Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d8241f54bc9fe616a9d278a6110ae10.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
1d8241f54bc9fe616a9d278a6110ae10.exe
-
Size
520KB
-
MD5
1d8241f54bc9fe616a9d278a6110ae10
-
SHA1
3421919049276645bef654f50dce75b3dc34e8d3
-
SHA256
03d1811f1ab5eb5a2827997f50c2600acf0ba1d94f1f7e9a459b61aee413786f
-
SHA512
d0e2bd521690c0926bcbc9776113f8347bcb68c2b9ee2e44c85258c56e25a2f3c701008e008ab52d5693bec38ca1571addfcb1211e15b207377f8592fadc45bc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3w:q7Tc2NYHUrAwfMHNnpls489A
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/892-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 892 xfxxflr.exe 3240 tnnhhh.exe 2212 ppvpv.exe 3288 7lrfxfx.exe 4056 rlrrffr.exe 1104 xxlrrrf.exe 5008 btbthn.exe 4524 lllrrrr.exe 2064 vvpjd.exe 624 nntnnt.exe 1436 vvjjp.exe 1624 xrxrxll.exe 1420 ttbbnn.exe 4888 3bttbb.exe 1012 lllllll.exe 2616 tttnnn.exe 5116 thbbnh.exe 2088 dddvp.exe 3044 rlxxxxx.exe 3684 7bbhhn.exe 4340 jpddj.exe 2720 ddddd.exe 2540 ttbbnt.exe 3540 pjjjj.exe 3756 fflfrxl.exe 4824 tnhhtt.exe 4224 ppjjj.exe 4584 frfxrxl.exe 4372 dvvpp.exe 4512 llrflrf.exe 332 tbhhhh.exe 3768 pvdjj.exe 3928 5ffxlrx.exe 364 5dvpj.exe 2216 rlxxxxx.exe 4608 rxxrrrr.exe 1380 5bhhhn.exe 4300 dppvp.exe 2288 rrxxxxx.exe 4388 thttnt.exe 852 hnbnbn.exe 4428 dvddd.exe 3288 lrlxrlf.exe 4836 bbthtn.exe 4852 jjdjd.exe 3136 ffrlxxl.exe 4328 nbbtth.exe 660 thnbtb.exe 4496 5pvdv.exe 2732 3fxxfrl.exe 3868 nntnnn.exe 2044 nbnbhb.exe 2068 ppvdd.exe 4772 frlfxxx.exe 3452 tnbtbb.exe 4132 vpdvj.exe 3656 vpvvv.exe 2284 xffxxfx.exe 4380 tnnnhb.exe 4700 vddpv.exe 5092 pdvdd.exe 2616 rxxrlxf.exe 2880 hhbtnn.exe 532 pjppv.exe -
resource yara_rule behavioral2/memory/892-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-106-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 892 4344 1d8241f54bc9fe616a9d278a6110ae10.exe 174 PID 4344 wrote to memory of 892 4344 1d8241f54bc9fe616a9d278a6110ae10.exe 174 PID 4344 wrote to memory of 892 4344 1d8241f54bc9fe616a9d278a6110ae10.exe 174 PID 892 wrote to memory of 3240 892 xfxxflr.exe 82 PID 892 wrote to memory of 3240 892 xfxxflr.exe 82 PID 892 wrote to memory of 3240 892 xfxxflr.exe 82 PID 3240 wrote to memory of 2212 3240 tnnhhh.exe 83 PID 3240 wrote to memory of 2212 3240 tnnhhh.exe 83 PID 3240 wrote to memory of 2212 3240 tnnhhh.exe 83 PID 2212 wrote to memory of 3288 2212 ppvpv.exe 126 PID 2212 wrote to memory of 3288 2212 ppvpv.exe 126 PID 2212 wrote to memory of 3288 2212 ppvpv.exe 126 PID 3288 wrote to memory of 4056 3288 7lrfxfx.exe 181 PID 3288 wrote to memory of 4056 3288 7lrfxfx.exe 181 PID 3288 wrote to memory of 4056 3288 7lrfxfx.exe 181 PID 4056 wrote to memory of 1104 4056 rlrrffr.exe 87 PID 4056 wrote to memory of 1104 4056 rlrrffr.exe 87 PID 4056 wrote to memory of 1104 4056 rlrrffr.exe 87 PID 1104 wrote to memory of 5008 1104 xxlrrrf.exe 184 PID 1104 wrote to memory of 5008 1104 xxlrrrf.exe 184 PID 1104 wrote to memory of 5008 1104 xxlrrrf.exe 184 PID 5008 wrote to memory of 4524 5008 btbthn.exe 90 PID 5008 wrote to memory of 4524 5008 btbthn.exe 90 PID 5008 wrote to memory of 4524 