Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 02:36
Behavioral task
behavioral1
Sample
c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe
-
Size
160KB
-
MD5
2d49d18f94b46100e57d82a5eda63d78
-
SHA1
d79faf8efc36d2249241a58138f9c9e142684cd9
-
SHA256
c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604
-
SHA512
dc35adc61de1e0ea6e352ceae8564cf18894bccd77a483b1a5d0a894ffc6ccb81459becbe4c93498ea02980e9f8ab3c3006db1f289c91c0929ef8b208fffba71
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout0fmCiiiXAQ5lpBoGYwNNhu0CzhKPDNuBZ:xcm4FmowdHoSgWrXF5lpKGYV0wh6Dk
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2356-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-151-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2792-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-199-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2784-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-341-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2468-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-359-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2468-400-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2924-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-484-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-684-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2364-828-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-1034-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2356-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2356-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000014825-66.dat UPX behavioral1/files/0x00070000000149f5-72.dat UPX behavioral1/files/0x00090000000146c0-56.dat UPX behavioral1/files/0x00070000000146a2-42.dat UPX behavioral1/memory/2652-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2620-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014abe-81.dat UPX behavioral1/memory/2460-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014af6-88.dat UPX behavioral1/memory/2612-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2608-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000146b8-49.dat UPX behavioral1/memory/2808-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2640-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000143ec-25.dat UPX behavioral1/memory/2388-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014667-33.dat UPX behavioral1/files/0x000c0000000141c0-17.dat UPX behavioral1/memory/2368-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000014120-8.dat UPX behavioral1/memory/1184-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014b31-96.dat UPX behavioral1/memory/2188-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014b70-104.dat UPX behavioral1/memory/2176-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014ef8-121.dat UPX behavioral1/memory/1668-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000155ed-137.dat UPX behavioral1/files/0x00060000000155f3-144.dat UPX behavioral1/files/0x00060000000155f7-153.dat UPX behavioral1/memory/2792-151-0x00000000002D0000-0x00000000002F7000-memory.dmp UPX behavioral1/memory/2792-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015605-160.dat UPX behavioral1/memory/2500-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015018-129.dat UPX behavioral1/files/0x0006000000014de9-113.dat UPX behavioral1/memory/2784-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015616-169.dat UPX behavioral1/files/0x0006000000015626-176.dat UPX behavioral1/files/0x0006000000015b6f-183.dat UPX behavioral1/memory/2840-184-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c3d-190.dat UPX behavioral1/files/0x0006000000015c52-201.dat UPX behavioral1/files/0x0006000000015c6b-209.dat UPX behavioral1/memory/684-207-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c78-217.dat UPX behavioral1/files/0x0006000000015c83-223.dat UPX