Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 00:33
Behavioral task
behavioral1
Sample
96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe
-
Size
331KB
-
MD5
06650cd13ea18309302c12420e46f657
-
SHA1
a2e38d14c5b44fe1ce89d9c6d3a924a7cb1f51e3
-
SHA256
96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64
-
SHA512
42fbcbf5fbf40e72056c1ec384b06e2d1185c467010fb28a7332adc05869289de19d5ef390785ff3a4076db66bb5e5ab0889906f05a5281940ad2865810adb7b
-
SSDEEP
6144:9cm4FmowdHoS4BftapTs8Hoo+6MjTVhRDqzS:/4wFHoS4d0G8HoljTVhRDqzS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2184-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-808-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-955-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/32-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3424 vvjjp.exe 3624 rxllflf.exe 4572 hhthbn.exe 1068 hnbttb.exe 3952 jdppj.exe 3972 thbhnn.exe 4832 jjddp.exe 1848 xxxrlfx.exe 2184 bttnnh.exe 1224 bntnnt.exe 100 dvppj.exe 5048 xlrllff.exe 220 bbttbn.exe 4576 dpjdp.exe 4944 1rrllll.exe 2124 bhbbbn.exe 3036 jdjdd.exe 3512 xxlrlff.exe 4528 httnhh.exe 2696 vpjpj.exe 2432 lffrxfr.exe 4684 nhnhbb.exe 4820 vjdjv.exe 5064 nhhbtt.exe 3524 ttnbht.exe 2912 vvpdp.exe 4048 hbnthh.exe 2408 rrxxlxx.exe 3768 bnhbtt.exe 4788 rrrxxll.exe 4204 ddjpp.exe 4540 5bbbbb.exe 4200 vdvdv.exe 736 xxfxrlf.exe 232 rlrrrll.exe 452 nnhbhh.exe 4332 jdjjj.exe 4600 rflfrrr.exe 3184 nthbtt.exe 1632 pddjv.exe 1904 frlffll.exe 4364 tnbbtb.exe 3256 ntbbbt.exe 4000 rllfffl.exe 3960 htnhht.exe 3260 pdjjd.exe 3292 jvddv.exe 2200 xxrffrr.exe 4872 llffrff.exe 1608 tnnhbb.exe 1560 pvvdd.exe 3324 dvjdd.exe 4832 7fffxfx.exe 1848 nnbtbh.exe 2296 hhbbbb.exe 5088 ppjdv.exe 5052 jppvd.exe 3032 fxfxxxx.exe 2092 bntttb.exe 3688 nbtntn.exe 3140 dvjvd.exe 2872 rrrrrxx.exe 1468 frfffxf.exe 3896 1htnnt.exe -
resource yara_rule behavioral2/memory/544-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c7-23.dat upx behavioral2/files/0x00070000000234c9-35.dat upx behavioral2/files/0x00070000000234ca-40.dat upx behavioral2/files/0x00070000000234cb-46.dat upx behavioral2/memory/2184-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cf-68.dat upx behavioral2/memory/220-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d4-96.dat upx behavioral2/files/0x00070000000234d5-101.dat upx behavioral2/files/0x00070000000234d6-107.dat upx behavioral2/files/0x00070000000234d9-125.dat upx behavioral2/files/0x00090000000234c3-128.dat upx behavioral2/memory/5064-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4820-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234da-134.dat upx behavioral2/files/0x00070000000234db-142.dat upx behavioral2/memory/5064-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234dc-147.dat upx behavioral2/memory/2912-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3768-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3768-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023405-173.dat upx behavioral2/files/0x00080000000234e0-178.dat upx behavioral2/files/0x00090000000234e1-181.dat upx behavioral2/memory/4200-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/452-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1904-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4000-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3324-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2092-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3140-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1468-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2316-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1588-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/216-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4512-393-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1140-400-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4484-413-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4564-451-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4392-471-