Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
276b56bc68499a0f87e0abebdf89b490N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
276b56bc68499a0f87e0abebdf89b490N.exe
-
Size
484KB
-
MD5
276b56bc68499a0f87e0abebdf89b490
-
SHA1
47bc5156d6123cb1cff4ccd64890544ccb4952a3
-
SHA256
ed0861e403c3329f3071cf935abaecaaec5aa078a395314b9b52b6da3c6c4e5b
-
SHA512
710d61b520e40bb9071034da24761779e7ebbeb4c929210b5ff04140c4cdb0be87eb5a0727c0021fcd9b3a1a48ba040c83ec905ab4982d43022e4ca87b0d6742
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjp:q7Tc2NYHUrAwqzc/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4876-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-924-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-1010-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-1709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3800 pjjdv.exe 756 9rlffff.exe 3000 1flfxxr.exe 3612 xflllll.exe 4788 nbbtbt.exe 408 hhhnbb.exe 2224 dvddd.exe 536 hbhbbt.exe 4044 pddjd.exe 3032 xfxrrlf.exe 4380 ntbhhh.exe 4792 hnbtbb.exe 4908 pjddj.exe 2936 3rlfrrr.exe 3044 9nnnhh.exe 400 bthbtt.exe 1604 jjjdv.exe 4884 rxffxrr.exe 5052 hhbtth.exe 1936 jvdvv.exe 2360 xlxllfx.exe 4332 1rrlffx.exe 3424 bnhbtt.exe 2000 3pvpj.exe 1432 vjjvv.exe 2344 5rlfxxr.exe 2512 7vddv.exe 3696 tnhhbb.exe 3060 lfllrrx.exe 3988 1hnhtn.exe 3688 3vppp.exe 4348 frrlffx.exe 4876 jvvpp.exe 2132 flxxxxf.exe 4480 nthhhb.exe 3972 5jppp.exe 1908 3vvpp.exe 3076 fxfxrrr.exe 4212 nbhbtn.exe 3524 pjdjj.exe 1312 dpvpj.exe 3108 9rrlffx.exe 2200 bbhbbt.exe 4864 pjjpp.exe 2708 9xxrlll.exe 3168 bhnhbn.exe 2356 3pjjj.exe 5048 ddpjp.exe 4792 5nhbnh.exe 2236 vdjdv.exe 3320 vjvpj.exe 3496 rxfxrll.exe 3924 7tnntt.exe 400 jvdpp.exe 3316 vjvvp.exe 4516 xlrrlll.exe 2912 tthhbb.exe 556 1jjjj.exe 3572 xrrrrrr.exe 1616 1tnbtn.exe 3188 pvjjd.exe 4580 flllfll.exe 796 lxfrllf.exe 4644 1tbtnh.exe -
resource yara_rule behavioral2/memory/4876-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-446-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 3800 4876 276b56bc68499a0f87e0abebdf89b490N.exe 84 PID 4876 wrote to memory of 3800 4876 276b56bc68499a0f87e0abebdf89b490N.exe 84 PID 4876 wrote to memory of 3800 4876 276b56bc68499a0f87e0abebdf89b490N.exe 84 PID 3800 wrote to memory of 756 3800 pjjdv.exe 85 PID 3800 wrote to memory of 756 3800 pjjdv.exe 85 PID 3800 wrote to memory of 756 3800 pjjdv.exe 85 PID 756 wrote to memory of 3000 756 9rlffff.exe 86 PID 756 wrote to memory of 3000 756 9rlffff.exe 86 PID 756 wrote to memory of 3000 756 9rlffff.exe 86 PID 3000 wrote to memory of 3612 3000 1flfxxr.exe 87 PID 3000 wrote to memory of 3612 3000 1flfxxr.exe 87 PID 3000 wrote to memory of 3612 3000 1flfxxr.exe 87 PID 3612 wrote to memory of 4788 3612 xflllll.exe 89 PID 3612 wrote to memory of 4788 3612 xflllll.exe 89 PID 3612 wrote to memory of 4788 3612 xflllll.exe 89 PID 4788 wrote to memory of 408 4788 nbbtbt.exe 90 PID 4788 wrote to memory of 408 4788 nbbtbt.exe 90 PID 4788 wrote to memory of 408 4788 nbbtbt.exe 90 PID 408 wrote to memory of 2224 408 hhhnbb.exe 92 PID 408 wrote to memory of 2224 408 hhhnbb.exe 92 PID 408 wrote to memory of 2224 408 hhhnbb.exe 92 PID 2224 wrote to memory of 536 2224 