Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe
Resource
win7-20240903-en
General
-
Target
a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe
-
Size
69KB
-
MD5
b1feb290557e45a4d35598c75282706a
-
SHA1
1734e81a47e0c29d45b591421551625c0c46e3c4
-
SHA256
a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81
-
SHA512
73b9b15319d762ac3a0237cb4b561d9a256da751e695c2e6bdbc694650a3878f03eabec164aeb5b2d04a7407e33fd7b3a49829ad67d52927ece25b7d6606cc26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcPD:ymb3NkkiQ3mdBjFIsIVcL
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1540-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3508 pdvdv.exe 1960 rxfxrll.exe 2876 xrrlxxl.exe 4852 7tbttt.exe 2400 dvvpj.exe 4680 hhbttt.exe 1108 tnhbbb.exe 3176 7dpjd.exe 4016 pdjdv.exe 1620 3xffxxf.exe 2568 9bhnnb.exe 4172 jjjvp.exe 1328 lrfxxrl.exe 2044 hnnnhh.exe 3564 hhhbtt.exe 3876 ddvpv.exe 1592 lffrllf.exe 4676 9lrrlrl.exe 4012 nhhhhb.exe 3048 hbtnhh.exe 468 7jvpv.exe 4732 lllfflx.exe 2308 9bhhnn.exe 3948 hhhbtn.exe 2748 djpjd.exe 4368 lflrlll.exe 2200 bbhttb.exe 3956 dpjvp.exe 2704 rlfrxlx.exe 1656 frlrxlr.exe 1956 thnthh.exe 2572 3pvjv.exe 3908 lfrlxxr.exe 368 1tbttn.exe 4076 bbbhhn.exe 2600 vjjpv.exe 2868 vjjvd.exe 3924 fxrfrlf.exe 1540 tntnnh.exe 4292 hbbttn.exe 1268 jjpjj.exe 1900 vvpjj.exe 1148 xrlfxxr.exe 4488 bnnnth.exe 752 5htthb.exe 1428 vvppj.exe 2400 pjvpp.exe 2360 xrxrfxr.exe 4892 nntthh.exe 2132 nhnhhb.exe 4656 jddjd.exe 3780 dvjdv.exe 3228 3fxrlff.exe 2140 fxffxxl.exe 5100 nhtntt.exe 4256 dvdpv.exe 60 ppvpd.exe 4172 lxlfllf.exe 3192 hhhbtb.exe 2116 nhnhbh.exe 2472 pjjjd.exe 1660 jvvvp.exe 2872 lrrlrlf.exe 4500 xxxxxxr.exe -
resource yara_rule behavioral2/memory/1540-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 3508 1540 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 84 PID 1540 wrote to memory of 3508 1540 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 84 PID 1540 wrote to memory of 3508 1540 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 84 PID 3508 wrote to memory of 1960 3508 pdvdv.exe 86 PID 3508 wrote to memory of 1960 3508 pdvdv.exe 86 PID 3508 wrote to memory of 1960 3508 pdvdv.exe 86 PID 1960 wrote to memory of 2876 1960 rxfxrll.exe 87 PID 1960 wrote to memory of 2876 1960 rxfxrll.exe 87 PID 1960 wrote to memory of 2876 1960 rxfxrll.exe 87 PID 2876 wrote to memory of 4852 2876 xrrlxxl.exe 88 PID 2876 wrote to memory of 4852 2876 xrrlxxl.exe 88 PID 2876 wrote to memory of 4852 2876 xrrlxxl.exe 88 PID 4852 wrote to memory of 2400 4852 7tbttt.exe 89 PID 4852 wrote to memory of 2400 4852 7tbttt.exe 89 PID 4852 wrote to memory of 2400 4852 7tbttt.exe 89 PID 2400 wrote to memory of 4680 2400 dvvpj.exe 90 PID 2400 wrote to memory of 4680 2400 dvvpj.exe 90 PID 2400 wrote to memory of 4680 2400 dvvpj.exe 90 PID 4680 wrote to memory of 1108 4680 hhbttt.exe 91 PID 4680 wrote to memory of 1108 4680 hhbttt.exe 91 PID 4680 wrote to memory of 1108 4680 hhbttt.exe 91 PID 1108 wrote to memory of 3176 1108 tnhbbb.exe 92 PID 1108 wrote to memory of 3176 1108 tnhbbb.exe 92 PID 1108 wrote to memory of 3176 1108 tnhbbb.exe 92 PID 3176 