Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 04:07
Behavioral task
behavioral1
Sample
cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe
-
Size
537KB
-
MD5
efcb3864632d0799969138af2d06fcc9
-
SHA1
2fd3741dd2d285ba4f5f2f87f57b7808513666f5
-
SHA256
cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc
-
SHA512
9eadc991732649ce4eb85e47d017fceb6ff9c02b33c3372289e9c32b3d069a5aff02770234ac4b606590f5c420c3a5253cc13fee5259e711d5a6dccd1b4b8628
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZj:HFp3lzZbGa5soj
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1848-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-126-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1808-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-252-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/3044-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1068-292-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/1068-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-270-0x0000000000350000-0x0000000000377000-memory.dmp family_blackmoon behavioral1/memory/2744-356-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2232-357-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2744-358-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2744-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-359-0x0000000000340000-0x0000000000367000-memory.dmp family_blackmoon behavioral1/memory/2604-377-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1660-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-390-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2888-404-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2820-437-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1632-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-464-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2308-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-471-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2820-486-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2268-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000900000001447e-5.dat UPX behavioral1/memory/1848-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000014539-18.dat UPX behavioral1/memory/2552-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000149f5-28.dat UPX behavioral1/memory/2080-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2124-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2080-33-0x00000000003C0000-0x00000000003E7000-memory.dmp UPX behavioral1/memory/2676-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014b70-39.dat UPX behavioral1/memory/2824-51-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000014de9-49.dat UPX behavioral1/files/0x0009000000014ef8-59.dat UPX behavioral1/memory/2628-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000015018-66.dat UPX behavioral1/memory/2640-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000155ed-76.dat UPX behavioral1/memory/2948-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000155f3-86.dat UPX behavioral1/memory/2132-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000155f7-96.dat UPX behavioral1/memory/2868-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015605-106.dat UPX behavioral1/files/0x0006000000015616-114.dat UPX behavioral1/memory/2692-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015626-124.dat UPX behavioral1/files/0x0008000000014abe-131.dat UPX behavioral1/files/0x0006000000015b6f-140.dat UPX behavioral1/files/0x0006000000015c3d-149.dat UPX behavioral1/files/0x0006000000015c52-158.dat UPX behavioral1/memory/1808-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c6b-167.dat UPX behavioral1/memory/2072-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2316-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c78-178.dat UPX behavioral1/files/0x0006000000015c83-188.dat UPX behavioral1/files/0x0006000000015c9f-196.dat UPX behavioral1/memory/1464-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/848-200-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cb6-206.dat