Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 18:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe
-
Size
70KB
-
MD5
3f61e232e98fef2ecd373a417e4ced9e
-
SHA1
a3889a600f362cea47e91a7f3c23b6e908f111a3
-
SHA256
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9
-
SHA512
4842336a4424b5083c853e64cb1bb9c2ae2579c842da200db34ae1251aead0849c9af60c702781d7df35f0dcecb84c30d501a41fe85021824642cd5adb101b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60LbB:ymb3NkkiQ3mdBjFIIp9LV
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
resource yara_rule behavioral1/memory/2856-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/488-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-635-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-709-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-734-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-888-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-1052-0x0000000000220000-0x000000000022C000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 61 IoCs
resource yara_rule behavioral1/memory/2856-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2564-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1880-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2456-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1436-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1364-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1464-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2008-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/792-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1812-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1820-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/276-270-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1636-309-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-313-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1676-320-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-341-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-342-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2848-364-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-373-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-372-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-404-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1244-396-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/844-411-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-441-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/488-503-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-547-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1820-562-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1532-614-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2224-620-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2888-635-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-664-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-679-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1632-708-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1632-709-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-734-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1612-740-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-783-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-798-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/792-813-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/748-828-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2324-843-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/892-858-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/552-873-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1020-888-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/888-903-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2408-974-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/312-1109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2440-1271-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1056-1356-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3044-1371-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1980-1386-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1864-1415-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1548-1430-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2700 jvdjd.exe 2564 xlrxxfl.exe 2616 jvjjv.exe 2532 llllxlx.exe 2724 5nbtbb.exe 1880 httnhh.exe 2480 dpppp.exe 2456 xlxxrxx.exe 1968 htbbtn.exe 1436 bnnnbb.exe 1364 