Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8d32d58c62504ec10559113f782eb50N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
b8d32d58c62504ec10559113f782eb50N.exe
-
Size
523KB
-
MD5
b8d32d58c62504ec10559113f782eb50
-
SHA1
9134085e8e84199b23aad8189dbf6d125143172b
-
SHA256
bfeeee3d2737f117e68db46600b416614c6217759c6bb383fcafbfc6fecab355
-
SHA512
94dff61181a2c84dd9ceb6f99b24c9c1d8a8c09b11b222f41dfcfd53746ded28ffc856817d80ca288457f3f9a5779d98d0fd3ab9e33e831b14f9536bd6cd0269
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3x+v:q7Tc2NYHUrAwfMHNnpls4894v
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3596-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-854-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-917-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-1032-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-1194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3596 rfllxll.exe 3348 7bhthb.exe 4788 bntttb.exe 4036 pdvdv.exe 1652 3ffxxxx.exe 2860 frxxfff.exe 2452 tbtttt.exe 776 ddvpv.exe 3544 3frllrx.exe 2184 rlfffrr.exe 4160 jdpdj.exe 4888 lffxffl.exe 1072 jjpjj.exe 2756 bbbhbh.exe 1164 lxlllll.exe 5028 lxflrrx.exe 4976 jpdvv.exe 5112 llllffr.exe 2240 bbbhnb.exe 2120 dvvjj.exe 3624 lxfxxfl.exe 3076 tnbbbb.exe 404 pvjjv.exe 4672 bbnnhh.exe 3320 jdppd.exe 2248 lxffxrl.exe 3180 dpdjj.exe 396 bnnnhh.exe 2236 bntttb.exe 224 vvdvd.exe 848 lxxfrfx.exe 4804 ppddj.exe 1368 ppddd.exe 4248 nbbbbb.exe 3288 ddpjj.exe 1472 rrrrlll.exe 3516 nhnnnn.exe 4412 flflflr.exe 3596 bbnthn.exe 4996 pvppd.exe 3124 rfrrrll.exe 4920 9vddd.exe 3944 1tttbb.exe 2028 hhtbtt.exe 2460 lrrlxrr.exe 8 tnbbtb.exe 4024 rflffrl.exe 2628 rxfxrrx.exe 5108 djjjd.exe 1732 lfrxxxf.exe 1104 tnnhnn.exe 4612 fflffff.exe 4052 tbhhhh.exe 1560 ddppp.exe 4160 flxxxrf.exe 4896 tntttt.exe 3684 tbhbbb.exe 1600 pjvvv.exe 3940 lxrrxxx.exe 4236 hntbbb.exe 1920 vvdvp.exe 3900 rrlrrxr.exe 2152 7hnnhh.exe 3988 nhhtnb.exe -
resource yara_rule behavioral2/memory/3596-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-612-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 3596 4412 b8d32d58c62504ec10559113f782eb50N.exe 84 PID 4412 wrote to memory of 3596 4412 b8d32d58c62504ec10559113f782eb50N.exe 84 PID 4412 wrote to memory of 3596 4412 b8d32d58c62504ec10559113f782eb50N.exe 84 PID 3596 wrote to memory of 3348 3596 rfllxll.exe 85 PID 3596 wrote to memory of 3348 3596 rfllxll.exe 85 PID 3596 wrote to memory of 3348 3596 rfllxll.exe 85 PID 3348 wrote to memory of 4788 3348 7bhthb.exe 86 PID 3348 wrote to memory of 4788 3348 7bhthb.exe 86 PID 3348 wrote to memory of 4788 3348 7bhthb.exe 86 PID 4788 wrote to memory of 4036 4788 bntttb.exe 87 PID 4788 wrote to memory of 4036 4788 bntttb.exe 87 PID 4788 wrote to memory of 4036 4788 bntttb.exe 87 PID 4036 wrote to memory of 1652 4036 pdvdv.exe 90 PID 4036 wrote to memory of 1652 4036 pdvdv.exe 90 PID 4036 wrote to memory of 1652 4036 pdvdv.exe 90 PID 1652 wrote to memory of 2860 1652 3ffxxxx.exe 91 PID 1652 wrote to memory of 2860 1652 3ffxxxx.exe 91 PID 1652 wrote to memory of 2860 1652 3ffxxxx.exe 91 PID 2860 wrote to memory of 2452 2860 frxxfff.exe 92 PID 2860 wrote to memory of 2452 2860 frxxfff.exe 92 PID 2860 wrote to