wrote to memory of 4016 3176 7dpjd.exe 93 PID 3176 wrote to memory of 4016 3176 7dpjd.exe 93 PID 3176 wrote to memory of 4016 3176 7dpjd.exe 93 PID 4016 wrote to memory of 1620 4016 pdjdv.exe 94 PID 4016 wrote to memory of 1620 4016 pdjdv.exe 94 PID 4016 wrote to memory of 1620 4016 pdjdv.exe 94 PID 1620 wrote to memory of 2568 1620 3xffxxf.exe 95 PID 1620 wrote to memory of 2568 1620 3xffxxf.exe 95 PID 1620 wrote to memory of 2568 1620 3xffxxf.exe 95 PID 2568 wrote to memory of 4172 2568 9bhnnb.exe 96 PID 2568 wrote to memory of 4172 2568 9bhnnb.exe 96 PID 2568 wrote to memory of 4172 2568 9bhnnb.exe 96 PID 4172 wrote to memory of 1328 4172 jjjvp.exe 98 PID 4172 wrote to memory of 1328 4172 jjjvp.exe 98 PID 4172 wrote to memory of 1328 4172 jjjvp.exe 98 PID 1328 wrote to memory of 2044 1328 lrfxxrl.exe 99 PID 1328 wrote to memory of 2044 1328 lrfxxrl.exe 99 PID 1328 wrote to memory of 2044 1328 lrfxxrl.exe 99 PID 2044 wrote to memory of 3564 2044 hnnnhh.exe 100 PID 2044 wrote to memory of 3564 2044 hnnnhh.exe 100 PID 2044 wrote to memory of 3564 2044 hnnnhh.exe 100 PID 3564 wrote to memory of 3876 3564 hhhbtt.exe 101 PID 3564 wrote to memory of 3876 3564 hhhbtt.exe 101 PID 3564 wrote to memory of 3876 3564 hhhbtt.exe 101 PID 3876 wrote to memory of 1592 3876 ddvpv.exe 102 PID 3876 wrote to memory of 1592 3876 ddvpv.exe 102 PID 3876 wrote to memory of 1592 3876 ddvpv.exe 102 PID 1592 wrote to memory of 4676 1592 lffrllf.exe 103 PID 1592 wrote to memory of 4676 1592 lffrllf.exe 103 PID 1592 wrote to memory of 4676 1592 lffrllf.exe 103 PID 4676 wrote to memory of 4012 4676 9lrrlrl.exe 104 PID 4676 wrote to memory of 4012 4676 9lrrlrl.exe 104 PID 4676 wrote to memory of 4012 4676 9lrrlrl.exe 104 PID 4012 wrote to memory of 3048 4012 nhhhhb.exe 105 PID 4012 wrote to memory of 3048 4012 nhhhhb.exe 105 PID 4012 wrote to memory of 3048 4012 nhhhhb.exe 105 PID 3048 wrote to memory of 468 3048 hbtnhh.exe 106 PID 3048 wrote to memory of 468 3048 hbtnhh.exe 106 PID 3048 wrote to memory of 468 3048 hbtnhh.exe 106 PID 468 wrote to memory of 4732 468 7jvpv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe"C:\Users\Admin\AppData\Local\Temp\a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\pdvdv.exec:\pdvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\rxfxrll.exec:\rxfxrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\xrrlxxl.exec:\xrrlxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7tbttt.exec:\7tbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\dvvpj.exec:\dvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhbttt.exec:\hhbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\tnhbbb.exec:\tnhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\7dpjd.exec:\7dpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\pdjdv.exec:\pdjdv.