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3456-500-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-564-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/736-568-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4864-594-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1608-624-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-643-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4316-668-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3580-685-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4412-727-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4224-780-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2224-808-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1236-827-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-870-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1704-955-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3136-980-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2296-1023-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4228-1019-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-1015-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2512-1011-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/964-894-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 544 wrote to memory of 3424 544 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 83 PID 544 wrote to memory of 3424 544 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 83 PID 544 wrote to memory of 3424 544 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 83 PID 3424 wrote to memory of 3624 3424 vvjjp.exe 393 PID 3424 wrote to memory of 3624 3424 vvjjp.exe 393 PID 3424 wrote to memory of 3624 3424 vvjjp.exe 393 PID 3624 wrote to memory of 4572 3624 rxllflf.exe 86 PID 3624 wrote to memory of 4572 3624 rxllflf.exe 86 PID 3624 wrote to memory of 4572 3624 rxllflf.exe 86 PID 4572 wrote to memory of 1068 4572 hhthbn.exe 88 PID 4572 wrote to memory of 1068 4572 hhthbn.exe 88 PID 4572 wrote to memory of 1068 4572 hhthbn.exe 88 PID 1068 wrote to memory of 3952 1068 hnbttb.exe 89 PID 1068 wrote to memory of 3952 1068 hnbttb.exe 89 PID 1068 wrote to memory of 3952 1068 hnbttb.exe 89 PID 3952 wrote to memory of 3972 3952 jdppj.exe 90 PID 3952 wrote to memory of 3972 3952 jdppj.exe 90 PID 3952 wrote to memory of 3972 3952 jdppj.exe 90 PID 3972 wrote to memory of 4832 3972 thbhnn.exe 91 PID 3972 wrote to memory of 4832 3972 thbhnn.exe 91 PID 3972 wrote to memory of 4832 3972 thbhnn.exe 91 PID 4832 wrote to memory of 1848 4832 jjddp.exe 92 PID 4832 wrote to memory of 1848 4832 jjddp.exe 92 PID 4832 wrote to memory of 1848 4832 jjddp.exe 92 PID 1848 wrote to memory of 2184 1848 xxxrlfx.exe 93 PID 1848 wrote to memory of 2184 1848 xxxrlfx.exe 93 PID 1848 wrote to memory of 2184 1848 xxxrlfx.exe 93 PID 2184 wrote to memory of 1224 2184 bttnnh.exe 94 PID 2184 wrote to memory of 1224 2184 bttnnh.exe 94 PID 2184 wrote to memory of 1224 2184 bttnnh.exe 94 PID 1224 wrote to memory of 100 1224 bntnnt.exe 95 PID 1224 wrote to memory of 100 1224 bntnnt.exe 95 PID 1224 wrote to memory of 100 1224 bntnnt.exe 95 PID 100 wrote to memory of 5048 100 dvppj.exe 96 PID 100 wrote to memory of 5048 100 dvppj.exe 96 PID 100 wrote to memory of 5048 100 dvppj.exe 96 PID 5048 wrote to memory of 220 5048 xlrllff.exe 97 PID 5048 wrote to memory of 220 5048 xlrllff.exe 97 PID 5048 wrote to memory of 220 5048 xlrllff.exe 97 PID 220 wrote to memory of 4576 220 bbttbn.exe 201 PID 220 wrote to memory of 4576 220 bbttbn.exe 201 PID 220 wrote to memory of 4576 220 bbttbn.exe 201 PID 4576 wrote to memory of 4944 4576 dpjdp.exe 99 PID 4576 wrote to memory of 4944 4576 dpjdp.exe 99 PID 4576 wrote to memory of 4944 4576 dpjdp.exe 99 PID 4944 wrote to memory of 2124 4944 1rrllll.exe 100 PID 4944 wrote to memory of 2124 4944 1rrllll.exe 100 PID 4944 wrote to memory of 2124 4944 1rrllll.exe 100 PID 2124 wrote to memory of 3036 2124 bhbbbn.exe 101 PID 2124 wrote to memory of 3036 2124 bhbbbn.exe 101 PID 