Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 23:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe
-
Size
231KB
-
MD5
49d7b57c75c6d10595b8258b5cfc7016
-
SHA1
107cf8a37136e002f796e3b0669cfd9d553877a6
-
SHA256
822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a
-
SHA512
66619d7a1e7c76455694cfd79c3bffc13fa9aea08c25d87fb64bbeff42eb75d7729064ef20e5fb2d4ed2cd546366f1ad602915df685b01f199635f758d77c44a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+M:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+M
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/files/0x000800000001db0e-7.dat UPX behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3408-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002326c-14.dat UPX behavioral2/memory/1376-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1376-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000800000002340d-22.dat UPX behavioral2/memory/964-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023411-31.dat UPX behavioral2/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023412-38.dat UPX behavioral2/memory/3476-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023413-46.dat UPX behavioral2/files/0x0007000000023414-51.dat UPX behavioral2/memory/1292-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023415-60.dat UPX behavioral2/memory/824-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023417-67.dat UPX behavioral2/files/0x0007000000023419-81.dat UPX behavioral2/memory/5008-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000700000002341a-88.dat UPX behavioral2/files/0x000700000002341b-94.dat UPX behavioral2/memory/432-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000700000002341c-99.dat UPX behavioral2/files/0x000800000002340e-105.dat UPX behavioral2/files/0x000700000002341d-112.dat UPX behavioral2/memory/2280-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/448-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000700000002341e-121.dat UPX behavioral2/memory/4956-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000700000002341f-125.dat UPX behavioral2/files/0x0007000000023418-73.dat UPX behavioral2/files/0x0007000000023420-133.dat UPX behavioral2/memory/2632-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023421-140.dat UPX behavioral2/memory/3304-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2776-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023422-147.dat UPX behavioral2/memory/4776-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023423-155.dat UPX behavioral2/files/0x0007000000023425-163.dat UPX behavioral2/files/0x0007000000023426-170.dat UPX behavioral2/memory/5052-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1872-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4488-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023414-182.dat UPX behavioral2/memory/1316-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023429-191.dat UPX behavioral2/files/0x000700000002342a-195.dat UPX behavioral2/memory/4272-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023427-177.dat UPX behavioral2/files/0x000700000002342b-204.dat UPX behavioral2/memory/1872-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/760-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000700000002342c-209.dat UPX behavioral2/memory/740-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000700000002342d-217.dat UPX behavioral2/files/0x000700000002342f-224.dat UPX behavioral2/memory/3004-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0007000000023430-229.dat UPX behavioral2/memory/2016-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3216-250-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3828 bnttnh.exe 1376 xrlfxxr.exe 964 dppjd.exe 2668 btnbnb.exe 3476 xfrfffr.exe 1292 jvjdp.exe 824 rllfrrl.exe 4776 bntnbn.exe 4956 dpjvp.exe 5008 xxfxxrl.exe 4660 7hbtnn.exe 1668 lrrlfxf.exe 432 bhhttn.exe 