Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe
Resource
win7-20240903-en
General
-
Target
29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe
-
Size
70KB
-
MD5
dbb9016dedae1473846f53fcba748ec0
-
SHA1
0ba692580139f8bbb8ffca21c0c65ffe2a0b6251
-
SHA256
29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2
-
SHA512
c48d4eb6a5463f28d7532a2cf572bdcf22d232b40fa01b1c1c8e95b9dd6bbd179891c201924ed336ba9cecdf17e05794696a99b08ee00918bb4bd794ec3be4ae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcB:ymb3NkkiQ3mdBjFIsIVcB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2144-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4604 5ntnnn.exe 3024 ddjdj.exe 1744 pjppj.exe 2136 fxllrrx.exe 3596 3flllfx.exe 4948 ttbbbb.exe 4936 jvjjj.exe 4536 dvpdd.exe 2844 thtnhb.exe 2904 jvpdp.exe 3068 fxllxxx.exe 4420 5ttnhh.exe 3924 pddpj.exe 4788 vvdvj.exe 3852 9nbbbb.exe 3856 bnnbnh.exe 2316 xllfllf.exe 2824 nbnhbt.exe 2292 dpjvp.exe 4716 bthbtt.exe 3376 dpjvj.exe 648 5xxlxrl.exe 4340 fxfxlfr.exe 2992 hbtnhb.exe 4720 vpjvj.exe 3116 pvpdj.exe 4568 fllxfxl.exe 3632 btbhtb.exe 2288 djjvj.exe 3664 5dpjj.exe 3180 1rlxllx.exe 1596 1ntnbt.exe 3756 5nthtn.exe 4104 dppdv.exe 4316 jdjpv.exe 2008 lfxlxrf.exe 3828 xxxxrlx.exe 3032 1tnbtn.exe 1076 3pjvj.exe 3560 jjjvp.exe 1752 lflfrlf.exe 3028 rxlxlfr.exe 1372 nnhhtt.exe 2028 btnbnh.exe 5004 jdddv.exe 2940 pdvjv.exe 832 vvvpj.exe 1660 rxflxlx.exe 4580 btnhtb.exe 3648 hbhbnh.exe 2144 jjdpp.exe 3736 9jjdp.exe 3024 7llfrlf.exe 4384 lfxlxrf.exe 4292 nnnnhb.exe 2240 vvdvv.exe 4612 rxlffrr.exe 2524 thbthh.exe 460 bhbnbb.exe 1604 3ddpv.exe 1612 pdvvv.exe 3528 xlfrfxr.exe 2544 btnhbt.exe 4356 thbthh.exe -
resource yara_rule behavioral2/memory/2144-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4604 2144 29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe 81 PID 2144 wrote to memory of 4604 2144 29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe 81 PID 2144 wrote to memory of 4604 2144 29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe 81 PID 4604 wrote to memory of 3024 4604 5ntnnn.exe 82 PID 4604 wrote to memory of 3024 4604 5ntnnn.exe 82 PID 4604 wrote to memory of 3024 4604 5ntnnn.exe 82 PID 3024 wrote to memory of 1744 3024 ddjdj.exe 83 PID 3024 wrote to memory of 1744 3024 ddjdj.exe 83 PID 3024 wrote to memory of 1744 3024 ddjdj.exe 83 PID 1744 wrote to memory of 2136 1744 pjppj.exe 84 PID 1744 wrote to memory of 2136 1744 pjppj.exe 84 PID 1744 wrote to memory of 2136 1744 pjppj.exe 84 PID 2136 wrote to memory of 3596 2136 fxllrrx.exe 85 PID 2136 wrote to memory of 3596 2136 fxllrrx.exe 85 PID 2136 wrote to memory of 3596 2136 fxllrrx.exe 85 PID 3596 wrote to memory of 4948 3596 3flllfx.exe 86 PID 3596 wrote to memory of 4948 3596 3flllfx.exe 86 PID 3596 wrote to memory of 4948 3596 3flllfx.exe 86 PID 4948 wrote to memory of 4936 4948 ttbbbb.exe 87 PID 4948 wrote to memory of 4936 4948 ttbbbb.exe 87 PID 4948 wrote to memory of 4936 4948 ttbbbb.exe 87 PID 4936 wrote to memory of 4536 4936 jvjjj.exe 88 PID 4936 wrote to memory of 4536 4936 jvjjj.exe 88 PID 4936 wrote to memory of 4536 4936 jvjjj.exe 