UPX behavioral1/files/0x0006000000015cce-216.dat UPX behavioral1/memory/2440-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cee-223.dat UPX behavioral1/memory/2440-222-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2016-225-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cf6-233.dat UPX behavioral1/memory/2008-235-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cfe-242.dat UPX behavioral1/files/0x0006000000015d07-249.dat UPX behavioral1/memory/1464-252-0x00000000002E0000-0x0000000000307000-memory.dmp UPX behavioral1/files/0x0006000000015d1a-267.dat UPX behavioral1/files/0x0006000000015d31-284.dat UPX behavioral1/memory/1632-315-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3044-301-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d98-294.dat UPX behavioral1/memory/1068-291-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d27-276.dat UPX behavioral1/files/0x0006000000015d0f-259.dat UPX behavioral1/memory/2744-356-0x0000000000230000-0x0000000000257000-memory.dmp UPX behavioral1/memory/2744-342-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2492-359-0x0000000000340000-0x0000000000367000-memory.dmp UPX behavioral1/memory/1660-389-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1632-418-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2124 3xrxrxf.exe 2552 1btbhh.exe 2080 ppdjv.exe 2676 tthbht.exe 2824 xxxlxff.exe 2628 xxxxflf.exe 2640 jdvdj.exe 2480 xxlxrfx.exe 2948 vpvvv.exe 2132 ttntbh.exe 2868 jjdjv.exe 2692 5jjpd.exe 2812 tnhntt.exe 2728 jdjpv.exe 2856 nhhtbn.exe 1808 fxfrflx.exe 896 bbnbbh.exe 2072 jjjjv.exe 2316 5httbh.exe 1464 tnhtbh.exe 848 lxrrxxx.exe 1136 jvddp.exe 2440 xfrffll.exe 2016 btbhnb.exe 2008 3pvvv.exe 1972 nbtbnb.exe 908 jvdjp.exe 3012 tthhnh.exe 1376 vpdpp.exe 2232 hhtthh.exe 1068 1pvpj.exe 3044 ttthnt.exe 2348 9lrxfrx.exe 2840 9jdjv.exe 1632 1thntn.exe 2612 xrffffl.exe 2660 5nhtnt.exe 2752 rlfrxlr.exe 2744 nhtthh.exe 2160 jdddj.exe 2492 1xfffrr.exe 2604 tntbnn.exe 2172 thntnt.exe 3064 bnbbht.exe 1660 3vddv.exe 2792 fxxrxxf.exe 2888 nthnnn.exe 2868 7fxfrxf.exe 2908 frffflr.exe 944 jdpvd.exe 2820 1jdvv.exe 2872 btnntb.exe 1788 jddjj.exe 940 rlxfllx.exe 2308 xrfffxx.exe 1428 nnnnbb.exe 2072 pjjjj.exe 652 hhhntt.exe 3008 7xrrrrr.exe 668 rlxflrx.exe 2128 pdpvv.exe 2156 rlffllr.exe 2268 9nhnhh.exe 2276 xrrxffr.exe -
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001447e-5.dat upx behavioral1/memory/1848-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014539-18.dat upx behavioral1/memory/2552-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000149f5-28.dat upx behavioral1/memory/2080-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-33-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2676-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014b70-39.dat upx behavioral1/memory/2824-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000014de9-49.dat upx behavioral1/files/0x0009000000014ef8-59.dat upx behavioral1/memory/2628-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015018-66.dat upx behavioral1/memory/2640-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000155ed-76.dat upx behavioral1/memory/2948-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000155f3-86.dat upx behavioral1/memory/2132-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000155f7-96.dat upx behavioral1/memory/2868-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015605-106.dat upx behavioral1/files/0x0006000000015616-114.dat upx behavioral1/memory/2692-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015626-124.dat upx behavioral1/files/0x0008000000014abe-131.dat upx behavioral1/files/0x0006000000015b6f-140.dat upx behavioral1/files/0x0006000000015c3d-149.dat upx behavioral1/files/0x0006000000015c52-158.dat upx behavioral1/memory/1808-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c6b-167.dat upx behavioral1/memory/2072-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2072-175-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2316-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c78-178.dat