Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 08:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.exe
Resource
win7-20240215-en
0 signatures
150 seconds
General
-
Target
HEUR-Trojan.Win32.exe
-
Size
441KB
-
MD5
d6ca2cae19a63047b1ba881b667a657a
-
SHA1
e83c8250333e3300b4d3448b12a489c8913ff5a2
-
SHA256
d72d920b00750016a2e3f61662cc48a3acdc6ee26e83b3604362b246fdfe8eb5
-
SHA512
b05d99a0e674ce290e0aacb928e8996888525b0bafe739a9e1dff902f41eaaae7e71a85129633751c63002cb427fbe8d300a5862b2e6f04e5714178a14ad379e
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JW:n3C9ytvn8whkb4i3e3GFO6JW
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral2/memory/4468-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 53 IoCs
resource yara_rule behavioral2/memory/4468-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4468-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3416-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4260-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3416-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3552-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/64-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/208-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3520-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/892-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5112-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3748-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2984-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2436-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2436-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1072-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3532-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4556-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3296-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4136-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2052-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3968-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2376-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1512-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1556-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2012-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1988-225-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3096-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/320-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2916-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1804-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4372-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/828-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1896-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1216-306-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-310-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1140-330-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/788-340-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-345-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-353-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1884-371-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3420-375-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1512-380-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1512-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2264-392-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3108-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1352 8660448.exe 3416 5rrxrxr.exe 4260 48400.exe 208 rfffxll.exe 3552 bhhhhh.exe 64 64484f.exe 3520 djvpp.exe 892 btnthh.exe 5112 fxlllff.exe 3748 684448.exe 2984 84488.exe 2436 1pvpp.exe 1112 9jdvp.exe 2016 fxfxffx.exe 3532 vjpjd.exe 1072 htbnhh.exe 1700 202648.exe 5080 644848.exe 4556 600844.exe 4460 fxffrxx.exe 3296 rllflxl.exe 4136 w28480.exe 2052 xfllxxr.exe 3968 u626482.exe 1512 pjjpj.exe 2376 0622600.exe 1880 8060448.exe 4840 244866.exe 1556 2022222.exe 2012 420004.exe 1988 hthnhb.exe 3096 8466004.exe 3416 jpvvp.exe 320 7ffxlfx.exe 244 68826.exe 2916 o664226.exe 3120 88048.exe 1720 djjvp.exe 4720 nbbtnn.exe 5100 vvjjj.exe 1804 48486.exe 4476 jddvp.exe 4560 4686448.exe 4372 rxfxxxf.exe 828 486008.exe 3768 q44820.exe 1896 7xffxxr.exe 1216 26822.exe 4724 866000.exe 2116 484844.exe 2292 880400.exe 784 8422682.exe 1140 dvpjj.exe 1696 tbbbtt.exe 788 860848.exe 3468 8626484.exe 1312 tttntt.exe 4684 46820.exe 2020 a6260.exe 5104 8288882.exe 3452 xllfxxf.exe 1884 vjjpj.exe 3420 0200004.exe 1512 5ddpd.exe -
