Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe
Resource
win7-20240729-en
General
-
Target
714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe
-
Size
57KB
-
MD5
a14dc2d35bbe74e2012eefe1744f0dd0
-
SHA1
580cc4cee05339bd276259e51adae7d588de35d7
-
SHA256
714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525
-
SHA512
8c2765bd6fecac80f1a6388168bb4ec50b8f8725e1957f7e6825e5945d63870a8e8f97840cba869132d1c864585bd0545eda7d558f824f9af401d547b1e649d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgFC:ymb3NkkiQ3mdBjFIgFC
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1548-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4276 3xrlxxr.exe 2216 1nntbn.exe 2492 vpvjp.exe 3268 vddvp.exe 3640 lfrlxrf.exe 2616 rxrfxrl.exe 4076 bntttb.exe 216 jdpjd.exe 1004 lrxllfr.exe 4548 tbthtn.exe 2840 jdppp.exe 228 rxxlrlf.exe 5052 thntbt.exe 1000 pjjdv.exe 4796 fllrxxr.exe 2920 htthhb.exe 1224 nhhtnh.exe 3400 ddvjv.exe 4516 xllfllx.exe 3244 rlrllxf.exe 4272 tbthtn.exe 4628 vjvjj.exe 3544 rffxffr.exe 4456 1rflfrl.exe 2024 btnhbt.exe 2680 5jddj.exe 3500 xlrlrlf.exe 4908 llxrlfx.exe 3644 hnhhbt.exe 3752 pjpjv.exe 2016 tbttnh.exe 1516 7pvpj.exe 4016 rflfrrl.exe 4604 bhtbnn.exe 1760 btthbt.exe 4200 jpjdv.exe 3976 llfrfxl.exe 4300 lxxlxrl.exe 1068 hbnhbn.exe 2792 7dpjv.exe 872 pdvjv.exe 1740 xlfxllf.exe 3652 fxrrfxl.exe 1372 htbtnh.exe 4364 bttnbb.exe 2904 9pvvd.exe 1548 vjjvj.exe 2812 xfxrlfx.exe 4848 5lrlxrl.exe 2084 thbthb.exe 4828 hththb.exe 3868 vjjpj.exe 2112 frfxrrf.exe 2676 fllrlxl.exe 3732 htnhtn.exe 2232 bhbthb.exe 1464 jvvjd.exe 1692 lxrfxlr.exe 3360 rxfxxrl.exe 4484 thhhbb.exe 3312 btthht.exe 1964 jpvvp.exe 2496 vjdvj.exe 1424 vppdp.exe -
resource yara_rule behavioral2/memory/1548-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxlfr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 4276 1548 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 82 PID 1548 wrote to memory of 4276 1548 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 82 PID 1548 wrote to memory of 4276 1548 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 82 PID 4276 wrote to memory of 2216 4276 3xrlxxr.exe 83 PID 4276 wrote to memory of 2216 4276 3xrlxxr.exe 83 PID 4276 wrote to memory of 2216 4276 3xrlxxr.exe 83 PID 2216 wrote to memory of 2492 2216 1nntbn.exe 84 PID 2216 wrote to memory of 2492 2216 1nntbn.exe 84 PID 2216 wrote to memory of 2492 2216 1nntbn.exe 84 PID 2492 wrote to memory of 3268 2492 vpvjp.exe 85 PID 2492 wrote to memory of 3268 2492 vpvjp.exe 85 PID 2492 wrote to memory of 3268 2492 vpvjp.exe 85 PID 3268 wrote to memory of 3640 3268 vddvp.exe 86 PID 3268 wrote to memory of 3640 3268 vddvp.exe 86 PID 3268 wrote to memory of 3640 3268 vddvp.exe 86 PID 3640 wrote to memory of 2616 3640 lfrlxrf.exe 87 PID 3640 wrote to memory of 2616 3640 lfrlxrf.exe 87 PID 3640 wrote to memory of 2616 3640 lfrlxrf.exe 87 PID 2616 wrote to memory of 4076 2616 rxrfxrl.exe 88 PID 2616 wrote to memory of 4076 2616 rxrfxrl.exe 88 PID 2616 wrote to memory of 4076 2616 rxrfxrl.exe 88 PID 4076 wrote to memory of 216 4076 bntttb.exe 89 PID 4076 wrote to memory of 216 4076 