dvddd.exe 93 PID 2224 wrote to memory of 536 2224 dvddd.exe 93 PID 2224 wrote to memory of 536 2224 dvddd.exe 93 PID 536 wrote to memory of 4044 536 hbhbbt.exe 94 PID 536 wrote to memory of 4044 536 hbhbbt.exe 94 PID 536 wrote to memory of 4044 536 hbhbbt.exe 94 PID 4044 wrote to memory of 3032 4044 pddjd.exe 95 PID 4044 wrote to memory of 3032 4044 pddjd.exe 95 PID 4044 wrote to memory of 3032 4044 pddjd.exe 95 PID 3032 wrote to memory of 4380 3032 xfxrrlf.exe 96 PID 3032 wrote to memory of 4380 3032 xfxrrlf.exe 96 PID 3032 wrote to memory of 4380 3032 xfxrrlf.exe 96 PID 4380 wrote to memory of 4792 4380 ntbhhh.exe 97 PID 4380 wrote to memory of 4792 4380 ntbhhh.exe 97 PID 4380 wrote to memory of 4792 4380 ntbhhh.exe 97 PID 4792 wrote to memory of 4908 4792 hnbtbb.exe 98 PID 4792 wrote to memory of 4908 4792 hnbtbb.exe 98 PID 4792 wrote to memory of 4908 4792 hnbtbb.exe 98 PID 4908 wrote to memory of 2936 4908 pjddj.exe 99 PID 4908 wrote to memory of 2936 4908 pjddj.exe 99 PID 4908 wrote to memory of 2936 4908 pjddj.exe 99 PID 2936 wrote to memory of 3044 2936 3rlfrrr.exe 100 PID 2936 wrote to memory of 3044 2936 3rlfrrr.exe 100 PID 2936 wrote to memory of 3044 2936 3rlfrrr.exe 100 PID 3044 wrote to memory of 400 3044 9nnnhh.exe 101 PID 3044 wrote to memory of 400 3044 9nnnhh.exe 101 PID 3044 wrote to memory of 400 3044 9nnnhh.exe 101 PID 400 wrote to memory of 1604 400 bthbtt.exe 102 PID 400 wrote to memory of 1604 400 bthbtt.exe 102 PID 400 wrote to memory of 1604 400 bthbtt.exe 102 PID 1604 wrote to memory of 4884 1604 jjjdv.exe 103 PID 1604 wrote to memory of 4884 1604 jjjdv.exe 103 PID 1604 wrote to memory of 4884 1604 jjjdv.exe 103 PID 4884 wrote to memory of 5052 4884 rxffxrr.exe 104 PID 4884 wrote to memory of 5052 4884 rxffxrr.exe 104 PID 4884 wrote to memory of 5052 4884 rxffxrr.exe 104 PID 5052 wrote to memory of 1936 5052 hhbtth.exe 105 PID 5052 wrote to memory of 1936 5052 hhbtth.exe 105 PID 5052 wrote to memory of 1936 5052 hhbtth.exe 105 PID 1936 wrote to memory of 2360 1936 jvdvv.exe 106 PID 1936 wrote to memory of 2360 1936 jvdvv.exe 106 PID 1936 wrote to memory of 2360 1936 jvdvv.exe 106 PID 2360 wrote to memory of 4332 2360 xlxllfx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\276b56bc68499a0f87e0abebdf89b490N.exe"C:\Users\Admin\AppData\Local\Temp\276b56bc68499a0f87e0abebdf89b490N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\pjjdv.exec:\pjjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\9rlffff.exec:\9rlffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\1flfxxr.exec:\1flfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xflllll.exec:\xflllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\nbbtbt.exec:\nbbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\hhhnbb.exec:\hhhnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\dvddd.exec:\dvddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\hbhbbt.exec:\hbhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\pddjd.exec:\pddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\xfxrrlf.exec:\xfxrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ntbhhh.exec:\ntbhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\hnbtbb.exec