Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 19:44
Behavioral task
behavioral1
Sample
2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe
-
Size
298KB
-
MD5
c53c80b9c606c7d4587cc44e843c5ac0
-
SHA1
0375b2311924d8c2cb1e34df585de1daa96ba9bc
-
SHA256
2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178
-
SHA512
6ae713c22fa425af4583f3ecba319afb9eb826bd04d20bacd604f4bdbe419b692068b8e885f99e697b1f6ffefbe3b57f34dba3e1409c04e3237470ceda3425ee
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftO+:K4wFHoSQkuUHk1zBR/pMT9XvEhdff
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2052-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2084-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2152-20-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2916-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2788-47-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2628-56-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2768-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2372-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2832-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2772-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2944-120-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1940-137-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1388-146-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/696-163-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2948-172-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2620-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2280-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/580-209-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1804-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2240-250-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3036-284-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1516-293-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2232-295-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1740-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2968-345-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2952-347-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2868-374-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2784-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2516-414-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1444-427-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2820-471-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1492-522-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1596-547-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2152-628-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2940-704-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1668-903-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon behavioral1/memory/1668-942-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon behavioral1/memory/2640-998-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2052-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2052-7-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000d000000012271-5.dat UPX behavioral1/memory/2084-11-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2152-20-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0012000000015ca9-18.dat UPX behavioral1/memory/2152-25-0x00000000002A0000-0x00000000002D4000-memory.dmp UPX behavioral1/files/0x0008000000015ce1-27.dat UPX behavioral1/memory/2916-28-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2916-36-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0008000000015ced-37.dat UPX behavioral1/memory/2788-38-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000015d02-45.dat UPX behavioral1/memory/2788-47-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2628-48-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000015d13-57.dat UPX behavioral1/memory/2628-56-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000015d1e-64.dat UPX behavioral1/memory/2768-66-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000016c5b-75.dat UPX behavioral1/memory/2372-74-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2832-83-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000016ca1-84.dat UPX behavioral1/files/0x0006000000016ccd-93.dat UPX behavioral1/memory/2772-92-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016cf2-100.dat UPX behavioral1/files/0x0006000000016d01-108.dat UPX behavioral1/files/0x0006000000016d10-116.dat UPX behavioral1/memory/2944-120-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d19-128.dat UPX behavioral1/files/0x0006000000016d21-135.dat UPX behavioral1/memory/1940-137-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1388-146-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d2d-147.dat UPX