2868 djdpj.exe 448 bttntn.exe 2280 vdvpj.exe 552 7ntnth.exe 2632 vvjdp.exe 3304 5thbnh.exe 2776 djvdp.exe 760 nnnhbn.exe 1872 pvvpd.exe 5052 ntthtn.exe 4488 rrxlffx.exe 2664 vpjvp.exe 1316 rllfrrl.exe 3284 nhhtnb.exe 4272 nbnhbb.exe 4992 5pvvd.exe 740 thnhnb.exe 2156 5vvpd.exe 1096 9hhbbh.exe 2456 1rxxrxx.exe 2016 1hnnnn.exe 2420 tttttt.exe 1068 ddjjd.exe 3216 btnhnn.exe 5060 7hnhhh.exe 2524 lxrlflf.exe 620 tnhhbh.exe 1468 fxlxlrl.exe 3132 hhnnnn.exe 1844 jvppj.exe 3832 lffxrxx.exe 1452 1dvpv.exe 2868 rflfrll.exe 448 jvddv.exe 4828 lxfxrll.exe 4072 btbhnn.exe 2632 xfllxxx.exe 3988 hhbtnb.exe 3304 pjvpd.exe 1972 nhtntt.exe 2984 3pdvd.exe 2240 ntbtnb.exe 2796 7nthhh.exe 4636 lxlfffx.exe 1276 tbhbhh.exe 4744 vppjd.exe 3904 htbtnn.exe 2404 djjdj.exe 3044 bnnhbb.exe 3488 vvpdd.exe 2792 fxfffff.exe -
resource yara_rule behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-453-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 3828 3408 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 85 PID 3408 wrote to memory of 3828 3408 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 85 PID 3408 wrote to memory of 3828 3408 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 85 PID 3828 wrote to memory of 1376 3828 bnttnh.exe 86 PID 3828 wrote to memory of 1376 3828 bnttnh.exe 86 PID 3828 wrote to memory of 1376 3828 bnttnh.exe 86 PID 1376 wrote to memory of 964 1376 xrlfxxr.exe 87 PID 1376 wrote to memory of 964 1376 xrlfxxr.exe 87 PID 1376 wrote to memory of 964 1376 xrlfxxr.exe 87 PID 964 wrote to memory of 2668 964 dppjd.exe 123 PID 964 wrote to memory of 2668 964 dppjd.exe 123 PID 964 wrote to memory of 2668 964 dppjd.exe 123 PID 2668 wrote to memory of 3476 2668 btnbnb.exe 89 PID 2668 wrote to memory of 3476 2668 btnbnb.exe 89 PID 2668 wrote to memory of 3476 2668 btnbnb.exe 89 PID 3476 wrote to memory of 1292 3476 xfrfffr.exe 90 PID 3476 wrote to memory of 1292 3476 xfrfffr.exe 90 PID 3476 wrote to memory of 1292 3476 xfrfffr.exe 90 PID 1292 wrote to memory of 824 1292 jvjdp.exe 91 PID 1292 wrote to memory of 824 1292 jvjdp.exe 91 PID 1292 wrote to memory of 824 1292 jvjdp.exe 91 PID 824 wrote to memory of 4776 824 rllfrrl.exe 92 PID 824 wrote to memory of 4776 824 rllfrrl.exe 92 PID 824 wrote to memory of 4776 824 rllfrrl.exe 92 PID 4776 wrote to memory of 4956 4776 bntnbn.exe 93 PID 4776 wrote to memory of 4956 4776 bntnbn.exe 93 PID 4776 wrote to memory of 4956 4776 bntnbn.exe 93 PID 4956 wrote to memory of 5008 4956 dpjvp.exe 94 PID 4956 wrote to memory of 5008 4956 dpjvp.exe 94 PID 4956 wrote to memory of 5008 4956 dpjvp.exe 94 PID 5008 wrote to memory of 4660 5008 xxfxxrl.exe 95 PID 5008 wrote to memory of 4660 5008 xxfxxrl.exe 95 PID 5008 wrote to memory of 4660 5008 xxfxxrl.exe 95 PID 4660 wrote to memory of 1668 4660 7hbtnn.exe 96 PID 4660 wrote to memory of 1668 4660 7hbtnn.exe 96 PID 4660 wrote to memory of 1668 4660 7hbtnn.exe 96 PID 1668 wrote to memory of 432 1668 lrrlfxf.exe 97 PID 1668 wrote to memory of 432 1668 lrrlfxf.exe 97 PID 1668 wrote to memory of 432 1668 lrrlfxf.exe 97 PID 432 wrote to memory of 2868 432 bhhttn.exe 134 PID 432 wrote to memory of 2868 432 bhhttn.exe 134 PID 432 wrote to memory of 2868 432 bhhttn.exe 134 PID 2868 wrote to memory of 448 2868 djdpj.exe 135 PID 2868 wrote to memory of 448 2868 djdpj.exe 135 PID 2868 wrote to memory of 448 2868 djdpj.exe 135 PID 448 wrote to memory of 2280 448 bttntn.exe 100 PID 448 wrote to memory of 2280 448 bttntn.exe 100 PID 448 wrote to memory of 2280 448 bttntn.exe 100 PID 2280 wrote to memory of 552 2280 vdvpj.exe 101 PID 2280 wrote to memory of 552 2280 vdvpj.exe 101 PID 2280 wrote to memory of 552 2280 vdvpj.exe 101 PID 552 wrote to memory of 2632 552 7ntnth.exe 138 PID 552 wrote to memory of 2632 552 7ntnth.exe 138 PID 552 wrote to memory of 2632 552 7ntnth.exe 138 PID 2632 wrote to memory of 3304 2632 vvjdp.exe 141 PID 2632 wrote to memory