bntttb.exe 89 PID 4076 wrote to memory of 216 4076 bntttb.exe 89 PID 216 wrote to memory of 1004 216 jdpjd.exe 90 PID 216 wrote to memory of 1004 216 jdpjd.exe 90 PID 216 wrote to memory of 1004 216 jdpjd.exe 90 PID 1004 wrote to memory of 4548 1004 lrxllfr.exe 91 PID 1004 wrote to memory of 4548 1004 lrxllfr.exe 91 PID 1004 wrote to memory of 4548 1004 lrxllfr.exe 91 PID 4548 wrote to memory of 2840 4548 tbthtn.exe 92 PID 4548 wrote to memory of 2840 4548 tbthtn.exe 92 PID 4548 wrote to memory of 2840 4548 tbthtn.exe 92 PID 2840 wrote to memory of 228 2840 jdppp.exe 93 PID 2840 wrote to memory of 228 2840 jdppp.exe 93 PID 2840 wrote to memory of 228 2840 jdppp.exe 93 PID 228 wrote to memory of 5052 228 rxxlrlf.exe 94 PID 228 wrote to memory of 5052 228 rxxlrlf.exe 94 PID 228 wrote to memory of 5052 228 rxxlrlf.exe 94 PID 5052 wrote to memory of 1000 5052 thntbt.exe 95 PID 5052 wrote to memory of 1000 5052 thntbt.exe 95 PID 5052 wrote to memory of 1000 5052 thntbt.exe 95 PID 1000 wrote to memory of 4796 1000 pjjdv.exe 96 PID 1000 wrote to memory of 4796 1000 pjjdv.exe 96 PID 1000 wrote to memory of 4796 1000 pjjdv.exe 96 PID 4796 wrote to memory of 2920 4796 fllrxxr.exe 97 PID 4796 wrote to memory of 2920 4796 fllrxxr.exe 97 PID 4796 wrote to memory of 2920 4796 fllrxxr.exe 97 PID 2920 wrote to memory of 1224 2920 htthhb.exe 98 PID 2920 wrote to memory of 1224 2920 htthhb.exe 98 PID 2920 wrote to memory of 1224 2920 htthhb.exe 98 PID 1224 wrote to memory of 3400 1224 nhhtnh.exe 99 PID 1224 wrote to memory of 3400 1224 nhhtnh.exe 99 PID 1224 wrote to memory of 3400 1224 nhhtnh.exe 99 PID 3400 wrote to memory of 4516 3400 ddvjv.exe 100 PID 3400 wrote to memory of 4516 3400 ddvjv.exe 100 PID 3400 wrote to memory of 4516 3400 ddvjv.exe 100 PID 4516 wrote to memory of 3244 4516 xllfllx.exe 101 PID 4516 wrote to memory of 3244 4516 xllfllx.exe 101 PID 4516 wrote to memory of 3244 4516 xllfllx.exe 101 PID 3244 wrote to memory of 4272 3244 rlrllxf.exe 102 PID 3244 wrote to memory of 4272 3244 rlrllxf.exe 102 PID 3244 wrote to memory of 4272 3244 rlrllxf.exe 102 PID 4272 wrote to memory of 4628 4272 tbthtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe"C:\Users\Admin\AppData\Local\Temp\714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\3xrlxxr.exec:\3xrlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\1nntbn.exec:\1nntbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\vpvjp.exec:\vpvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vddvp.exec:\vddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\lfrlxrf.exec:\lfrlxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\rxrfxrl.exec:\rxrfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bntttb.exec:\bntttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\jdpjd.exec:\jdpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\lrxllfr.exec:\lrxllfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\tbthtn.exec:\tbthtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\jdppp.exec:\jdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rxxlrlf.exec:\rxxlrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\thntbt.exec:\thntbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\pjjdv.exec:\pjjdv.