5008 btbthn.exe 90 PID 4524 wrote to memory of 2064 4524 lllrrrr.exe 92 PID 4524 wrote to memory of 2064 4524 lllrrrr.exe 92 PID 4524 wrote to memory of 2064 4524 lllrrrr.exe 92 PID 2064 wrote to memory of 624 2064 vvpjd.exe 93 PID 2064 wrote to memory of 624 2064 vvpjd.exe 93 PID 2064 wrote to memory of 624 2064 vvpjd.exe 93 PID 624 wrote to memory of 1436 624 nntnnt.exe 94 PID 624 wrote to memory of 1436 624 nntnnt.exe 94 PID 624 wrote to memory of 1436 624 nntnnt.exe 94 PID 1436 wrote to memory of 1624 1436 vvjjp.exe 95 PID 1436 wrote to memory of 1624 1436 vvjjp.exe 95 PID 1436 wrote to memory of 1624 1436 vvjjp.exe 95 PID 1624 wrote to memory of 1420 1624 xrxrxll.exe 96 PID 1624 wrote to memory of 1420 1624 xrxrxll.exe 96 PID 1624 wrote to memory of 1420 1624 xrxrxll.exe 96 PID 1420 wrote to memory of 4888 1420 ttbbnn.exe 97 PID 1420 wrote to memory of 4888 1420 ttbbnn.exe 97 PID 1420 wrote to memory of 4888 1420 ttbbnn.exe 97 PID 4888 wrote to memory of 1012 4888 3bttbb.exe 98 PID 4888 wrote to memory of 1012 4888 3bttbb.exe 98 PID 4888 wrote to memory of 1012 4888 3bttbb.exe 98 PID 1012 wrote to memory of 2616 1012 lllllll.exe 99 PID 1012 wrote to memory of 2616 1012 lllllll.exe 99 PID 1012 wrote to memory of 2616 1012 lllllll.exe 99 PID 2616 wrote to memory of 5116 2616 tttnnn.exe 100 PID 2616 wrote to memory of 5116 2616 tttnnn.exe 100 PID 2616 wrote to memory of 5116 2616 tttnnn.exe 100 PID 5116 wrote to memory of 2088 5116 thbbnh.exe 101 PID 5116 wrote to memory of 2088 5116 thbbnh.exe 101 PID 5116 wrote to memory of 2088 5116 thbbnh.exe 101 PID 2088 wrote to memory of 3044 2088 dddvp.exe 102 PID 2088 wrote to memory of 3044 2088 dddvp.exe 102 PID 2088 wrote to memory of 3044 2088 dddvp.exe 102 PID 3044 wrote to memory of 3684 3044 rlxxxxx.exe 103 PID 3044 wrote to memory of 3684 3044 rlxxxxx.exe 103 PID 3044 wrote to memory of 3684 3044 rlxxxxx.exe 103 PID 3684 wrote to memory of 4340 3684 7bbhhn.exe 104 PID 3684 wrote to memory of 4340 3684 7bbhhn.exe 104 PID 3684 wrote to memory of 4340 3684 7bbhhn.exe 104 PID 4340 wrote to memory of 2720 4340 jpddj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8241f54bc9fe616a9d278a6110ae10.exe"C:\Users\Admin\AppData\Local\Temp\1d8241f54bc9fe616a9d278a6110ae10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\xfxxflr.exec:\xfxxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\tnnhhh.exec:\tnnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\ppvpv.exec:\ppvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\7lrfxfx.exec:\7lrfxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\rlrrffr.exec:\rlrrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\xxlrrrf.exec:\xxlrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\btbthn.exec:\btbthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\lllrrrr.exec:\lllrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\vvpjd.exec:\vvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nntnnt.exec:\nntnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\vvjjp.exec:\vvjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\xrxrxll.exec:\xrxrxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