Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe
-
Size
303KB
-
MD5
c0fdbd33fde9dcabe183c82e712d339b
-
SHA1
55d5193de622d96fc4f76d0e0bf1f8d2d9e16119
-
SHA256
b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee
-
SHA512
1e53dff5d988eb816133100f82523c9e8e03c7086a45ff58f0a647c2ff1d35a3a45c6c1fc9fb5978bf9d9f4d2c443dedb71bfbe02aed32c8c407f41d08a4ba01
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDLS0k+sLiiBVS0ILlMcGGW7sRCl9g:n3C9BRo/AIuunS3+sOiBVSXxMxTsm9g
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral1/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/384-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-515-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-555-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-734-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 62 IoCs
resource yara_rule behavioral1/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1580-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2640-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/896-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2448-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1840-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1752-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/684-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1996-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/384-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1296-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1768-238-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1888-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1628-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1592-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2764-328-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-329-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-344-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-360-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-404-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3024-413-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2320-475-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1128-490-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/640-505-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/640-506-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1576-515-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-522-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1012-530-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-538-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/704-553-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/704-555-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1784-569-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-598-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-613-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-628-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-643-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-658-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2460-666-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-688-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-703-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-718-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2528-733-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2528-734-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-749-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-757-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/336-779-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-794-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1772-809-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1088-824-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1876-839-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1308-854-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/884-869-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2520-884-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2956 fxllxxf.exe 1580 pdvjv.exe 2040 9nhntb.exe 2640 ppjpv.exe 2572 tnbhhh.exe 2756 3hnhbh.exe 896 jvppv.exe 2448 nhntth.exe 3000 xrllllr.exe 1796 dvpvd.exe 2976 frllllr.exe 2988 vpddd.exe 1840 3bbhtb.exe 1752 5pvpv.exe 2780 nhhthn.exe 2840 9lffxrf.exe 2192 7tnnhh.exe 2844 lfxrffl.exe 684 pvjpv.exe 1648 tnttbb.exe 1996 1xffflf.exe 384 bbnnbb.exe 1296 lxlfllr.exe 1768 1dvdp.exe 1888 9lfrffl.exe 1284 jdpvd.exe 1784 tthnnn.exe 1508 fxxfllx.exe 804 dvjvp.exe 1628 rlfflrx.exe 1592 jjdpd.exe 3060 nhhbhb.exe 2764 rlxxffl.exe 2548 9nhntb.exe 2636 ffllrlr.exe 2288 bbtthn.exe 2648 lxrlrxx.exe 2572 9nbnbb.exe 2464 jdjjv.exe 2656 3thnnt.exe 896 5pjpv.exe 2488 7btbbb.exe 1436 9rrlffr.exe 2948 hbtthn.exe 3024 9xlffxx.exe 2476 hbtthn.exe 2772 rlflxfl.exe 2508 hbnthn.exe 2696 rlxrxfl.exe 3036 ttnhbb.exe 2824 3rrrllf.exe 2836 dddjj.exe 2908 ffxfxfl.exe 2320 btbhnt.exe 596 3jpdp.exe 1128 9hbhhn.exe 1848 9pvdd.exe 640 5xrxfrx.exe 1576 tnbntt.exe 2140 xxlflfl.exe 1012 jjddj.exe 1672 lflrrxl.exe 920 3nbhnn.exe 704 ffrxfrf.exe -