behavioral1/memory/2432-224-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000900000001448a-231.dat UPX behavioral1/memory/1852-234-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c9f-239.dat UPX behavioral1/memory/1132-246-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cb6-248.dat UPX behavioral1/memory/1448-255-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cce-256.dat UPX behavioral1/memory/2376-262-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2992-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2992-279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2044-290-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2532-304-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2240-320-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2468-363-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2368 pjvdp.exe 2388 lxxlrxf.exe 2640 5hhbhb.exe 2808 9vppj.exe 2652 jdvpd.exe 2608 3rffffr.exe 2612 hbbnbh.exe 2628 tnhhhh.exe 2620 vpdjv.exe 2460 nhbhnt.exe 1184 hbthbh.exe 2188 ddvjp.exe 2176 frlrxxl.exe 2500 hbtbht.exe 1668 5bnnbb.exe 1860 jvdjp.exe 1308 frxfllr.exe 2792 lfrlxfl.exe 1744 9tbhtb.exe 2784 5vjpp.exe 2020 rllfxrr.exe 2840 rlfrffr.exe 2024 dpdjd.exe 2104 jvppv.exe 684 hbnnhh.exe 1916 nhntnt.exe 1452 vjpdd.exe 2432 rlllxlf.exe 1852 dpvjv.exe 1132 3rxxxxf.exe 1856 3btbhb.exe 1448 vjddd.exe 2376 vpvdp.exe 2888 vjpjv.exe 2992 hhhthh.exe 1092 3jvjj.exe 2044 7dpvv.exe 1976 rllfflr.exe 2532 ththtt.exe 2556 vjpvj.exe 1716 frfflrx.exe 2240 llfxxfl.exe 1592 nhntbb.exe 2832 5vddd.exe 1740 rlxlllr.exe 2624 lrxxfff.exe 2092 btnntn.exe 848 3jddp.exe 2480 frflflx.exe 2468 rfrrxrr.exe 2716 9htbhh.exe 2952 1vvjj.exe 2448 9rffrrr.exe 2956 rfrxxrr.exe 1656 nbnbhn.exe 1672 1nbntb.exe 2824 dvpvd.exe 1632 xlrxxff.exe 952 btnthb.exe 2676 3jvpv.exe 2340 lfrlxlx.exe 2760 rrflrlr.exe 768 xrfrllr.exe 380 bnttbb.exe -
resource yara_rule behavioral1/memory/2356-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014825-66.dat upx behavioral1/files/0x00070000000149f5-72.dat upx behavioral1/files/0x00090000000146c0-56.dat upx behavioral1/files/0x00070000000146a2-42.dat upx behavioral1/memory/2652-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014abe-81.dat upx behavioral1/memory/2460-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014af6-88.dat upx behavioral1/memory/2612-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000146b8-49.dat upx behavioral1/memory/2808-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000143ec-25.dat upx behavioral1/memory/2388-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014667-33.dat upx behavioral1/files/0x000c0000000141c0-17.dat upx behavioral1/memory/2368-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014120-8.dat upx behavioral1/memory/1184-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b31-96.dat upx behavioral1/memory/2188-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b70-104.dat upx behavioral1/memory/2176-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014ef8-121.dat upx behavioral1/memory/1668-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155ed-137.dat upx behavioral1/files/0x00060000000155f3-144.dat upx behavioral1/files/0x00060000000155f7-153.dat upx behavioral1/memory/2792-151-0x00000000002D0000-0x00000000002F7000-memory.dmp upx behavioral1/memory/2792-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015605-160.dat upx behavioral1/memory/2500-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015018-129.dat upx behavioral1/files/0x0006000000014de9-113.dat upx behavioral1/memory/2784-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015616-169.dat upx behavioral1/files/0x0006000000015626-176.dat upx behavioral1/files/0x0006000000015b6f-183.dat upx behavioral1/memory/2840-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c3d-190.dat upx behavioral1/memory/2792-199-0x00000000002D0000-0x00000000002F7000-memory.dmp upx behavioral1/files/0x0006000000015c52-201.dat