:\hnbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\pjddj.exec:\pjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\3rlfrrr.exec:\3rlfrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\9nnnhh.exec:\9nnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\bthbtt.exec:\bthbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\jjjdv.exec:\jjjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rxffxrr.exec:\rxffxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\hhbtth.exec:\hhbtth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\jvdvv.exec:\jvdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xlxllfx.exec:\xlxllfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\1rrlffx.exec:\1rrlffx.exe23⤵
- Executes dropped EXE
PID:4332 -
\??\c:\bnhbtt.exec:\bnhbtt.exe24⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3pvpj.exec:\3pvpj.exe25⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjjvv.exec:\vjjvv.exe26⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5rlfxxr.exec:\5rlfxxr.exe27⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7vddv.exec:\7vddv.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tnhhbb.exec:\tnhhbb.exe29⤵
- Executes dropped EXE
PID:3696 -
\??\c:\lfllrrx.exec:\lfllrrx.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1hnhtn.exec:\1hnhtn.exe31⤵
- Executes dropped EXE
PID:3988 -
\??\c:\3vppp.exec:\3vppp.exe32⤵
- Executes dropped EXE
PID:3688 -
\??\c:\frrlffx.exec:\frrlffx.exe33⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jvvpp.exec:\jvvpp.exe34⤵
- Executes dropped EXE
PID:4876 -
\??\c:\flxxxxf.exec:\flxxxxf.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nthhhb.exec:\nthhhb.exe36⤵
- Executes dropped EXE
PID:4480 -
\??\c:\5jppp.exec:\5jppp.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\3vvpp.exec:\3vvpp.exe38⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe39⤵
- Executes dropped EXE
PID:3076 -
\??\c:\nbhbtn.exec:\nbhbtn.exe40⤵
- Executes dropped EXE
PID:4212 -
\??\c:\pjdjj.exec:\pjdjj.exe41⤵
- Executes dropped EXE
PID:3524 -
\??\c:\dpvpj.exec:\dpvpj.exe42⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9rrlffx.exec:\9rrlffx.exe43⤵
- Executes dropped EXE
PID:3108 -
\??\c:\bbhbbt.exec:\bbhbbt.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjjpp.exec:\pjjpp.exe45⤵
- Executes dropped EXE
PID:4864 -
\??\c:\9xxrlll.exec:\9xxrlll.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bhnhbn.exec:\bhnhbn.exe47⤵
- Executes dropped EXE
PID:3168 -
\??\c:\3pjjj.exec:\3pjjj.exe48⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ddpjp.exec:\ddpjp.exe49⤵
- Executes dropped EXE
PID:5048 -
\??\c:\5nhbnh.exec:\5nhbnh.exe50⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vdjdv.exec:\vdjdv.exe51⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjvpj.exec:\vjvpj.exe52⤵
- Executes dropped EXE
PID:3320 -
\??\c:\rxfxrll.exec:\rxfxrll.exe53⤵
- Executes dropped EXE
PID:3496 -
\??\c:\7tnntt.exec:\7tnntt.exe54⤵
- Executes dropped EXE
PID:3924 -
\??\c:\jvdpp.exec:\jvdpp.exe55⤵
- Executes dropped EXE
PID:400 -
\??\c:\vjvvp.exec:\vjvvp.exe56⤵
- Executes dropped EXE
PID:3316 -
\??\c:\xlrrlll.exec:\xlrrlll.exe57⤵
- Executes dropped EXE
PID:4516 -
