Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe
Resource
win7-20240903-en
General
-
Target
3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe
-
Size
66KB
-
MD5
0c8535cb9f7a6c49d176d0a2bb466650
-
SHA1
73b6d4f2a09888ed363b87e7b6b0823d0302ac8c
-
SHA256
3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96
-
SHA512
a0bedadf9905fb04b30e191671718ab8b74b96f27a2e3e20730922c312c8cd9210f1b6d7e1a0f279e71643c274de71957cfc21e3795a8482dd9a14846c6ef611
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeQ:ymb3NkkiQ3mdBjF0y7kbUQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4692-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1528 3bnnnn.exe 3260 nntbbn.exe 4708 vpjjv.exe 5036 7rxxllx.exe 4312 1bbbtt.exe 112 xlfxrrr.exe 2136 fxrfrrf.exe 5100 jjddv.exe 2476 7rxrfxr.exe 1232 5rxrlfx.exe 4640 tnttbb.exe 2232 pddvv.exe 1748 9frrrxr.exe 4716 nhtbbn.exe 8 pppjj.exe 3192 7fxrfff.exe 3656 tbhhhb.exe 4504 7dpjd.exe 3980 vjvpd.exe 4500 lxxxrrr.exe 2356 llxxrlf.exe 436 nhttbh.exe 2684 nhhhbh.exe 4104 djpjd.exe 2372 1jpdv.exe 4636 nhnhhh.exe 3232 3hnnbh.exe 4428 3vvvv.exe 624 9jjjv.exe 392 fxlrrrl.exe 1376 bnnnhh.exe 4384 tnhhbb.exe 1472 pvddd.exe 380 rlfxrrl.exe 3528 vvddj.exe 3948 jjjpp.exe 992 lrxxrlx.exe 1768 hbtnbt.exe 2948 hnhbhb.exe 4072 1lrlffx.exe 2556 xrxlfxr.exe 4360 tnnnnh.exe 940 jpddv.exe 4692 fxfxffl.exe 2676 xfrlllf.exe 2140 bbhbtn.exe 4460 tnbbhh.exe 2592 vjvpd.exe 4524 rffxxrr.exe 2760 bhhbtn.exe 2596 vjjpj.exe 2500 pvvpj.exe 3764 flfxlfx.exe 1952 1frfxrl.exe 2136 tnnnhh.exe 1564 vddvv.exe 2872 7pjdv.exe 208 xxxlfxl.exe 2344 nbtnhh.exe 1232 bnnhtn.exe 1824 dvpjv.exe 3760 fxfxllr.exe 3812 btbthb.exe 1748 ppjjd.exe -
resource yara_rule behavioral2/memory/4692-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1528 4692 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 83 PID 4692 wrote to memory of 1528 4692 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 83 PID 4692 wrote to memory of 1528 4692 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 83 PID 1528 wrote to memory of 3260 1528 3bnnnn.exe 84 PID 1528 wrote to memory of 3260 1528 3bnnnn.exe 84 PID 1528 wrote to memory of 3260 1528 3bnnnn.exe 84 PID 3260 wrote to memory of 4708 3260 nntbbn.exe 85 PID 3260 wrote to memory of 4708 3260 nntbbn.exe 85 PID 3260 wrote to memory of 4708 3260 nntbbn.exe 85 PID 4708 wrote to memory of 5036 4708 vpjjv.exe 86 PID 4708 wrote to memory of 5036 4708 vpjjv.exe 86 PID 4708 wrote to memory of 5036 4708 vpjjv.exe 86 PID 5036 wrote to memory of 4312 5036 7rxxllx.exe 87 PID 5036 wrote to memory of 4312 5036 7rxxllx.exe 87 PID 5036 wrote to memory of 4312 5036 7rxxllx.exe 87 PID 4312 wrote to memory of 112 4312 1bbbtt.exe 88 PID 4312 wrote to memory of 112 4312 1bbbtt.exe 88 PID 4312 wrote to memory of 112 4312 1bbbtt.exe 88 PID 112 wrote to memory of 2136 112 xlfxrrr.exe 89 PID 112 wrote to memory of 2136 112 xlfxrrr.exe 89 PID 112 wrote to memory of 2136 112 xlfxrrr.exe 89 PID 2136 wrote to memory of 5100 2136 fxrfrrf.exe 90 PID 2136 wrote to memory of 5100 2136 fxrfrrf.exe 90 PID 