88 PID 4536 wrote to memory of 2844 4536 dvpdd.exe 89 PID 4536 wrote to memory of 2844 4536 dvpdd.exe 89 PID 4536 wrote to memory of 2844 4536 dvpdd.exe 89 PID 2844 wrote to memory of 2904 2844 thtnhb.exe 90 PID 2844 wrote to memory of 2904 2844 thtnhb.exe 90 PID 2844 wrote to memory of 2904 2844 thtnhb.exe 90 PID 2904 wrote to memory of 3068 2904 jvpdp.exe 91 PID 2904 wrote to memory of 3068 2904 jvpdp.exe 91 PID 2904 wrote to memory of 3068 2904 jvpdp.exe 91 PID 3068 wrote to memory of 4420 3068 fxllxxx.exe 92 PID 3068 wrote to memory of 4420 3068 fxllxxx.exe 92 PID 3068 wrote to memory of 4420 3068 fxllxxx.exe 92 PID 4420 wrote to memory of 3924 4420 5ttnhh.exe 93 PID 4420 wrote to memory of 3924 4420 5ttnhh.exe 93 PID 4420 wrote to memory of 3924 4420 5ttnhh.exe 93 PID 3924 wrote to memory of 4788 3924 pddpj.exe 94 PID 3924 wrote to memory of 4788 3924 pddpj.exe 94 PID 3924 wrote to memory of 4788 3924 pddpj.exe 94 PID 4788 wrote to memory of 3852 4788 vvdvj.exe 95 PID 4788 wrote to memory of 3852 4788 vvdvj.exe 95 PID 4788 wrote to memory of 3852 4788 vvdvj.exe 95 PID 3852 wrote to memory of 3856 3852 9nbbbb.exe 96 PID 3852 wrote to memory of 3856 3852 9nbbbb.exe 96 PID 3852 wrote to memory of 3856 3852 9nbbbb.exe 96 PID 3856 wrote to memory of 2316 3856 bnnbnh.exe 97 PID 3856 wrote to memory of 2316 3856 bnnbnh.exe 97 PID 3856 wrote to memory of 2316 3856 bnnbnh.exe 97 PID 2316 wrote to memory of 2824 2316 xllfllf.exe 98 PID 2316 wrote to memory of 2824 2316 xllfllf.exe 98 PID 2316 wrote to memory of 2824 2316 xllfllf.exe 98 PID 2824 wrote to memory of 2292 2824 nbnhbt.exe 99 PID 2824 wrote to memory of 2292 2824 nbnhbt.exe 99 PID 2824 wrote to memory of 2292 2824 nbnhbt.exe 99 PID 2292 wrote to memory of 4716 2292 dpjvp.exe 100 PID 2292 wrote to memory of 4716 2292 dpjvp.exe 100 PID 2292 wrote to memory of 4716 2292 dpjvp.exe 100 PID 4716 wrote to memory of 3376 4716 bthbtt.exe 101 PID 4716 wrote to memory of 3376 4716 bthbtt.exe 101 PID 4716 wrote to memory of 3376 4716 bthbtt.exe 101 PID 3376 wrote to memory of 648 3376 dpjvj.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe"C:\Users\Admin\AppData\Local\Temp\29c0b11ed68f902890fbefe01f24a992a3ea3635f2456b6fe6fc4917c7632cc2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\5ntnnn.exec:\5ntnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\ddjdj.exec:\ddjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pjppj.exec:\pjppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\fxllrrx.exec:\fxllrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3flllfx.exec:\3flllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\ttbbbb.exec:\ttbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jvjjj.exec:\jvjjj.