of 3304 2632 vvjdp.exe 141 PID 2632 wrote to memory of 3304 2632 vvjdp.exe 141 PID 3304 wrote to memory of 2776 3304 5thbnh.exe 104 PID 3304 wrote to memory of 2776 3304 5thbnh.exe 104 PID 3304 wrote to memory of 2776 3304 5thbnh.exe 104 PID 2776 wrote to memory of 760 2776 djvdp.exe 105 PID 2776 wrote to memory of 760 2776 djvdp.exe 105 PID 2776 wrote to memory of 760 2776 djvdp.exe 105 PID 760 wrote to memory of 1872 760 nnnhbn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe"C:\Users\Admin\AppData\Local\Temp\822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\bnttnh.exec:\bnttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\dppjd.exec:\dppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\btnbnb.exec:\btnbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xfrfffr.exec:\xfrfffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\jvjdp.exec:\jvjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rllfrrl.exec:\rllfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\bntnbn.exec:\bntnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\dpjvp.exec:\dpjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\xxfxxrl.exec:\xxfxxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\7hbtnn.exec:\7hbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\lrrlfxf.exec:\lrrlfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bhhttn.exec:\bhhttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\djdpj.exec:\djdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bttntn.exec:\bttntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vdvpj.exec:\vdvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\7ntnth.exec:\7ntnth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\vvjdp.exec:\vvjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5thbnh.exec:\5thbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\djvdp.exec:\djvdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nnnhbn.exec:\nnnhbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pvvpd.exec:\pvvpd.exe23⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ntthtn.exec:\ntthtn.exe24⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rrxlffx.exec:\rrxlffx.exe25⤵
- Executes dropped EXE
PID:4488 -
\??\c:\vpjvp.exec:\vpjvp.exe26⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rllfrrl.exec:\rllfrrl.exe27⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nhhtnb.exec:\nhhtnb.exe28⤵
- Executes dropped EXE
PID:3284 -
\??\c:\nbnhbb.exec:\nbnhbb.exe29⤵
- Executes dropped EXE
PID:4272 -
\??\c:\5pvvd.exec:\5pvvd.exe30⤵
- Executes dropped EXE
PID:4992 -
\??\c:\thnhnb.exec:\thnhnb.exe31⤵
- Executes dropped EXE
PID:740 -
\??\c:\5vvpd.exec:\5vvpd.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fflfrxr.exec:\fflfrxr.exe33⤵PID:3004
-
\??\c:\9hhbbh.exec:\9hhbbh.exe34⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1rxxrxx.exec:\1rxxrxx.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1hnnnn.exec:\1hnnnn.exe36⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tttttt.exec:\tttttt.exe37⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ddjjd.exec:\ddjjd.exe38⤵
- Executes dropped EXE
PID:1068 -
\??\c:\btnhnn.exec:\btnhnn.exe39⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7hnhhh.exec:\7hnhhh.exe40⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lxrlflf.exec:\lxrlflf.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tnhhbh.exec:\tnhhbh.exe42⤵
- Executes dropped EXE
PID:620 -
\??\c:\fxlxlrl.exec:\fxlxlrl.exe43⤵
- Executes dropped EXE
PID:1468 -
\??\c:\hhnnnn.exec:\hhnnnn.exe44⤵
- Executes dropped EXE
PID:3132 -
\??\c:\jvppj.exec:\jvppj.exe45⤵
- Executes dropped EXE
PID:1844 -
\??\c:\lffxrxx.exec:\lffxrxx.exe46⤵
- Executes dropped EXE
PID:3832 -
\??\c:\1dvpv.exec:\1dvpv.exe47⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rflfrll.exec:\rflfrll.exe48⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jvddv.exec:\jvddv.exe49⤵