2136 wrote to memory of 5100 2136 fxrfrrf.exe 90 PID 5100 wrote to memory of 2476 5100 jjddv.exe 91 PID 5100 wrote to memory of 2476 5100 jjddv.exe 91 PID 5100 wrote to memory of 2476 5100 jjddv.exe 91 PID 2476 wrote to memory of 1232 2476 7rxrfxr.exe 92 PID 2476 wrote to memory of 1232 2476 7rxrfxr.exe 92 PID 2476 wrote to memory of 1232 2476 7rxrfxr.exe 92 PID 1232 wrote to memory of 4640 1232 5rxrlfx.exe 93 PID 1232 wrote to memory of 4640 1232 5rxrlfx.exe 93 PID 1232 wrote to memory of 4640 1232 5rxrlfx.exe 93 PID 4640 wrote to memory of 2232 4640 tnttbb.exe 94 PID 4640 wrote to memory of 2232 4640 tnttbb.exe 94 PID 4640 wrote to memory of 2232 4640 tnttbb.exe 94 PID 2232 wrote to memory of 1748 2232 pddvv.exe 95 PID 2232 wrote to memory of 1748 2232 pddvv.exe 95 PID 2232 wrote to memory of 1748 2232 pddvv.exe 95 PID 1748 wrote to memory of 4716 1748 9frrrxr.exe 96 PID 1748 wrote to memory of 4716 1748 9frrrxr.exe 96 PID 1748 wrote to memory of 4716 1748 9frrrxr.exe 96 PID 4716 wrote to memory of 8 4716 nhtbbn.exe 97 PID 4716 wrote to memory of 8 4716 nhtbbn.exe 97 PID 4716 wrote to memory of 8 4716 nhtbbn.exe 97 PID 8 wrote to memory of 3192 8 pppjj.exe 98 PID 8 wrote to memory of 3192 8 pppjj.exe 98 PID 8 wrote to memory of 3192 8 pppjj.exe 98 PID 3192 wrote to memory of 3656 3192 7fxrfff.exe 99 PID 3192 wrote to memory of 3656 3192 7fxrfff.exe 99 PID 3192 wrote to memory of 3656 3192 7fxrfff.exe 99 PID 3656 wrote to memory of 4504 3656 tbhhhb.exe 100 PID 3656 wrote to memory of 4504 3656 tbhhhb.exe 100 PID 3656 wrote to memory of 4504 3656 tbhhhb.exe 100 PID 4504 wrote to memory of 3980 4504 7dpjd.exe 101 PID 4504 wrote to memory of 3980 4504 7dpjd.exe 101 PID 4504 wrote to memory of 3980 4504 7dpjd.exe 101 PID 3980 wrote to memory of 4500 3980 vjvpd.exe 102 PID 3980 wrote to memory of 4500 3980 vjvpd.exe 102 PID 3980 wrote to memory of 4500 3980 vjvpd.exe 102 PID 4500 wrote to memory of 2356 4500 lxxxrrr.exe 103 PID 4500 wrote to memory of 2356 4500 lxxxrrr.exe 103 PID 4500 wrote to memory of 2356 4500 lxxxrrr.exe 103 PID 2356 wrote to memory of 436 2356 llxxrlf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe"C:\Users\Admin\AppData\Local\Temp\3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\3bnnnn.exec:\3bnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\nntbbn.exec:\nntbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\vpjjv.exec:\vpjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\7rxxllx.exec:\7rxxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\1bbbtt.exec:\1bbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\xlfxrrr.exec:\xlfxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jjddv.exec:\jjddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\7rxrfxr.exec:\7rxrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\5rxrlfx.exec:\5rxrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\tnttbb.exec:\tnttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\pddvv.exec:\pddvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9frrrxr.exec:\9frrrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\nhtbbn.exec:\nhtbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pppjj.exec:\pppjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\7fxrfff.exec:\7fxrfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\tbhhhb.exec:\tbhhhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\7dpjd.exec:\7dpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\vjvpd.exec:\vjvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\llxxrlf.exec:\llxxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nhttbh.exec:\nhttbh.exe23⤵
- Executes dropped EXE
PID:436 -
\??\c:\nhhhbh.exec:\nhhhbh.exe24⤵
- Executes dropped EXE
PID:2684 -
\??\c:\djpjd.exec:\djpjd.exe25⤵
- Executes dropped EXE
PID:4104 -
\??\c:\1jpdv.exec:\1jpdv.exe26⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhnhhh.exec:\nhnhhh.exe27⤵
- Executes dropped EXE
PID:4636 -
\??\c:\3hnnbh.exec:\3hnnbh.exe28⤵
- Executes dropped EXE
PID:3232 -
\??\c:\3vvvv.exec:\3vvvv.exe29⤵
- Executes dropped EXE
PID:4428 -
\??\c:\9jjjv.exec:\9jjjv.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\fxlrrrl.exec:\fxlrrrl.exe31⤵
- Executes dropped EXE
PID:392 -
\??\c:\bnnnhh.exec:\bnnnhh.exe32⤵
- Executes dropped EXE
PID:1376 -
\??\c:\tnhhbb.exec:\tnhhbb.exe33⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pvddd.exec:\pvddd.exe34⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe35⤵
- Executes dropped EXE
PID:380 -
\??\c:\vvddj.exec:\vvddj.exe36⤵
- Executes dropped EXE
PID:3528 -
\??\c:\jjjpp.exec:\jjjpp.exe37⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lrxxrlx.exec:\lrxxrlx.exe38⤵
- Executes dropped EXE
PID:992 -
\??\c:\hbtnbt.exec:\hbtnbt.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hnhbhb.exec:\hnhbhb.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1lrlffx.exec:\1lrlffx.exe41⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tnnnnh.exec:\tnnnnh.exe43⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jpddv.exec:\jpddv.exe44⤵
- Executes dropped EXE
PID:940 -
\??\c:\fxfxffl.exec:\fxfxffl.exe45⤵
- Executes dropped EXE
PID:4692 -
\??\c:\xfrlllf.exec:\xfrlllf.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbhbtn.exec:\bbhbtn.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tnbbhh.exec:\tnbbhh.exe48⤵
- Executes dropped EXE
PID:4460 -
\??\c:\vjvpd.exec:\vjvpd.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rffxxrr.exec:\rffxxrr.exe50⤵
- Executes dropped EXE
PID:4524 -
\??\c:\bhhbtn.exec:\bhhbtn.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjjpj.exec:\vjjpj.exe52⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pvvpj.exec:\pvvpj.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\flfxlfx.exec:\flfxlfx.exe54⤵
- Executes dropped EXE
PID:3764 -
\??\c:\1frfxrl.exec:\1frfxrl.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnnnhh.exec:\tnnnhh.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vddvv.exec:\vddvv.exe57⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7pjdv.exec:\7pjdv.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe59⤵
- Executes dropped EXE
PID:208 -
