Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe
-
Size
275KB
-
MD5
1d4853a68bb3bcbd4ee3274da32641c9
-
SHA1
3395b2ffaf240b845f5f30b02e92edd914f92f14
-
SHA256
65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db
-
SHA512
25ecc8443195116e59797cc490582fd582d5807067c02c24d0787c7adf410968de944e753f9441c46baa2b067f3feb9c464a73ba33616b480bc17a033ff6c289
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFfl:8cm7ImGddXmNt251UriZFfl
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/5044-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5044 9lxrffx.exe 1448 5nnbtt.exe 4904 5ddvp.exe 1240 frrfxrr.exe 2200 djvpj.exe 2020 rffrfrx.exe 3040 nnnhbt.exe 1064 pjdvp.exe 696 dvjvj.exe 2268 httnhn.exe 1956 dpjvj.exe 3044 tntnhh.exe 4912 nhbnbt.exe 3200 ddvvp.exe 1516 flflxll.exe 4032 nbbnhb.exe 2448 dpppv.exe 832 9ffxrrl.exe 1472 pvdvp.exe 3504 rrlfflf.exe 2368 5hhbtt.exe 4648 3vvpj.exe 1828 3vvpj.exe 3924 rlxrlll.exe 3416 hhntbn.exe 2932 pjjjd.exe 972 lfxrlrr.exe 4476 flrrffx.exe 2440 rlxlxxr.exe 2096 thnhbt.exe 1060 pjvpj.exe 4676 7flfrrf.exe 2380 3llflfl.exe 3812 hnbhtn.exe 2828 pjddd.exe 116 5flxrlf.exe 428 ntthhb.exe 532 pvjdv.exe 1256 1llrlfx.exe 4316 ffrlxrx.exe 4720 5thttn.exe 4996 7jppv.exe 5044 xrllffx.exe 4008 5nbttt.exe 1416 htttnn.exe 2188 ddjdv.exe 2088 llrllfx.exe 3372 tnntnn.exe 4588 ttttbn.exe 624 3ppdv.exe 4564 rfrlffx.exe 1744 7xxrlrl.exe 1064 3tbnbb.exe 3288 dpvjd.exe 3696 9fxfxfx.exe 1048 9ffxrll.exe 3764 htbthh.exe 3956 nhnhhb.exe 3636 djvjd.exe 4976 xxxxrrl.exe 3080 hbbttn.exe 2524 pjdpd.exe 4832 llxrfxf.exe 3624 rxxrlxl.exe -
resource yara_rule behavioral2/memory/5044-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-402-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 5044 4996 65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe 82 PID 4996 wrote to memory of 5044 4996 65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe 82 PID 4996 wrote to memory of 5044 4996 65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe 82 PID 5044 wrote to memory of 1448 5044 9lxrffx.exe 83 PID 5044 wrote to memory of 1448 5044 9lxrffx.exe 83 PID 5044 wrote to memory of 1448 5044 9lxrffx.exe 83 PID 1448 wrote to memory of 4904 1448 5nnbtt.exe 84 PID 1448 wrote to memory of 4904 1448 5nnbtt.exe 84 PID 1448 wrote to memory of 4904 1448 5nnbtt.exe 84 PID 4904 wrote to memory of 1240 4904 5ddvp.exe 86 PID 4904 wrote to memory of 1240 4904 5ddvp.exe 86 PID 4904 wrote to memory of 1240 4904 5ddvp.exe 86 PID 1240 wrote to memory of 2200 1240 frrfxrr.exe 88 PID 1240 wrote to memory of 2200 1240 frrfxrr.exe 88 PID 1240 wrote to memory of 2200 1240 frrfxrr.exe 88 PID 2200 wrote to memory of 2020 2200 djvpj.exe 89 PID 2200 wrote to memory of 2020 2200 djvpj.exe 89 PID 2200 wrote to memory of 2020 2200 djvpj.exe 89 PID 2020 wrote to memory of 3040 2020 rffrfrx.exe 90 PID 2020 wrote to memory of 3040 2020 rffrfrx.exe 90 PID 2020 wrote to memory of 3040 2020 rffrfrx.exe 90 PID 3040 wrote to memory of 1064 3040 nnnhbt.exe 137 PID 3040 wrote to memory of 1064 3040 nnnhbt.exe 137 PID 3040 wrote to memory of 1064 3040 nnnhbt.exe 137 PID 1064 wrote to memory of 