- Executes dropped EXE
PID:448 -
\??\c:\lxfxrll.exec:\lxfxrll.exe50⤵
- Executes dropped EXE
PID:4828 -
\??\c:\btbhnn.exec:\btbhnn.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xfllxxx.exec:\xfllxxx.exe52⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hhbtnb.exec:\hhbtnb.exe53⤵
- Executes dropped EXE
PID:3988 -
\??\c:\pjvpd.exec:\pjvpd.exe54⤵
- Executes dropped EXE
PID:3304 -
\??\c:\nhtntt.exec:\nhtntt.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3pdvd.exec:\3pdvd.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ntbtnb.exec:\ntbtnb.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7nthhh.exec:\7nthhh.exe58⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxlfffx.exec:\lxlfffx.exe59⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tbhbhh.exec:\tbhbhh.exe60⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vppjd.exec:\vppjd.exe61⤵
- Executes dropped EXE
PID:4744 -
\??\c:\htbtnn.exec:\htbtnn.exe62⤵
- Executes dropped EXE
PID:3904 -
\??\c:\djjdj.exec:\djjdj.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bnnhbb.exec:\bnnhbb.exe64⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vvpdd.exec:\vvpdd.exe65⤵
- Executes dropped EXE
PID:3488 -
\??\c:\fxfffff.exec:\fxfffff.exe66⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhbbhh.exec:\nhbbhh.exe67⤵PID:2624
-
\??\c:\frxrrrr.exec:\frxrrrr.exe68⤵PID:3000
-
\??\c:\jdpjj.exec:\jdpjj.exe69⤵PID:1176
-
\??\c:\rxlfffx.exec:\rxlfffx.exe70⤵PID:2288
-
\??\c:\bntbtt.exec:\bntbtt.exe71⤵PID:3940
-
\??\c:\rfxrllf.exec:\rfxrllf.exe72⤵PID:512
-
\??\c:\hbbbtt.exec:\hbbbtt.exe73⤵PID:2312
-
\??\c:\jjjvd.exec:\jjjvd.exe74⤵PID:2104
-
\??\c:\thnhbb.exec:\thnhbb.exe75⤵PID:824
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe76⤵PID:5060
-
\??\c:\tbhhtt.exec:\tbhhtt.exe77⤵PID:2524
-
\??\c:\7xrxxxx.exec:\7xrxxxx.exe78⤵PID:1440
-
\??\c:\nhnnnn.exec:\nhnnnn.exe79⤵PID:1468
-
\??\c:\llxxrrl.exec:\llxxrrl.exe80⤵PID:3036
-
\??\c:\nhhhtt.exec:\nhhhtt.exe81⤵PID:4976
-
\??\c:\xxrllfr.exec:\xxrllfr.exe82⤵PID:2244
-
\??\c:\tttnnn.exec:\tttnnn.exe83⤵PID:3408
-
\??\c:\vppdv.exec:\vppdv.exe84⤵PID:4484
-
\??\c:\tbbnbt.exec:\tbbnbt.exe85⤵PID:1224
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe86⤵PID:700
-
\??\c:\9tbttt.exec:\9tbttt.exe87⤵PID:964
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe88⤵PID:3396
-
\??\c:\bhtnhh.exec:\bhtnhh.exe89⤵PID:4568
-
\??\c:\vddvp.exec:\vddvp.exe90⤵PID:3464
-
\??\c:\bntnbb.exec:\bntnbb.exe91⤵PID:2300
-
\??\c:\7pdvv.exec:\7pdvv.exe92⤵PID:4520
-
\??\c:\nbthtb.exec:\nbthtb.exe93⤵PID:4592
-
\??\c:\hhnbtt.exec:\hhnbtt.exe94⤵PID:4064
-
\??\c:\xxlrllr.exec:\xxlrllr.exe95⤵PID:4656
-
\??\c:\jdjjd.exec:\jdjjd.exe96⤵PID:4944
-
\??\c:\nhhbnh.exec:\nhhbnh.exe97⤵PID:3116
-
\??\c:\ddvpv.exec:\ddvpv.exe98⤵PID:1032
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe99⤵PID:4348
-
\??\c:\5nnnnh.exec:\5nnnnh.exe100⤵PID:4440
-
\??\c:\xfxlffx.exec:\xfxlffx.exe101⤵PID:1132
-
\??\c:\hhnnnn.exec:\hhnnnn.exe102⤵PID:2792
-
\??\c:\ddjdd.exec:\ddjdd.exe103⤵PID:3004
-
\??\c:\fflfxrr.exec:\fflfxrr.exe104⤵PID:3000
-
\??\c:\pddvj.exec:\pddvj.exe105⤵PID:408
-
\??\c:\frffrrr.exec:\frffrrr.exe106⤵PID:3500
-
\??\c:\btbbtt.exec:\btbbtt.exe107⤵PID:4756
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe108⤵PID:4968
-
\??\c:\nhtttt.exec:\nhtttt.exe109⤵PID:2248
-
\??\c:\1xlfflf.exec:\1xlfflf.exe110⤵PID:756
-
\??\c:\5nbbbb.exec:\5nbbbb.exe111⤵PID:4040
-
\??\c:\ppppd.exec:\ppppd.exe112⤵PID:3132
-
\??\c:\hnbttt.exec:\hnbttt.exe113⤵PID:3832
-
\??\c:\dvdvj.exec:\dvdvj.exe114⤵PID:4508
-
\??\c:\htnhtn.exec:\htnhtn.exe115⤵PID:3492
-
\??\c:\lxxffff.exec:\lxxffff.exe116⤵PID:1224
-
\??\c:\1bbtnn.exec:\1bbtnn.exe117⤵PID:1668
-
\??\c:\5dppd.exec:\5dppd.exe118⤵PID:3380
-
\??\c:\tthbnn.exec:\tthbnn.exe119⤵PID:2904
-
\??\c:\rrlllll.exec:\rrlllll.exe120⤵PID:736
-
\??\c:\lrlllrr.exec:\lrlllrr.exe121⤵PID:1408
-
\??\c:\1vppv.exec:\1vppv.exe122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-