behavioral1/files/0x0006000000016d36-156.dat UPX behavioral1/memory/696-163-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0012000000015cc2-164.dat UPX behavioral1/memory/2948-172-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d3e-173.dat UPX behavioral1/memory/2620-182-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d46-181.dat UPX behavioral1/files/0x0006000000016d4f-190.dat UPX behavioral1/memory/2280-192-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d57-199.dat UPX behavioral1/files/0x0006000000016d5f-207.dat UPX behavioral1/memory/580-209-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d73-216.dat UPX behavioral1/files/0x0006000000016d79-227.dat UPX behavioral1/memory/1804-226-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000016d7d-234.dat UPX behavioral1/files/0x0006000000016fa9-243.dat UPX behavioral1/memory/2240-250-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000600000001708c-251.dat UPX behavioral1/files/0x00060000000171ad-259.dat UPX behavioral1/files/0x000600000001738e-266.dat UPX behavioral1/files/0x000600000001738f-275.dat UPX behavioral1/files/0x00060000000173e2-283.dat UPX behavioral1/memory/1516-285-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/3036-284-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1516-293-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2232-295-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1740-307-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1664-314-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2952-347-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2084 lllfrfr.exe 2152 9frrffl.exe 2916 9hnhth.exe 2788 nbnthn.exe 2628 dvvjd.exe 2768 thhbbb.exe 2372 1dpvd.exe 2832 5lxxfxf.exe 2772 nhbhtt.exe 2524 dvdpp.exe 2640 hbnthb.exe 2944 nhbntb.exe 1912 3xllxxx.exe 1940 hbnttb.exe 1388 dvjpv.exe 1996 bthhtt.exe 696 jdvpj.exe 2948 xlllflf.exe 2620 ddpvd.exe 3028 vpvdv.exe 2280 btnbhn.exe 688 7vjpv.exe 580 1fxxfll.exe 1804 htnnnt.exe 1132 jpjdj.exe 2864 xfrxrxf.exe 2240 ttbhtb.exe 960 dpdjp.exe 2024 5rlrllx.exe 896 nhtbnh.exe 3036 pjddp.exe 1516 tntbtb.exe 2232 1dvdp.exe 1740 7fllllx.exe 2360 5xllrrr.exe 1664 bnbhtb.exe 548 jdjjv.exe 2896 xlrrxxf.exe 2904 9rxlrxf.exe 2968 tnbhbb.exe 2952 tntttn.exe 3020 dvdjp.exe 2732 xrfflrx.exe 2676 9xxllxf.exe 2868 5nttbb.exe 2784 9vpvj.exe 2560 1vjdj.exe 2632 9llrfrx.exe 2540 5bnbnn.exe 2516 dvjjp.exe 2416 jdppv.exe 1836 xrfffxf.exe 1444 htbbhh.exe 1216 hhbnnt.exe 1940 7dvdd.exe 2184 vjvvj.exe 2176 rllxffr.exe 1028 bthnbt.exe 2820 nbtnbt.exe 2800 pjddp.exe 2248 fxlrffr.exe 2284 rfrrffl.exe 2616 tnbhnn.exe 1240 nbhhnh.exe -
resource yara_rule behavioral1/memory/2052-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2052-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000d000000012271-5.dat upx behavioral1/memory/2084-11-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2152-20-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0012000000015ca9-18.dat upx behavioral1/memory/2152-25-0x00000000002A0000-0x00000000002D4000-memory.dmp upx behavioral1/files/0x0008000000015ce1-27.dat upx behavioral1/memory/2916-28-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2916-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000015ced-37.dat upx behavioral1/memory/2788-38-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000015d02-45.dat upx behavioral1/memory/2788-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2628-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000015d13-57.dat upx behavioral1/memory/2628-56-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000015d1e-64.dat upx behavioral1/memory/2768-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016c5b-75.dat upx behavioral1/memory/2372-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2832-83-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016ca1-84.dat upx behavioral1/files/0x0006000000016ccd-93.dat upx behavioral1/memory/2772-92-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016cf2-100.dat upx behavioral1/files/0x0006000000016d01-108.dat upx behavioral1/files/0x0006000000016d10-116.dat upx behavioral1/memory/2944-120-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d19-128.dat upx behavioral1/files/0x0006000000016d21-135.dat upx behavioral1/memory/1940-137-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1388-146-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d2d-147.dat upx behavioral1/files/0x0006000000016d36-156.dat upx behavioral1/memory/696-163-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0012000000015cc2-164.dat upx behavioral1/memory/2948-172-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d3e-173.dat upx behavioral1/memory/2620-182-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d46-181.dat