upx behavioral1/files/0x0006000000015c83-188.dat upx behavioral1/files/0x0006000000015c9f-196.dat upx behavioral1/memory/1464-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/848-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb6-206.dat upx behavioral1/files/0x0006000000015cce-216.dat upx behavioral1/memory/2440-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cee-223.dat upx behavioral1/memory/2440-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf6-233.dat upx behavioral1/memory/2008-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cfe-242.dat upx behavioral1/files/0x0006000000015d07-249.dat upx behavioral1/memory/1464-252-0x00000000002E0000-0x0000000000307000-memory.dmp upx behavioral1/files/0x0006000000015d1a-267.dat upx behavioral1/files/0x0006000000015d31-284.dat upx behavioral1/memory/1632-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d98-294.dat upx behavioral1/memory/1068-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d27-276.dat upx behavioral1/files/0x0006000000015d0f-259.dat upx behavioral1/memory/2744-356-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/memory/2744-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-359-0x0000000000340000-0x0000000000367000-memory.dmp upx behavioral1/memory/1660-389-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2124 1848 cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe 28 PID 1848 wrote to memory of 2124 1848 cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe 28 PID 1848 wrote to memory of 2124 1848 cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe 28 PID 1848 wrote to memory of 2124 1848 cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe 28 PID 2124 wrote to memory of 2552 2124 3xrxrxf.exe 29 PID 2124 wrote to memory of 2552 2124 3xrxrxf.exe 29 PID 2124 wrote to memory of 2552 2124 3xrxrxf.exe 29 PID 2124 wrote to memory of 2552 2124 3xrxrxf.exe 29 PID 2552 wrote to memory of 2080 2552 1btbhh.exe 30 PID 2552 wrote to memory of 2080 2552 1btbhh.exe 30 PID 2552 wrote to memory of 2080 2552 1btbhh.exe 30 PID 2552 wrote to memory of 2080 2552 1btbhh.exe 30 PID 2080 wrote to memory of 2676 2080 ppdjv.exe 31 PID 2080 wrote to memory of 2676 2080 ppdjv.exe 31 PID 2080 wrote to memory of 2676 2080 ppdjv.exe 31 PID 2080 wrote to memory of 2676 2080 ppdjv.exe 31 PID 2676 wrote to memory of 2824 2676 tthbht.exe 32 PID 2676 wrote to memory of 2824 2676 tthbht.exe 32 PID 2676 wrote to memory of 2824 2676 tthbht.exe 32 PID 2676 wrote to memory of 2824 2676 tthbht.exe 32 PID 2824 wrote to memory of 2628 2824 xxxlxff.exe 33 PID 2824 wrote to memory of 2628 2824 xxxlxff.exe 33 PID 2824 wrote to memory of 2628 2824 xxxlxff.exe 33 PID 2824 wrote to memory of 2628 2824 xxxlxff.exe 33 PID 2628 wrote to memory of 2640 2628 xxxxflf.exe 34 PID 2628 wrote to memory of 2640 2628 xxxxflf.exe 34 PID 2628 wrote to memory of 2640 2628 xxxxflf.exe 34 PID 2628 wrote to memory of 2640 2628 xxxxflf.exe 34 PID 2640 wrote to memory of 2480 2640 jdvdj.exe 35 PID 2640 wrote to memory of 2480 2640 jdvdj.exe 35 PID 2640 wrote to memory of 2480 2640 jdvdj.exe 35 PID 2640 wrote to memory of 2480 2640 jdvdj.exe 35 PID 2480 wrote to memory of 2948 2480 xxlxrfx.exe 36 PID 2480 wrote to memory of 2948 2480 xxlxrfx.exe 36 PID 2480 wrote to memory of 2948 2480 xxlxrfx.exe 36 PID 2480 wrote to memory of 2948 2480 xxlxrfx.exe 36 PID 2948 wrote to memory of 2132 2948 vpvvv.exe 37 PID 2948 wrote to memory of 2132 2948 vpvvv.exe 37 PID 2948 wrote to memory of 2132 2948 vpvvv.exe 37 PID 2948 wrote to memory of 2132 2948 vpvvv.exe 37 PID 2132 wrote to memory of 2868 2132 ttntbh.exe 38 PID 2132 wrote to memory of 2868 2132 ttntbh.exe 38 PID 2132 wrote to memory of 2868 2132 ttntbh.exe 38 PID 2132 wrote to memory of 2868 2132 ttntbh.exe 38 PID 2868 wrote to memory of 2692 2868 jjdjv.exe 39 PID 2868 wrote to memory of 2692 2868 jjdjv.exe 39 PID 2868 wrote to memory of 2692 2868 jjdjv.exe 39 PID 2868 wrote to memory of 2692 2868 jjdjv.exe 39 PID 2692 wrote to memory of 2812 2692 