Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a5cce903dc24b6de6a986270c92fa42.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
4a5cce903dc24b6de6a986270c92fa42.exe
-
Size
115KB
-
MD5
4a5cce903dc24b6de6a986270c92fa42
-
SHA1
98cd75f2603ee2d78b02802b6abfa3447d8d26eb
-
SHA256
b1de069f9a042660c9cc0b61d6cfc8e8a9b5c7ab5a0535500ecbc8123d9e95e5
-
SHA512
5c1f312d6b8b25d195181cab0e57904a25ab219e7f6263a6ca1f04577ad1b6f0cc5093b553e17001695ad16c7e17a892607041e2db2c08ee43aec3affdd8ef37
-
SSDEEP
3072:XhOm2sI93UufdC67cibYiMav4YFo8BLk8Wg1a:Xcm7ImGddXgYW6x1a
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4180-4-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4688-9-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2832-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4012-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2724-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2664-40-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4436-51-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3136-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2180-56-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5016-62-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4704-69-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4244-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2148-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1720-80-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3684-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5072-101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3032-107-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1672-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4804-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2164-138-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4596-133-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1104-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5060-144-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2612-154-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3740-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/716-163-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2276-171-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1576-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2936-192-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2516-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3500-200-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1332-206-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/832-212-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5068-220-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3268-223-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/460-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2852-232-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4948-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3612-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/940-273-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3464-317-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1676-324-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4136-338-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4608-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3940-355-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4500-368-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3944-378-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1724-382-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3936-423-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3888-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2148-460-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1036-467-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3208-492-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3052-530-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/832-557-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1672-654-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1884-690-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1200-702-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4784-720-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2712-854-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2200-958-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2852-1030-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2984-1091-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5096-1119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4688 ddjjp.exe 2832 lffxrrr.exe 3048 fxrrllf.exe 4012 pppjd.exe 2724 fxfxllr.exe 2444 hbthtn.exe 2664 5jddj.exe 3136 jdvpp.exe 4436 nnnhhb.exe 2180 bhtbbn.exe 5016 vvvpd.exe 4704 1flxxrr.exe 2356 pjdvp.exe 1720 xffxrfx.exe 2148 rffxxrr.exe 4244 thnhnh.exe 3684 dvjdj.exe 5072 thbntt.exe 3032 nhnhnh.exe 2640 pjpdp.exe 1672 7llxlfx.exe 4804 hbnhhb.exe 4596 ntnhnt.exe 2164 pdvpd.exe 5060 fxrfrfx.exe 1104 lrrlrrx.exe 2612 lrrfrlx.exe 3740 bhhbtn.exe 716 hnnbhh.exe 2276 7dvpd.exe 3940 7xxrxrf.exe 1576 nbbthn.exe 1968 jvpdp.exe 1044 5xxrfrl.exe 4860 3xxlxxr.exe 2936 rffxllf.exe 2516 tnnbth.exe 3500 1rrlfxf.exe 2428 3llxrff.exe 1332 3hhbnt.exe 832 pvvjv.exe 1176 pvpjp.exe 4484 1tnbnn.exe 5068 pvvpd.exe 3268 jvvjp.exe 3748 bnhbhb.exe 460 vjppv.exe 2852 fflllrr.exe 4112 nbthtn.exe 1792 pppjp.exe 3656 dpvvd.exe 1204 1fxlxlx.exe 2664 nbhbtn.exe 1740 bhthtt.exe 3136 thbtht.exe 4948 3pdvj.exe 3604 lxxlrff.exe 3688 xxlxrlf.exe 3612 nthbtb.exe 940 djvjd.exe 1568 jpjpv.exe 4796 3xfrxrx.exe 2064 httnhn.exe 1948 5nhtbt.exe -
