4868 9rxrffx.exe 97 PID 2484 wrote to memory of 2116 2484 xfllfrr.exe 98 PID 2484 wrote to memory of 2116 2484 xfllfrr.exe 98 PID 2484 wrote to memory of 2116 2484 xfllfrr.exe 98 PID 2116 wrote to memory of 4528 2116 htnnnt.exe 99 PID 2116 wrote to memory of 4528 2116 htnnnt.exe 99 PID 2116 wrote to memory of 4528 2116 htnnnt.exe 99 PID 4528 wrote to memory of 2876 4528 jdjdv.exe 100 PID 4528 wrote to memory of 2876 4528 jdjdv.exe 100 PID 4528 wrote to memory of 2876 4528 jdjdv.exe 100 PID 2876 wrote to memory of 4608 2876 rrxxfxr.exe 101 PID 2876 wrote to memory of 4608 2876 rrxxfxr.exe 101 PID 2876 wrote to memory of 4608 2876 rrxxfxr.exe 101 PID 4608 wrote to memory of 2324 4608 xllfxff.exe 102 PID 4608 wrote to memory of 2324 4608 xllfxff.exe 102 PID 4608 wrote to memory of 2324 4608 xllfxff.exe 102 PID 2324 wrote to memory of 1792 2324 tnntnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe"C:\Users\Admin\AppData\Local\Temp\9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\pjddd.exec:\pjddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\rffxfff.exec:\rffxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\xffxrrl.exec:\xffxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\7htnhh.exec:\7htnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\nnnnhn.exec:\nnnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\btttbb.exec:\btttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ppjdv.exec:\ppjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\5jvpj.exec:\5jvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxrrrll.exec:\fxrrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\tbbttt.exec:\tbbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\jpppp.exec:\jpppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\dvvpj.exec:\dvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\9rxrffx.exec:\9rxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\xfllfrr.exec:\xfllfrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\htnnnt.exec:\htnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jdjdv.exec:\jdjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\rrxxfxr.exec:\rrxxfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xllfxff.exec:\xllfxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\tnntnt.exec:\tnntnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3hhntt.exec:\3hhntt.exe23⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pjvpv.exec:\pjvpv.exe24⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vvjdd.exec:\vvjdd.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\ttnntt.exec:\ttnntt.exe26⤵
- Executes dropped EXE
PID:3728 -
\??\c:\hbbtnn.exec:\hbbtnn.exe27⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdvvp.exec:\jdvvp.exe28⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ddvpp.exec:\ddvpp.exe29⤵
- Executes dropped EXE
PID:624 -
\??\c:\fxfxrrx.exec:\fxfxrrx.exe30⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xflllff.exec:\xflllff.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbbnbt.exec:\hbbnbt.exe32⤵
- Executes dropped EXE
PID:3420 -
\??\c:\jdjpj.exec:\jdjpj.exe33⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xlllrrr.exec:\xlllrrr.exe34⤵
- Executes dropped EXE
PID:3316 -
\??\c:\tbhhhn.exec:\tbhhhn.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jjvpp.exec:\jjvpp.exe36⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pdpjj.exec:\pdpjj.exe37⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1jpjd.exec:\1jpjd.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnnhhb.exec:\tnnhhb.exe40⤵
- Executes dropped EXE
PID:4884 -
\??\c:\9ntnhh.exec:\9ntnhh.exe41⤵
- Executes dropped EXE
PID:3108 -
\??\c:\9dppj.exec:\9dppj.exe42⤵
- Executes dropped EXE
PID:4244 -
\??\c:\1xxfxxr.exec:\1xxfxxr.exe43⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lfllfff.exec:\lfllfff.exe44⤵
- Executes dropped EXE
PID:3200 -
\??\c:\3tbnbn.exec:\3tbnbn.exe45⤵
- Executes dropped EXE
PID:4216 -