pvvpj.exe 1776 lrxlfxx.exe 1256 3rxrxrx.exe 1464 9fxfrrf.exe 2400 fllfxxr.exe 2716 7vjdd.exe 1932 vjjjp.exe 2008 vpppp.exe 2772 bhntnn.exe 792 bttbtn.exe 1812 rfxxlxl.exe 2052 5vvvv.exe 2916 bnttth.exe 3064 7lxflll.exe 1284 bntnnn.exe 1820 fxfrrrr.exe 276 pdpvv.exe 3004 xrxrllr.exe 2212 httbbn.exe 2592 dpvvv.exe 1636 tnbbnt.exe 2240 xrfffff.exe 1676 hnnhhh.exe 2116 3rffxrr.exe 2620 bnhbhn.exe 2752 pjjpp.exe 2748 rlrrrrl.exe 2504 7pvvd.exe 2848 3rxllrr.exe 2424 7ppvv.exe 2300 lxfffff.exe 2832 jpppv.exe 1244 htttnb.exe 2140 rxffrrl.exe 844 7pdvv.exe 2172 7tbnhn.exe 2332 3xrlrxf.exe 1456 dvvdd.exe 2192 httthn.exe 1464 rflllfl.exe 1220 llxxxxf.exe 3052 vjdpj.exe 1980 thnhnh.exe 860 rflfxfx.exe 2928 jvvpv.exe 608 7hhhbh.exe 488 fxfxfff.exe 652 9tnhnn.exe 1808 nhtnbb.exe 748 rlxxrrr.exe 1940 jdjvv.exe 2904 hbnhhb.exe 2104 1rfxfxx.exe 1708 5bbntb.exe -
resource yara_rule behavioral1/memory/2856-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/488-503-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-547-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-562-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-620-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-635-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-664-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-679-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-708-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-709-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-734-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-740-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-783-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-798-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-813-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-828-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-843-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-858-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-873-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-888-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-903-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-974-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-1109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-1271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-1356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-1371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-1386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-1415-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-1430-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2700 2856 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 28 PID 2856 wrote to memory of 2700 2856 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 28 PID 2856 wrote to memory of 2700 2856 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 28 PID 2856 wrote to memory of 2700 2856 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 28 PID 2700 wrote to memory of 2564 2700 jvdjd.exe 29 PID 2700 wrote to memory of 2564 2700 jvdjd.exe 29 PID 2700 wrote to memory of 2564 2700 jvdjd.exe 29 PID 2700 wrote to memory of 2564 2700 jvdjd.exe 29 PID 2564 wrote to memory of 2616 2564 xlrxxfl.exe 30 PID 2564 wrote to memory of 2616 2564 xlrxxfl.exe 30 PID 2564 wrote to memory of 2616 2564 xlrxxfl.exe 30 PID 2564 wrote to memory of 2616 2564 xlrxxfl.exe 30 PID 2616 wrote to memory of 2532 2616 jvjjv.exe 31 PID 2616 wrote to memory of 2532 2616 jvjjv.exe 31 PID 2616 wrote to memory of 2532 2616 jvjjv.exe 31 PID 2616 wrote to memory of 2532 2616 jvjjv.exe 31 PID 2532 wrote to memory of 2724 2532 llllxlx.exe 32 PID 2532 wrote to memory of 2724 2532 llllxlx.exe 32 PID 2532 wrote to memory of 2724 2532 llllxlx.exe 32 PID 2532 wrote to memory of 2724 2532 llllxlx.exe 32 PID 2724 wrote to memory of 1880 2724 5nbtbb.exe 33 PID 2724 wrote to memory of 1880 2724 5nbtbb.exe 33 PID 2724 wrote to memory of 1880 2724 5nbtbb.exe 33 PID 2724 wrote to memory of 1880 2724 5nbtbb.exe 33 PID 1880 wrote to memory of 2480 1880 httnhh.exe 34 PID 1880 wrote to memory of 2480 1880 httnhh.exe 34 PID 1880 wrote to memory of 2480 1880 httnhh.exe 34 PID 1880 wrote to memory of 2480 1880 httnhh.exe 34 PID 2480 wrote to memory of 2456 2480 dpppp.exe 35 PID 2480 wrote to memory of 2456 2480 dpppp.exe 35 PID 2480 wrote to memory of 2456 2480 dpppp.exe 35 PID 2480 wrote to memory of 2456 2480 dpppp.exe 35 PID 2456 wrote to memory of 1968 2456 xlxxrxx.exe 36 