resource yara_rule behavioral2/memory/4180-4-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2832-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4688-9-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2832-14-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4012-22-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4012-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2724-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2664-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4436-51-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3136-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2180-56-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5016-62-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4704-69-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4244-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2148-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1720-80-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3684-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5072-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3032-107-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1672-118-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4804-124-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4596-129-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2164-138-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4596-133-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1104-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5060-144-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2612-154-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3740-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/716-163-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2276-171-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1576-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2936-192-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2516-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3500-200-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1332-206-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/832-212-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5068-220-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3268-223-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/460-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2852-232-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4948-259-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3612-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/940-273-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4796-279-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3464-317-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1676-324-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4136-338-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4608-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3940-350-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3940-355-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4500-368-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3944-378-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1724-382-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3936-423-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3888-432-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2148-460-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1036-467-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3208-492-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2796-493-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3052-530-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3488-540-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/832-557-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1672-654-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1884-690-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4180 wrote to memory of 4688 4180 4a5cce903dc24b6de6a986270c92fa42.exe 87 PID 4180 wrote to memory of 4688 4180 4a5cce903dc24b6de6a986270c92fa42.exe 87 PID 4180 wrote to memory of 4688 4180 4a5cce903dc24b6de6a986270c92fa42.exe 87 PID 4688 wrote to memory of 2832 4688 ddjjp.exe 88 PID 4688 wrote to memory of 2832 4688 ddjjp.exe 88 PID 4688 wrote to memory of 2832 4688 ddjjp.exe 88 PID 2832 wrote to memory of 3048 2832 lffxrrr.exe 89 PID 2832 wrote to memory of 3048 2832 lffxrrr.exe 89 PID 2832 wrote to memory of 3048 2832 lffxrrr.exe 89 PID 3048 wrote to memory of 4012 3048 fxrrllf.exe 90 PID 3048 wrote to memory of 4012 3048 fxrrllf.exe 90 PID 3048 wrote to memory of 4012 3048 fxrrllf.exe 90 PID 4012 