resource yara_rule behavioral1/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/384-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-505-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-506-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-522-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-530-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-555-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-569-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-598-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-613-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-628-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-643-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-658-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-666-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-688-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-703-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-718-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-733-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-734-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-749-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-757-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/336-779-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-794-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-809-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-824-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-839-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-854-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-869-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-884-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2956 2152 b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe 28 PID 2152 wrote to memory of 2956 2152 b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe 28 PID 2152 wrote to memory of 2956 2152 b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe 28 PID 2152 wrote to memory of 2956 2152 b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe 28 PID 2956 wrote to memory of 1580 2956 fxllxxf.exe 29 PID 2956 wrote to memory of 1580 2956 fxllxxf.exe 29 PID 2956 wrote to memory of 1580 2956 fxllxxf.exe 29 PID 2956 wrote to memory of 1580 2956 fxllxxf.exe 29 PID 1580 wrote to memory of 2040 1580 pdvjv.exe 30 PID 1580 wrote to memory of 2040 1580 pdvjv.exe 30 PID 1580 wrote to memory of 2040 1580 pdvjv.exe 30 PID 1580 wrote to memory of 2040 1580 pdvjv.exe 30 PID 2040 wrote to memory of 2640 2040 9nhntb.exe 31 PID 2040 wrote to memory of 2640 2040 9nhntb.exe 31 PID 2040 wrote to memory of 2640 2040 9nhntb.exe 31 PID 2040 wrote to memory of 2640 2040 9nhntb.exe 31 PID 2640 wrote to memory of 2572 2640 ppjpv.exe 32 PID 2640 wrote to memory of 2572 2640 ppjpv.exe 32 PID 2640 wrote to memory of 2572 2640 ppjpv.exe 32 PID 2640 wrote to memory of 2572 2640 ppjpv.exe 32 PID 2572 wrote to memory of 2756 2572 tnbhhh.exe 33 PID 2572 wrote to memory of 2756 2572 tnbhhh.exe 33 PID 2572 wrote to memory of 2756 2572 tnbhhh.exe 33 PID 2572 wrote to memory of 2756 2572 tnbhhh.exe 33 PID 2756 wrote to memory of 896 2756 3hnhbh.exe 34 PID 2756 wrote to memory of 896 2756 3hnhbh.exe 34 PID 2756 wrote to memory of 896 2756 3hnhbh.exe 34 PID 2756 wrote to memory of 896 2756 3hnhbh.exe 34 PID 896 wrote to memory of 2448 896 jvppv.exe 35 PID 896 wrote to memory of 2448 896 jvppv.exe 35 PID 896 wrote to memory of 2448 896 jvppv.exe 35 PID 896 wrote to memory of 2448 896 jvppv.exe 35 PID 2448 wrote to memory of 3000 2448 nhntth.exe 36 PID 2448 wrote to memory of 3000 2448 nhntth.exe 36 PID 2448 wrote to memory of 3000 2448 nhntth.exe 36 PID 2448 wrote to memory of 3000 2448 nhntth.exe 36 PID 3000 wrote to memory of 1796 3000 xrllllr.exe 37 PID 3000 wrote