PID 2456 wrote to memory of 1968 2456 xlxxrxx.exe 36 PID 2456 wrote to memory of 1968 2456 xlxxrxx.exe 36 PID 2456 wrote to memory of 1968 2456 xlxxrxx.exe 36 PID 1968 wrote to memory of 1436 1968 htbbtn.exe 37 PID 1968 wrote to memory of 1436 1968 htbbtn.exe 37 PID 1968 wrote to memory of 1436 1968 htbbtn.exe 37 PID 1968 wrote to memory of 1436 1968 htbbtn.exe 37 PID 1436 wrote to memory of 1364 1436 bnnnbb.exe 38 PID 1436 wrote to memory of 1364 1436 bnnnbb.exe 38 PID 1436 wrote to memory of 1364 1436 bnnnbb.exe 38 PID 1436 wrote to memory of 1364 1436 bnnnbb.exe 38 PID 1364 wrote to memory of 1776 1364 pvvpj.exe 39 PID 1364 wrote to memory of 1776 1364 pvvpj.exe 39 PID 1364 wrote to memory of 1776 1364 pvvpj.exe 39 PID 1364 wrote to memory of 1776 1364 pvvpj.exe 39 PID 1776 wrote to memory of 1256 1776 lrxlfxx.exe 40 PID 1776 wrote to memory of 1256 1776 lrxlfxx.exe 40 PID 1776 wrote to memory of 1256 1776 lrxlfxx.exe 40 PID 1776 wrote to memory of 1256 1776 lrxlfxx.exe 40 PID 1256 wrote to memory of 1464 1256 3rxrxrx.exe 41 PID 1256 wrote to memory of 1464 1256 3rxrxrx.exe 41 PID 1256 wrote to memory of 1464 1256 3rxrxrx.exe 41 PID 1256 wrote to memory of 1464 1256 3rxrxrx.exe 41 PID 1464 wrote to memory of 2400 1464 9fxfrrf.exe 42 PID 1464 wrote to memory of 2400 1464 9fxfrrf.exe 42 PID 1464 wrote to memory of 2400 1464 9fxfrrf.exe 42 PID 1464 wrote to memory of 2400 1464 9fxfrrf.exe 42 PID 2400 wrote to memory of 2716 2400 fllfxxr.exe 43 PID 2400 wrote to memory of 2716 2400 fllfxxr.exe 43 PID 2400 wrote to memory of 2716 2400 fllfxxr.exe 43 PID 2400 wrote to memory of 2716 2400 fllfxxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe"C:\Users\Admin\AppData\Local\Temp\30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jvdjd.exec:\jvdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xlrxxfl.exec:\xlrxxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jvjjv.exec:\jvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\llllxlx.exec:\llllxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\5nbtbb.exec:\5nbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\httnhh.exec:\httnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\dpppp.exec:\dpppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\htbbtn.exec:\htbbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\bnnnbb.exec:\bnnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\pvvpj.exec:\pvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\lrxlfxx.exec:\lrxlfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\3rxrxrx.exec:\3rxrxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\9fxfrrf.exec:\9fxfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\fllfxxr.exec:\fllfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\7vjdd.exec:\7vjdd.exe17⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vjjjp.exec:\vjjjp.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpppp.exec:\vpppp.exe19⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bhntnn.exec:\bhntnn.exe20⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bttbtn.exec:\bttbtn.exe21⤵
- Executes dropped EXE
PID:792 -
\??\c:\rfxxlxl.exec:\rfxxlxl.exe22⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5vvvv.exec:\5vvvv.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bnttth.exec:\bnttth.exe24⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7lxflll.exec:\7lxflll.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bntnnn.exec:\bntnnn.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\fxfrrrr.exec:\fxfrrrr.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pdpvv.exec:\pdpvv.exe28⤵
- Executes dropped EXE
PID:276 -
\??\c:\xrxrllr.exec:\xrxrllr.exe29⤵
- Executes dropped EXE
PID:3004 -
\??\c:\httbbn.exec:\httbbn.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dpvvv.exec:\dpvvv.exe31⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnbbnt.exec:\tnbbnt.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrfffff.exec:\xrfffff.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hnnhhh.exec:\hnnhhh.exe34⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3rffxrr.exec:\3rffxrr.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnhbhn.exec:\bnhbhn.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pjjpp.exec:\pjjpp.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7pvvd.exec:\7pvvd.exe39⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3rxllrr.exec:\3rxllrr.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7ppvv.exec:\7ppvv.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lxfffff.exec:\lxfffff.exe42⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jpppv.exec:\jpppv.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\htttnb.exec:\htttnb.exe44⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rxffrrl.exec:\rxffrrl.exe45⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7pdvv.exec:\7pdvv.exe46⤵
