Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
Resource
win7-20240903-en
General
-
Target
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
-
Size
64KB
-
MD5
23babc5fb7485d6f4a539544582ac0a0
-
SHA1
47b4d56548cb50773d284411097776c544c27486
-
SHA256
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563
-
SHA512
2a680fd0be0ee2b0d766c684847c47fc28bb65d77e52f283c4b2db90ffd2654b351aaaf84f1bf32f849b889c0ba8e43d9abef0d275087adcd236c79aa6fd181b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1R:ymb3NkkiQ3mdBjFI9cD
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1780-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4464 frlxlfr.exe 3148 htbbbh.exe 2632 1hbbnt.exe 3440 5pvvp.exe 3804 vdjdp.exe 3768 rlxxrrr.exe 3820 9lxrrlr.exe 3992 jdvpp.exe 3196 vvdvp.exe 4516 lllfrrl.exe 4316 3nbhtt.exe 5056 jppjj.exe 1112 lllffff.exe 2860 btbtnn.exe 4056 ppjjj.exe 3080 vdjjp.exe 5076 1rlfxfx.exe 1476 1xfxxfx.exe 752 nnnnnn.exe 1764 3djjd.exe 4656 9llllll.exe 2924 bttbhn.exe 4820 djpjv.exe 2296 rlfxfxl.exe 1172 bttbbb.exe 2156 frxrlfx.exe 3372 nbbhbb.exe 1280 bnnthh.exe 2828 dvppp.exe 2304 vjppp.exe 4028 xrxrlrl.exe 3172 hhtnhh.exe 4364 pvjdd.exe 880 pdppj.exe 2336 rffrflf.exe 2292 7xrrxfr.exe 872 xxrlxxl.exe 4068 7nnttt.exe 516 thtntb.exe 612 5vddj.exe 3024 xfffrxx.exe 2996 hnhhbh.exe 4204 ntbbbb.exe 1700 jvvpj.exe 2788 ddjdv.exe 3460 xlrflfx.exe 2120 3rlffxf.exe 3904 hthbtn.exe 4280 dvjdd.exe 3500 fxxlfxl.exe 1864 lllfxrl.exe 2356 nhhhnh.exe 2600 pddjj.exe 2812 fxrfllf.exe 4888 lrrfrrl.exe 4296 1tntnb.exe 548 fxxlffx.exe 2192 5fxrffx.exe 3428 nhhbtn.exe 780 dvvpp.exe 1140 rllxxll.exe 1112 hbbnhb.exe 2972 rfxxxfl.exe 2284 thtnnn.exe -
resource yara_rule behavioral2/memory/1780-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 4464 1780 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 82 PID 1780 wrote to memory of 4464 1780 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 82 PID 1780 wrote to memory of 4464 1780 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 82 PID 4464 wrote to memory of 3148 4464 frlxlfr.exe 83 PID 4464 wrote to memory of 3148 4464 frlxlfr.exe 83 PID 4464 wrote to memory of 3148 4464 frlxlfr.exe 83 PID 3148 wrote to memory of 2632 3148 htbbbh.exe 84 PID 3148 wrote to memory of 2632 3148 htbbbh.exe 84 PID 3148 wrote to memory of 2632 3148 htbbbh.exe 84 PID 2632 wrote to memory of 3440 2632 1hbbnt.exe 85 PID 2632 wrote to memory of 3440 2632 1hbbnt.exe 85 PID 2632 wrote to memory of 3440 2632 1hbbnt.exe 85 PID 3440 wrote to memory of 3804 3440 5pvvp.exe 86 PID 3440 wrote to memory of 3804 3440 5pvvp.exe 86 PID 3440 wrote to memory of 3804 3440 5pvvp.exe 86 PID 3804 wrote to memory of 3768 3804 vdjdp.exe 87 PID 3804 wrote to memory of 3768 3804 vdjdp.exe 87 PID 3804 wrote to memory of 3768 3804 vdjdp.exe 87 PID 3768 wrote to memory of 3820 3768 rlxxrrr.exe 88 PID 3768 wrote to memory of 3820 3768 rlxxrrr.exe 88 PID 3768 wrote to memory of 3820 3768 rlxxrrr.exe 88 PID 3820 wrote to memory of 3992 3820 9lxrrlr.exe 89 PID 3820 wrote to memory of 3992 3820 9lxrrlr.exe 89 PID 3820 wrote to memory of 3992 3820 9lxrrlr.exe 89 