resource yara_rule behavioral2/memory/4468-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-401-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 1352 4468 HEUR-Trojan.Win32.exe 88 PID 4468 wrote to memory of 1352 4468 HEUR-Trojan.Win32.exe 88 PID 4468 wrote to memory of 1352 4468 HEUR-Trojan.Win32.exe 88 PID 1352 wrote to memory of 3416 1352 8660448.exe 89 PID 1352 wrote to memory of 3416 1352 8660448.exe 89 PID 1352 wrote to memory of 3416 1352 8660448.exe 89 PID 3416 wrote to memory of 4260 3416 5rrxrxr.exe 90 PID 3416 wrote to memory of 4260 3416 5rrxrxr.exe 90 PID 3416 wrote to memory of 4260 3416 5rrxrxr.exe 90 PID 4260 wrote to memory of 208 4260 48400.exe 91 PID 4260 wrote to memory of 208 4260 48400.exe 91 PID 4260 wrote to memory of 208 4260 48400.exe 91 PID 208 wrote to memory of 3552 208 rfffxll.exe 92 PID 208 wrote to memory of 3552 208 rfffxll.exe 92 PID 208 wrote to memory of 3552 208 rfffxll.exe 92 PID 3552 wrote to memory of 64 3552 bhhhhh.exe 94 PID 3552 wrote to memory of 64 3552 bhhhhh.exe 94 PID 3552 wrote to memory of 64 3552 bhhhhh.exe 94 PID 64 wrote to memory of 3520 64 64484f.exe 93 PID 64 wrote to memory of 3520 64 64484f.exe 93 PID 64 wrote to memory of 3520 64 64484f.exe 93 PID 3520 wrote to memory of 892 3520 djvpp.exe 95 PID 3520 wrote to memory of 892 3520 djvpp.exe 95 PID 3520 wrote to memory of 892 3520 djvpp.exe 95 PID 892 wrote to memory of 5112 892 btnthh.exe 96 PID 892 wrote to memory of 5112 892 btnthh.exe 96 PID 892 wrote to memory of 5112 892 btnthh.exe 96 PID 5112 wrote to memory of 3748 5112 fxlllff.exe 97 PID 5112 wrote to memory of 3748 5112 fxlllff.exe 97 PID 5112 wrote to memory of 3748 5112 fxlllff.exe 97 PID 3748 wrote to memory of 2984 3748 684448.exe 98 PID 3748 wrote to memory of 2984 3748 684448.exe 98 PID 3748 wrote to memory of 2984 3748 684448.exe 98 PID 2984 wrote to memory of 2436 2984 84488.exe 99 PID 2984 wrote to memory of 2436 2984 84488.exe 99 PID 2984 wrote to memory of 2436 2984 84488.exe 99 PID 2436 wrote to memory of 1112 2436 1pvpp.exe 100 PID 2436 wrote to memory of 1112 2436 1pvpp.exe 100 PID 2436 wrote to memory of 1112 2436 1pvpp.exe 100 PID 1112 wrote to memory of 2016 1112 9jdvp.exe 101 PID 1112 wrote to memory of 2016 1112 9jdvp.exe 101 PID 1112 wrote to memory of 2016 1112 9jdvp.exe 101 PID 2016 wrote to memory of 3532 2016 fxfxffx.exe 102 PID 2016 wrote to memory of 3532 2016 fxfxffx.exe 102 PID 2016 wrote to memory of 3532 2016 fxfxffx.exe 102 PID 3532 wrote to memory of 1072 3532 vjpjd.exe 103 PID 3532 wrote to memory of 1072 3532 vjpjd.exe 103 PID 3532 wrote to memory of 1072 3532 vjpjd.exe 103 PID 1072 wrote to memory of 1700 1072 htbnhh.exe 107 PID 1072 wrote to memory of 1700 1072 htbnhh.exe 107 PID 1072 wrote to memory of 1700 1072 htbnhh.exe 107 PID 1700 wrote to memory of 5080 1700 202648.exe 104 PID 1700 wrote to memory of 5080 1700 202648.exe 104 PID 1700 wrote to memory of 5080 1700 202648.exe 104 PID 5080 wrote to memory of 4556 5080 644848.exe 108 PID 5080 wrote to memory of 4556 5080 644848.exe 108 PID 5080 wrote to memory of 4556 5080 644848.exe 108 PID 4556 wrote to memory of 4460 4556 600844.exe 109 PID 4556 wrote to memory of 4460 4556 600844.exe 109 PID 4556 wrote to memory of 4460 4556 600844.exe 109 PID 4460 wrote to memory of 3296 4460 fxffrxx.exe 110 PID 4460 wrote to memory of 3296 4460 fxffrxx.exe 110 PID 4460 wrote to memory of 3296 4460 fxffrxx.exe 110 PID 3296 wrote to memory of 4136 3296 rllflxl.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\8660448.exec:\8660448.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\5rrxrxr.exec:\5rrxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\48400.exec:\48400.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\rfffxll.exec:\rfffxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\bhhhhh.exec:\bhhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\64484f.exec:\64484f.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64