to memory of 1796 3000 xrllllr.exe 37 PID 3000 wrote to memory of 1796 3000 xrllllr.exe 37 PID 3000 wrote to memory of 1796 3000 xrllllr.exe 37 PID 1796 wrote to memory of 2976 1796 dvpvd.exe 38 PID 1796 wrote to memory of 2976 1796 dvpvd.exe 38 PID 1796 wrote to memory of 2976 1796 dvpvd.exe 38 PID 1796 wrote to memory of 2976 1796 dvpvd.exe 38 PID 2976 wrote to memory of 2988 2976 frllllr.exe 39 PID 2976 wrote to memory of 2988 2976 frllllr.exe 39 PID 2976 wrote to memory of 2988 2976 frllllr.exe 39 PID 2976 wrote to memory of 2988 2976 frllllr.exe 39 PID 2988 wrote to memory of 1840 2988 vpddd.exe 40 PID 2988 wrote to memory of 1840 2988 vpddd.exe 40 PID 2988 wrote to memory of 1840 2988 vpddd.exe 40 PID 2988 wrote to memory of 1840 2988 vpddd.exe 40 PID 1840 wrote to memory of 1752 1840 3bbhtb.exe 41 PID 1840 wrote to memory of 1752 1840 3bbhtb.exe 41 PID 1840 wrote to memory of 1752 1840 3bbhtb.exe 41 PID 1840 wrote to memory of 1752 1840 3bbhtb.exe 41 PID 1752 wrote to memory of 2780 1752 5pvpv.exe 42 PID 1752 wrote to memory of 2780 1752 5pvpv.exe 42 PID 1752 wrote to memory of 2780 1752 5pvpv.exe 42 PID 1752 wrote to memory of 2780 1752 5pvpv.exe 42 PID 2780 wrote to memory of 2840 2780 nhhthn.exe 43 PID 2780 wrote to memory of 2840 2780 nhhthn.exe 43 PID 2780 wrote to memory of 2840 2780 nhhthn.exe 43 PID 2780 wrote to memory of 2840 2780 nhhthn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe"C:\Users\Admin\AppData\Local\Temp\b836001a2f5c37c12c6704fe0024d536e99f4bd57e932a40ab567bf312adb8ee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\fxllxxf.exec:\fxllxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pdvjv.exec:\pdvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\9nhntb.exec:\9nhntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\ppjpv.exec:\ppjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnbhhh.exec:\tnbhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\3hnhbh.exec:\3hnhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jvppv.exec:\jvppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\nhntth.exec:\nhntth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xrllllr.exec:\xrllllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dvpvd.exec:\dvpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\frllllr.exec:\frllllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vpddd.exec:\vpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\3bbhtb.exec:\3bbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\5pvpv.exec:\5pvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nhhthn.exec:\nhhthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9lffxrf.exec:\9lffxrf.exe17⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7tnnhh.exec:\7tnnhh.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lfxrffl.exec:\lfxrffl.exe19⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pvjpv.exec:\pvjpv.exe20⤵
- Executes dropped EXE
PID:684 -
\??\c:\tnttbb.exec:\tnttbb.exe21⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1xffflf.exec:\1xffflf.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bbnnbb.exec:\bbnnbb.exe23⤵
- Executes dropped EXE
PID:384 -
\??\c:\lxlfllr.exec:\lxlfllr.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\1dvdp.exec:\1dvdp.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\9lfrffl.exec:\9lfrffl.exe26⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jdpvd.exec:\jdpvd.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tthnnn.exec:\tthnnn.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\fxxfllx.exec:\fxxfllx.exe29⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dvjvp.exec:\dvjvp.exe30⤵
- Executes dropped EXE
PID:804 -
\??\c:\rlfflrx.exec:\rlfflrx.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjdpd.exec:\jjdpd.exe32⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nhhbhb.exec:\nhhbhb.exe33⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rlxxffl.exec:\rlxxffl.exe34⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9nhntb.exec:\9nhntb.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ffllrlr.exec:\ffllrlr.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bbtthn.exec:\bbtthn.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxrlrxx.exec:\lxrlrxx.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9nbnbb.exec:\9nbnbb.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jdjjv.exec:\jdjjv.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3thnnt.exec:\3thnnt.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5pjpv.exec:\5pjpv.exe42⤵