ttbbnn.exec:\ttbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\3bttbb.exec:\3bttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lllllll.exec:\lllllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\tttnnn.exec:\tttnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\thbbnh.exec:\thbbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\dddvp.exec:\dddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\7bbhhn.exec:\7bbhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\jpddj.exec:\jpddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\ddddd.exec:\ddddd.exe23⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ttbbnt.exec:\ttbbnt.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjjjj.exec:\pjjjj.exe25⤵
- Executes dropped EXE
PID:3540 -
\??\c:\fflfrxl.exec:\fflfrxl.exe26⤵
- Executes dropped EXE
PID:3756 -
\??\c:\tnhhtt.exec:\tnhhtt.exe27⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ppjjj.exec:\ppjjj.exe28⤵
- Executes dropped EXE
PID:4224 -
\??\c:\frfxrxl.exec:\frfxrxl.exe29⤵
- Executes dropped EXE
PID:4584 -
\??\c:\dvvpp.exec:\dvvpp.exe30⤵
- Executes dropped EXE
PID:4372 -
\??\c:\llrflrf.exec:\llrflrf.exe31⤵
- Executes dropped EXE
PID:4512 -
\??\c:\tbhhhh.exec:\tbhhhh.exe32⤵
- Executes dropped EXE
PID:332 -
\??\c:\pvdjj.exec:\pvdjj.exe33⤵
- Executes dropped EXE
PID:3768 -
\??\c:\5ffxlrx.exec:\5ffxlrx.exe34⤵
- Executes dropped EXE
PID:3928 -
\??\c:\5dvpj.exec:\5dvpj.exe35⤵
- Executes dropped EXE
PID:364 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe36⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe37⤵
- Executes dropped EXE
PID:4608 -
\??\c:\5bhhhn.exec:\5bhhhn.exe38⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dppvp.exec:\dppvp.exe39⤵
- Executes dropped EXE
PID:4300 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe40⤵
- Executes dropped EXE
PID:2288 -
\??\c:\thttnt.exec:\thttnt.exe41⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hnbnbn.exec:\hnbnbn.exe42⤵
- Executes dropped EXE
PID:852 -
\??\c:\dvddd.exec:\dvddd.exe43⤵
- Executes dropped EXE
PID:4428 -
\??\c:\lrlxrlf.exec:\lrlxrlf.exe44⤵
- Executes dropped EXE
PID:3288 -
\??\c:\bbthtn.exec:\bbthtn.exe45⤵
- Executes dropped EXE
PID:4836 -
\??\c:\jjdjd.exec:\jjdjd.exe46⤵
- Executes dropped EXE
PID:4852 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe47⤵
- Executes dropped EXE
PID:3136 -
\??\c:\nbbtth.exec:\nbbtth.exe48⤵
- Executes dropped EXE
PID:4328 -
\??\c:\thnbtb.exec:\thnbtb.exe49⤵
- Executes dropped EXE
PID:660 -
\??\c:\5pvdv.exec:\5pvdv.exe50⤵
- Executes dropped EXE
PID:4496 -
\??\c:\3fxxfrl.exec:\3fxxfrl.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nntnnn.exec:\nntnnn.exe52⤵
- Executes dropped EXE
PID:3868 -
\??\c:\nbnbhb.exec:\nbnbhb.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ppvdd.exec:\ppvdd.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\frlfxxx.exec:\frlfxxx.exe55⤵
- Executes dropped EXE
PID:4772 -
\??\c:\tnbtbb.exec:\tnbtbb.exe56⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vpdvj.exec:\vpdvj.exe57⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vpvvv.exec:\vpvvv.exe58⤵
- Executes dropped EXE
