Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe
-
Size
426KB
-
MD5
d68b78b7fa425e8966260f9eeeedaeb7
-
SHA1
078f8bc60697729d2cb1edadb6d83930dc965d82
-
SHA256
58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8
-
SHA512
cc805fa98ec6ad192fe01333108757bda3a284cb53cde75f3a227e06e3b07814453b44401e01770a832c43460fe8be4a4214b54c45b81e4a4893b34da75c5145
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1BxI21xQo:Pcm7ImGddXtWrXD486jJq1BSq
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3888-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-428-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-574-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-655-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-685-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-817-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-836-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-1076-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-1260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3888 m0048.exe 2308 rlllrxx.exe 4980 vdvpd.exe 5100 2844862.exe 4928 64200.exe 3356 pvjdv.exe 4316 0660404.exe 1228 2864442.exe 3524 48088.exe 3020 600860.exe 4540 vpddv.exe 3536 hthhhn.exe 3636 lxffxxx.exe 5044 xlxrrrl.exe 3116 rfrrlrl.exe 4636 fffffff.exe 2364 hbhbbt.exe 4608 8864640.exe 3252 tbnhbt.exe 3876 6686802.exe 4396 jpjjj.exe 3952 ppvpv.exe 1936 w02228.exe 1464 280000.exe 4152 420448.exe 3980 q84022.exe 1300 lllrrlr.exe 3576 ppdjd.exe 3828 6880444.exe 4772 llrrrff.exe 2192 frffxff.exe 3652 1vvpp.exe 4200 80608.exe 4592 8046466.exe 1488 044484.exe 1772 frlrrrr.exe 1724 88626.exe 3776 dvddd.exe 4832 ffrrrll.exe 3484 224428.exe 3824 xxrrrxx.exe 3860 80086.exe 4048 484262.exe 408 e62048.exe 548 pjjjj.exe 736 ttbtbn.exe 4408 7xxrlll.exe 216 e44826.exe 3124 i242822.exe 5096 84088.exe 1456 fxfxrlf.exe 1556 jddpj.exe 3620 824082.exe 3056 xflfrlx.exe 3176 o060486.exe 2696 ppjdp.exe 2216 ntbnhh.exe 2624 nbbbtn.exe 1480 rlrlfrr.exe 2868 lrrfxxr.exe 1124 o226042.exe 4844 46202.exe 960 068460.exe 1212 jppjp.exe -
resource yara_rule behavioral2/memory/3888-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-460-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-464-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-481-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 3888 4712 58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe 84 PID 4712 wrote to memory of 3888 4712 58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe 84 PID 4712 wrote to memory of 3888 4712 58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe 84 PID 3888 wrote to memory of 2308 3888 m0048.exe 85 PID 3888 wrote to memory of 2308 3888 m0048.exe 85 PID 3888 wrote to memory of 2308 3888 m0048.exe 85 PID 2308 wrote to memory of 4980 2308 rlllrxx.exe 86 PID 2308 wrote to memory of 4980 2308 rlllrxx.exe 86 PID 2308 wrote to memory of 4980 2308 rlllrxx.exe 86 PID 4980 wrote to memory of 5100 4980 vdvpd.exe 87 PID 4980 wrote to memory of 5100 4980 vdvpd.exe 87 PID 4980 wrote to memory of 5100 4980 vdvpd.exe 87 PID 5100 wrote to memory of 4928 5100 2844862.exe 88 PID 5100 wrote to memory of 4928 5100 2844862.exe 88 PID 5100 wrote to memory of 4928 5100 2844862.exe 88 PID 4928 wrote to memory of 3356 