696 1064 pjdvp.exe 93 PID 1064 wrote to memory of 696 1064 pjdvp.exe 93 PID 1064 wrote to memory of 696 1064 pjdvp.exe 93 PID 696 wrote to memory of 2268 696 dvjvj.exe 94 PID 696 wrote to memory of 2268 696 dvjvj.exe 94 PID 696 wrote to memory of 2268 696 dvjvj.exe 94 PID 2268 wrote to memory of 1956 2268 httnhn.exe 95 PID 2268 wrote to memory of 1956 2268 httnhn.exe 95 PID 2268 wrote to memory of 1956 2268 httnhn.exe 95 PID 1956 wrote to memory of 3044 1956 dpjvj.exe 96 PID 1956 wrote to memory of 3044 1956 dpjvj.exe 96 PID 1956 wrote to memory of 3044 1956 dpjvj.exe 96 PID 3044 wrote to memory of 4912 3044 tntnhh.exe 97 PID 3044 wrote to memory of 4912 3044 tntnhh.exe 97 PID 3044 wrote to memory of 4912 3044 tntnhh.exe 97 PID 4912 wrote to memory of 3200 4912 nhbnbt.exe 98 PID 4912 wrote to memory of 3200 4912 nhbnbt.exe 98 PID 4912 wrote to memory of 3200 4912 nhbnbt.exe 98 PID 3200 wrote to memory of 1516 3200 ddvvp.exe 99 PID 3200 wrote to memory of 1516 3200 ddvvp.exe 99 PID 3200 wrote to memory of 1516 3200 ddvvp.exe 99 PID 1516 wrote to memory of 4032 1516 flflxll.exe 100 PID 1516 wrote to memory of 4032 1516 flflxll.exe 100 PID 1516 wrote to memory of 4032 1516 flflxll.exe 100 PID 4032 wrote to memory of 2448 4032 nbbnhb.exe 101 PID 4032 wrote to memory of 2448 4032 nbbnhb.exe 101 PID 4032 wrote to memory of 2448 4032 nbbnhb.exe 101 PID 2448 wrote to memory of 832 2448 dpppv.exe 102 PID 2448 wrote to memory of 832 2448 dpppv.exe 102 PID 2448 wrote to memory of 832 2448 dpppv.exe 102 PID 832 wrote to memory of 1472 832 9ffxrrl.exe 103 PID 832 wrote to memory of 1472 832 9ffxrrl.exe 103 PID 832 wrote to memory of 1472 832 9ffxrrl.exe 103 PID 1472 wrote to memory of 3504 1472 pvdvp.exe 104 PID 1472 wrote to memory of 3504 1472 pvdvp.exe 104 PID 1472 wrote to memory of 3504 1472 pvdvp.exe 104 PID 3504 wrote to memory of 2368 3504 rrlfflf.exe 105 PID 3504 wrote to memory of 2368 3504 rrlfflf.exe 105 PID 3504 wrote to memory of 2368 3504 rrlfflf.exe 105 PID 2368 wrote to memory of 4648 2368 5hhbtt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe"C:\Users\Admin\AppData\Local\Temp\65327b0b5289419b2f2f880c57ee6b7c8e338e892a1c6855b9733f1615c502db.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\9lxrffx.exec:\9lxrffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\5nnbtt.exec:\5nnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\5ddvp.exec:\5ddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\frrfxrr.exec:\frrfxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\djvpj.exec:\djvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rffrfrx.exec:\rffrfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nnnhbt.exec:\nnnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pjdvp.exec:\pjdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\dvjvj.exec:\dvjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\httnhn.exec:\httnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\dpjvj.exec:\dpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\tntnhh.exec:\tntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nhbnbt.exec:\nhbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\ddvvp.exec:\ddvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\flflxll.exec:\flflxll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\nbbnhb.exec:\nbbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\dpppv.exec:\dpppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\pvdvp.exec:\pvdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\rrlfflf.exec:\rrlfflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\5hhbtt.exec:\5hhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3vvpj.exec:\3vvpj.exe23⤵
- Executes dropped EXE
PID:4648 -
\??\c:\3vvpj.exec:\3vvpj.exe24⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rlxrlll.exec:\rlxrlll.exe25⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhntbn.exec:\hhntbn.exe26⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pjjjd.exec:\pjjjd.exe27⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe28⤵
- Executes dropped EXE
PID:972 -
\??\c:\flrrffx.exec:\flrrffx.exe29⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rlxlxxr.exec:\rlxlxxr.exe30⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thnhbt.exec:\thnhbt.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjvpj.exec:\pjvpj.exe32⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7flfrrf.exec:\7flfrrf.exe33⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3llflfl.exec:\3llflfl.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hnbhtn.exec:\hnbhtn.exe35⤵
- Executes dropped EXE
PID:3812 -
\??\c:\pjddd.exec:\pjddd.exe36⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5flxrlf.exec:\5flxrlf.exe37⤵
- Executes dropped EXE
PID:116 -
\??\c:\ntthhb.exec:\ntthhb.exe38⤵
- Executes dropped EXE
PID:428 -
\??\c:\pvjdv.exec:\pvjdv.exe39⤵
- Executes dropped EXE
PID:532 -
\??\c:\1llrlfx.exec:\1llrlfx.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ffrlxrx.exec:\ffrlxrx.exe41⤵
- Executes dropped EXE
PID:4316 -
\??\c:\5thttn.exec:\5thttn.exe42⤵
- Executes dropped EXE
PID:4720 -
\??\c:\7jppv.exec:\7jppv.exe43⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xrllffx.exec:\xrllffx.exe44⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5nbttt.exec:\5nbttt.exe45⤵
- Executes dropped EXE
PID:4008 -
\??\c:\htttnn.exec:\htttnn.exe46⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ddjdv.exec:\ddjdv.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\llrllfx.exec:\llrllfx.exe48⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnntnn.exec:\tnntnn.exe49⤵
- Executes dropped EXE
PID:3372 -
\??\c:\ttttbn.exec:\ttttbn.exe50⤵
- Executes dropped EXE
PID:4588 -
\??\c:\3ppdv.exec:\3ppdv.exe51⤵
- Executes dropped EXE
PID:624 -
\??\c:\rfrlffx.exec:\rfrlffx.exe52⤵
- Executes dropped EXE
PID:4564 -
\??\c:\7xxrlrl.exec:\7xxrlrl.exe53⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3tbnbb.exec:\3tbnbb.exe54⤵
- Executes dropped EXE
PID:1064 -
\??\c:\dpvjd.exec:\dpvjd.exe55⤵
- Executes dropped EXE
PID:3288 -
\??\c:\9fxfxfx.exec:\9fxfxfx.exe56⤵
- Executes dropped EXE
PID:3696 -
\??\c:\9ffxrll.exec:\9ffxrll.exe57⤵
- Executes dropped EXE
PID:1048 -
\??\c:\htbthh.exec:\htbthh.exe58⤵
- Executes dropped EXE
PID:3764 -
