Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 18:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe
-
Size
70KB
-
MD5
3f61e232e98fef2ecd373a417e4ced9e
-
SHA1
a3889a600f362cea47e91a7f3c23b6e908f111a3
-
SHA256
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9
-
SHA512
4842336a4424b5083c853e64cb1bb9c2ae2579c842da200db34ae1251aead0849c9af60c702781d7df35f0dcecb84c30d501a41fe85021824642cd5adb101b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60LbB:ymb3NkkiQ3mdBjFIIp9LV
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral2/memory/1444-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 51 IoCs
resource yara_rule behavioral2/memory/1444-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/812-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/208-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/688-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4644-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/672-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4092-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2484-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2196-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2488-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/648-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1600-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2140-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3808-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1204-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1000-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/920-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1676-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4520-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4492-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4728-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4728-262-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2968-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1760-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2796-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1708-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4504-309-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4000-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-330-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-332-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-339-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/636-363-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2784-384-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-393-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4272-406-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3596-409-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3504-413-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2888-423-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1848-428-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2760 vjpjv.exe 688 006088.exe 812 422624.exe 208 288204.exe 4644 266402.exe 672 82820.exe 4232 htnnhb.exe 4572 8606022.exe 4048 pjvpd.exe 4092 jvdvj.exe 1936 200482.exe 4844 vpjdv.exe 3044 jdpjd.exe 3772 ddpdv.exe 2484 hbnhtn.exe 2196 dpppj.exe 1016 1rrlxxr.exe 2488 vdjdv.exe 2820 dpjvj.exe 648 c826000.exe 1600 684822.exe 2140 08008.exe 3808 5nnbnn.exe 1204 vpjdp.exe 1608 6004224.exe 1000 6084448.exe 920 flrlxrf.exe 3500 6066000.exe 3612 0448226.exe 4004 llxrxxr.exe 3464 20228.exe 2308 htnttt.exe 1676 28082.exe 4520 3vdpj.exe 4204 5jpjv.exe 4492 40660.exe 3308 9djdp.exe 4888 20826.exe 3060 hntnbb.exe 4728 i666004.exe 2968 68004.exe 1972 8482442.exe 4044 6002626.exe 1760 8400428.exe 2796 nbbtnn.exe 1708 228204.exe 468 pddvv.exe 2216 6248826.exe 4504 dddvp.exe 4000 lxxlrlx.exe 5060 284200.exe 4708 48266.exe 1348 286426.exe 5028 2460840.exe 4524 s4040.exe 2196 pddpd.exe 4208 fxrxrlf.exe 1488 7jpjd.exe 4688 666248.exe 1968 fxrrfxr.exe 636 c682828.exe 4516 pdvpj.exe 4720 bbhthb.exe 2944 488648.exe -