4928 64200.exe 89 PID 4928 wrote to memory of 3356 4928 64200.exe 89 PID 4928 wrote to memory of 3356 4928 64200.exe 89 PID 3356 wrote to memory of 4316 3356 pvjdv.exe 90 PID 3356 wrote to memory of 4316 3356 pvjdv.exe 90 PID 3356 wrote to memory of 4316 3356 pvjdv.exe 90 PID 4316 wrote to memory of 1228 4316 0660404.exe 91 PID 4316 wrote to memory of 1228 4316 0660404.exe 91 PID 4316 wrote to memory of 1228 4316 0660404.exe 91 PID 1228 wrote to memory of 3524 1228 2864442.exe 92 PID 1228 wrote to memory of 3524 1228 2864442.exe 92 PID 1228 wrote to memory of 3524 1228 2864442.exe 92 PID 3524 wrote to memory of 3020 3524 48088.exe 93 PID 3524 wrote to memory of 3020 3524 48088.exe 93 PID 3524 wrote to memory of 3020 3524 48088.exe 93 PID 3020 wrote to memory of 4540 3020 600860.exe 150 PID 3020 wrote to memory of 4540 3020 600860.exe 150 PID 3020 wrote to memory of 4540 3020 600860.exe 150 PID 4540 wrote to memory of 3536 4540 vpddv.exe 95 PID 4540 wrote to memory of 3536 4540 vpddv.exe 95 PID 4540 wrote to memory of 3536 4540 vpddv.exe 95 PID 3536 wrote to memory of 3636 3536 hthhhn.exe 96 PID 3536 wrote to memory of 3636 3536 hthhhn.exe 96 PID 3536 wrote to memory of 3636 3536 hthhhn.exe 96 PID 3636 wrote to memory of 5044 3636 lxffxxx.exe 97 PID 3636 wrote to memory of 5044 3636 lxffxxx.exe 97 PID 3636 wrote to memory of 5044 3636 lxffxxx.exe 97 PID 5044 wrote to memory of 3116 5044 xlxrrrl.exe 98 PID 5044 wrote to memory of 3116 5044 xlxrrrl.exe 98 PID 5044 wrote to memory of 3116 5044 xlxrrrl.exe 98 PID 3116 wrote to memory of 4636 3116 rfrrlrl.exe 99 PID 3116 wrote to memory of 4636 3116 rfrrlrl.exe 99 PID 3116 wrote to memory of 4636 3116 rfrrlrl.exe 99 PID 4636 wrote to memory of 2364 4636 fffffff.exe 100 PID 4636 wrote to memory of 2364 4636 fffffff.exe 100 PID 4636 wrote to memory of 2364 4636 fffffff.exe 100 PID 2364 wrote to memory of 4608 2364 hbhbbt.exe 101 PID 2364 wrote to memory of 4608 2364 hbhbbt.exe 101 PID 2364 wrote to memory of 4608 2364 hbhbbt.exe 101 PID 4608 wrote to memory of 3252 4608 8864640.exe 102 PID 4608 wrote to memory of 3252 4608 8864640.exe 102 PID 4608 wrote to memory of 3252 4608 8864640.exe 102 PID 3252 wrote to memory of 3876 3252 tbnhbt.exe 103 PID 3252 wrote to memory of 3876 3252 tbnhbt.exe 103 PID 3252 wrote to memory of 3876 3252 tbnhbt.exe 103 PID 3876 wrote to memory of 4396 3876 6686802.exe 104 PID 3876 wrote to memory of 4396 3876 6686802.exe 104 PID 3876 wrote to memory of 4396 3876 6686802.exe 104 PID 4396 wrote to memory of 3952 4396 jpjjj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe"C:\Users\Admin\AppData\Local\Temp\58b830b1c8059030253dc759f738d5e4bf799a04f258766a574eabd4c870cfd8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\m0048.exec:\m0048.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\rlllrxx.exec:\rlllrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\vdvpd.exec:\vdvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\2844862.exec:\2844862.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\64200.exec:\64200.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\pvjdv.exec:\pvjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\0660404.exec:\0660404.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\2864442.exec:\2864442.