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\3xffxxf.exec:\3xffxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\9bhnnb.exec:\9bhnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jjjvp.exec:\jjjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\lrfxxrl.exec:\lrfxxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\hnnnhh.exec:\hnnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\hhhbtt.exec:\hhhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\ddvpv.exec:\ddvpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\lffrllf.exec:\lffrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\9lrrlrl.exec:\9lrrlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\nhhhhb.exec:\nhhhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\hbtnhh.exec:\hbtnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\7jvpv.exec:\7jvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\lllfflx.exec:\lllfflx.exe23⤵
- Executes dropped EXE
PID:4732 -
\??\c:\9bhhnn.exec:\9bhhnn.exe24⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hhhbtn.exec:\hhhbtn.exe25⤵
- Executes dropped EXE
PID:3948 -
\??\c:\djpjd.exec:\djpjd.exe26⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lflrlll.exec:\lflrlll.exe27⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bbhttb.exec:\bbhttb.exe28⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dpjvp.exec:\dpjvp.exe29⤵
- Executes dropped EXE
PID:3956 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe30⤵
- Executes dropped EXE
PID:2704 -
\??\c:\frlrxlr.exec:\frlrxlr.exe31⤵
- Executes dropped EXE
PID:1656 -
\??\c:\thnthh.exec:\thnthh.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3pvjv.exec:\3pvjv.exe33⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe34⤵
- Executes dropped EXE
PID:3908 -
\??\c:\1tbttn.exec:\1tbttn.exe35⤵
- Executes dropped EXE
PID:368 -
\??\c:\bbbhhn.exec:\bbbhhn.exe36⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vjjpv.exec:\vjjpv.exe37⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vjjvd.exec:\vjjvd.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe39⤵
- Executes dropped EXE
PID:3924 -
\??\c:\tntnnh.exec:\tntnnh.exe40⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hbbttn.exec:\hbbttn.exe41⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jjpjj.exec:\jjpjj.exe42⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vvpjj.exec:\vvpjj.exe43⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe44⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bnnnth.exec:\bnnnth.exe45⤵
- Executes dropped EXE
PID:4488 -
\??\c:\5htthb.exec:\5htthb.exe46⤵
- Executes dropped EXE
PID:752 -
\??\c:\vvppj.exec:\vvppj.exe47⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pjvpp.exec:\pjvpp.exe48⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xrxrfxr.exec:\xrxrfxr.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nntthh.exec:\nntthh.exe50⤵
- Executes dropped EXE
PID:4892 -
\??\c:\nhnhhb.exec:\nhnhhb.exe51⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jddjd.exec:\jddjd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656 -
\??\c:\dvjdv.exec:\dvjdv.exe53⤵
- Executes dropped EXE
PID:3780 -
\??\c:\3fxrlff.exec:\3fxrlff.exe54⤵
- Executes dropped EXE
PID:3228 -
\??\c:\fxffxxl.exec:\fxffxxl.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhtntt.exec:\nhtntt.exe56⤵
- Executes dropped EXE
PID:5100 -
\??\c:\dvdpv.exec:\dvdpv.exe57⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ppvpd.exec:\ppvpd.exe58⤵