resource yara_rule behavioral2/memory/1444-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-428-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 2760 1444 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 85 PID 1444 wrote to memory of 2760 1444 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 85 PID 1444 wrote to memory of 2760 1444 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 85 PID 2760 wrote to memory of 688 2760 vjpjv.exe 86 PID 2760 wrote to memory of 688 2760 vjpjv.exe 86 PID 2760 wrote to memory of 688 2760 vjpjv.exe 86 PID 688 wrote to memory of 812 688 006088.exe 87 PID 688 wrote to memory of 812 688 006088.exe 87 PID 688 wrote to memory of 812 688 006088.exe 87 PID 812 wrote to memory of 208 812 422624.exe 88 PID 812 wrote to memory of 208 812 422624.exe 88 PID 812 wrote to memory of 208 812 422624.exe 88 PID 208 wrote to memory of 4644 208 288204.exe 89 PID 208 wrote to memory of 4644 208 288204.exe 89 PID 208 wrote to memory of 4644 208 288204.exe 89 PID 4644 wrote to memory of 672 4644 266402.exe 90 PID 4644 wrote to memory of 672 4644 266402.exe 90 PID 4644 wrote to memory of 672 4644 266402.exe 90 PID 672 wrote to memory of 4232 672 82820.exe 91 PID 672 wrote to memory of 4232 672 82820.exe 91 PID 672 wrote to memory of 4232 672 82820.exe 91 PID 4232 wrote to memory of 4572 4232 htnnhb.exe 92 PID 4232 wrote to memory of 4572 4232 htnnhb.exe 92 PID 4232 wrote to memory of 4572 4232 htnnhb.exe 92 PID 4572 wrote to memory of 4048 4572 8606022.exe 93 PID 4572 wrote to memory of 4048 4572 8606022.exe 93 PID 4572 wrote to memory of 4048 4572 8606022.exe 93 PID 4048 wrote to memory of 4092 4048 pjvpd.exe 94 PID 4048 wrote to memory of 4092 4048 pjvpd.exe 94 PID 4048 wrote to memory of 4092 4048 pjvpd.exe 94 PID 4092 wrote to memory of 1936 4092 jvdvj.exe 95 PID 4092 wrote to memory of 1936 4092 jvdvj.exe 95 PID 4092 wrote to memory of 1936 4092 jvdvj.exe 95 PID 1936 wrote to memory of 4844 1936 200482.exe 96 PID 1936 wrote to memory of 4844 1936 200482.exe 96 PID 1936 wrote to memory of 4844 1936 200482.exe 96 PID 4844 wrote to memory of 3044 4844 vpjdv.exe 97 PID 4844 wrote to memory of 3044 4844 vpjdv.exe 97 PID 4844 wrote to memory of 3044 4844 vpjdv.exe 97 PID 3044 wrote to memory of 3772 3044 jdpjd.exe 98 PID 3044 wrote to memory of 3772 3044 jdpjd.exe 98 PID 3044 wrote to memory of 3772 3044 jdpjd.exe 98 PID 3772 wrote to memory of 2484 3772 ddpdv.exe 100 PID 3772 wrote to memory of 2484 3772 ddpdv.exe 100 PID 3772 wrote to memory of 2484 3772 ddpdv.exe 100 PID 2484 wrote to memory of 2196 2484 hbnhtn.exe 101 PID 2484 wrote to memory of 2196 2484 hbnhtn.exe 101 PID 2484 wrote to memory of 2196 2484 hbnhtn.exe 101 PID 2196 wrote to memory of 1016 2196 dpppj.exe 102 PID 2196 wrote to memory of 1016 2196 dpppj.exe 102 PID 2196 wrote to memory of 1016 2196 dpppj.exe 102 PID 1016 wrote to memory of 2488 1016 1rrlxxr.exe 103 PID 1016 wrote to memory of 2488 1016 1rrlxxr.exe 103 PID 1016 wrote to memory of 2488 1016 1rrlxxr.exe 103 PID 2488 wrote to memory of 2820 2488 vdjdv.exe 104 PID 2488 wrote to memory of 2820 2488 vdjdv.exe 104 PID 2488 wrote to memory of 2820 2488 vdjdv.exe 104 PID 2820 wrote to memory of 648 2820 dpjvj.exe 105 PID 2820 wrote to memory of 648 2820 dpjvj.exe 105 PID 2820 wrote to memory of 648 2820 dpjvj.exe 105 PID 648 wrote to memory of 1600 648 c826000.exe 106 PID 648 wrote to memory of 1600 648 c826000.exe 106 PID 648 wrote to memory of 1600 648 c826000.exe 106 PID 1600 wrote to memory of 2140 1600 684822.