-
-
-
-
-
-
-
\??\c:\djvpp.exec:\djvpp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\btnthh.exec:\btnthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\fxlllff.exec:\fxlllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\684448.exec:\684448.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\84488.exec:\84488.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\1pvpp.exec:\1pvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9jdvp.exec:\9jdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\fxfxffx.exec:\fxfxffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\vjpjd.exec:\vjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\htbnhh.exec:\htbnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\202648.exec:\202648.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700
-
-
-
-
-
-
-
-
-
-
-
\??\c:\644848.exec:\644848.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\600844.exec:\600844.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\fxffrxx.exec:\fxffrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\rllflxl.exec:\rllflxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\w28480.exec:\w28480.exe5⤵
- Executes dropped EXE
PID:4136 -
\??\c:\xfllxxr.exec:\xfllxxr.exe6⤵
- Executes dropped EXE
PID:2052 -
\??\c:\u626482.exec:\u626482.exe7⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pjjpj.exec:\pjjpj.exe8⤵
- Executes dropped EXE
PID:1512 -
\??\c:\0622600.exec:\0622600.exe9⤵
- Executes dropped EXE
PID:2376 -
\??\c:\8060448.exec:\8060448.exe10⤵
- Executes dropped EXE
PID:1880 -
\??\c:\244866.exec:\244866.exe11⤵
- Executes dropped EXE
PID:4840 -
\??\c:\2022222.exec:\2022222.exe12⤵
- Executes dropped EXE
PID:1556 -
\??\c:\420004.exec:\420004.exe13⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hthnhb.exec:\hthnhb.exe14⤵
- Executes dropped EXE
PID:1988 -
\??\c:\8466004.exec:\8466004.exe15⤵
- Executes dropped EXE
PID:3096 -
\??\c:\jpvvp.exec:\jpvvp.exe16⤵
- Executes dropped EXE
PID:3416 -
\??\c:\7ffxlfx.exec:\7ffxlfx.exe17⤵
- Executes dropped EXE
PID:320 -
\??\c:\68826.exec:\68826.exe18⤵
- Executes dropped EXE
PID:244 -
\??\c:\o664226.exec:\o664226.exe19⤵
- Executes dropped EXE
PID:2916 -
\??\c:\88048.exec:\88048.exe20⤵
- Executes dropped EXE
PID:3120 -
\??\c:\djjvp.exec:\djjvp.exe21⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nbbtnn.exec:\nbbtnn.exe22⤵
- Executes dropped EXE
PID:4720 -
\??\c:\vvjjj.exec:\vvjjj.exe23⤵
- Executes dropped EXE
PID:5100 -
\??\c:\48486.exec:\48486.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jddvp.exec:\jddvp.exe25⤵
- Executes dropped EXE
PID:4476 -
\??\c:\4686448.exec:\4686448.exe26⤵
- Executes dropped EXE
PID:4560 -
\??\c:\rxfxxxf.exec:\rxfxxxf.exe27⤵
- Executes dropped EXE
PID:4372 -
\??\c:\486008.exec:\486008.exe28⤵
- Executes dropped EXE
PID:828 -
\??\c:\q44820.exec:\q44820.exe29⤵
- Executes dropped EXE
PID:3768 -
\??\c:\7xffxxr.exec:\7xffxxr.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\26822.exec:\26822.exe31⤵
- Executes dropped EXE
PID:1216 -
\??\c:\866000.exec:\866000.exe32⤵
- Executes dropped EXE
PID:4724 -
\??\c:\484844.exec:\484844.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\880400.exec:\880400.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\8422682.exec:\8422682.exe35⤵
- Executes dropped EXE
PID:784 -
\??\c:\dvpjj.exec:\dvpjj.exe36⤵
- Executes dropped EXE
PID:1140 -
\??\c:\tbbbtt.exec:\tbbbtt.exe37⤵
- Executes dropped EXE
PID:1696 -
\??\c:\860848.exec:\860848.exe38⤵
- Executes dropped EXE
PID:788 -
\??\c:\8626484.exec:\8626484.exe39⤵