\??\c:\lfflxrf.exec:\lfflxrf.exe46⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tnnhbb.exec:\tnnhbb.exe47⤵
- Executes dropped EXE
PID:2956 -
\??\c:\htttnn.exec:\htttnn.exe48⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jvpvj.exec:\jvpvj.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jdpjj.exec:\jdpjj.exe50⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrlffxx.exec:\xrlffxx.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbhbbb.exec:\bbhbbb.exe53⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vvpjd.exec:\vvpjd.exe54⤵
- Executes dropped EXE
PID:3908 -
\??\c:\llflfrl.exec:\llflfrl.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nhnbnh.exec:\nhnbnh.exe56⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe57⤵
- Executes dropped EXE
PID:3332 -
\??\c:\tthnbn.exec:\tthnbn.exe58⤵
- Executes dropped EXE
PID:4252 -
\??\c:\3hnnhn.exec:\3hnnhn.exe59⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jvdvj.exec:\jvdvj.exe60⤵
- Executes dropped EXE
PID:224 -
\??\c:\xrrlxfl.exec:\xrrlxfl.exe61⤵
- Executes dropped EXE
PID:4760 -
\??\c:\1tbttt.exec:\1tbttt.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bbbtnn.exec:\bbbtnn.exe63⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7ddvj.exec:\7ddvj.exe64⤵
- Executes dropped EXE
PID:4764 -
\??\c:\lrllflf.exec:\lrllflf.exe65⤵
- Executes dropped EXE
PID:3248 -
\??\c:\7flxrfx.exec:\7flxrfx.exe66⤵PID:3300
-
\??\c:\7btttb.exec:\7btttb.exe67⤵PID:1352
-
\??\c:\7vjvp.exec:\7vjvp.exe68⤵PID:4480
-
\??\c:\7frlrrr.exec:\7frlrrr.exe69⤵PID:3476
-
\??\c:\httnbb.exec:\httnbb.exe70⤵PID:3004
-
\??\c:\nbbbbt.exec:\nbbbbt.exe71⤵PID:2996
-
\??\c:\pdjdd.exec:\pdjdd.exe72⤵PID:1324
-
\??\c:\vvvdd.exec:\vvvdd.exe73⤵PID:4436
-
\??\c:\flrrflf.exec:\flrrflf.exe74⤵PID:3032
-
\??\c:\xfxfrlx.exec:\xfxfrlx.exe75⤵PID:1984
-
\??\c:\bnnbbn.exec:\bnnbbn.exe76⤵PID:112
-
\??\c:\ddvvd.exec:\ddvvd.exe77⤵PID:1696
-
\??\c:\3vdvj.exec:\3vdvj.exe78⤵PID:1596
-
\??\c:\xffrffx.exec:\xffrffx.exe79⤵PID:4864
-
\??\c:\nhbtnn.exec:\nhbtnn.exe80⤵PID:116
-
\??\c:\dvvvj.exec:\dvvvj.exe81⤵PID:1104
-
\??\c:\3ddvj.exec:\3ddvj.exe82⤵PID:3668
-
\??\c:\lrfrxrf.exec:\lrfrxrf.exe83⤵PID:3712
-
\??\c:\9bntnn.exec:\9bntnn.exe84⤵PID:3728
-
\??\c:\nnhtnh.exec:\nnhtnh.exe85⤵PID:3684
-
\??\c:\pvdvp.exec:\pvdvp.exe86⤵PID:4636
-
\??\c:\5pvvj.exec:\5pvvj.exe87⤵PID:4820
-
\??\c:\xffxllf.exec:\xffxllf.exe88⤵PID:624
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe89⤵
- System Location Discovery: System Language Discovery
PID:1164 -
\??\c:\hhnbtt.exec:\hhnbtt.exe90⤵PID:1756
-
\??\c:\pvdvj.exec:\pvdvj.exe91⤵PID:1612
-
\??\c:\pvvpd.exec:\pvvpd.exe92⤵PID:2352
-
\??\c:\xfxrllx.exec:\xfxrllx.exe93⤵PID:856
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe94⤵PID:832
-
\??\c:\9hhbtt.exec:\9hhbtt.exe95⤵PID:4060
-
\??\c:\nhhbtt.exec:\nhhbtt.exe96⤵PID:2708
-
\??\c:\5pvpj.exec:\5pvpj.exe97⤵PID:2136
-
\??\c:\dpjjd.exec:\dpjjd.exe98⤵PID:1948
-
\??\c:\xxxflxf.exec:\xxxflxf.exe99⤵PID:1928
-
\??\c:\xxrlffr.exec:\xxrlffr.exe100⤵PID:680
-
\??\c:\ntnbnb.exec:\ntnbnb.exe101⤵PID:3108
-
\??\c:\nbbtnn.exec:\nbbtnn.exe102⤵PID:4244
-
\??\c:\jvdvd.exec:\jvdvd.exe103⤵PID:4100
-
\??\c:\dvpdd.exec:\dvpdd.exe104⤵PID:4652
-
\??\c:\5xxrllf.exec:\5xxrllf.exe105⤵PID:3304
-
\??\c:\7ttbtt.exec:\7ttbtt.exe106⤵PID:1572
-
\??\c:\3pvpj.exec:\3pvpj.exe107⤵PID:4412
-
\??\c:\jjvvv.exec:\jjvvv.exe108⤵PID:4320
-
\??\c:\fxrlfff.exec:\fxrlfff.exe109⤵PID:4724
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe110⤵PID:3944
-
\??\c:\9hnhbt.exec:\9hnhbt.exe111⤵PID:2716
-
\??\c:\7djvp.exec:\7djvp.exe112⤵PID:1656
-
\??\c:\5frlxxr.exec:\5frlxxr.exe113⤵PID:4180
-
\??\c:\frxrrrl.exec:\frxrrrl.exe114⤵PID:3992
-
\??\c:\jjdpv.exec:\jjdpv.exe115⤵PID:2968
-
\??\c:\frfxrrr.exec:\frfxrrr.exe116⤵PID:4800
-
\??\c:\bnhbtn.exec:\bnhbtn.exe117⤵PID:1676
-
\??\c:\nbtbnb.exec:\nbtbnb.exe118⤵PID:4252
-
\??\c:\pjvvp.exec:\pjvvp.exe119⤵PID:2312
-
\??\c:\1jdvj.exec:\1jdvj.exe120⤵PID:4728
-
\??\c:\7xxlflx.exec:\7xxlflx.exe121⤵PID:2700
-
\??\c:\9thhtt.exec:\9thhtt.exe122⤵PID:32
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-