upx behavioral1/files/0x0006000000015c6b-209.dat upx behavioral1/memory/684-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c78-217.dat upx behavioral1/files/0x0006000000015c83-223.dat upx behavioral1/memory/2432-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001448a-231.dat upx behavioral1/memory/1852-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9f-239.dat upx behavioral1/memory/1132-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb6-248.dat upx behavioral1/memory/1448-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cce-256.dat upx behavioral1/memory/2376-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2044-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-320-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2368 2356 c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe 28 PID 2356 wrote to memory of 2368 2356 c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe 28 PID 2356 wrote to memory of 2368 2356 c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe 28 PID 2356 wrote to memory of 2368 2356 c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe 28 PID 2368 wrote to memory of 2388 2368 pjvdp.exe 29 PID 2368 wrote to memory of 2388 2368 pjvdp.exe 29 PID 2368 wrote to memory of 2388 2368 pjvdp.exe 29 PID 2368 wrote to memory of 2388 2368 pjvdp.exe 29 PID 2388 wrote to memory of 2640 2388 lxxlrxf.exe 30 PID 2388 wrote to memory of 2640 2388 lxxlrxf.exe 30 PID 2388 wrote to memory of 2640 2388 lxxlrxf.exe 30 PID 2388 wrote to memory of 2640 2388 lxxlrxf.exe 30 PID 2640 wrote to memory of 2808 2640 5hhbhb.exe 31 PID 2640 wrote to memory of 2808 2640 5hhbhb.exe 31 PID 2640 wrote to memory of 2808 2640 5hhbhb.exe 31 PID 2640 wrote to memory of 2808 2640 5hhbhb.exe 31 PID 2808 wrote to memory of 2652 2808 9vppj.exe 32 PID 2808 wrote to memory of 2652 2808 9vppj.exe 32 PID 2808 wrote to memory of 2652 2808 9vppj.exe 32 PID 2808 wrote to memory of 2652 2808 9vppj.exe 32 PID 2652 wrote to memory of 2608 2652 jdvpd.exe 33 PID 2652 wrote to memory of 2608 2652 jdvpd.exe 33 PID 2652 wrote to memory of 2608 2652 jdvpd.exe 33 PID 2652 wrote to memory of 2608 2652 jdvpd.exe 33 PID 2608 wrote to memory of 2612 2608 3rffffr.exe 34 PID 2608 wrote to memory of 2612 2608 3rffffr.exe 34 PID 2608 wrote to memory of 2612 2608 3rffffr.exe 34 PID 2608 wrote to memory of 2612 2608 3rffffr.exe 34 PID 2612 wrote to memory of 2628 2612 hbbnbh.exe 35 PID 2612 wrote to memory of 2628 2612 hbbnbh.exe 35 PID 2612 wrote to memory of 2628 2612 hbbnbh.exe 35 PID 2612 wrote to memory of 2628 2612 hbbnbh.exe 35 PID 2628 wrote to memory of 2620 2628 tnhhhh.exe 36 PID 2628 wrote to memory of 2620 2628 tnhhhh.exe 36 PID 2628 wrote to memory of 2620 2628 tnhhhh.exe 36 PID 2628 wrote to memory of 2620 2628 tnhhhh.exe 36 PID 2620 wrote to memory of 2460 2620 vpdjv.exe 37 PID 2620 wrote to memory of 2460 2620 vpdjv.exe 37 PID 2620 wrote to memory of 2460 2620 vpdjv.exe 37 PID 2620 wrote to memory of 2460 2620 vpdjv.exe 37 PID 2460 wrote to memory of 1184 2460 nhbhnt.exe 38 PID 2460 wrote to memory of 1184 2460 nhbhnt.exe 38 PID 2460 wrote to memory of 1184 2460 nhbhnt.exe 38 PID 2460 wrote to memory of 1184 2460 nhbhnt.exe 38 PID 1184 wrote to memory of 2188 1184 hbthbh.exe 39 PID 1184 wrote to memory of 2188 1184 hbthbh.exe 39 PID 1184 wrote to memory of 2188 1184 hbthbh.exe 39 PID 1184 wrote to memory of 2188 1184 hbthbh.exe 39 PID 2188 wrote to memory of 2176 2188 ddvjp.exe 40 PID 2188 wrote to memory of 2176 2188 ddvjp.exe 40 PID 2188 wrote to memory of 2176 2188 ddvjp.exe 40 PID 2188 wrote to memory of 2176 2188 ddvjp.exe 40 PID 2176 wrote to memory of 2500 2176 frlrxxl.exe 41 PID 2176 wrote to memory of 2500 2176 frlrxxl.exe 41 PID 2176 wrote to memory of 2500 2176 frlrxxl.exe 41 PID 2176 wrote to memory of 2500 2176 frlrxxl.exe 41 PID 2500 wrote to memory of 1668 2500 hbtbht.exe 42 PID 2500 wrote to memory of 1668 2500 hbtbht.exe 42 PID 2500 wrote to memory of 1668 2500 hbtbht.exe 42 PID 2500 wrote to memory of 1668 2500 hbtbht.exe 42 PID 1668 wrote to memory of 1860 1668 5bnnbb.exe 43 PID 1668 wrote to memory of 1860 1668 5bnnbb.exe 43 PID 1668 wrote to memory of 1860 1668 5bnnbb.exe 43 PID 1668 wrote to memory of 1860 1668 5bnnbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe"C:\Users\Admin\AppData\Local\Temp\c511d0c0425c42a45d929c45b38a37ece992986e6430db5fe98fe84743e23604.