5jjpd.exe 40 PID 2692 wrote to memory of 2812 2692 5jjpd.exe 40 PID 2692 wrote to memory of 2812 2692 5jjpd.exe 40 PID 2692 wrote to memory of 2812 2692 5jjpd.exe 40 PID 2812 wrote to memory of 2728 2812 tnhntt.exe 41 PID 2812 wrote to memory of 2728 2812 tnhntt.exe 41 PID 2812 wrote to memory of 2728 2812 tnhntt.exe 41 PID 2812 wrote to memory of 2728 2812 tnhntt.exe 41 PID 2728 wrote to memory of 2856 2728 jdjpv.exe 42 PID 2728 wrote to memory of 2856 2728 jdjpv.exe 42 PID 2728 wrote to memory of 2856 2728 jdjpv.exe 42 PID 2728 wrote to memory of 2856 2728 jdjpv.exe 42 PID 2856 wrote to memory of 1808 2856 nhhtbn.exe 43 PID 2856 wrote to memory of 1808 2856 nhhtbn.exe 43 PID 2856 wrote to memory of 1808 2856 nhhtbn.exe 43 PID 2856 wrote to memory of 1808 2856 nhhtbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe"C:\Users\Admin\AppData\Local\Temp\cf5651b9d6ab4948a3835e79201a89c12a3c4e7498e7730fba302d9c5a3dc8bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\3xrxrxf.exec:\3xrxrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\1btbhh.exec:\1btbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ppdjv.exec:\ppdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\tthbht.exec:\tthbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xxxlxff.exec:\xxxlxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xxxxflf.exec:\xxxxflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xxlxrfx.exec:\xxlxrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\vpvvv.exec:\vpvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ttntbh.exec:\ttntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jjdjv.exec:\jjdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\5jjpd.exec:\5jjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\tnhntt.exec:\tnhntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jdjpv.exec:\jdjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhhtbn.exec:\nhhtbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\fxfrflx.exec:\fxfrflx.exe17⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bbnbbh.exec:\bbnbbh.exe18⤵
- Executes dropped EXE
PID:896 -
\??\c:\jjjjv.exec:\jjjjv.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5httbh.exec:\5httbh.exe20⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tnhtbh.exec:\tnhtbh.exe21⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lxrrxxx.exec:\lxrrxxx.exe22⤵
- Executes dropped EXE
PID:848 -
\??\c:\jvddp.exec:\jvddp.exe23⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xfrffll.exec:\xfrffll.exe24⤵
- Executes dropped EXE
PID:2440 -
\??\c:\btbhnb.exec:\btbhnb.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3pvvv.exec:\3pvvv.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nbtbnb.exec:\nbtbnb.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jvdjp.exec:\jvdjp.exe28⤵
- Executes dropped EXE
PID:908 -
\??\c:\tthhnh.exec:\tthhnh.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpdpp.exec:\vpdpp.exe30⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hhtthh.exec:\hhtthh.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1pvpj.exec:\1pvpj.exe32⤵
- Executes dropped EXE
PID:1068 -
\??\c:\ttthnt.exec:\ttthnt.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9lrxfrx.exec:\9lrxfrx.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9jdjv.exec:\9jdjv.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1thntn.exec:\1thntn.exe36⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrffffl.exec:\xrffffl.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5nhtnt.exec:\5nhtnt.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rlfrxlr.exec:\rlfrxlr.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nhtthh.exec:\nhtthh.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdddj.exec:\jdddj.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1xfffrr.exec:\1xfffrr.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tntbnn.exec:\tntbnn.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\thntnt.exec:\thntnt.exe44⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bnbbht.exec:\bnbbht.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\3vddv.exec:\3vddv.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nthnnn.exec:\nthnnn.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7fxfrxf.exec:\7fxfrxf.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\frffflr.exec:\frffflr.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jdpvd.exec:\jdpvd.exe51⤵