wrote to memory of 2724 4012 pppjd.exe 91 PID 4012 wrote to memory of 2724 4012 pppjd.exe 91 PID 4012 wrote to memory of 2724 4012 pppjd.exe 91 PID 2724 wrote to memory of 2444 2724 fxfxllr.exe 92 PID 2724 wrote to memory of 2444 2724 fxfxllr.exe 92 PID 2724 wrote to memory of 2444 2724 fxfxllr.exe 92 PID 2444 wrote to memory of 2664 2444 hbthtn.exe 93 PID 2444 wrote to memory of 2664 2444 hbthtn.exe 93 PID 2444 wrote to memory of 2664 2444 hbthtn.exe 93 PID 2664 wrote to memory of 3136 2664 5jddj.exe 94 PID 2664 wrote to memory of 3136 2664 5jddj.exe 94 PID 2664 wrote to memory of 3136 2664 5jddj.exe 94 PID 3136 wrote to memory of 4436 3136 jdvpp.exe 95 PID 3136 wrote to memory of 4436 3136 jdvpp.exe 95 PID 3136 wrote to memory of 4436 3136 jdvpp.exe 95 PID 4436 wrote to memory of 2180 4436 nnnhhb.exe 96 PID 4436 wrote to memory of 2180 4436 nnnhhb.exe 96 PID 4436 wrote to memory of 2180 4436 nnnhhb.exe 96 PID 2180 wrote to memory of 5016 2180 bhtbbn.exe 97 PID 2180 wrote to memory of 5016 2180 bhtbbn.exe 97 PID 2180 wrote to memory of 5016 2180 bhtbbn.exe 97 PID 5016 wrote to memory of 4704 5016 vvvpd.exe 98 PID 5016 wrote to memory of 4704 5016 vvvpd.exe 98 PID 5016 wrote to memory of 4704 5016 vvvpd.exe 98 PID 4704 wrote to memory of 2356 4704 1flxxrr.exe 99 PID 4704 wrote to memory of 2356 4704 1flxxrr.exe 99 PID 4704 wrote to memory of 2356 4704 1flxxrr.exe 99 PID 2356 wrote to memory of 1720 2356 pjdvp.exe 100 PID 2356 wrote to memory of 1720 2356 pjdvp.exe 100 PID 2356 wrote to memory of 1720 2356 pjdvp.exe 100 PID 1720 wrote to memory of 2148 1720 xffxrfx.exe 101 PID 1720 wrote to memory of 2148 1720 xffxrfx.exe 101 PID 1720 wrote to memory of 2148 1720 xffxrfx.exe 101 PID 2148 wrote to memory of 4244 2148 rffxxrr.exe 102 PID 2148 wrote to memory of 4244 2148 rffxxrr.exe 102 PID 2148 wrote to memory of 4244 2148 rffxxrr.exe 102 PID 4244 wrote to memory of 3684 4244 thnhnh.exe 103 PID 4244 wrote to memory of 3684 4244 thnhnh.exe 103 PID 4244 wrote to memory of 3684 4244 thnhnh.exe 103 PID 3684 wrote to memory of 5072 3684 dvjdj.exe 104 PID 3684 wrote to memory of 5072 3684 dvjdj.exe 104 PID 3684 wrote to memory of 5072 3684 dvjdj.exe 104 PID 5072 wrote to memory of 3032 5072 thbntt.exe 105 PID 5072 wrote to memory of 3032 5072 thbntt.exe 105 PID 5072 wrote to memory of 3032 5072 thbntt.exe 105 PID 3032 wrote to memory of 2640 3032 nhnhnh.exe 107 PID 3032 wrote to memory of 2640 3032 nhnhnh.exe 107 PID 3032 wrote to memory of 2640 3032 nhnhnh.exe 107 PID 2640 wrote to memory of 1672 2640 pjpdp.exe 108 PID 2640 wrote to memory of 1672 2640 pjpdp.exe 108 PID 2640 wrote to memory of 1672 2640 pjpdp.exe 108 PID 1672 wrote to memory of 4804 1672 7llxlfx.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5cce903dc24b6de6a986270c92fa42.exe"C:\Users\Admin\AppData\Local\Temp\4a5cce903dc24b6de6a986270c92fa42.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\ddjjp.exec:\ddjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\lffxrrr.exec:\lffxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\fxrrllf.exec:\fxrrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\pppjd.exec:\pppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\fxfxllr.exec:\fxfxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hbthtn.exec:\hbthtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5jddj.exec:\5jddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jdvpp.exec:\jdvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\nnnhhb.exec:\nnnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\bhtbbn.exec:\bhtbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vvvpd.exec:\vvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\1flxxrr.exec:\1flxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\pjdvp.exec:\pjdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\xffxrfx.exec:\xffxrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rffxxrr.exec:\rffxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\thnhnh.exec:\thnhnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\dvjdj.exec:\dvjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\thbntt.exec:\thbntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\nhnhnh.exec:\nhnhnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\pjpdp.exec:\pjpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7llxlfx.exec:\7llxlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\hbnhhb.exec:\hbnhhb.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ntnhnt.exec:\ntnhnt.exe24⤵
- Executes dropped EXE
PID:4596 -
\??\c:\pdvpd.exec:\pdvpd.exe25⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxrfrfx.exec:\fxrfrfx.exe26⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lrrlrrx.exec:\lrrlrrx.exe27⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe28⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bhhbtn.exec:\bhhbtn.exe29⤵
- Executes dropped EXE
PID:3740 -
\??\c:\hnnbhh.exec:\hnnbhh.exe30⤵
- Executes dropped EXE
PID:716 -