\??\c:\tthhbb.exec:\tthhbb.exe58⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1jjjj.exec:\1jjjj.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe60⤵
- Executes dropped EXE
PID:3572 -
\??\c:\1tnbtn.exec:\1tnbtn.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pvjjd.exec:\pvjjd.exe62⤵
- Executes dropped EXE
PID:3188 -
\??\c:\flllfll.exec:\flllfll.exe63⤵
- Executes dropped EXE
PID:4580 -
\??\c:\lxfrllf.exec:\lxfrllf.exe64⤵
- Executes dropped EXE
PID:796 -
\??\c:\1tbtnh.exec:\1tbtnh.exe65⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vpppp.exec:\vpppp.exe66⤵PID:3424
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe67⤵PID:2684
-
\??\c:\nbbbbb.exec:\nbbbbb.exe68⤵PID:5104
-
\??\c:\httnnn.exec:\httnnn.exe69⤵PID:3204
-
\??\c:\5djjj.exec:\5djjj.exe70⤵PID:4936
-
\??\c:\5fxxrxr.exec:\5fxxrxr.exe71⤵PID:1664
-
\??\c:\tnttnn.exec:\tnttnn.exe72⤵PID:4068
-
\??\c:\jdvpd.exec:\jdvpd.exe73⤵PID:4392
-
\??\c:\7fllffx.exec:\7fllffx.exe74⤵PID:3216
-
\??\c:\3nnnhh.exec:\3nnnhh.exe75⤵PID:3060
-
\??\c:\lflfffl.exec:\lflfffl.exe76⤵PID:1680
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe77⤵PID:4312
-
\??\c:\7hnhnn.exec:\7hnhnn.exe78⤵PID:4260
-
\??\c:\9vvvp.exec:\9vvvp.exe79⤵PID:848
-
\??\c:\1lrfxll.exec:\1lrfxll.exe80⤵PID:3240
-
\??\c:\1tnnbn.exec:\1tnnbn.exe81⤵PID:4348
-
\??\c:\7dvvp.exec:\7dvvp.exe82⤵PID:456
-
\??\c:\1lrrlff.exec:\1lrrlff.exe83⤵PID:3448
-
\??\c:\hbhtnn.exec:\hbhtnn.exe84⤵PID:2016
-
\??\c:\nhnntn.exec:\nhnntn.exe85⤵PID:2468
-
\??\c:\vjpjp.exec:\vjpjp.exe86⤵PID:3560
-
\??\c:\lrxxxll.exec:\lrxxxll.exe87⤵PID:1908
-
\??\c:\1hnhbb.exec:\1hnhbb.exe88⤵PID:2956
-
\??\c:\vjpjj.exec:\vjpjj.exe89⤵PID:1380
-
\??\c:\vdjpj.exec:\vdjpj.exe90⤵PID:1484
-
\??\c:\xlllfff.exec:\xlllfff.exe91⤵PID:1808
-
\??\c:\bthttn.exec:\bthttn.exe92⤵PID:4700
-
\??\c:\jvdvd.exec:\jvdvd.exe93⤵PID:408
-
\??\c:\lxrfxlf.exec:\lxrfxlf.exe94⤵PID:3192
-
\??\c:\xrllfff.exec:\xrllfff.exe95⤵PID:4864
-
\??\c:\3hnbnb.exec:\3hnbnb.exe96⤵PID:3540
-
\??\c:\jjpjd.exec:\jjpjd.exe97⤵PID:2724
-
\??\c:\fffxxxr.exec:\fffxxxr.exe98⤵PID:4648
-
\??\c:\rlllrrx.exec:\rlllrrx.exe99⤵PID:2356
-
\??\c:\bttntt.exec:\bttntt.exe100⤵PID:4116
-
\??\c:\vjjvd.exec:\vjjvd.exe101⤵PID:2288
-
\??\c:\rllffxx.exec:\rllffxx.exe102⤵PID:968
-
\??\c:\thhbtn.exec:\thhbtn.exe103⤵PID:4716
-
\??\c:\nnbttn.exec:\nnbttn.exe104⤵PID:1912
-
\??\c:\dpvjd.exec:\dpvjd.exe105⤵PID:2124
-
\??\c:\fxlfrfl.exec:\fxlfrfl.exe106⤵PID:3304
-
\??\c:\bbbbhh.exec:\bbbbhh.exe107⤵PID:368
-
\??\c:\nhhbnn.exec:\nhhbnn.exe108⤵PID:3316
-
\??\c:\pddvp.exec:\pddvp.exe109⤵PID:4516
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe110⤵PID:464
-
\??\c:\tbbbtn.exec:\tbbbtn.exe111⤵PID:1212
-
\??\c:\jdddv.exec:\jdddv.exe112⤵PID:1936
-
\??\c:\7xrfxrf.exec:\7xrfxrf.exe113⤵PID:3536
-
\??\c:\nbhbbt.exec:\nbhbbt.exe114⤵PID:2360
-
\??\c:\tbnhnn.exec:\tbnhnn.exe115⤵PID:4740
-
\??\c:\vjpvj.exec:\vjpvj.exe116⤵PID:2192
-
\??\c:\rlrlffx.exec:\rlrlffx.exe117⤵PID:3836
-
\??\c:\5rrrlxr.exec:\5rrrlxr.exe118⤵PID:2628
-
\??\c:\btnhbt.exec:\btnhbt.exe119⤵PID:3424
-
\??\c:\vppjj.exec:\vppjj.exe120⤵PID:3732
-
\??\c:\djppj.exec:\djppj.exe121⤵PID:5104
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe122⤵PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-