memory of 2452 2860 frxxfff.exe 92 PID 2452 wrote to memory of 776 2452 tbtttt.exe 93 PID 2452 wrote to memory of 776 2452 tbtttt.exe 93 PID 2452 wrote to memory of 776 2452 tbtttt.exe 93 PID 776 wrote to memory of 3544 776 ddvpv.exe 95 PID 776 wrote to memory of 3544 776 ddvpv.exe 95 PID 776 wrote to memory of 3544 776 ddvpv.exe 95 PID 3544 wrote to memory of 2184 3544 3frllrx.exe 96 PID 3544 wrote to memory of 2184 3544 3frllrx.exe 96 PID 3544 wrote to memory of 2184 3544 3frllrx.exe 96 PID 2184 wrote to memory of 4160 2184 rlfffrr.exe 97 PID 2184 wrote to memory of 4160 2184 rlfffrr.exe 97 PID 2184 wrote to memory of 4160 2184 rlfffrr.exe 97 PID 4160 wrote to memory of 4888 4160 jdpdj.exe 98 PID 4160 wrote to memory of 4888 4160 jdpdj.exe 98 PID 4160 wrote to memory of 4888 4160 jdpdj.exe 98 PID 4888 wrote to memory of 1072 4888 lffxffl.exe 99 PID 4888 wrote to memory of 1072 4888 lffxffl.exe 99 PID 4888 wrote to memory of 1072 4888 lffxffl.exe 99 PID 1072 wrote to memory of 2756 1072 jjpjj.exe 100 PID 1072 wrote to memory of 2756 1072 jjpjj.exe 100 PID 1072 wrote to memory of 2756 1072 jjpjj.exe 100 PID 2756 wrote to memory of 1164 2756 bbbhbh.exe 101 PID 2756 wrote to memory of 1164 2756 bbbhbh.exe 101 PID 2756 wrote to memory of 1164 2756 bbbhbh.exe 101 PID 1164 wrote to memory of 5028 1164 lxlllll.exe 102 PID 1164 wrote to memory of 5028 1164 lxlllll.exe 102 PID 1164 wrote to memory of 5028 1164 lxlllll.exe 102 PID 5028 wrote to memory of 4976 5028 lxflrrx.exe 103 PID 5028 wrote to memory of 4976 5028 lxflrrx.exe 103 PID 5028 wrote to memory of 4976 5028 lxflrrx.exe 103 PID 4976 wrote to memory of 5112 4976 jpdvv.exe 104 PID 4976 wrote to memory of 5112 4976 jpdvv.exe 104 PID 4976 wrote to memory of 5112 4976 jpdvv.exe 104 PID 5112 wrote to memory of 2240 5112 llllffr.exe 105 PID 5112 wrote to memory of 2240 5112 llllffr.exe 105 PID 5112 wrote to memory of 2240 5112 llllffr.exe 105 PID 2240 wrote to memory of 2120 2240 bbbhnb.exe 106 PID 2240 wrote to memory of 2120 2240 bbbhnb.exe 106 PID 2240 wrote to memory of 2120 2240 bbbhnb.exe 106 PID 2120 wrote to memory of 3624 2120 dvvjj.exe 107 PID 2120 wrote to memory of 3624 2120 dvvjj.exe 107 PID 2120 wrote to memory of 3624 2120 dvvjj.exe 107 PID 3624 wrote to memory of 3076 3624 lxfxxfl.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d32d58c62504ec10559113f782eb50N.exe"C:\Users\Admin\AppData\Local\Temp\b8d32d58c62504ec10559113f782eb50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\rfllxll.exec:\rfllxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\7bhthb.exec:\7bhthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\bntttb.exec:\bntttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\pdvdv.exec:\pdvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\3ffxxxx.exec:\3ffxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\frxxfff.exec:\frxxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\tbtttt.exec:\tbtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ddvpv.exec:\ddvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\3frllrx.exec:\3frllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\rlfffrr.exec:\rlfffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jdpdj.exec:\jdpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\lffxffl.exec:\lffxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\jjpjj.exec:\jjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\bbbhbh.exec:\bbbhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lxlllll.exec:\lxlllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\lxflrrx.exec:\lxflrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jpdvv.exec:\jpdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\llllffr.exec:\llllffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\bbbhnb.exec:\bbbhnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dvvjj.exec:\dvvjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\lxfxxfl.exec:\lxfxxfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\tnbbbb.exec:\tnbbbb.exe23⤵
- Executes dropped EXE
PID:3076 -
\??\c:\pvjjv.exec:\pvjjv.exe24⤵
- Executes dropped EXE
PID:404 -
\??\c:\bbnnhh.exec:\bbnnhh.exe25⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jdppd.exec:\jdppd.exe26⤵
- Executes dropped EXE
PID:3320 -
\??\c:\lxffxrl.exec:\lxffxrl.exe27⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dpdjj.exec:\dpdjj.exe28⤵
- Executes dropped EXE
PID:3180 -
\??\c:\bnnnhh.exec:\bnnnhh.exe29⤵
- Executes dropped EXE
PID:396 -
\??\c:\bntttb.exec:\bntttb.exe30⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vvdvd.exec:\vvdvd.exe31⤵
- Executes dropped EXE
PID:224 -
\??\c:\lxxfrfx.exec:\lxxfrfx.exe32⤵
- Executes dropped EXE
PID:848 -
\??\c:\ppddj.exec:\ppddj.exe33⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ppddd.exec:\ppddd.exe34⤵
- Executes dropped EXE
PID:1368 -
\??\c:\nbbbbb.exec:\nbbbbb.exe35⤵
- Executes dropped EXE
PID:4248 -
\??\c:\ddpjj.exec:\ddpjj.exe36⤵
- Executes dropped EXE
PID:3288 -
\??\c:\rrrrlll.exec:\rrrrlll.exe37⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nhnnnn.exec:\nhnnnn.exe38⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jdvvp.exec:\jdvvp.exe39⤵PID:4448
-
\??\c:\flflflr.exec:\flflflr.exe40⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bbnthn.exec:\bbnthn.exe41⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pvppd.exec:\pvppd.exe42⤵
- Executes dropped EXE
PID:4996 -
\??\c:\rfrrrll.exec:\rfrrrll.exe43⤵
- Executes dropped EXE
PID:3124 -
\??\c:\9vddd.exec:\9vddd.exe44⤵
- Executes dropped EXE
PID:4920 -
\??\c:\1tttbb.exec:\1tttbb.exe45⤵
- Executes dropped EXE
PID:3944 -
\??\c:\hhtbtt.exec:\hhtbtt.exe46⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lrrlxrr.exec:\lrrlxrr.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tnbbtb.exec:\tnbbtb.exe48⤵
- Executes dropped EXE
PID:8 -
\??\c:\rflffrl.exec:\rflffrl.exe49⤵
- Executes dropped EXE
PID:4024 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe50⤵
- Executes dropped EXE
PID:2628 -
\??\c:\djjjd.exec:\djjjd.exe51⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe52⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tnnhnn.exec:\tnnhnn.exe53⤵
- Executes dropped EXE
PID:1104 -
\??\c:\fflffff.exec:\fflffff.exe54⤵
- Executes dropped EXE
PID:4612 -
\??\c:\tbhhhh.exec:\tbhhhh.exe55⤵
- Executes dropped EXE
PID:4052 -
\??\c:\ddppp.exec:\ddppp.exe56⤵
- Executes dropped EXE
PID:1560 -
\??\c:\flxxxrf.exec:\flxxxrf.exe57⤵
- Executes dropped EXE