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\dvpdd.exec:\dvpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\thtnhb.exec:\thtnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jvpdp.exec:\jvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fxllxxx.exec:\fxllxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\5ttnhh.exec:\5ttnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\pddpj.exec:\pddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\vvdvj.exec:\vvdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\9nbbbb.exec:\9nbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\bnnbnh.exec:\bnnbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\xllfllf.exec:\xllfllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nbnhbt.exec:\nbnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\dpjvp.exec:\dpjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\bthbtt.exec:\bthbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\dpjvj.exec:\dpjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\5xxlxrl.exec:\5xxlxrl.exe23⤵
- Executes dropped EXE
PID:648 -
\??\c:\fxfxlfr.exec:\fxfxlfr.exe24⤵
- Executes dropped EXE
PID:4340 -
\??\c:\hbtnhb.exec:\hbtnhb.exe25⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpjvj.exec:\vpjvj.exe26⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pvpdj.exec:\pvpdj.exe27⤵
- Executes dropped EXE
PID:3116 -
\??\c:\fllxfxl.exec:\fllxfxl.exe28⤵
- Executes dropped EXE
PID:4568 -
\??\c:\btbhtb.exec:\btbhtb.exe29⤵
- Executes dropped EXE
PID:3632 -
\??\c:\djjvj.exec:\djjvj.exe30⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5dpjj.exec:\5dpjj.exe31⤵
- Executes dropped EXE
PID:3664 -
\??\c:\1rlxllx.exec:\1rlxllx.exe32⤵
- Executes dropped EXE
PID:3180 -
\??\c:\1ntnbt.exec:\1ntnbt.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5nthtn.exec:\5nthtn.exe34⤵
- Executes dropped EXE
PID:3756 -
\??\c:\dppdv.exec:\dppdv.exe35⤵
- Executes dropped EXE
PID:4104 -
\??\c:\jdjpv.exec:\jdjpv.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xxxxrlx.exec:\xxxxrlx.exe38⤵
- Executes dropped EXE
PID:3828 -
\??\c:\1tnbtn.exec:\1tnbtn.exe39⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3pjvj.exec:\3pjvj.exe40⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jjjvp.exec:\jjjvp.exe41⤵
- Executes dropped EXE
PID:3560 -
\??\c:\lflfrlf.exec:\lflfrlf.exe42⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rxlxlfr.exec:\rxlxlfr.exe43⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnhhtt.exec:\nnhhtt.exe44⤵
- Executes dropped EXE
PID:1372 -
\??\c:\btnbnh.exec:\btnbnh.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jdddv.exec:\jdddv.exe46⤵
- Executes dropped EXE
PID:5004 -
\??\c:\pdvjv.exec:\pdvjv.exe47⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vvvpj.exec:\vvvpj.exe48⤵
- Executes dropped EXE
PID:832 -
\??\c:\rxflxlx.exec:\rxflxlx.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\btnhtb.exec:\btnhtb.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\hbhbnh.exec:\hbhbnh.exe51⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jjdpp.exec:\jjdpp.exe52⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9jjdp.exec:\9jjdp.exe53⤵
- Executes dropped EXE
PID:3736 -
\??\c:\7llfrlf.exec:\7llfrlf.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe55⤵
- Executes dropped EXE
PID:4384 -
\??\c:\nnnnhb.exec:\nnnnhb.exe56⤵
- Executes dropped EXE
PID:4292 -