- Executes dropped EXE
PID:944 -
\??\c:\1jdvv.exec:\1jdvv.exe52⤵
- Executes dropped EXE
PID:2820 -
\??\c:\btnntb.exec:\btnntb.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jddjj.exec:\jddjj.exe54⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlxfllx.exec:\rlxfllx.exe55⤵
- Executes dropped EXE
PID:940 -
\??\c:\xrfffxx.exec:\xrfffxx.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nnnnbb.exec:\nnnnbb.exe57⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pjjjj.exec:\pjjjj.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hhhntt.exec:\hhhntt.exe59⤵
- Executes dropped EXE
PID:652 -
\??\c:\7xrrrrr.exec:\7xrrrrr.exe60⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rlxflrx.exec:\rlxflrx.exe61⤵
- Executes dropped EXE
PID:668 -
\??\c:\pdpvv.exec:\pdpvv.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlffllr.exec:\rlffllr.exe63⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9nhnhh.exec:\9nhnhh.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xrrxffr.exec:\xrrxffr.exe65⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xrlffll.exec:\xrlffll.exe66⤵PID:628
-
\??\c:\3dvjp.exec:\3dvjp.exe67⤵PID:1984
-
\??\c:\xrffffl.exec:\xrffffl.exe68⤵PID:2280
-
\??\c:\pjpdj.exec:\pjpdj.exe69⤵PID:2372
-
\??\c:\dpppp.exec:\dpppp.exe70⤵PID:712
-
\??\c:\nhttbh.exec:\nhttbh.exe71⤵PID:2168
-
\??\c:\3djjd.exec:\3djjd.exe72⤵PID:888
-
\??\c:\rlffflr.exec:\rlffflr.exe73⤵PID:1848
-
\??\c:\5vdpv.exec:\5vdpv.exe74⤵PID:2140
-
\??\c:\xrfllrx.exec:\xrfllrx.exe75⤵PID:1736
-
\??\c:\vpddj.exec:\vpddj.exe76⤵PID:908
-
\??\c:\rrfrxlr.exec:\rrfrxlr.exe77⤵PID:2144
-
\??\c:\nhnnnn.exec:\nhnnnn.exe78⤵PID:2076
-
\??\c:\3rxfffl.exec:\3rxfffl.exe79⤵PID:2664
-
\??\c:\tthbht.exec:\tthbht.exe80⤵PID:2592
-
\??\c:\vpppv.exec:\vpppv.exe81⤵PID:2752
-
\??\c:\bhtnbb.exec:\bhtnbb.exe82⤵PID:2772
-
\??\c:\xlxlflr.exec:\xlxlflr.exe83⤵PID:2500
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe84⤵PID:2640
-
\??\c:\7htbtb.exec:\7htbtb.exe85⤵PID:2172
-
\??\c:\pdvjv.exec:\pdvjv.exe86⤵PID:2484
-
\??\c:\7rfrrxf.exec:\7rfrrxf.exe87⤵PID:2536
-
\??\c:\bthtbb.exec:\bthtbb.exe88⤵PID:2132
-
\??\c:\ppjjp.exec:\ppjjp.exe89⤵PID:2684
-
\??\c:\lrllllr.exec:\lrllllr.exe90⤵PID:2648
-
\??\c:\nhttbh.exec:\nhttbh.exe91⤵PID:2924
-
\??\c:\dvdjp.exec:\dvdjp.exe92⤵PID:936
-
\??\c:\fxllrxf.exec:\fxllrxf.exe93⤵PID:2352
-
\??\c:\hthbnn.exec:\hthbnn.exe94⤵PID:2568
-
\??\c:\rlllrrx.exec:\rlllrrx.exe95⤵PID:952
-
\??\c:\nhbhnn.exec:\nhbhnn.exe96⤵PID:1704
-
\??\c:\rlffrrf.exec:\rlffrrf.exe97⤵PID:2308
-
\??\c:\bthnnb.exec:\bthnnb.exe98⤵PID:1240
-
\??\c:\vvpvd.exec:\vvpvd.exe99⤵PID:2932
-
\??\c:\3vddv.exec:\3vddv.exe100⤵PID:1468
-
\??\c:\9rllllr.exec:\9rllllr.exe101⤵PID:1464
-
\??\c:\vjvdd.exec:\vjvdd.exe102⤵PID:1136
-
\??\c:\jjpdj.exec:\jjpdj.exe103⤵PID:1492
-
\??\c:\3rxlffl.exec:\3rxlffl.exe104⤵PID:2436
-
\??\c:\9thnnb.exec:\9thnnb.exe105⤵PID:1308
-
\??\c:\vpvpp.exec:\vpvpp.exe106⤵PID:1584
-
\??\c:\1lxflrr.exec:\1lxflrr.exe107⤵PID:1644
-
\??\c:\nnnntb.exec:\nnnntb.exe108⤵PID:2860
-
\??\c:\9pddv.exec:\9pddv.exe109⤵PID:1976
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe110⤵PID:1960
-
\??\c:\7thhbh.exec:\7thhbh.exe111⤵PID:2676
-
\??\c:\htbttb.exec:\htbttb.exe112⤵PID:2388
-
\??\c:\3xxxlfr.exec:\3xxxlfr.exe113⤵PID:2408
-
\??\c:\bthnnt.exec:\bthnnt.exe114⤵PID:1932
-
\??\c:\jdvdd.exec:\jdvdd.exe115⤵PID:1108
-
\??\c:\3tbbtn.exec:\3tbbtn.exe116⤵PID:1628
-
\??\c:\rlxffll.exec:\rlxffll.exe117⤵PID:1848
-
\??\c:\tbntnt.exec:\tbntnt.exe118⤵PID:1080
-
\??\c:\xxxfrfl.exec:\xxxfrfl.exe119⤵PID:2936
-
\??\c:\ddppp.exec:\ddppp.exe120⤵PID:2296
-
\??\c:\3hbbhn.exec:\3hbbhn.exe121⤵PID:2980
-
\??\c:\dvjpd.exec:\dvjpd.exe122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-