- Executes dropped EXE
PID:844 -
\??\c:\7tbnhn.exec:\7tbnhn.exe47⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3xrlrxf.exec:\3xrlrxf.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dvvdd.exec:\dvvdd.exe49⤵
- Executes dropped EXE
PID:1456 -
\??\c:\httthn.exec:\httthn.exe50⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rflllfl.exec:\rflllfl.exe51⤵
- Executes dropped EXE
PID:1464 -
\??\c:\llxxxxf.exec:\llxxxxf.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vjdpj.exec:\vjdpj.exe53⤵
- Executes dropped EXE
PID:3052 -
\??\c:\thnhnh.exec:\thnhnh.exe54⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rflfxfx.exec:\rflfxfx.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\jvvpv.exec:\jvvpv.exe56⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hhhbh.exec:\7hhhbh.exe57⤵
- Executes dropped EXE
PID:608 -
\??\c:\fxfxfff.exec:\fxfxfff.exe58⤵
- Executes dropped EXE
PID:488 -
\??\c:\9tnhnn.exec:\9tnhnn.exe59⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhtnbb.exec:\nhtnbb.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rlxxrrr.exec:\rlxxrrr.exe61⤵
- Executes dropped EXE
PID:748 -
\??\c:\jdjvv.exec:\jdjvv.exe62⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbnhhb.exec:\hbnhhb.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1rfxfxx.exec:\1rfxfxx.exe64⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5bbntb.exec:\5bbntb.exe65⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5rxrxrx.exec:\5rxrxrx.exe66⤵PID:1684
-
\??\c:\bnthhh.exec:\bnthhh.exe67⤵PID:1820
-
\??\c:\dvppd.exec:\dvppd.exe68⤵PID:912
-
\??\c:\5bhnnt.exec:\5bhnnt.exe69⤵PID:332
-
\??\c:\djpvd.exec:\djpvd.exe70⤵PID:2076
-
\??\c:\rrrrllr.exec:\rrrrllr.exe71⤵PID:2392
-
\??\c:\bnbtnb.exec:\bnbtnb.exe72⤵PID:1280
-
\??\c:\lrxffrx.exec:\lrxffrx.exe73⤵PID:2012
-
\??\c:\nnnnbb.exec:\nnnnbb.exe74⤵PID:1532
-
\??\c:\jjppd.exec:\jjppd.exe75⤵PID:2224
-
\??\c:\flrrrll.exec:\flrrrll.exe76⤵PID:2888
-
\??\c:\vpvvd.exec:\vpvvd.exe77⤵PID:2556
-
\??\c:\rfxxlxl.exec:\rfxxlxl.exe78⤵PID:2520
-
\??\c:\jjvpv.exec:\jjvpv.exe79⤵PID:2752
-
\??\c:\5xffllr.exec:\5xffllr.exe80⤵PID:2748
-
\??\c:\nnbttt.exec:\nnbttt.exe81⤵PID:2628
-
\??\c:\5xllfxl.exec:\5xllfxl.exe82⤵PID:2528
-
\??\c:\9hnttt.exec:\9hnttt.exe83⤵PID:2824
-
\??\c:\flrxxrr.exec:\flrxxrr.exe84⤵PID:1584
-
\??\c:\3htbnn.exec:\3htbnn.exe85⤵PID:2456
-
\??\c:\dvdjv.exec:\dvdjv.exe86⤵PID:1196
-
\??\c:\bntntb.exec:\bntntb.exe87⤵PID:1632
-
\??\c:\djjjp.exec:\djjjp.exe88⤵PID:280
-
\??\c:\xrxxfll.exec:\xrxxfll.exe89⤵PID:1752
-
\??\c:\jvdjp.exec:\jvdjp.exe90⤵PID:2348
-
\??\c:\vpvvp.exec:\vpvvp.exe91⤵PID:1612
-
\??\c:\5rllxrr.exec:\5rllxrr.exe92⤵PID:1192
-
\??\c:\ddvjd.exec:\ddvjd.exe93⤵PID:1692
-
\??\c:\7lxxflx.exec:\7lxxflx.exe94⤵PID:2720
-
\??\c:\7hhhhh.exec:\7hhhhh.exe95⤵PID:2028
-
\??\c:\vddpp.exec:\vddpp.exe96⤵PID:1968
-
\??\c:\htthhb.exec:\htthhb.exe97⤵PID:2728
-
\??\c:\vpppv.exec:\vpppv.exe98⤵PID:1420
-
\??\c:\nhthbh.exec:\nhthbh.exe99⤵PID:2776
-
\??\c:\pdddj.exec:\pdddj.exe100⤵PID:328
-
\??\c:\xrrxflx.exec:\xrrxflx.exe101⤵PID:792
-
\??\c:\vjppp.exec:\vjppp.exe102⤵PID:1812
-
\??\c:\pjvvd.exec:\pjvvd.exe103⤵PID:748
-
\??\c:\rffffff.exec:\rffffff.exe104⤵PID:2488
-
\??\c:\nhhbhn.exec:\nhhbhn.exe105⤵PID:2324
-
\??\c:\7dpdj.exec:\7dpdj.exe106⤵PID:296
-
\??\c:\5lflxrr.exec:\5lflxrr.exe107⤵PID:892
-
\??\c:\nbtthn.exec:\nbtthn.exe108⤵PID:1724
-
\??\c:\lfflxxl.exec:\lfflxxl.exe109⤵PID:552
-
\??\c:\tthntt.exec:\tthntt.exe110⤵PID:864
-
\??\c:\7xrrflf.exec:\7xrrflf.exe111⤵PID:1020
-
\??\c:\nhhttb.exec:\nhhttb.exe112⤵PID:2252
-
\??\c:\vpvpv.exec:\vpvpv.exe113⤵PID:888
-
\??\c:\hhbhnb.exec:\hhbhnb.exe114⤵PID:2092
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe115⤵PID:2012
-
\??\c:\tnbhnb.exec:\tnbhnb.exe116⤵PID:2872
-
\??\c:\jdddj.exec:\jdddj.exe117⤵PID:2892
-
\??\c:\hbbhtt.exec:\hbbhtt.exe118⤵PID:1640
-
\??\c:\jddjv.exec:\jddjv.exe119⤵PID:2620
-
\??\c:\ffrxlxf.exec:\ffrxlxf.exe120⤵PID:2664
-
\??\c:\tnbtbn.exec:\tnbtbn.exe121⤵PID:1744
-
\??\c:\vvjvd.exec:\vvjvd.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-