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\48088.exec:\48088.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\600860.exec:\600860.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vpddv.exec:\vpddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\hthhhn.exec:\hthhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\lxffxxx.exec:\lxffxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\fffffff.exec:\fffffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\hbhbbt.exec:\hbhbbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\8864640.exec:\8864640.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\tbnhbt.exec:\tbnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\6686802.exec:\6686802.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\jpjjj.exec:\jpjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\ppvpv.exec:\ppvpv.exe23⤵
- Executes dropped EXE
PID:3952 -
\??\c:\w02228.exec:\w02228.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\280000.exec:\280000.exe25⤵
- Executes dropped EXE
PID:1464 -
\??\c:\420448.exec:\420448.exe26⤵
- Executes dropped EXE
PID:4152 -
\??\c:\q84022.exec:\q84022.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\lllrrlr.exec:\lllrrlr.exe28⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ppdjd.exec:\ppdjd.exe29⤵
- Executes dropped EXE
PID:3576 -
\??\c:\6880444.exec:\6880444.exe30⤵
- Executes dropped EXE
PID:3828 -
\??\c:\llrrrff.exec:\llrrrff.exe31⤵
- Executes dropped EXE
PID:4772 -
\??\c:\frffxff.exec:\frffxff.exe32⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1vvpp.exec:\1vvpp.exe33⤵
- Executes dropped EXE
PID:3652 -
\??\c:\80608.exec:\80608.exe34⤵
- Executes dropped EXE
PID:4200 -
\??\c:\8046466.exec:\8046466.exe35⤵
- Executes dropped EXE
PID:4592 -
\??\c:\044484.exec:\044484.exe36⤵
- Executes dropped EXE
PID:1488 -
\??\c:\frlrrrr.exec:\frlrrrr.exe37⤵
- Executes dropped EXE
PID:1772 -
\??\c:\88626.exec:\88626.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvddd.exec:\dvddd.exe39⤵
- Executes dropped EXE
PID:3776 -
\??\c:\ffrrrll.exec:\ffrrrll.exe40⤵
- Executes dropped EXE
PID:4832 -
\??\c:\224428.exec:\224428.exe41⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe42⤵
- Executes dropped EXE
PID:3824 -
\??\c:\80086.exec:\80086.exe43⤵
- Executes dropped EXE
PID:3860 -
\??\c:\484262.exec:\484262.exe44⤵
- Executes dropped EXE
PID:4048 -
\??\c:\e62048.exec:\e62048.exe45⤵
- Executes dropped EXE
PID:408 -
\??\c:\pjjjj.exec:\pjjjj.exe46⤵
- Executes dropped EXE
PID:548 -
\??\c:\ttbtbn.exec:\ttbtbn.exe47⤵
- Executes dropped EXE
PID:736 -
\??\c:\7xxrlll.exec:\7xxrlll.exe48⤵
- Executes dropped EXE
PID:4408 -
\??\c:\e44826.exec:\e44826.exe49⤵
- Executes dropped EXE
PID:216 -
\??\c:\i242822.exec:\i242822.exe50⤵
- Executes dropped EXE
PID:3124 -
\??\c:\84088.exec:\84088.exe51⤵
- Executes dropped EXE
PID:5096 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe52⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jddpj.exec:\jddpj.exe53⤵
- Executes dropped EXE
PID:1556 -
\??\c:\824082.exec:\824082.exe54⤵
- Executes dropped EXE
PID:3620 -
\??\c:\xflfrlx.exec:\xflfrlx.exe55⤵
- Executes dropped EXE
PID:3056 -
\??\c:\o060486.exec:\o060486.exe56⤵
- Executes dropped EXE
PID:3176 -