PID 3992 wrote to memory of 3196 3992 jdvpp.exe 90 PID 3992 wrote to memory of 3196 3992 jdvpp.exe 90 PID 3992 wrote to memory of 3196 3992 jdvpp.exe 90 PID 3196 wrote to memory of 4516 3196 vvdvp.exe 91 PID 3196 wrote to memory of 4516 3196 vvdvp.exe 91 PID 3196 wrote to memory of 4516 3196 vvdvp.exe 91 PID 4516 wrote to memory of 4316 4516 lllfrrl.exe 92 PID 4516 wrote to memory of 4316 4516 lllfrrl.exe 92 PID 4516 wrote to memory of 4316 4516 lllfrrl.exe 92 PID 4316 wrote to memory of 5056 4316 3nbhtt.exe 93 PID 4316 wrote to memory of 5056 4316 3nbhtt.exe 93 PID 4316 wrote to memory of 5056 4316 3nbhtt.exe 93 PID 5056 wrote to memory of 1112 5056 jppjj.exe 94 PID 5056 wrote to memory of 1112 5056 jppjj.exe 94 PID 5056 wrote to memory of 1112 5056 jppjj.exe 94 PID 1112 wrote to memory of 2860 1112 lllffff.exe 95 PID 1112 wrote to memory of 2860 1112 lllffff.exe 95 PID 1112 wrote to memory of 2860 1112 lllffff.exe 95 PID 2860 wrote to memory of 4056 2860 btbtnn.exe 96 PID 2860 wrote to memory of 4056 2860 btbtnn.exe 96 PID 2860 wrote to memory of 4056 2860 btbtnn.exe 96 PID 4056 wrote to memory of 3080 4056 ppjjj.exe 97 PID 4056 wrote to memory of 3080 4056 ppjjj.exe 97 PID 4056 wrote to memory of 3080 4056 ppjjj.exe 97 PID 3080 wrote to memory of 5076 3080 vdjjp.exe 98 PID 3080 wrote to memory of 5076 3080 vdjjp.exe 98 PID 3080 wrote to memory of 5076 3080 vdjjp.exe 98 PID 5076 wrote to memory of 1476 5076 1rlfxfx.exe 99 PID 5076 wrote to memory of 1476 5076 1rlfxfx.exe 99 PID 5076 wrote to memory of 1476 5076 1rlfxfx.exe 99 PID 1476 wrote to memory of 752 1476 1xfxxfx.exe 100 PID 1476 wrote to memory of 752 1476 1xfxxfx.exe 100 PID 1476 wrote to memory of 752 1476 1xfxxfx.exe 100 PID 752 wrote to memory of 1764 752 nnnnnn.exe 101 PID 752 wrote to memory of 1764 752 nnnnnn.exe 101 PID 752 wrote to memory of 1764 752 nnnnnn.exe 101 PID 1764 wrote to memory of 4656 1764 3djjd.exe 102 PID 1764 wrote to memory of 4656 1764 3djjd.exe 102 PID 1764 wrote to memory of 4656 1764 3djjd.exe 102 PID 4656 wrote to memory of 2924 4656 9llllll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\frlxlfr.exec:\frlxlfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\htbbbh.exec:\htbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\1hbbnt.exec:\1hbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5pvvp.exec:\5pvvp.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\vdjdp.exec:\vdjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\rlxxrrr.exec:\rlxxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\9lxrrlr.exec:\9lxrrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\jdvpp.exec:\jdvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\vvdvp.exec:\vvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\lllfrrl.exec:\lllfrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\3nbhtt.exec:\3nbhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\jppjj.exec:\jppjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\lllffff.exec:\lllffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\btbtnn.exec:\btbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