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe"C:\Users\Admin\AppData\Local\Temp\30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\vjpjv.exec:\vjpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\006088.exec:\006088.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\422624.exec:\422624.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\288204.exec:\288204.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\266402.exec:\266402.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\82820.exec:\82820.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\htnnhb.exec:\htnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\8606022.exec:\8606022.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\pjvpd.exec:\pjvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\jvdvj.exec:\jvdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\200482.exec:\200482.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vpjdv.exec:\vpjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\jdpjd.exec:\jdpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ddpdv.exec:\ddpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\hbnhtn.exec:\hbnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\dpppj.exec:\dpppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1rrlxxr.exec:\1rrlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\vdjdv.exec:\vdjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\dpjvj.exec:\dpjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\c826000.exec:\c826000.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\684822.exec:\684822.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\08008.exec:\08008.exe23⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5nnbnn.exec:\5nnbnn.exe24⤵
- Executes dropped EXE
PID:3808 -
\??\c:\vpjdp.exec:\vpjdp.exe25⤵
- Executes dropped EXE
PID:1204 -
\??\c:\6004224.exec:\6004224.exe26⤵
- Executes dropped EXE
PID:1608 -
\??\c:\6084448.exec:\6084448.exe27⤵
- Executes dropped EXE
PID:1000 -
\??\c:\flrlxrf.exec:\flrlxrf.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\6066000.exec:\6066000.exe29⤵
- Executes dropped EXE
PID:3500 -
\??\c:\0448226.exec:\0448226.exe30⤵
- Executes dropped EXE
PID:3612 -
\??\c:\llxrxxr.exec:\llxrxxr.exe31⤵
- Executes dropped EXE
PID:4004 -
\??\c:\20228.exec:\20228.exe32⤵
- Executes dropped EXE
PID:3464 -
\??\c:\htnttt.exec:\htnttt.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\28082.exec:\28082.exe34⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3vdpj.exec:\3vdpj.exe35⤵
- Executes dropped EXE
PID:4520 -
\??\c:\5jpjv.exec:\5jpjv.exe36⤵
- Executes dropped EXE
PID:4204 -
\??\c:\40660.exec:\40660.exe37⤵
- Executes dropped EXE
PID:4492 -
\??\c:\9djdp.exec:\9djdp.exe38⤵
- Executes dropped EXE
PID:3308 -
\??\c:\20826.exec:\20826.exe39⤵
- Executes dropped EXE
PID:4888 -
\??\c:\hntnbb.exec:\hntnbb.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\i666004.exec:\i666004.exe41⤵
- Executes dropped EXE
PID:4728 -
\??\c:\68004.exec:\68004.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\8482442.exec:\8482442.exe43⤵
- Executes dropped EXE
PID:1972 -
\??\c:\6002626.exec:\6002626.exe44⤵
- Executes dropped EXE
PID:4044 -
\??\c:\8400428.exec:\8400428.exe45⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nbbtnn.exec:\nbbtnn.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\228204.exec:\228204.exe47⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pddvv.exec:\pddvv.exe48⤵
- Executes dropped EXE
PID:468 -
\??\c:\6248826.exec:\6248826.exe49⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dddvp.exec:\dddvp.exe50⤵