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pjvdp.exec:\pjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\lxxlrxf.exec:\lxxlrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\5hhbhb.exec:\5hhbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9vppj.exec:\9vppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jdvpd.exec:\jdvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3rffffr.exec:\3rffffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbbnbh.exec:\hbbnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tnhhhh.exec:\tnhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vpdjv.exec:\vpdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nhbhnt.exec:\nhbhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\hbthbh.exec:\hbthbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ddvjp.exec:\ddvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\frlrxxl.exec:\frlrxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hbtbht.exec:\hbtbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\5bnnbb.exec:\5bnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\jvdjp.exec:\jvdjp.exe17⤵
- Executes dropped EXE
PID:1860 -
\??\c:\frxfllr.exec:\frxfllr.exe18⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe19⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9tbhtb.exec:\9tbhtb.exe20⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5vjpp.exec:\5vjpp.exe21⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rllfxrr.exec:\rllfxrr.exe22⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rlfrffr.exec:\rlfrffr.exe23⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpdjd.exec:\dpdjd.exe24⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvppv.exec:\jvppv.exe25⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbnnhh.exec:\hbnnhh.exe26⤵
- Executes dropped EXE
PID:684 -
\??\c:\nhntnt.exec:\nhntnt.exe27⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vjpdd.exec:\vjpdd.exe28⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rlllxlf.exec:\rlllxlf.exe29⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dpvjv.exec:\dpvjv.exe30⤵
- Executes dropped EXE
PID:1852 -
\??\c:\3rxxxxf.exec:\3rxxxxf.exe31⤵
- Executes dropped EXE
PID:1132 -
\??\c:\3btbhb.exec:\3btbhb.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vjddd.exec:\vjddd.exe33⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vpvdp.exec:\vpvdp.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vjpjv.exec:\vjpjv.exe35⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhhthh.exec:\hhhthh.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3jvjj.exec:\3jvjj.exe37⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7dpvv.exec:\7dpvv.exe38⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rllfflr.exec:\rllfflr.exe39⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe40⤵PID:2356
-
\??\c:\ththtt.exec:\ththtt.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vjpvj.exec:\vjpvj.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\frfflrx.exec:\frfflrx.exe43⤵
- Executes dropped EXE
PID:1716 -
\??\c:\llfxxfl.exec:\llfxxfl.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nhntbb.exec:\nhntbb.exe45⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5vddd.exec:\5vddd.exe46⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rlxlllr.exec:\rlxlllr.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lrxxfff.exec:\lrxxfff.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\btnntn.exec:\btnntn.exe49⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3jddp.exec:\3jddp.exe50⤵