ppjjj.exec:\ppjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\vdjjp.exec:\vdjjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\1rlfxfx.exec:\1rlfxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\1xfxxfx.exec:\1xfxxfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\nnnnnn.exec:\nnnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\3djjd.exec:\3djjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\9llllll.exec:\9llllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\bttbhn.exec:\bttbhn.exe23⤵
- Executes dropped EXE
PID:2924 -
\??\c:\djpjv.exec:\djpjv.exe24⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rlfxfxl.exec:\rlfxfxl.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bttbbb.exec:\bttbbb.exe26⤵
- Executes dropped EXE
PID:1172 -
\??\c:\frxrlfx.exec:\frxrlfx.exe27⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nbbhbb.exec:\nbbhbb.exe28⤵
- Executes dropped EXE
PID:3372 -
\??\c:\bnnthh.exec:\bnnthh.exe29⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dvppp.exec:\dvppp.exe30⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vjppp.exec:\vjppp.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe32⤵
- Executes dropped EXE
PID:4028 -
\??\c:\hhtnhh.exec:\hhtnhh.exe33⤵
- Executes dropped EXE
PID:3172 -
\??\c:\pvjdd.exec:\pvjdd.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364 -
\??\c:\pdppj.exec:\pdppj.exe35⤵
- Executes dropped EXE
PID:880 -
\??\c:\rffrflf.exec:\rffrflf.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7xrrxfr.exec:\7xrrxfr.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe38⤵
- Executes dropped EXE
PID:872 -
\??\c:\7nnttt.exec:\7nnttt.exe39⤵
- Executes dropped EXE
PID:4068 -
\??\c:\thtntb.exec:\thtntb.exe40⤵
- Executes dropped EXE
PID:516 -
\??\c:\5vddj.exec:\5vddj.exe41⤵
- Executes dropped EXE
PID:612 -
\??\c:\xfffrxx.exec:\xfffrxx.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hnhhbh.exec:\hnhhbh.exe43⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ntbbbb.exec:\ntbbbb.exe44⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jvvpj.exec:\jvvpj.exe45⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ddjdv.exec:\ddjdv.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xlrflfx.exec:\xlrflfx.exe47⤵
- Executes dropped EXE
PID:3460 -
\??\c:\3rlffxf.exec:\3rlffxf.exe48⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hthbtn.exec:\hthbtn.exe49⤵
- Executes dropped EXE
PID:3904 -
\??\c:\dvjdd.exec:\dvjdd.exe50⤵
- Executes dropped EXE
PID:4280 -
\??\c:\fxxlfxl.exec:\fxxlfxl.exe51⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lllfxrl.exec:\lllfxrl.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nhhhnh.exec:\nhhhnh.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pddjj.exec:\pddjj.exe54⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxrfllf.exec:\fxrfllf.exe55⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lrrfrrl.exec:\lrrfrrl.exe56⤵
- Executes dropped EXE
PID:4888 -
\??\c:\1tntnb.exec:\1tntnb.exe57⤵
- Executes dropped EXE
PID:4296 -
\??\c:\fxxlffx.exec:\fxxlffx.exe58⤵
- Executes dropped EXE
PID:548 -