\??\c:\vvdvv.exec:\vvdvv.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rxlffrr.exec:\rxlffrr.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\thbthh.exec:\thbthh.exe59⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bhbnbb.exec:\bhbnbb.exe60⤵
- Executes dropped EXE
PID:460 -
\??\c:\3ddpv.exec:\3ddpv.exe61⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pdvvv.exec:\pdvvv.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe63⤵
- Executes dropped EXE
PID:3528 -
\??\c:\btnhbt.exec:\btnhbt.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\thbthh.exec:\thbthh.exe65⤵
- Executes dropped EXE
PID:4356 -
\??\c:\dvvpd.exec:\dvvpd.exe66⤵PID:2596
-
\??\c:\9pvjv.exec:\9pvjv.exe67⤵PID:4160
-
\??\c:\llrfrfx.exec:\llrfrfx.exe68⤵PID:3004
-
\??\c:\bthhtb.exec:\bthhtb.exe69⤵PID:4852
-
\??\c:\dpdjp.exec:\dpdjp.exe70⤵PID:1984
-
\??\c:\jvdvv.exec:\jvdvv.exe71⤵PID:2560
-
\??\c:\lfxrfll.exec:\lfxrfll.exe72⤵PID:4652
-
\??\c:\9xfxfxf.exec:\9xfxfxf.exe73⤵PID:4684
-
\??\c:\thnhhb.exec:\thnhhb.exe74⤵PID:528
-
\??\c:\hntnhb.exec:\hntnhb.exe75⤵PID:3856
-
\??\c:\9ddpd.exec:\9ddpd.exe76⤵PID:3060
-
\??\c:\pddpd.exec:\pddpd.exe77⤵PID:2304
-
\??\c:\hthhth.exec:\hthhth.exe78⤵PID:1440
-
\??\c:\5dvjv.exec:\5dvjv.exe79⤵PID:4716
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe80⤵PID:5064
-
\??\c:\xflrfxl.exec:\xflrfxl.exe81⤵PID:5000
-
\??\c:\1bhbhb.exec:\1bhbhb.exe82⤵PID:3896
-
\??\c:\nbnhbt.exec:\nbnhbt.exe83⤵PID:5016
-
\??\c:\pvddv.exec:\pvddv.exe84⤵PID:2992
-
\??\c:\9xfrfxl.exec:\9xfrfxl.exe85⤵PID:4720
-
\??\c:\xflxlfl.exec:\xflxlfl.exe86⤵PID:2520
-
\??\c:\hthtbn.exec:\hthtbn.exe87⤵PID:3340
-
\??\c:\tbtntt.exec:\tbtntt.exe88⤵PID:3904
-
\??\c:\vjjvp.exec:\vjjvp.exe89⤵PID:4648
-
\??\c:\pvvpd.exec:\pvvpd.exe90⤵PID:3196
-
\??\c:\9fllxxr.exec:\9fllxxr.exe91⤵PID:1152
-
\??\c:\nhhnhh.exec:\nhhnhh.exe92⤵PID:1912
-
\??\c:\hnnbhb.exec:\hnnbhb.exe93⤵PID:624
-
\??\c:\nhbnhn.exec:\nhbnhn.exe94⤵PID:2496
-
\??\c:\vjpdv.exec:\vjpdv.exe95⤵PID:3756
-
\??\c:\ppdpj.exec:\ppdpj.exe96⤵PID:1496
-
\??\c:\1ffxrll.exec:\1ffxrll.exe97⤵PID:5012
-
\??\c:\7bbthh.exec:\7bbthh.exe98⤵PID:452
-
\??\c:\btbnhb.exec:\btbnhb.exe99⤵PID:2204
-
\??\c:\vdjdp.exec:\vdjdp.exe100⤵PID:3032
-
\??\c:\rffxffx.exec:\rffxffx.exe101⤵PID:244
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe102⤵PID:320
-
\??\c:\nhhbnh.exec:\nhhbnh.exe103⤵PID:1752
-
\??\c:\pdjdp.exec:\pdjdp.exe104⤵PID:2712
-
\??\c:\pvvpd.exec:\pvvpd.exe105⤵PID:4348
-
\??\c:\frlxlfx.exec:\frlxlfx.exe106⤵PID:2472
-
\??\c:\1flxxrx.exec:\1flxxrx.exe107⤵PID:4928
-
\??\c:\ntnbht.exec:\ntnbht.exe108⤵PID:2112
-
\??\c:\5jppd.exec:\5jppd.exe109⤵PID:4472
-
\??\c:\pddvj.exec:\pddvj.exe110⤵PID:1272
-
\??\c:\7lflxrl.exec:\7lflxrl.exe111⤵PID:4580
-
\??\c:\5nntnh.exec:\5nntnh.exe112⤵PID:940
-
\??\c:\thbthb.exec:\thbthb.exe113⤵PID:4912
-
\??\c:\jppdp.exec:\jppdp.exe114⤵PID:1208
-
\??\c:\9vvjv.exec:\9vvjv.exe115⤵PID:3956
-
\??\c:\xfrfrfx.exec:\xfrfrfx.exe116⤵PID:3612
-
\??\c:\frfxrfr.exec:\frfxrfr.exe117⤵PID:3452
-
\??\c:\httbnn.exec:\httbnn.exe118⤵PID:1096
-
\??\c:\pjvdj.exec:\pjvdj.exe119⤵PID:3592
-
\??\c:\vpdpj.exec:\vpdpj.exe120⤵PID:2524
-
\??\c:\lflffxl.exec:\lflffxl.exe121⤵PID:3280
-
\??\c:\nbntbh.exec:\nbntbh.exe122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-