2124 wrote to memory of 3036 2124 bhbbbn.exe 101 PID 3036 wrote to memory of 3512 3036 jdjdd.exe 102 PID 3036 wrote to memory of 3512 3036 jdjdd.exe 102 PID 3036 wrote to memory of 3512 3036 jdjdd.exe 102 PID 3512 wrote to memory of 4528 3512 xxlrlff.exe 103 PID 3512 wrote to memory of 4528 3512 xxlrlff.exe 103 PID 3512 wrote to memory of 4528 3512 xxlrlff.exe 103 PID 4528 wrote to memory of 2696 4528 httnhh.exe 152 PID 4528 wrote to memory of 2696 4528 httnhh.exe 152 PID 4528 wrote to memory of 2696 4528 httnhh.exe 152 PID 2696 wrote to memory of 2432 2696 vpjpj.exe 105 PID 2696 wrote to memory of 2432 2696 vpjpj.exe 105 PID 2696 wrote to memory of 2432 2696 vpjpj.exe 105 PID 2432 wrote to memory of 4684 2432 lffrxfr.exe 106
Processes
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe"C:\Users\Admin\AppData\Local\Temp\96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\vvjjp.exec:\vvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\rxllflf.exec:\rxllflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\hhthbn.exec:\hhthbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\hnbttb.exec:\hnbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jdppj.exec:\jdppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\thbhnn.exec:\thbhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jjddp.exec:\jjddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\bttnnh.exec:\bttnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bntnnt.exec:\bntnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\dvppj.exec:\dvppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\xlrllff.exec:\xlrllff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\bbttbn.exec:\bbttbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\dpjdp.exec:\dpjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\1rrllll.exec:\1rrllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\bhbbbn.exec:\bhbbbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\jdjdd.exec:\jdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xxlrlff.exec:\xxlrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\httnhh.exec:\httnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\vpjpj.exec:\vpjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lffrxfr.exec:\lffrxfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\nhnhbb.exec:\nhnhbb.exe23⤵
- Executes dropped EXE
PID:4684 -
\??\c:\vjdjv.exec:\vjdjv.exe24⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nhhbtt.exec:\nhhbtt.exe25⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ttnbht.exec:\ttnbht.exe26⤵
- Executes dropped EXE
PID:3524 -
\??\c:\vvpdp.exec:\vvpdp.exe27⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hbnthh.exec:\hbnthh.exe28⤵
- Executes dropped EXE
PID:4048 -
\??\c:\rrxxlxx.exec:\rrxxlxx.exe29⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bnhbtt.exec:\bnhbtt.exe30⤵
- Executes dropped EXE
PID:3768 -
\??\c:\rrrxxll.exec:\rrrxxll.exe31⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ddjpp.exec:\ddjpp.exe32⤵
- Executes dropped EXE
PID:4204 -
\??\c:\5bbbbb.exec:\5bbbbb.exe33⤵
- Executes dropped EXE
PID:4540 -
\??\c:\vdvdv.exec:\vdvdv.exe34⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe35⤵
- Executes dropped EXE
PID:736 -
\??\c:\rlrrrll.exec:\rlrrrll.exe36⤵
- Executes dropped EXE
PID:232 -
\??\c:\nnhbhh.exec:\nnhbhh.exe37⤵
- Executes dropped EXE
PID:452 -
\??\c:\jdjjj.exec:\jdjjj.exe38⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rflfrrr.exec:\rflfrrr.exe39⤵
- Executes dropped EXE
PID:4600 -
\??\c:\nthbtt.exec:\nthbtt.exe40⤵
- Executes dropped EXE
PID:3184 -
\??\c:\pddjv.exec:\pddjv.exe41⤵
- Executes dropped EXE
PID:1632 -
\??\c:\frlffll.exec:\frlffll.exe42⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tnbbtb.exec:\tnbbtb.exe43⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ntbbbt.exec:\ntbbbt.exe44⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rllfffl.exec:\rllfffl.exe45⤵
- Executes dropped EXE
PID:4000 -
\??\c:\htnhht.exec:\htnhht.exe46⤵