\??\c:\nbtnhh.exec:\nbtnhh.exe60⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bnnhtn.exec:\bnnhtn.exe61⤵
- Executes dropped EXE
PID:1232 -
\??\c:\dvpjv.exec:\dvpjv.exe62⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fxfxllr.exec:\fxfxllr.exe63⤵
- Executes dropped EXE
PID:3760 -
\??\c:\btbthb.exec:\btbthb.exe64⤵
- Executes dropped EXE
PID:3812 -
\??\c:\ppjjd.exec:\ppjjd.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hhhhbh.exec:\hhhhbh.exe66⤵PID:3184
-
\??\c:\jjpdp.exec:\jjpdp.exe67⤵PID:4920
-
\??\c:\pdpdv.exec:\pdpdv.exe68⤵PID:3608
-
\??\c:\frllxfx.exec:\frllxfx.exe69⤵PID:4960
-
\??\c:\ttbtnn.exec:\ttbtnn.exe70⤵PID:4968
-
\??\c:\jdddv.exec:\jdddv.exe71⤵PID:2304
-
\??\c:\jjppp.exec:\jjppp.exe72⤵PID:2604
-
\??\c:\1xxrfff.exec:\1xxrfff.exe73⤵PID:2888
-
\??\c:\3nhbnn.exec:\3nhbnn.exe74⤵PID:3744
-
\??\c:\djpjv.exec:\djpjv.exe75⤵PID:4236
-
\??\c:\vdddp.exec:\vdddp.exe76⤵PID:436
-
\??\c:\1fxrffx.exec:\1fxrffx.exe77⤵PID:3864
-
\??\c:\5lfrllf.exec:\5lfrllf.exe78⤵PID:4000
-
\??\c:\tntntt.exec:\tntntt.exe79⤵PID:1016
-
\??\c:\vpppj.exec:\vpppj.exe80⤵PID:3004
-
\??\c:\xflfxxr.exec:\xflfxxr.exe81⤵PID:2332
-
\??\c:\xfffffx.exec:\xfffffx.exe82⤵PID:4612
-
\??\c:\hbhhbb.exec:\hbhhbb.exe83⤵PID:1832
-
\??\c:\pjvpd.exec:\pjvpd.exe84⤵PID:1848
-
\??\c:\rxfrlll.exec:\rxfrlll.exe85⤵PID:4244
-
\??\c:\tnnnhb.exec:\tnnnhb.exe86⤵PID:392
-
\??\c:\5nttth.exec:\5nttth.exe87⤵PID:1980
-
\??\c:\9vjjd.exec:\9vjjd.exe88⤵PID:2208
-
\??\c:\vpvdv.exec:\vpvdv.exe89⤵PID:2212
-
\??\c:\bnttnn.exec:\bnttnn.exe90⤵PID:4816
-
\??\c:\tbhbnh.exec:\tbhbnh.exe91⤵PID:3956
-
\??\c:\vppjv.exec:\vppjv.exe92⤵PID:3948
-
\??\c:\dpdvd.exec:\dpdvd.exe93⤵PID:1664
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe94⤵PID:3028
-
\??\c:\xrllffx.exec:\xrllffx.exe95⤵PID:1400
-
\??\c:\bntttt.exec:\bntttt.exe96⤵PID:4344
-
\??\c:\jpvpp.exec:\jpvpp.exe97⤵PID:5008
-
\??\c:\pddvv.exec:\pddvv.exe98⤵PID:4852
-
\??\c:\llxrfxr.exec:\llxrfxr.exe99⤵PID:2588
-
\??\c:\bttttt.exec:\bttttt.exe100⤵PID:1692
-
\??\c:\djjdv.exec:\djjdv.exe101⤵PID:548
-
\??\c:\vpjdd.exec:\vpjdd.exe102⤵PID:840
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe103⤵PID:1068
-
\??\c:\1ntttt.exec:\1ntttt.exe104⤵PID:2376
-
\??\c:\1hhbnn.exec:\1hhbnn.exe105⤵PID:2752
-
\??\c:\pppjv.exec:\pppjv.exe106⤵PID:4124
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe107⤵PID:2756
-
\??\c:\xlrllll.exec:\xlrllll.exe108⤵PID:112
-
\??\c:\hbtnbb.exec:\hbtnbb.exe109⤵PID:2688
-
\??\c:\jddpd.exec:\jddpd.exe110⤵PID:3152
-
\??\c:\ppdvd.exec:\ppdvd.exe111⤵PID:2136
-
\??\c:\frxxlll.exec:\frxxlll.exe112⤵PID:3172
-
\??\c:\tbbttt.exec:\tbbttt.exe113⤵PID:1924
-
\??\c:\tnbhth.exec:\tnbhth.exe114⤵PID:4880
-
\??\c:\jjdjd.exec:\jjdjd.exe115⤵PID:3136
-
\??\c:\jjjdv.exec:\jjjdv.exe116⤵PID:1232
-
\??\c:\rlfxllf.exec:\rlfxllf.exe117⤵PID:3064
-
\??\c:\rflxxff.exec:\rflxxff.exe118⤵PID:3760
-
\??\c:\hnbhtb.exec:\hnbhtb.exe119⤵PID:2804
-
\??\c:\jdddp.exec:\jdddp.exe120⤵PID:4644
-
\??\c:\jvdpj.exec:\jvdpj.exe121⤵PID:8
-
\??\c:\5rxrlfx.exec:\5rxrlfx.exe122⤵PID:632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-