\??\c:\5fxrffx.exec:\5fxrffx.exe59⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhhbtn.exec:\nhhbtn.exe60⤵
- Executes dropped EXE
PID:3428 -
\??\c:\dvvpp.exec:\dvvpp.exe61⤵
- Executes dropped EXE
PID:780 -
\??\c:\rllxxll.exec:\rllxxll.exe62⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hbbnhb.exec:\hbbnhb.exe63⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe64⤵
- Executes dropped EXE
PID:2972 -
\??\c:\thtnnn.exec:\thtnnn.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5ttthh.exec:\5ttthh.exe66⤵PID:1420
-
\??\c:\rfxrxxr.exec:\rfxrxxr.exe67⤵PID:2612
-
\??\c:\thhttn.exec:\thhttn.exe68⤵PID:5076
-
\??\c:\nbhthh.exec:\nbhthh.exe69⤵PID:1476
-
\??\c:\lffxrlf.exec:\lffxrlf.exe70⤵PID:4652
-
\??\c:\bntnht.exec:\bntnht.exe71⤵PID:2036
-
\??\c:\btthtt.exec:\btthtt.exe72⤵PID:3688
-
\??\c:\jjjjj.exec:\jjjjj.exe73⤵PID:2616
-
\??\c:\jdvpd.exec:\jdvpd.exe74⤵PID:4656
-
\??\c:\rxlxxxx.exec:\rxlxxxx.exe75⤵PID:3300
-
\??\c:\9lllfxr.exec:\9lllfxr.exe76⤵PID:2544
-
\??\c:\hnttnh.exec:\hnttnh.exe77⤵PID:4920
-
\??\c:\jjjvd.exec:\jjjvd.exe78⤵PID:2184
-
\??\c:\5pdvp.exec:\5pdvp.exe79⤵PID:1068
-
\??\c:\1lfrxrf.exec:\1lfrxrf.exe80⤵PID:3624
-
\??\c:\htbbtt.exec:\htbbtt.exe81⤵PID:3392
-
\??\c:\tbthtt.exec:\tbthtt.exe82⤵PID:3524
-
\??\c:\vvvjp.exec:\vvvjp.exe83⤵PID:4808
-
\??\c:\xfxxrrf.exec:\xfxxrrf.exe84⤵PID:3048
-
\??\c:\frxrrlx.exec:\frxrrlx.exe85⤵PID:2240
-
\??\c:\hntnbt.exec:\hntnbt.exe86⤵PID:3744
-
\??\c:\vdjdp.exec:\vdjdp.exe87⤵PID:4940
-
\??\c:\3jjjv.exec:\3jjjv.exe88⤵PID:3560
-
\??\c:\1flfrlx.exec:\1flfrlx.exe89⤵PID:4064
-
\??\c:\rffxrrf.exec:\rffxrrf.exe90⤵PID:4564
-
\??\c:\7ttnnn.exec:\7ttnnn.exe91⤵PID:2336
-
\??\c:\dppjv.exec:\dppjv.exe92⤵PID:2292
-
\??\c:\7llfxxx.exec:\7llfxxx.exe93⤵PID:872
-
\??\c:\9xffllr.exec:\9xffllr.exe94⤵PID:4420
-
\??\c:\nnnnnt.exec:\nnnnnt.exe95⤵PID:1808
-
\??\c:\tntnbh.exec:\tntnbh.exe96⤵PID:3596
-
\??\c:\vppjv.exec:\vppjv.exe97⤵PID:1824
-
\??\c:\9llfxfx.exec:\9llfxfx.exe98⤵PID:4360
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe99⤵PID:4204
-
\??\c:\nbbnhb.exec:\nbbnhb.exe100⤵PID:1780
-
\??\c:\tbhhbb.exec:\tbhhbb.exe101⤵PID:4464
-
\??\c:\1jppv.exec:\1jppv.exe102⤵PID:3460
-
\??\c:\jdddj.exec:\jdddj.exe103⤵PID:2868
-
\??\c:\rxxfrrf.exec:\rxxfrrf.exe104⤵PID:2632
-
\??\c:\nhbnhb.exec:\nhbnhb.exe105⤵PID:1248
-
\??\c:\hbtbnn.exec:\hbtbnn.exe106⤵PID:4216
-
\??\c:\jpdvv.exec:\jpdvv.exe107⤵PID:2656
-
\??\c:\vjjdv.exec:\vjjdv.exe108⤵PID:4512
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe109⤵PID:4540
-
\??\c:\bttnht.exec:\bttnht.exe110⤵PID:2088
-
\??\c:\jpjpd.exec:\jpjpd.exe111⤵PID:3992
-
\??\c:\1jdvj.exec:\1jdvj.exe112⤵PID:1788
-
\??\c:\xlrlrfr.exec:\xlrlrfr.exe113⤵PID:2112
-
\??\c:\hhhhhh.exec:\hhhhhh.exe114⤵PID:4776
-
\??\c:\tntbbh.exec:\tntbbh.exe115⤵PID:1416
-
\??\c:\9jpjv.exec:\9jpjv.exe116⤵PID:372
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe117⤵PID:3088
-
\??\c:\nbhbtb.exec:\nbhbtb.exe118⤵PID:2860
-
\??\c:\ddjdp.exec:\ddjdp.exe119⤵PID:4056
-
\??\c:\vjppd.exec:\vjppd.exe120⤵PID:3932
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe121⤵PID:1240
-
\??\c:\7nhhbb.exec:\7nhhbb.exe122⤵PID:4576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-