- Executes dropped EXE
PID:3960 -
\??\c:\pdjjd.exec:\pdjjd.exe47⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jvddv.exec:\jvddv.exe48⤵
- Executes dropped EXE
PID:3292 -
\??\c:\xxrffrr.exec:\xxrffrr.exe49⤵
- Executes dropped EXE
PID:2200 -
\??\c:\llffrff.exec:\llffrff.exe50⤵
- Executes dropped EXE
PID:4872 -
\??\c:\tnnhbb.exec:\tnnhbb.exe51⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pvvdd.exec:\pvvdd.exe52⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dvjdd.exec:\dvjdd.exe53⤵
- Executes dropped EXE
PID:3324 -
\??\c:\7fffxfx.exec:\7fffxfx.exe54⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nnbtbh.exec:\nnbtbh.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hhbbbb.exec:\hhbbbb.exe56⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ppjdv.exec:\ppjdv.exe57⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jppvd.exec:\jppvd.exe58⤵
- Executes dropped EXE
PID:5052 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bntttb.exec:\bntttb.exe60⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nbtntn.exec:\nbtntn.exe61⤵
- Executes dropped EXE
PID:3688 -
\??\c:\dvjvd.exec:\dvjvd.exe62⤵
- Executes dropped EXE
PID:3140 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe63⤵
- Executes dropped EXE
PID:2872 -
\??\c:\frfffxf.exec:\frfffxf.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\1htnnt.exec:\1htnnt.exe65⤵
- Executes dropped EXE
PID:3896 -
\??\c:\ddppv.exec:\ddppv.exe66⤵PID:3328
-
\??\c:\ddvdj.exec:\ddvdj.exe67⤵PID:4132
-
\??\c:\3xxrfff.exec:\3xxrfff.exe68⤵PID:32
-
\??\c:\nbbnhb.exec:\nbbnhb.exe69⤵PID:2696
-
\??\c:\hntttb.exec:\hntttb.exe70⤵PID:3096
-
\??\c:\pppjv.exec:\pppjv.exe71⤵PID:2316
-
\??\c:\llrrrxx.exec:\llrrrxx.exe72⤵PID:4684
-
\??\c:\3rrffll.exec:\3rrffll.exe73⤵PID:2660
-
\??\c:\hntthh.exec:\hntthh.exe74⤵PID:3616
-
\??\c:\btnbbn.exec:\btnbbn.exe75⤵PID:3748
-
\??\c:\vdddd.exec:\vdddd.exe76⤵PID:4984
-
\??\c:\frrllrl.exec:\frrllrl.exe77⤵PID:3524
-
\??\c:\7llfxfx.exec:\7llfxfx.exe78⤵PID:4972
-
\??\c:\bttttt.exec:\bttttt.exe79⤵PID:5072
-
\??\c:\nnbtht.exec:\nnbtht.exe80⤵PID:1588
-
\??\c:\vpppp.exec:\vpppp.exe81⤵PID:3484
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe82⤵PID:4816
-
\??\c:\nhtbhh.exec:\nhtbhh.exe83⤵PID:3768
-
\??\c:\thnttt.exec:\thnttt.exe84⤵PID:5100
-
\??\c:\vjjjj.exec:\vjjjj.exe85⤵PID:4148
-
\??\c:\xlrflrr.exec:\xlrflrr.exe86⤵PID:2280
-
\??\c:\hnnbtn.exec:\hnnbtn.exe87⤵PID:4372
-
\??\c:\vddvp.exec:\vddvp.exe88⤵PID:216
-
\??\c:\vdvdd.exec:\vdvdd.exe89⤵PID:692
-
\??\c:\flfxrrx.exec:\flfxrrx.exe90⤵PID:4948
-
\??\c:\thhnbh.exec:\thhnbh.exe91⤵PID:1172
-
\??\c:\ttnbtn.exec:\ttnbtn.exe92⤵PID:5068
-
\??\c:\jvdvp.exec:\jvdvp.exe93⤵PID:4512
-
\??\c:\frrxlxx.exec:\frrxlxx.exe94⤵PID:1140
-
\??\c:\fxlrlxr.exec:\fxlrlxr.exe95⤵PID:4272
-
\??\c:\thbthb.exec:\thbthb.exe96⤵PID:3444
-
\??\c:\ppvpd.exec:\ppvpd.exe97⤵PID:4348
-
\??\c:\jpdvd.exec:\jpdvd.exe98⤵PID:4520
-
\??\c:\xflrflf.exec:\xflrflf.exe99⤵PID:4484
-
\??\c:\btbhbn.exec:\btbhbn.exe100⤵PID:4436
-
\??\c:\dvddp.exec:\dvddp.exe101⤵PID:4184
-
\??\c:\jjdjp.exec:\jjdjp.exe102⤵PID:3012
-
\??\c:\xfxlffr.exec:\xfxlffr.exe103⤵PID:2204
-
\??\c:\llxfffr.exec:\llxfffr.exe104⤵PID:4488
-
\??\c:\hbttnt.exec:\hbttnt.exe105⤵PID:4892
-
\??\c:\jpjjj.exec:\jpjjj.exe106⤵PID:1628
-
\??\c:\vppjj.exec:\vppjj.exe107⤵PID:4872
-
\??\c:\lllrflf.exec:\lllrflf.exe108⤵PID:3972
-
\??\c:\ffllxxl.exec:\ffllxxl.exe109⤵PID:2592
-
\??\c:\httntb.exec:\httntb.exe110⤵PID:3028
-
\??\c:\jvddd.exec:\jvddd.exe111⤵PID:4564
-
\??\c:\pvdpj.exec:\pvdpj.exe112⤵PID:1364
-
\??\c:\rffxrlr.exec:\rffxrlr.exe113⤵PID:320
-
\??\c:\rxxxrfx.exec:\rxxxrfx.exe114⤵PID:4044
-
\??\c:\bbntbh.exec:\bbntbh.exe115⤵PID:4628
-
\??\c:\dppdv.exec:\dppdv.exe116⤵PID:3188
-
\??\c:\pjjdd.exec:\pjjdd.exe117⤵PID:4392
-
\??\c:\frfrrlr.exec:\frfrrlr.exe118⤵PID:4576
-
\??\c:\hthbnn.exec:\hthbnn.exe119⤵PID:2124
-
\??\c:\jdddd.exec:\jdddd.exe120⤵PID:2208
-
\??\c:\9frrflx.exec:\9frrflx.exe121⤵PID:2008
-
\??\c:\xfllfrf.exec:\xfllfrf.exe122⤵PID:3896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-