\??\c:\nhnhhb.exec:\nhnhhb.exe59⤵
- Executes dropped EXE
PID:3956 -
\??\c:\djvjd.exec:\djvjd.exe60⤵
- Executes dropped EXE
PID:3636 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe61⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hbbttn.exec:\hbbttn.exe62⤵
- Executes dropped EXE
PID:3080 -
\??\c:\pjdpd.exec:\pjdpd.exe63⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llxrfxf.exec:\llxrfxf.exe64⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rxxrlxl.exec:\rxxrlxl.exe65⤵
- Executes dropped EXE
PID:3624 -
\??\c:\7bbbnt.exec:\7bbbnt.exe66⤵PID:2296
-
\??\c:\pddjp.exec:\pddjp.exe67⤵PID:4988
-
\??\c:\xrxrlrx.exec:\xrxrlrx.exe68⤵PID:628
-
\??\c:\hhnntt.exec:\hhnntt.exe69⤵PID:1508
-
\??\c:\jdvjp.exec:\jdvjp.exe70⤵PID:3356
-
\??\c:\lrxlflf.exec:\lrxlflf.exe71⤵PID:2364
-
\??\c:\bnthbb.exec:\bnthbb.exe72⤵PID:3548
-
\??\c:\bbbbht.exec:\bbbbht.exe73⤵PID:2040
-
\??\c:\dvvpv.exec:\dvvpv.exe74⤵PID:1916
-
\??\c:\lrlflrf.exec:\lrlflrf.exe75⤵PID:4916
-
\??\c:\jjpjj.exec:\jjpjj.exe76⤵PID:1316
-
\??\c:\fxxlfxf.exec:\fxxlfxf.exe77⤵PID:3928
-
\??\c:\tbthbt.exec:\tbthbt.exe78⤵PID:2932
-
\??\c:\frlxlfx.exec:\frlxlfx.exe79⤵PID:4880
-
\??\c:\nnhnnh.exec:\nnhnnh.exe80⤵PID:912
-
\??\c:\jpjpp.exec:\jpjpp.exe81⤵PID:5016
-
\??\c:\dpjvp.exec:\dpjvp.exe82⤵PID:3340
-
\??\c:\rffxlfx.exec:\rffxlfx.exe83⤵PID:3588
-
\??\c:\tnbttt.exec:\tnbttt.exe84⤵PID:1060
-
\??\c:\pjjdp.exec:\pjjdp.exe85⤵PID:3604
-
\??\c:\fllfrrl.exec:\fllfrrl.exe86⤵PID:1352
-
\??\c:\nhhtbb.exec:\nhhtbb.exe87⤵PID:2380
-
\??\c:\hbtbhn.exec:\hbtbhn.exe88⤵PID:4244
-
\??\c:\ddpjj.exec:\ddpjj.exe89⤵PID:3324
-
\??\c:\xrrlfff.exec:\xrrlfff.exe90⤵PID:3448
-
\??\c:\tnnnnt.exec:\tnnnnt.exe91⤵PID:3268
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe92⤵PID:208
-
\??\c:\xfrlfff.exec:\xfrlfff.exe93⤵PID:3740
-
\??\c:\lffrrlx.exec:\lffrrlx.exe94⤵PID:4428
-
\??\c:\xxlxrxr.exec:\xxlxrxr.exe95⤵PID:4788
-
\??\c:\nbhhbb.exec:\nbhhbb.exe96⤵PID:3528
-
\??\c:\hbhbtb.exec:\hbhbtb.exe97⤵PID:3236
-
\??\c:\ddvvp.exec:\ddvvp.exe98⤵PID:3036
-
\??\c:\3hhnbh.exec:\3hhnbh.exe99⤵PID:4004
-
\??\c:\hbbthh.exec:\hbbthh.exe100⤵PID:4596
-
\??\c:\jdppv.exec:\jdppv.exe101⤵PID:1444
-
\??\c:\rlxxllr.exec:\rlxxllr.exe102⤵PID:2200
-
\??\c:\btttnn.exec:\btttnn.exe103⤵PID:4920
-
\??\c:\bttbhh.exec:\bttbhh.exe104⤵PID:2020
-
\??\c:\pjpjd.exec:\pjpjd.exe105⤵PID:4588
-
\??\c:\dvddd.exec:\dvddd.exe106⤵PID:4564
-
\??\c:\xrxlllr.exec:\xrxlllr.exe107⤵PID:5084
-
\??\c:\nnhbtt.exec:\nnhbtt.exe108⤵PID:696
-
\??\c:\jdpjv.exec:\jdpjv.exe109⤵PID:4464
-
\??\c:\5rffxff.exec:\5rffxff.exe110⤵PID:4888
-
\??\c:\jdjdd.exec:\jdjdd.exe111⤵PID:1048
-
\??\c:\lffxrxx.exec:\lffxrxx.exe112⤵PID:3764
-
\??\c:\jvjdv.exec:\jvjdv.exe113⤵PID:5076
-
\??\c:\jjdvp.exec:\jjdvp.exe114⤵PID:1884
-
\??\c:\rllxrrr.exec:\rllxrrr.exe115⤵PID:4976
-
\??\c:\dvpvp.exec:\dvpvp.exe116⤵PID:3080
-
\??\c:\3jpdp.exec:\3jpdp.exe117⤵PID:2680
-
\??\c:\lfrrrfr.exec:\lfrrrfr.exe118⤵PID:2276
-
\??\c:\hnbttt.exec:\hnbttt.exe119⤵PID:4552
-
\??\c:\5jjdp.exec:\5jjdp.exe120⤵PID:1220
-
\??\c:\1xxrffx.exec:\1xxrffx.exe121⤵PID:4116
-
\??\c:\httbhb.exec:\httbhb.exe122⤵PID:4736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-