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\fllrxxr.exec:\fllrxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\htthhb.exec:\htthhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nhhtnh.exec:\nhhtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\ddvjv.exec:\ddvjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\xllfllx.exec:\xllfllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rlrllxf.exec:\rlrllxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\tbthtn.exec:\tbthtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\vjvjj.exec:\vjvjj.exe23⤵
- Executes dropped EXE
PID:4628 -
\??\c:\rffxffr.exec:\rffxffr.exe24⤵
- Executes dropped EXE
PID:3544 -
\??\c:\1rflfrl.exec:\1rflfrl.exe25⤵
- Executes dropped EXE
PID:4456 -
\??\c:\btnhbt.exec:\btnhbt.exe26⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5jddj.exec:\5jddj.exe27⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe28⤵
- Executes dropped EXE
PID:3500 -
\??\c:\llxrlfx.exec:\llxrlfx.exe29⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hnhhbt.exec:\hnhhbt.exe30⤵
- Executes dropped EXE
PID:3644 -
\??\c:\pjpjv.exec:\pjpjv.exe31⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tbttnh.exec:\tbttnh.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7pvpj.exec:\7pvpj.exe33⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rflfrrl.exec:\rflfrrl.exe34⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bhtbnn.exec:\bhtbnn.exe35⤵
- Executes dropped EXE
PID:4604 -
\??\c:\btthbt.exec:\btthbt.exe36⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jpjdv.exec:\jpjdv.exe37⤵
- Executes dropped EXE
PID:4200 -
\??\c:\llfrfxl.exec:\llfrfxl.exe38⤵
- Executes dropped EXE
PID:3976 -
\??\c:\lxxlxrl.exec:\lxxlxrl.exe39⤵
- Executes dropped EXE
PID:4300 -
\??\c:\hbnhbn.exec:\hbnhbn.exe40⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7dpjv.exec:\7dpjv.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdvjv.exec:\pdvjv.exe42⤵
- Executes dropped EXE
PID:872 -
\??\c:\xlfxllf.exec:\xlfxllf.exe43⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe44⤵
- Executes dropped EXE
PID:3652 -
\??\c:\htbtnh.exec:\htbtnh.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bttnbb.exec:\bttnbb.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\9pvvd.exec:\9pvvd.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vjjvj.exec:\vjjvj.exe48⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5lrlxrl.exec:\5lrlxrl.exe50⤵
- Executes dropped EXE
PID:4848 -
\??\c:\thbthb.exec:\thbthb.exe51⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hththb.exec:\hththb.exe52⤵
- Executes dropped EXE
PID:4828 -
\??\c:\vjjpj.exec:\vjjpj.exe53⤵
- Executes dropped EXE
PID:3868 -
\??\c:\frfxrrf.exec:\frfxrrf.exe54⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fllrlxl.exec:\fllrlxl.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\htnhtn.exec:\htnhtn.exe56⤵
- Executes dropped EXE
PID:3732 -