PID:3656 -
\??\c:\xffxxfx.exec:\xffxxfx.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnnnhb.exec:\tnnnhb.exe60⤵
- Executes dropped EXE
PID:4380 -
\??\c:\vddpv.exec:\vddpv.exe61⤵
- Executes dropped EXE
PID:4700 -
\??\c:\pdvdd.exec:\pdvdd.exe62⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rxxrlxf.exec:\rxxrlxf.exe63⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hhbtnn.exec:\hhbtnn.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pjppv.exec:\pjppv.exe65⤵
- Executes dropped EXE
PID:532 -
\??\c:\fflfxxl.exec:\fflfxxl.exe66⤵PID:3924
-
\??\c:\nbhnht.exec:\nbhnht.exe67⤵PID:1860
-
\??\c:\jdjvd.exec:\jdjvd.exe68⤵PID:1872
-
\??\c:\jpppp.exec:\jpppp.exe69⤵PID:3348
-
\??\c:\rlrrxff.exec:\rlrrxff.exe70⤵PID:3592
-
\??\c:\httnbt.exec:\httnbt.exe71⤵PID:432
-
\??\c:\vjpjd.exec:\vjpjd.exe72⤵PID:3828
-
\??\c:\xxrxrxf.exec:\xxrxrxf.exe73⤵PID:2344
-
\??\c:\rfxfrfl.exec:\rfxfrfl.exe74⤵PID:1536
-
\??\c:\bnbhht.exec:\bnbhht.exe75⤵PID:1016
-
\??\c:\dpdjp.exec:\dpdjp.exe76⤵PID:4224
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe77⤵PID:3572
-
\??\c:\nnntbt.exec:\nnntbt.exe78⤵PID:4872
-
\??\c:\pdppj.exec:\pdppj.exe79⤵PID:2592
-
\??\c:\lxxxxrx.exec:\lxxxxrx.exe80⤵PID:2144
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe81⤵PID:3484
-
\??\c:\7jjdd.exec:\7jjdd.exe82⤵PID:332
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe83⤵PID:5068
-
\??\c:\ntnhtt.exec:\ntnhtt.exe84⤵PID:4040
-
\??\c:\jdvvp.exec:\jdvvp.exe85⤵PID:1496
-
\??\c:\pjjdp.exec:\pjjdp.exe86⤵PID:2392
-
\??\c:\rrlfrfx.exec:\rrlfrfx.exe87⤵PID:1340
-
\??\c:\1bnbth.exec:\1bnbth.exe88⤵PID:4788
-
\??\c:\djppj.exec:\djppj.exe89⤵PID:3976
-
\??\c:\lxrrllr.exec:\lxrrllr.exe90⤵PID:4440
-
\??\c:\lfrfxrf.exec:\lfrfxrf.exe91⤵PID:4320
-
\??\c:\hbnbhb.exec:\hbnbhb.exe92⤵PID:892
-
\??\c:\jvvpj.exec:\jvvpj.exe93⤵PID:2508
-
\??\c:\5xrlrrl.exec:\5xrlrrl.exe94⤵PID:216
-
\??\c:\nttnnb.exec:\nttnnb.exe95⤵PID:400
-
\??\c:\htbbbb.exec:\htbbbb.exe96⤵PID:1576
-
\??\c:\ddddv.exec:\ddddv.exe97⤵PID:4056
-
\??\c:\lxrllll.exec:\lxrllll.exe98⤵PID:444
-
\??\c:\hhhbtt.exec:\hhhbtt.exe99⤵PID:1864
-
\??\c:\lrfrflr.exec:\lrfrflr.exe100⤵PID:5008
-
\??\c:\hhbbht.exec:\hhbbht.exe101⤵PID:660
-
\??\c:\pvpjv.exec:\pvpjv.exe102⤵PID:4496
-
\??\c:\ntnbhb.exec:\ntnbhb.exe103⤵PID:2732
-
\??\c:\7ppjj.exec:\7ppjj.exe104⤵PID:3868
-
\??\c:\dddpp.exec:\dddpp.exe105⤵PID:2044
-
\??\c:\fflfxxr.exec:\fflfxxr.exe106⤵PID:4840
-
\??\c:\jvvvp.exec:\jvvvp.exe107⤵PID:2400
-
\??\c:\jvjpd.exec:\jvjpd.exe108⤵PID:4548
-
\??\c:\frrxlfr.exec:\frrxlfr.exe109⤵PID:3112
-
\??\c:\rxflllf.exec:\rxflllf.exe110⤵PID:4768
-
\??\c:\bbthnb.exec:\bbthnb.exe111⤵PID:3764
-
\??\c:\vpvjj.exec:\vpvjj.exe112⤵PID:1944
-
\??\c:\jvvjd.exec:\jvvjd.exe113⤵PID:3780
-
\??\c:\ddpjj.exec:\ddpjj.exe114⤵PID:4564
-
\??\c:\fllrrrx.exec:\fllrrrx.exe115⤵PID:2228
-
\??\c:\thbbbb.exec:\thbbbb.exe116⤵PID:4600
-
\??\c:\vdjdv.exec:\vdjdv.exe117⤵PID:972
-
\??\c:\lfxlffr.exec:\lfxlffr.exe118⤵PID:3440
-
\??\c:\tnthtn.exec:\tnthtn.exe119⤵PID:3592
-
\??\c:\pdpdp.exec:\pdpdp.exe120⤵PID:1820
-
\??\c:\rflxlrx.exec:\rflxlrx.exe121⤵PID:4520
-
\??\c:\nntbbb.exec:\nntbbb.exe122⤵PID:3776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-