- Executes dropped EXE
PID:60 -
\??\c:\lxlfllf.exec:\lxlfllf.exe59⤵
- Executes dropped EXE
PID:4172 -
\??\c:\hhhbtb.exec:\hhhbtb.exe60⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nhnhbh.exec:\nhnhbh.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjjjd.exec:\pjjjd.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jvvvp.exec:\jvvvp.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lrrlrlf.exec:\lrrlrlf.exe64⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe65⤵
- Executes dropped EXE
PID:4500 -
\??\c:\tbbtnn.exec:\tbbtnn.exe66⤵PID:2592
-
\??\c:\bhbthh.exec:\bhbthh.exe67⤵PID:4688
-
\??\c:\pvjpj.exec:\pvjpj.exe68⤵PID:1028
-
\??\c:\xxrrflr.exec:\xxrrflr.exe69⤵PID:1192
-
\??\c:\hbhhbb.exec:\hbhhbb.exe70⤵PID:468
-
\??\c:\thnnhb.exec:\thnnhb.exe71⤵PID:2276
-
\??\c:\3vjjd.exec:\3vjjd.exe72⤵PID:3268
-
\??\c:\lrxfxxr.exec:\lrxfxxr.exe73⤵PID:2712
-
\??\c:\rxxrxlf.exec:\rxxrxlf.exe74⤵PID:3948
-
\??\c:\9nbbhh.exec:\9nbbhh.exe75⤵PID:4996
-
\??\c:\9vdvp.exec:\9vdvp.exe76⤵PID:1672
-
\??\c:\jpjvp.exec:\jpjvp.exe77⤵PID:4068
-
\??\c:\rrllrlx.exec:\rrllrlx.exe78⤵PID:1136
-
\??\c:\nntnhh.exec:\nntnhh.exe79⤵PID:5064
-
\??\c:\jjjpj.exec:\jjjpj.exe80⤵PID:2704
-
\??\c:\dpvvv.exec:\dpvvv.exe81⤵PID:4844
-
\??\c:\xrxrrll.exec:\xrxrrll.exe82⤵PID:972
-
\??\c:\xxfxllx.exec:\xxfxllx.exe83⤵PID:1956
-
\??\c:\5bttnn.exec:\5bttnn.exe84⤵PID:3960
-
\??\c:\dvjjp.exec:\dvjjp.exe85⤵PID:4548
-
\??\c:\3vdjd.exec:\3vdjd.exe86⤵PID:2708
-
\??\c:\flxrrxr.exec:\flxrrxr.exe87⤵PID:2436
-
\??\c:\fxlfllr.exec:\fxlfllr.exe88⤵PID:2600
-
\??\c:\htbhbt.exec:\htbhbt.exe89⤵PID:3360
-
\??\c:\vjjdv.exec:\vjjdv.exe90⤵PID:3412
-
\??\c:\pjpdv.exec:\pjpdv.exe91⤵PID:1696
-
\??\c:\rlffxxx.exec:\rlffxxx.exe92⤵PID:2860
-
\??\c:\flfxrfx.exec:\flfxrfx.exe93⤵PID:4332
-
\??\c:\hbtttt.exec:\hbtttt.exe94⤵PID:2812
-
\??\c:\vvjpp.exec:\vvjpp.exe95⤵PID:2612
-
\??\c:\ppvpv.exec:\ppvpv.exe96⤵PID:3640
-
\??\c:\xxxlffl.exec:\xxxlffl.exe97⤵PID:4852
-
\??\c:\lrxxxxr.exec:\lrxxxxr.exe98⤵PID:3092
-
\??\c:\thnnhn.exec:\thnnhn.exe99⤵PID:2640
-
\??\c:\tbhhbb.exec:\tbhhbb.exe100⤵PID:3088
-
\??\c:\vdjpd.exec:\vdjpd.exe101⤵PID:1108
-
\??\c:\3fxffff.exec:\3fxffff.exe102⤵PID:4616
-
\??\c:\flfrxrr.exec:\flfrxrr.exe103⤵PID:264
-
\??\c:\tnbbtt.exec:\tnbbtt.exe104⤵PID:4960
-
\??\c:\nbbtnn.exec:\nbbtnn.exe105⤵PID:3052
-
\??\c:\vdjvv.exec:\vdjvv.exe106⤵PID:2996
-
\??\c:\dpvpd.exec:\dpvpd.exe107⤵PID:3352
-
\??\c:\rrrflfl.exec:\rrrflfl.exe108⤵PID:2568
-
\??\c:\bbnhhh.exec:\bbnhhh.exe109⤵PID:1576
-
\??\c:\tbbnht.exec:\tbbnht.exe110⤵PID:1328
-
\??\c:\pppjd.exec:\pppjd.exe111⤵PID:2680
-
\??\c:\jjjjv.exec:\jjjjv.exe112⤵PID:3348
-
\??\c:\rflfxrf.exec:\rflfxrf.exe113⤵PID:936
-
\??\c:\llrfxxr.exec:\llrfxxr.exe114⤵PID:1804
-
\??\c:\nntnhh.exec:\nntnhh.exe115⤵PID:3292
-
\??\c:\bbhbnt.exec:\bbhbnt.exe116⤵PID:3416
-
\??\c:\pvvpd.exec:\pvvpd.exe117⤵PID:920
-
\??\c:\ddddv.exec:\ddddv.exe118⤵PID:2488
-
\??\c:\llxrlll.exec:\llxrlll.exe119⤵PID:1720
-
\??\c:\bhtthb.exec:\bhtthb.exe120⤵PID:1536
-
\??\c:\btbbbb.exec:\btbbbb.exe121⤵PID:2456
-
\??\c:\ddjjd.exec:\ddjjd.exe122⤵PID:3756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-