\??\c:\ppjdp.exec:\ppjdp.exe57⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ntbnhh.exec:\ntbnhh.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nbbbtn.exec:\nbbbtn.exe59⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlrlfrr.exec:\rlrlfrr.exe60⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lrrfxxr.exec:\lrrfxxr.exe61⤵
- Executes dropped EXE
PID:2868 -
\??\c:\o226042.exec:\o226042.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\46202.exec:\46202.exe63⤵
- Executes dropped EXE
PID:4844 -
\??\c:\068460.exec:\068460.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\jppjp.exec:\jppjp.exe65⤵
- Executes dropped EXE
PID:1212 -
\??\c:\4246482.exec:\4246482.exe66⤵PID:3972
-
\??\c:\rlrrrll.exec:\rlrrrll.exe67⤵PID:3020
-
\??\c:\thnnbt.exec:\thnnbt.exe68⤵PID:4540
-
\??\c:\pvvpj.exec:\pvvpj.exe69⤵PID:1864
-
\??\c:\ntnbhh.exec:\ntnbhh.exe70⤵PID:2664
-
\??\c:\rfxrllf.exec:\rfxrllf.exe71⤵PID:2792
-
\??\c:\06884.exec:\06884.exe72⤵PID:1860
-
\??\c:\802280.exec:\802280.exe73⤵PID:1420
-
\??\c:\dppdv.exec:\dppdv.exe74⤵PID:3016
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe75⤵PID:4608
-
\??\c:\hntnnh.exec:\hntnnh.exe76⤵PID:3640
-
\??\c:\k48248.exec:\k48248.exe77⤵PID:3464
-
\??\c:\xlffrrr.exec:\xlffrrr.exe78⤵PID:2692
-
\??\c:\k24204.exec:\k24204.exe79⤵PID:456
-
\??\c:\vpvpj.exec:\vpvpj.exe80⤵PID:1464
-
\??\c:\480400.exec:\480400.exe81⤵PID:4152
-
\??\c:\q28662.exec:\q28662.exe82⤵PID:3980
-
\??\c:\xxxrlll.exec:\xxxrlll.exe83⤵PID:3608
-
\??\c:\rfxfxrx.exec:\rfxfxrx.exe84⤵PID:936
-
\??\c:\2484662.exec:\2484662.exe85⤵PID:3212
-
\??\c:\204202.exec:\204202.exe86⤵PID:3604
-
\??\c:\824482.exec:\824482.exe87⤵PID:4808
-
\??\c:\ddjjd.exec:\ddjjd.exe88⤵PID:1184
-
\??\c:\hhhbbt.exec:\hhhbbt.exe89⤵PID:2036
-
\??\c:\24282.exec:\24282.exe90⤵PID:4516
-
\??\c:\g6266.exec:\g6266.exe91⤵PID:3776
-
\??\c:\nhbtbt.exec:\nhbtbt.exe92⤵PID:4384
-
\??\c:\frrlflf.exec:\frrlflf.exe93⤵PID:2484
-
\??\c:\frxrlfx.exec:\frxrlfx.exe94⤵PID:1828
-
\??\c:\46868.exec:\46868.exe95⤵PID:3860
-
\??\c:\06406.exec:\06406.exe96⤵PID:1288
-
\??\c:\042662.exec:\042662.exe97⤵PID:548
-
\??\c:\lflfffl.exec:\lflfffl.exe98⤵PID:1924
-
\??\c:\o026488.exec:\o026488.exe99⤵PID:2172
-
\??\c:\04448.exec:\04448.exe100⤵PID:2592
-
\??\c:\3llxxfx.exec:\3llxxfx.exe101⤵PID:3124
-
\??\c:\062266.exec:\062266.exe102⤵PID:1456
-
\??\c:\822488.exec:\822488.exe103⤵PID:552
-
\??\c:\jdvjp.exec:\jdvjp.exe104⤵PID:1556
-
\??\c:\bbbnbt.exec:\bbbnbt.exe105⤵PID:5072
-
\??\c:\o400880.exec:\o400880.exe106⤵PID:1012
-
\??\c:\vvpdj.exec:\vvpdj.exe107⤵PID:5104
-
\??\c:\flflrrx.exec:\flflrrx.exe108⤵PID:3912
-
\??\c:\82202.exec:\82202.exe109⤵PID:4168
-
\??\c:\664026.exec:\664026.exe110⤵PID:416
-
\??\c:\thnbbb.exec:\thnbbb.exe111⤵PID:960
-
\??\c:\00660.exec:\00660.exe112⤵PID:5040
-
\??\c:\lflfxxx.exec:\lflfxxx.exe113⤵PID:1476
-
\??\c:\02488.exec:\02488.exe114⤵PID:4020
-
\??\c:\8022224.exec:\8022224.exe115⤵PID:3020
-
\??\c:\w40488.exec:\w40488.exe116⤵PID:4316
-
\??\c:\0622222.exec:\0622222.exe117⤵PID:3696
-
\??\c:\46004.exec:\46004.exe118⤵PID:2792
-
\??\c:\622266.exec:\622266.exe119⤵PID:3504
-
\??\c:\g4400.exec:\g4400.exe120⤵PID:1824
-
\??\c:\1bbnbh.exec:\1bbnbh.exe121⤵PID:4212
-
\??\c:\226846.exec:\226846.exe122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-