- Executes dropped EXE
PID:4504 -
\??\c:\lxxlrlx.exec:\lxxlrlx.exe51⤵
- Executes dropped EXE
PID:4000 -
\??\c:\284200.exec:\284200.exe52⤵
- Executes dropped EXE
PID:5060 -
\??\c:\48266.exec:\48266.exe53⤵
- Executes dropped EXE
PID:4708 -
\??\c:\286426.exec:\286426.exe54⤵
- Executes dropped EXE
PID:1348 -
\??\c:\2460840.exec:\2460840.exe55⤵
- Executes dropped EXE
PID:5028 -
\??\c:\s4040.exec:\s4040.exe56⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pddpd.exec:\pddpd.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxrxrlf.exec:\fxrxrlf.exe58⤵
- Executes dropped EXE
PID:4208 -
\??\c:\7jpjd.exec:\7jpjd.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\666248.exec:\666248.exe60⤵
- Executes dropped EXE
PID:4688 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\c682828.exec:\c682828.exe62⤵
- Executes dropped EXE
PID:636 -
\??\c:\pdvpj.exec:\pdvpj.exe63⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bbhthb.exec:\bbhthb.exe64⤵
- Executes dropped EXE
PID:4720 -
\??\c:\488648.exec:\488648.exe65⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7rlxlfx.exec:\7rlxlfx.exe66⤵PID:4620
-
\??\c:\888648.exec:\888648.exe67⤵PID:2784
-
\??\c:\dvpjv.exec:\dvpjv.exe68⤵PID:3168
-
\??\c:\006888.exec:\006888.exe69⤵PID:4228
-
\??\c:\82226.exec:\82226.exe70⤵PID:3268
-
\??\c:\64042.exec:\64042.exe71⤵PID:4272
-
\??\c:\9hhbhh.exec:\9hhbhh.exe72⤵PID:3596
-
\??\c:\w44866.exec:\w44866.exe73⤵PID:3504
-
\??\c:\42448.exec:\42448.exe74⤵PID:3184
-
\??\c:\q28604.exec:\q28604.exe75⤵PID:2888
-
\??\c:\nhbbnn.exec:\nhbbnn.exe76⤵PID:1848
-
\??\c:\i842028.exec:\i842028.exe77⤵PID:4976
-
\??\c:\rrflflf.exec:\rrflflf.exe78⤵PID:4604
-
\??\c:\fffxllf.exec:\fffxllf.exe79⤵PID:2084
-
\??\c:\jdjjj.exec:\jdjjj.exe80⤵PID:4748
-
\??\c:\btntbn.exec:\btntbn.exe81⤵PID:4996
-
\??\c:\88406.exec:\88406.exe82⤵PID:1644
-
\??\c:\nnbthh.exec:\nnbthh.exe83⤵PID:4868
-
\??\c:\4840804.exec:\4840804.exe84⤵PID:1960
-
\??\c:\jdddj.exec:\jdddj.exe85⤵PID:1688
-
\??\c:\thhbnh.exec:\thhbnh.exe86⤵PID:4732
-
\??\c:\xllxllx.exec:\xllxllx.exe87⤵PID:4448
-
\??\c:\62882.exec:\62882.exe88⤵PID:1216
-
\??\c:\jddvp.exec:\jddvp.exe89⤵PID:4644
-
\??\c:\2060882.exec:\2060882.exe90⤵PID:1460
-
\??\c:\vppjd.exec:\vppjd.exe91⤵PID:1944
-
\??\c:\hnnnbb.exec:\hnnnbb.exe92⤵PID:4048
-
\??\c:\k84600.exec:\k84600.exe93⤵PID:2752
-
\??\c:\rxflffr.exec:\rxflffr.exe94⤵PID:3208
-
\??\c:\2022666.exec:\2022666.exe95⤵PID:2340
-
\??\c:\jvppj.exec:\jvppj.exe96⤵PID:3924
-
\??\c:\nhhbnn.exec:\nhhbnn.exe97⤵PID:2996
-
\??\c:\7tnhtt.exec:\7tnhtt.exe98⤵PID:2288
-
\??\c:\llffxxx.exec:\llffxxx.exe99⤵PID:2832
-
\??\c:\jjdvv.exec:\jjdvv.exe100⤵PID:1924
-
\??\c:\0648604.exec:\0648604.exe101⤵PID:4524
-
\??\c:\vddvp.exec:\vddvp.exe102⤵PID:2396
-
\??\c:\hbhtnn.exec:\hbhtnn.exe103⤵PID:2824
-
\??\c:\bnthhb.exec:\bnthhb.exe104⤵PID:1488
-
\??\c:\vpvdj.exec:\vpvdj.exe105⤵PID:4120
-
\??\c:\o404882.exec:\o404882.exe106⤵PID:636
-
\??\c:\frllxxx.exec:\frllxxx.exe107⤵PID:1600
-
\??\c:\2066244.exec:\2066244.exe108⤵PID:4624
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe109⤵PID:3672
-
\??\c:\4844882.exec:\4844882.exe110⤵PID:2712
-
\??\c:\bbntnn.exec:\bbntnn.exe111⤵PID:1824
-
\??\c:\nbbnhb.exec:\nbbnhb.exe112⤵PID:4652
-
\??\c:\c448660.exec:\c448660.exe113⤵PID:4660
-
\??\c:\446044.exec:\446044.exe114⤵PID:4116
-
\??\c:\ppvpj.exec:\ppvpj.exe115⤵PID:4004
-
\??\c:\vpjdv.exec:\vpjdv.exe116⤵PID:4392
-
\??\c:\fxllrrl.exec:\fxllrrl.exe117⤵PID:2880
-
\??\c:\6226000.exec:\6226000.exe118⤵PID:1808
-
\??\c:\2626600.exec:\2626600.exe119⤵PID:4980
-
\??\c:\jjvvp.exec:\jjvvp.exe120⤵PID:3340
-
\??\c:\jjvpj.exec:\jjvpj.exe121⤵PID:1836
-
\??\c:\rlxlrfr.exec:\rlxlrfr.exe122⤵PID:5000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-