PID:4160 -
\??\c:\tntttt.exec:\tntttt.exe58⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tbhbbb.exec:\tbhbbb.exe59⤵
- Executes dropped EXE
PID:3684 -
\??\c:\pjvvv.exec:\pjvvv.exe60⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lxrrxxx.exec:\lxrrxxx.exe61⤵
- Executes dropped EXE
PID:3940 -
\??\c:\hntbbb.exec:\hntbbb.exe62⤵
- Executes dropped EXE
PID:4236 -
\??\c:\vvdvp.exec:\vvdvp.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe64⤵
- Executes dropped EXE
PID:3900 -
\??\c:\7hnnhh.exec:\7hnnhh.exe65⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhhtnb.exec:\nhhtnb.exe66⤵
- Executes dropped EXE
PID:3988 -
\??\c:\jjvjv.exec:\jjvjv.exe67⤵PID:2128
-
\??\c:\9xlrrll.exec:\9xlrrll.exe68⤵PID:1344
-
\??\c:\hntbhb.exec:\hntbhb.exe69⤵PID:5084
-
\??\c:\jpddj.exec:\jpddj.exe70⤵PID:3036
-
\??\c:\xrfffll.exec:\xrfffll.exe71⤵PID:2620
-
\??\c:\nbtnhh.exec:\nbtnhh.exe72⤵PID:320
-
\??\c:\nbhhhh.exec:\nbhhhh.exe73⤵PID:4344
-
\??\c:\vdpjj.exec:\vdpjj.exe74⤵PID:1008
-
\??\c:\7lfffff.exec:\7lfffff.exe75⤵PID:2728
-
\??\c:\bhtnbt.exec:\bhtnbt.exe76⤵PID:1340
-
\??\c:\vvppj.exec:\vvppj.exe77⤵PID:1764
-
\??\c:\fxlxrll.exec:\fxlxrll.exe78⤵PID:4552
-
\??\c:\ntttnt.exec:\ntttnt.exe79⤵PID:4132
-
\??\c:\5vvjd.exec:\5vvjd.exe80⤵PID:3508
-
\??\c:\3lrrrxx.exec:\3lrrrxx.exe81⤵PID:3380
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe82⤵PID:2236
-
\??\c:\hhhbbb.exec:\hhhbbb.exe83⤵PID:3964
-
\??\c:\jvppv.exec:\jvppv.exe84⤵PID:764
-
\??\c:\1flfxxx.exec:\1flfxxx.exe85⤵PID:4980
-
\??\c:\bbbhbb.exec:\bbbhbb.exe86⤵PID:3844
-
\??\c:\hhhbbb.exec:\hhhbbb.exe87⤵PID:1032
-
\??\c:\djpdp.exec:\djpdp.exe88⤵PID:4800
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe89⤵PID:4412
-
\??\c:\bnbhbb.exec:\bnbhbb.exe90⤵PID:632
-
\??\c:\vdjjp.exec:\vdjjp.exe91⤵PID:4092
-
\??\c:\3lxrxxx.exec:\3lxrxxx.exe92⤵PID:4508
-
\??\c:\hbhbnn.exec:\hbhbnn.exe93⤵PID:3580
-
\??\c:\jppdv.exec:\jppdv.exe94⤵PID:2028
-
\??\c:\9frllll.exec:\9frllll.exe95⤵PID:2896
-
\??\c:\xfrlrrr.exec:\xfrlrrr.exe96⤵PID:4516
-
\??\c:\3nnhhn.exec:\3nnhhn.exe97⤵PID:4024
-
\??\c:\1pvpp.exec:\1pvpp.exe98⤵PID:1204
-
\??\c:\9rfxxfx.exec:\9rfxxfx.exe99⤵PID:672
-
\??\c:\thtnhh.exec:\thtnhh.exe100⤵PID:3244
-
\??\c:\pddvv.exec:\pddvv.exe101⤵PID:2496
-
\??\c:\3lrlffr.exec:\3lrlffr.exe102⤵PID:2184
-
\??\c:\ttttnh.exec:\ttttnh.exe103⤵PID:456
-
\??\c:\5jvpp.exec:\5jvpp.exe104⤵PID:768
-
\??\c:\3jvvp.exec:\3jvvp.exe105⤵PID:4160
-
\??\c:\5rfxflf.exec:\5rfxflf.exe106⤵PID:2308
-
\??\c:\hnnnth.exec:\hnnnth.exe107⤵PID:3684
-
\??\c:\dpjdd.exec:\dpjdd.exe108⤵PID:4620
-
\??\c:\lfllllf.exec:\lfllllf.exe109⤵PID:740
-
\??\c:\tnbbtb.exec:\tnbbtb.exe110⤵PID:4264
-
\??\c:\pvvdj.exec:\pvvdj.exe111⤵PID:2296
-
\??\c:\5fxxxxx.exec:\5fxxxxx.exe112⤵PID:3900
-
\??\c:\9bnhtb.exec:\9bnhtb.exe113⤵PID:1260
-
\??\c:\ttbbbh.exec:\ttbbbh.exe114⤵PID:4112
-
\??\c:\pjddd.exec:\pjddd.exe115⤵PID:5112
-
\??\c:\fxlfflr.exec:\fxlfflr.exe116⤵PID:3748
-
\??\c:\hnbbbh.exec:\hnbbbh.exe117⤵PID:5084
-
\??\c:\pvjpp.exec:\pvjpp.exe118⤵PID:1004
-
\??\c:\vvddd.exec:\vvddd.exe119⤵PID:3624
-
\??\c:\1fxxrlr.exec:\1fxxrlr.exe120⤵PID:1324
-
\??\c:\1tbbtb.exec:\1tbbtb.exe121⤵PID:2612
-
\??\c:\5djpv.exec:\5djpv.exe122⤵PID:1484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-