\??\c:\7dvpd.exec:\7dvpd.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7xxrxrf.exec:\7xxrxrf.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\nbbthn.exec:\nbbthn.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jvpdp.exec:\jvpdp.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5xxrfrl.exec:\5xxrfrl.exe35⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3xxlxxr.exec:\3xxlxxr.exe36⤵
- Executes dropped EXE
PID:4860 -
\??\c:\rffxllf.exec:\rffxllf.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnnbth.exec:\tnnbth.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1rrlfxf.exec:\1rrlfxf.exe39⤵
- Executes dropped EXE
PID:3500 -
\??\c:\3llxrff.exec:\3llxrff.exe40⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3hhbnt.exec:\3hhbnt.exe41⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pvvjv.exec:\pvvjv.exe42⤵
- Executes dropped EXE
PID:832 -
\??\c:\pvpjp.exec:\pvpjp.exe43⤵
- Executes dropped EXE
PID:1176 -
\??\c:\1tnbnn.exec:\1tnbnn.exe44⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pvvpd.exec:\pvvpd.exe45⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jvvjp.exec:\jvvjp.exe46⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bnhbhb.exec:\bnhbhb.exe47⤵
- Executes dropped EXE
PID:3748 -
\??\c:\vjppv.exec:\vjppv.exe48⤵
- Executes dropped EXE
PID:460 -
\??\c:\fflllrr.exec:\fflllrr.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nbthtn.exec:\nbthtn.exe50⤵
- Executes dropped EXE
PID:4112 -
\??\c:\pppjp.exec:\pppjp.exe51⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dpvvd.exec:\dpvvd.exe52⤵
- Executes dropped EXE
PID:3656 -
\??\c:\1fxlxlx.exec:\1fxlxlx.exe53⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nbhbtn.exec:\nbhbtn.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bhthtt.exec:\bhthtt.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thbtht.exec:\thbtht.exe56⤵
- Executes dropped EXE
PID:3136 -
\??\c:\3pdvj.exec:\3pdvj.exe57⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lxxlrff.exec:\lxxlrff.exe58⤵
- Executes dropped EXE
PID:3604 -
\??\c:\xxlxrlf.exec:\xxlxrlf.exe59⤵
- Executes dropped EXE
PID:3688 -
\??\c:\nthbtb.exec:\nthbtb.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\djvjd.exec:\djvjd.exe61⤵
- Executes dropped EXE
PID:940 -
\??\c:\jpjpv.exec:\jpjpv.exe62⤵
- Executes dropped EXE
PID:1568 -
\??\c:\3xfrxrx.exec:\3xfrxrx.exe63⤵
- Executes dropped EXE
PID:4796 -
\??\c:\httnhn.exec:\httnhn.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5nhtbt.exec:\5nhtbt.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\djjvj.exec:\djjvj.exe66⤵PID:3764
-
\??\c:\xxrfrlf.exec:\xxrfrlf.exe67⤵PID:3536
-
\??\c:\flfrlfr.exec:\flfrlfr.exe68⤵PID:4528
-
\??\c:\5hhbbb.exec:\5hhbbb.exe69⤵PID:1876
-
\??\c:\7bbnhh.exec:\7bbnhh.exe70⤵PID:3976
-
\??\c:\thhtnh.exec:\thhtnh.exe71⤵PID:2640
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵PID:1868
-
\??\c:\pddpp.exec:\pddpp.exe73⤵PID:3576
-
\??\c:\1fxrxrl.exec:\1fxrxrl.exe74⤵PID:740
-
\??\c:\ntnnnh.exec:\ntnnnh.exe75⤵PID:3464
-
\??\c:\5bbnbb.exec:\5bbnbb.exe76⤵PID:5100
-
\??\c:\7jjvj.exec:\7jjvj.exe77⤵PID:1676
-
\??\c:\vdvdp.exec:\vdvdp.exe78⤵PID:1448
-
\??\c:\1lfrfxr.exec:\1lfrfxr.exe79⤵PID:2104
-
\??\c:\bttnbh.exec:\bttnbh.exe80⤵PID:2544
-
\??\c:\ntthbt.exec:\ntthbt.exe81⤵PID:4136
-
\??\c:\3ddvd.exec:\3ddvd.exe82⤵PID:3740
-
\??\c:\bhtbnh.exec:\bhtbnh.exe83⤵PID:4608
-
\??\c:\3hhttn.exec:\3hhttn.exe84⤵PID:3616
-
\??\c:\7htnhh.exec:\7htnhh.exe85⤵PID:3940
-
\??\c:\flrfrrf.exec:\flrfrrf.exe86⤵PID:1576
-
\??\c:\hhbnht.exec:\hhbnht.exe87⤵PID:2400
-
\??\c:\bbnbht.exec:\bbnbht.exe88⤵PID:2320
-
\??\c:\djjdp.exec:\djjdp.exe89⤵PID:4500
-
\??\c:\pjpdv.exec:\pjpdv.exe90⤵PID:2248
-
\??\c:\fxrfrfl.exec:\fxrfrfl.exe91⤵PID:2712
-
\??\c:\rrrfxrr.exec:\rrrfxrr.exe92⤵PID:3628
-
\??\c:\ntnhtn.exec:\ntnhtn.exe93⤵PID:3944
-
\??\c:\tnnbtn.exec:\tnnbtn.exe94⤵PID:1724
-
\??\c:\vvpjd.exec:\vvpjd.exe95⤵PID:4496
-
\??\c:\dvjvp.exec:\dvjvp.exe96⤵PID:4544
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe97⤵PID:1712
-
\??\c:\rffxfxf.exec:\rffxfxf.exe98⤵PID:1284
-
\??\c:\rrxflrl.exec:\rrxflrl.exe99⤵PID:3860
-
\??\c:\nbtthb.exec:\nbtthb.exe100⤵PID:4120
-
\??\c:\nhbhth.exec:\nhbhth.exe101⤵PID:4084
-
\??\c:\hhbtbt.exec:\hhbtbt.exe102⤵PID:2884
-
\??\c:\ppddj.exec:\ppddj.exe103⤵PID:2060
-
\??\c:\3ddvp.exec:\3ddvp.exe104⤵PID:3384
-
\??\c:\rlrffrx.exec:\rlrffrx.exe105⤵PID:2444
-
\??\c:\9xrfrlx.exec:\9xrfrlx.exe106⤵PID:1496
-
\??\c:\hbbbtb.exec:\hbbbtb.exe107⤵PID:3936
-
\??\c:\hbthtn.exec:\hbthtn.exe108⤵PID:3168
-
\??\c:\xrxxlrr.exec:\xrxxlrr.exe109⤵PID:4052
-
\??\c:\flrlxrf.exec:\flrlxrf.exe110⤵PID:3888
-
\??\c:\flxlfrl.exec:\flxlfrl.exe111⤵PID:2652
-
\??\c:\7bnhnh.exec:\7bnhnh.exe112⤵PID:2364
-
\??\c:\9vdpd.exec:\9vdpd.exe113⤵PID:2604
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe114⤵PID:4788
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe115⤵PID:444
-
\??\c:\9lxxxrr.exec:\9lxxxrr.exe116⤵PID:1628
-
\??\c:\nnnhtn.exec:\nnnhtn.exe117⤵PID:1936
-
\??\c:\hbhbbt.exec:\hbhbbt.exe118⤵PID:2476
-
\??\c:\jjpjv.exec:\jjpjv.exe119⤵PID:2148
-
\??\c:\rxrfrrx.exec:\rxrfrrx.exe120⤵PID:756
-
\??\c:\fxxrffr.exec:\fxxrffr.exe121⤵PID:1036
-
\??\c:\htnbnn.exec:\htnbnn.exe122⤵PID:4512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-