- Executes dropped EXE
PID:896 -
\??\c:\7btbbb.exec:\7btbbb.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9rrlffr.exec:\9rrlffr.exe44⤵
- Executes dropped EXE
PID:1436 -
\??\c:\hbtthn.exec:\hbtthn.exe45⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9xlffxx.exec:\9xlffxx.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hbtthn.exec:\hbtthn.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rlflxfl.exec:\rlflxfl.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hbnthn.exec:\hbnthn.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rlxrxfl.exec:\rlxrxfl.exe50⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ttnhbb.exec:\ttnhbb.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3rrrllf.exec:\3rrrllf.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dddjj.exec:\dddjj.exe53⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ffxfxfl.exec:\ffxfxfl.exe54⤵
- Executes dropped EXE
PID:2908 -
\??\c:\btbhnt.exec:\btbhnt.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3jpdp.exec:\3jpdp.exe56⤵
- Executes dropped EXE
PID:596 -
\??\c:\9hbhhn.exec:\9hbhhn.exe57⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9pvdd.exec:\9pvdd.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5xrxfrx.exec:\5xrxfrx.exe59⤵
- Executes dropped EXE
PID:640 -
\??\c:\tnbntt.exec:\tnbntt.exe60⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxlflfl.exec:\xxlflfl.exe61⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jjddj.exec:\jjddj.exe62⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lflrrxl.exec:\lflrrxl.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3nbhnn.exec:\3nbhnn.exe64⤵
- Executes dropped EXE
PID:920 -
\??\c:\ffrxfrf.exec:\ffrxfrf.exe65⤵
- Executes dropped EXE
PID:704 -
\??\c:\nnhthn.exec:\nnhthn.exe66⤵PID:1040
-
\??\c:\llxflxl.exec:\llxflxl.exe67⤵PID:1784
-
\??\c:\nhbhbb.exec:\nhbhbb.exe68⤵PID:1988
-
\??\c:\llflflx.exec:\llflflx.exe69⤵PID:1948
-
\??\c:\vpddp.exec:\vpddp.exe70⤵PID:1544
-
\??\c:\hbhhnn.exec:\hbhhnn.exe71⤵PID:2336
-
\??\c:\5flfffl.exec:\5flfffl.exe72⤵PID:1632
-
\??\c:\nbnthh.exec:\nbnthh.exe73⤵PID:2956
-
\??\c:\5dvdd.exec:\5dvdd.exe74⤵PID:1580
-
\??\c:\rrflffl.exec:\rrflffl.exe75⤵PID:2668
-
\??\c:\3jdpd.exec:\3jdpd.exe76⤵PID:2636
-
\??\c:\xrllrrx.exec:\xrllrrx.exe77⤵PID:2288
-
\??\c:\jjjvj.exec:\jjjvj.exe78⤵PID:2604
-
\??\c:\xlrllrf.exec:\xlrllrf.exe79⤵PID:2624
-
\??\c:\5jvjv.exec:\5jvjv.exe80⤵PID:2460
-
\??\c:\lfrflrx.exec:\lfrflrx.exe81⤵PID:2612
-
\??\c:\vvjpd.exec:\vvjpd.exe82⤵PID:896
-
\??\c:\rlflxfr.exec:\rlflxfr.exe83⤵PID:2704
-
\??\c:\nttnhb.exec:\nttnhb.exe84⤵PID:2968
-
\??\c:\rxrxlfr.exec:\rxrxlfr.exe85⤵PID:2976
-
\??\c:\ppjpv.exec:\ppjpv.exe86⤵PID:1640
-
\??\c:\llfrxfr.exec:\llfrxfr.exe87⤵PID:2672
-
\??\c:\tnhhtt.exec:\tnhhtt.exe88⤵PID:2712
-
\??\c:\rrllrrf.exec:\rrllrrf.exe89⤵PID:2528
-
\??\c:\7bnhnn.exec:\7bnhnn.exe90⤵PID:1752
-
\??\c:\7jpdj.exec:\7jpdj.exe91⤵PID:2840
-
\??\c:\nbhbbh.exec:\nbhbbh.exe92⤵PID:2836
-
\??\c:\3btbnh.exec:\3btbnh.exe93⤵PID:324
-
\??\c:\llfxlxr.exec:\llfxlxr.exe94⤵PID:1252
-
\??\c:\jjppp.exec:\jjppp.exe95⤵PID:336
-
\??\c:\ffffrrx.exec:\ffffrrx.exe96⤵PID:1128
-
\??\c:\btbhnh.exec:\btbhnh.exe97⤵PID:1280
-
\??\c:\lrffflr.exec:\lrffflr.exe98⤵PID:960
-
\??\c:\pdvvd.exec:\pdvvd.exe99⤵PID:1772
-
\??\c:\rlxllfl.exec:\rlxllfl.exe100⤵PID:1296
-
\??\c:\jjppp.exec:\jjppp.exe101⤵PID:1088
-
\??\c:\fxrrxxr.exec:\fxrrxxr.exe102⤵PID:2340
-
\??\c:\htnntt.exec:\htnntt.exe103⤵PID:1876
-
\??\c:\pdvvv.exec:\pdvvv.exe104⤵PID:2400
-
\??\c:\bbnntn.exec:\bbnntn.exe105⤵PID:1308
-
\??\c:\9dpvd.exec:\9dpvd.exe106⤵PID:2524
-
\??\c:\3hbhnn.exec:\3hbhnn.exe107⤵PID:884
-
\??\c:\dvpvv.exec:\dvpvv.exe108⤵PID:1984
-
\??\c:\1bnhhb.exec:\1bnhhb.exe109⤵PID:2520
-
\??\c:\ppdjp.exec:\ppdjp.exe110⤵PID:2208
-
\??\c:\thbbbb.exec:\thbbbb.exe111⤵PID:2096
-
\??\c:\dvpvd.exec:\dvpvd.exe112⤵PID:2032
-
\??\c:\tthtbb.exec:\tthtbb.exe113⤵PID:2584
-
\??\c:\3pddd.exec:\3pddd.exe114⤵PID:2596
-
\??\c:\3nbbbn.exec:\3nbbbn.exe115⤵PID:2728
-
\??\c:\7xlffxx.exec:\7xlffxx.exe116⤵PID:1756
-
\??\c:\htnntt.exec:\htnntt.exe117⤵PID:2812
-
\??\c:\xrxflrf.exec:\xrxflrf.exe118⤵PID:2492
-
\??\c:\9nbbhb.exec:\9nbbhb.exe119⤵PID:2576
-
\??\c:\dvjpv.exec:\dvjpv.exe120⤵PID:2448
-
\??\c:\btnnnh.exec:\btnnnh.exe121⤵PID:2440
-
\??\c:\1pppj.exec:\1pppj.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-