- Executes dropped EXE
PID:3468 -
\??\c:\tttntt.exec:\tttntt.exe40⤵
- Executes dropped EXE
PID:1312 -
\??\c:\46820.exec:\46820.exe41⤵
- Executes dropped EXE
PID:4684 -
\??\c:\a6260.exec:\a6260.exe42⤵
- Executes dropped EXE
PID:2020 -
\??\c:\8288882.exec:\8288882.exe43⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xllfxxf.exec:\xllfxxf.exe44⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vjjpj.exec:\vjjpj.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\0200004.exec:\0200004.exe46⤵
- Executes dropped EXE
PID:3420 -
\??\c:\5ddpd.exec:\5ddpd.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\2884882.exec:\2884882.exe48⤵PID:4872
-
\??\c:\xxfxrlx.exec:\xxfxrlx.exe49⤵PID:2264
-
\??\c:\1nhbnn.exec:\1nhbnn.exe50⤵PID:4680
-
\??\c:\4060826.exec:\4060826.exe51⤵PID:3108
-
\??\c:\408266.exec:\408266.exe52⤵PID:2340
-
\??\c:\0660484.exec:\0660484.exe53⤵PID:1300
-
\??\c:\820606.exec:\820606.exe54⤵PID:1340
-
\??\c:\8460604.exec:\8460604.exe55⤵PID:1228
-
\??\c:\7hhtnn.exec:\7hhtnn.exe56⤵PID:4444
-
\??\c:\60604.exec:\60604.exe57⤵PID:4260
-
\??\c:\3rxlfxx.exec:\3rxlfxx.exe58⤵PID:3696
-
\??\c:\028222.exec:\028222.exe59⤵PID:244
-
\??\c:\pdjdv.exec:\pdjdv.exe60⤵PID:896
-
\??\c:\5btnhh.exec:\5btnhh.exe61⤵PID:4676
-
\??\c:\bthbbt.exec:\bthbbt.exe62⤵PID:3520
-
\??\c:\o028226.exec:\o028226.exe63⤵PID:1648
-
\??\c:\nbhbtt.exec:\nbhbtt.exe64⤵PID:4668
-
\??\c:\k02604.exec:\k02604.exe65⤵PID:972
-
\??\c:\60008.exec:\60008.exe66⤵PID:2100
-
\??\c:\bnntnn.exec:\bnntnn.exe67⤵PID:4560
-
\??\c:\1nbttt.exec:\1nbttt.exe68⤵PID:4372
-
\??\c:\6264604.exec:\6264604.exe69⤵PID:4428
-
\??\c:\66260.exec:\66260.exe70⤵PID:2072
-
\??\c:\1dpdv.exec:\1dpdv.exe71⤵PID:1784
-
\??\c:\628640.exec:\628640.exe72⤵PID:4232
-
\??\c:\bbtbnn.exec:\bbtbnn.exe73⤵PID:4724
-
\??\c:\4622628.exec:\4622628.exe74⤵PID:4380
-
\??\c:\lxxrlll.exec:\lxxrlll.exe75⤵PID:2292
-
\??\c:\9rrrrrl.exec:\9rrrrrl.exe76⤵PID:3580
-
\??\c:\60000.exec:\60000.exe77⤵PID:4556
-
\??\c:\4260666.exec:\4260666.exe78⤵PID:1696
-
\??\c:\3nhhhn.exec:\3nhhhn.exe79⤵PID:4548
-
\??\c:\8240066.exec:\8240066.exe80⤵PID:4300
-
\??\c:\7frrlll.exec:\7frrlll.exe81⤵PID:1204
-
\??\c:\htnhtn.exec:\htnhtn.exe82⤵PID:4412
-
\??\c:\82220.exec:\82220.exe83⤵PID:3720
-
\??\c:\022666.exec:\022666.exe84⤵PID:5104
-
\??\c:\djvpd.exec:\djvpd.exe85⤵PID:3452
-
\??\c:\26222.exec:\26222.exe86⤵PID:1884
-
\??\c:\7nhttt.exec:\7nhttt.exe87⤵PID:3420
-
\??\c:\8682660.exec:\8682660.exe88⤵PID:2228
-
\??\c:\hntthb.exec:\hntthb.exe89⤵PID:4872
-
\??\c:\08822.exec:\08822.exe90⤵PID:4840
-
\??\c:\9fllffx.exec:\9fllffx.exe91⤵PID:4864
-
\??\c:\6662622.exec:\6662622.exe92⤵PID:4468
-
\??\c:\6886040.exec:\6886040.exe93⤵PID:1384
-
\??\c:\bbttnn.exec:\bbttnn.exe94⤵PID:2140
-
\??\c:\jjpjj.exec:\jjpjj.exe95⤵PID:1964
-
\??\c:\6660482.exec:\6660482.exe96⤵PID:3040
-
\??\c:\06226.exec:\06226.exe97⤵PID:4444
-
\??\c:\frrllll.exec:\frrllll.exe98⤵PID:4260
-
\??\c:\20486.exec:\20486.exe99⤵PID:3696
-
\??\c:\a2204.exec:\a2204.exe100⤵PID:3120
-
\??\c:\200400.exec:\200400.exe101⤵PID:896
-
\??\c:\g8422.exec:\g8422.exe102⤵PID:2300
-
\??\c:\84482.exec:\84482.exe103⤵PID:4036
-
\??\c:\0626448.exec:\0626448.exe104⤵PID:2224
-
\??\c:\20000.exec:\20000.exe105⤵PID:5112
-
\??\c:\thnhbb.exec:\thnhbb.exe106⤵PID:2320
-
\??\c:\0822660.exec:\0822660.exe107⤵PID:4936
-
\??\c:\dppdp.exec:\dppdp.exe108⤵PID:4740
-
\??\c:\888648.exec:\888648.exe109⤵PID:3272
-
\??\c:\w88660.exec:\w88660.exe110⤵PID:3376
-
\??\c:\c666448.exec:\c666448.exe111⤵PID:1628
-
\??\c:\xlfxlfl.exec:\xlfxlfl.exe112⤵PID:1180
-
\??\c:\822628.exec:\822628.exe113⤵PID:2408
-
\??\c:\8408882.exec:\8408882.exe114⤵PID:1164
-
\??\c:\djjdv.exec:\djjdv.exe115⤵PID:2748
-
\??\c:\6626448.exec:\6626448.exe116⤵PID:1140
-
\??\c:\486840.exec:\486840.exe117⤵PID:4460
-
\??\c:\ntbntn.exec:\ntbntn.exe118⤵PID:788
-
\??\c:\6260860.exec:\6260860.exe119⤵PID:3468
-
\??\c:\86086.exec:\86086.exe120⤵PID:3960
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe121⤵PID:3576
-
\??\c:\06604.exec:\06604.exe122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-