- Executes dropped EXE
PID:848 -
\??\c:\frflflx.exec:\frflflx.exe51⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rfrrxrr.exec:\rfrrxrr.exe52⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9htbhh.exec:\9htbhh.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1vvjj.exec:\1vvjj.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9rffrrr.exec:\9rffrrr.exe55⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rfrxxrr.exec:\rfrxxrr.exe56⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nbnbhn.exec:\nbnbhn.exe57⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1nbntb.exec:\1nbntb.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvpvd.exec:\dvpvd.exe59⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xlrxxff.exec:\xlrxxff.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\btnthb.exec:\btnthb.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\3jvpv.exec:\3jvpv.exe62⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfrlxlx.exec:\lfrlxlx.exe63⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rrflrlr.exec:\rrflrlr.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrfrllr.exec:\xrfrllr.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\bnttbb.exec:\bnttbb.exe66⤵
- Executes dropped EXE
PID:380 -
\??\c:\jjjjv.exec:\jjjjv.exe67⤵PID:2688
-
\??\c:\lxffrrx.exec:\lxffrrx.exe68⤵PID:1556
-
\??\c:\5ffrffl.exec:\5ffrffl.exe69⤵PID:2924
-
\??\c:\vpjjp.exec:\vpjjp.exe70⤵PID:2296
-
\??\c:\rlrfrfl.exec:\rlrfrfl.exe71⤵PID:1960
-
\??\c:\5hbnbb.exec:\5hbnbb.exe72⤵PID:2252
-
\??\c:\1vvdj.exec:\1vvdj.exe73⤵PID:2024
-
\??\c:\rlflfrl.exec:\rlflfrl.exe74⤵PID:2552
-
\??\c:\nhntbn.exec:\nhntbn.exe75⤵PID:268
-
\??\c:\thnntb.exec:\thnntb.exe76⤵PID:828
-
\??\c:\vjppv.exec:\vjppv.exe77⤵PID:1664
-
\??\c:\btnbhb.exec:\btnbhb.exe78⤵PID:3068
-
\??\c:\jdppd.exec:\jdppd.exe79⤵PID:1660
-
\??\c:\xrffrrx.exec:\xrffrrx.exe80⤵PID:1792
-
\??\c:\vvpvp.exec:\vvpvp.exe81⤵PID:1832
-
\??\c:\5djjp.exec:\5djjp.exe82⤵PID:2984
-
\??\c:\1rxrxfr.exec:\1rxrxfr.exe83⤵PID:960
-
\??\c:\hthtbb.exec:\hthtbb.exe84⤵PID:1084
-
\??\c:\jdppd.exec:\jdppd.exe85⤵PID:1116
-
\??\c:\dvdjp.exec:\dvdjp.exe86⤵PID:2916
-
\??\c:\fxflrrf.exec:\fxflrrf.exe87⤵PID:2888
-
\??\c:\hbhnbb.exec:\hbhnbb.exe88⤵PID:2316
-
\??\c:\lfllxfl.exec:\lfllxfl.exe89⤵PID:3040
-
\??\c:\7rxlrfl.exec:\7rxlrfl.exe90⤵PID:2368
-
\??\c:\tthhnt.exec:\tthhnt.exe91⤵PID:2388
-
\??\c:\jdpjj.exec:\jdpjj.exe92⤵PID:2352
-
\??\c:\vpddp.exec:\vpddp.exe93⤵PID:2652
-
\??\c:\3rlxffr.exec:\3rlxffr.exe94⤵PID:2288
-
\??\c:\7frxlrf.exec:\7frxlrf.exe95⤵PID:2644
-
\??\c:\tntthn.exec:\tntthn.exe96⤵PID:1588
-
\??\c:\nhbntn.exec:\nhbntn.exe97⤵PID:2568
-
\??\c:\1jvdj.exec:\1jvdj.exe98⤵PID:2656
-
\??\c:\xxxrxlf.exec:\xxxrxlf.exe99⤵PID:2740
-
\??\c:\lflxrrx.exec:\lflxrrx.exe100⤵PID:2512
-
\??\c:\7dpvj.exec:\7dpvj.exe101⤵PID:2564
-
\??\c:\vvpdv.exec:\vvpdv.exe102⤵PID:2508
-
\??\c:\7rxlxrl.exec:\7rxlxrl.exe103⤵PID:2648
-
\??\c:\frfrrrx.exec:\frfrrrx.exe104⤵PID:2588
-
\??\c:\thbhtb.exec:\thbhtb.exe105⤵PID:1184
-
\??\c:\hbtttt.exec:\hbtttt.exe106⤵PID:3020
-
\??\c:\dvvvj.exec:\dvvvj.exe107⤵PID:2948
-
\??\c:\lfxxffr.exec:\lfxxffr.exe108⤵PID:2400
-
\??\c:\xrffllr.exec:\xrffllr.exe109⤵PID:2788
-
\??\c:\fxlflrx.exec:\fxlflrx.exe110⤵PID:932
-
\??\c:\thtthn.exec:\thtthn.exe111⤵PID:2032
-
\??\c:\pjpdv.exec:\pjpdv.exe112⤵PID:1480
-
\??\c:\jvpdv.exec:\jvpdv.exe113⤵PID:1604
-
\??\c:\fxffrlx.exec:\fxffrlx.exe114⤵PID:2768
-
\??\c:\5thnbh.exec:\5thnbh.exe115⤵PID:1280
-
\??\c:\5pjvd.exec:\5pjvd.exe116⤵PID:1528
-
\??\c:\dpjdj.exec:\dpjdj.exe117⤵PID:1520
-
\??\c:\lffffrx.exec:\lffffrx.exe118⤵PID:1512
-
\??\c:\nhhbhh.exec:\nhhbhh.exe119⤵PID:2940
-
\??\c:\bntbtb.exec:\bntbtb.exe120⤵PID:1764
-
\??\c:\rllffxl.exec:\rllffxl.exe121⤵PID:2848
-
\??\c:\xlflrfr.exec:\xlflrfr.exe122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-