\??\c:\bhbthb.exec:\bhbthb.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvvjd.exec:\jvvjd.exe58⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lxrfxlr.exec:\lxrfxlr.exe59⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rxfxxrl.exec:\rxfxxrl.exe60⤵
- Executes dropped EXE
PID:3360 -
\??\c:\thhhbb.exec:\thhhbb.exe61⤵
- Executes dropped EXE
PID:4484 -
\??\c:\btthht.exec:\btthht.exe62⤵
- Executes dropped EXE
PID:3312 -
\??\c:\jpvvp.exec:\jpvvp.exe63⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vjdvj.exec:\vjdvj.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vppdp.exec:\vppdp.exe65⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe66⤵PID:1272
-
\??\c:\btttnh.exec:\btttnh.exe67⤵PID:4340
-
\??\c:\9nnnbt.exec:\9nnnbt.exe68⤵PID:5076
-
\??\c:\pddpd.exec:\pddpd.exe69⤵PID:2036
-
\??\c:\dvjvj.exec:\dvjvj.exe70⤵PID:3424
-
\??\c:\ffxrrff.exec:\ffxrrff.exe71⤵PID:3352
-
\??\c:\ffrxlxf.exec:\ffrxlxf.exe72⤵PID:2160
-
\??\c:\btnhhb.exec:\btnhhb.exe73⤵PID:2432
-
\??\c:\tbbthb.exec:\tbbthb.exe74⤵PID:4064
-
\??\c:\7hhbnt.exec:\7hhbnt.exe75⤵PID:976
-
\??\c:\pvpdp.exec:\pvpdp.exe76⤵PID:4864
-
\??\c:\xlrlrlx.exec:\xlrlrlx.exe77⤵PID:2864
-
\??\c:\xlllfxr.exec:\xlllfxr.exe78⤵PID:1520
-
\??\c:\tnhhbt.exec:\tnhhbt.exe79⤵PID:1060
-
\??\c:\hnnthb.exec:\hnnthb.exe80⤵PID:4592
-
\??\c:\3ppjd.exec:\3ppjd.exe81⤵PID:1676
-
\??\c:\pdvjv.exec:\pdvjv.exe82⤵PID:2600
-
\??\c:\fxffxff.exec:\fxffxff.exe83⤵PID:4680
-
\??\c:\tnhbnn.exec:\tnhbnn.exe84⤵PID:2680
-
\??\c:\vppjp.exec:\vppjp.exe85⤵PID:856
-
\??\c:\ppdpv.exec:\ppdpv.exe86⤵PID:1928
-
\??\c:\rxxxffr.exec:\rxxxffr.exe87⤵PID:864
-
\??\c:\rflfxrl.exec:\rflfxrl.exe88⤵PID:892
-
\??\c:\ttnbbt.exec:\ttnbbt.exe89⤵PID:2352
-
\??\c:\5nhbnh.exec:\5nhbnh.exe90⤵PID:1564
-
\??\c:\jpjvd.exec:\jpjvd.exe91⤵PID:1784
-
\??\c:\jjjdv.exec:\jjjdv.exe92⤵PID:384
-
\??\c:\lxxrlxl.exec:\lxxrlxl.exe93⤵PID:3772
-
\??\c:\flxffrr.exec:\flxffrr.exe94⤵PID:3532
-
\??\c:\tnhhnh.exec:\tnhhnh.exe95⤵PID:3044
-
\??\c:\btbtnh.exec:\btbtnh.exe96⤵PID:1952
-
\??\c:\vjjdv.exec:\vjjdv.exe97⤵PID:3976
-
\??\c:\jpjdd.exec:\jpjdd.exe98⤵PID:4236
-
\??\c:\fllxlfx.exec:\fllxlfx.exe99⤵PID:3220
-
\??\c:\rllfxrl.exec:\rllfxrl.exe100⤵PID:2792
-
\??\c:\bbhhhn.exec:\bbhhhn.exe101⤵PID:3568
-
\??\c:\nhtnbb.exec:\nhtnbb.exe102⤵PID:2264
-
\??\c:\1pppd.exec:\1pppd.exe103⤵PID:3396
-
\??\c:\pjvpp.exec:\pjvpp.exe104⤵PID:4352
-
\??\c:\xxxlrlf.exec:\xxxlrlf.exe105⤵PID:1848
-
\??\c:\bbbthb.exec:\bbbthb.exe106⤵PID:3236
-
\??\c:\htnhbt.exec:\htnhbt.exe107⤵PID:2912
-
\??\c:\ttthbn.exec:\ttthbn.exe108⤵PID:2684
-
\??\c:\jvvpv.exec:\jvvpv.exe109⤵PID:2216
-
\??\c:\vppvv.exec:\vppvv.exe110⤵PID:3076
-
\??\c:\lllfrlf.exec:\lllfrlf.exe111⤵PID:2276
-
\??\c:\xfxrflx.exec:\xfxrflx.exe112⤵PID:4420
-
\??\c:\frllffx.exec:\frllffx.exe113⤵PID:920
-
\??\c:\htbthb.exec:\htbthb.exe114⤵PID:752
-
\??\c:\nhbnnh.exec:\nhbnnh.exe115⤵PID:3596
-
\??\c:\pvpvj.exec:\pvpvj.exe116⤵PID:4140
-
\??\c:\djvvp.exec:\djvvp.exe117⤵PID:4076
-
\??\c:\7lfrlfx.exec:\7lfrlfx.exe118⤵PID:1820
-
\??\c:\ffxrllf.exec:\ffxrllf.exe119⤵PID:4956
-
\??\c:\tnnnhb.exec:\tnnnhb.exe120⤵PID:1540
-
\??\c:\ttttbh.exec:\ttttbh.exe121⤵PID:5080
-
\??\c:\3pppd.exec:\3pppd.exe122⤵PID:116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-