upx behavioral1/files/0x0006000000016d4f-190.dat upx behavioral1/memory/2280-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d57-199.dat upx behavioral1/files/0x0006000000016d5f-207.dat upx behavioral1/memory/580-209-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d73-216.dat upx behavioral1/files/0x0006000000016d79-227.dat upx behavioral1/memory/1804-226-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d7d-234.dat upx behavioral1/files/0x0006000000016fa9-243.dat upx behavioral1/memory/2240-250-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000600000001708c-251.dat upx behavioral1/files/0x00060000000171ad-259.dat upx behavioral1/files/0x000600000001738e-266.dat upx behavioral1/files/0x000600000001738f-275.dat upx behavioral1/files/0x00060000000173e2-283.dat upx behavioral1/memory/1516-285-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3036-284-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1516-293-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2232-295-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1740-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1664-314-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2952-347-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2084 2052 2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe 28 PID 2052 wrote to memory of 2084 2052 2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe 28 PID 2052 wrote to memory of 2084 2052 2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe 28 PID 2052 wrote to memory of 2084 2052 2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe 28 PID 2084 wrote to memory of 2152 2084 lllfrfr.exe 29 PID 2084 wrote to memory of 2152 2084 lllfrfr.exe 29 PID 2084 wrote to memory of 2152 2084 lllfrfr.exe 29 PID 2084 wrote to memory of 2152 2084 lllfrfr.exe 29 PID 2152 wrote to memory of 2916 2152 9frrffl.exe 30 PID 2152 wrote to memory of 2916 2152 9frrffl.exe 30 PID 2152 wrote to memory of 2916 2152 9frrffl.exe 30 PID 2152 wrote to memory of 2916 2152 9frrffl.exe 30 PID 2916 wrote to memory of 2788 2916 9hnhth.exe 31 PID 2916 wrote to memory of 2788 2916 9hnhth.exe 31 PID 2916 wrote to memory of 2788 2916 9hnhth.exe 31 PID 2916 wrote to memory of 2788 2916 9hnhth.exe 31 PID 2788 wrote to memory of 2628 2788 nbnthn.exe 32 PID 2788 wrote to memory of 2628 2788 nbnthn.exe 32 PID 2788 wrote to memory of 2628 2788 nbnthn.exe 32 PID 2788 wrote to memory of 2628 2788 nbnthn.exe 32 PID 2628 wrote to memory of 2768 2628 dvvjd.exe 33 PID 2628 wrote to memory of 2768 2628 dvvjd.exe 33 PID 2628 wrote to memory of 2768 2628 dvvjd.exe 33 PID 2628 wrote to memory of 2768 2628 dvvjd.exe 33 PID 2768 wrote to memory of 2372 2768 thhbbb.exe 34 PID 2768 wrote to memory of 2372 2768 thhbbb.exe 34 PID 2768 wrote to memory of 2372 2768 thhbbb.exe 34 PID 2768 wrote to memory of 2372 2768 thhbbb.exe 34 PID 2372 wrote to memory of 2832 2372 1dpvd.exe 35 PID 2372 wrote to memory of 2832 2372 1dpvd.exe 35 PID 2372 wrote to memory of 2832 2372 1dpvd.exe 35 PID 2372 wrote to memory of 2832 2372 1dpvd.exe 35 PID 2832 wrote to memory of 2772 2832 5lxxfxf.exe 36 PID 2832 wrote to memory of 2772 2832 5lxxfxf.exe 36 PID 2832 wrote to memory of 2772 2832 5lxxfxf.exe 36 PID 2832 wrote to memory of 2772 2832 5lxxfxf.exe 36 PID 2772 wrote to memory of 2524 2772 nhbhtt.exe 37 PID 2772 wrote to memory of 2524 2772 nhbhtt.exe 37 PID 2772 wrote to memory of 2524 2772 nhbhtt.exe 37 PID 2772 wrote to memory of 2524 2772 nhbhtt.exe 37 PID 2524 wrote to memory of 2640 2524 dvdpp.exe 38 PID 2524 wrote to memory of 2640 2524 dvdpp.exe 38 PID 2524 wrote to memory of 2640 2524 dvdpp.exe 38 PID 2524 wrote to memory of 2640 2524 dvdpp.exe 38 PID 2640 wrote to memory of 2944 2640 hbnthb.exe 39 PID 2640 wrote to memory of 2944 2640 hbnthb.exe 39 PID 2640 wrote to memory of 2944 2640 hbnthb.exe 39 PID 2640 wrote to memory of 2944 2640 hbnthb.exe 39 PID 2944 wrote to memory of 1912 2944 nhbntb.exe 40 PID 2944 wrote to memory of 1912 2944 nhbntb.exe 40 PID 2944 wrote to memory of 1912 2944 nhbntb.exe 40 PID 2944 wrote to memory of 1912 2944 nhbntb.exe 40 PID 1912 wrote to memory of 1940 1912 3xllxxx.exe 41 PID 1912 wrote to memory of 1940 1912 3xllxxx.exe 41 PID 1912 wrote to memory of 1940 1912 3xllxxx.exe 41 PID 1912 wrote to memory of 1940 1912 3xllxxx.exe 41 PID 1940 wrote to memory of 1388 1940 hbnttb.exe 42 PID 1940 wrote to memory of 1388 1940 hbnttb.exe 42 PID 1940 wrote to memory of 1388 1940 hbnttb.exe 42 PID 1940 wrote to memory of 1388 1940 hbnttb.exe 42 PID 1388 wrote to memory of 1996 1388 dvjpv.exe 43 PID 1388 wrote to memory of 1996 1388 dvjpv.exe 43 PID 1388 wrote to memory of 1996 1388 dvjpv.exe 43 PID 1388 wrote to memory of 1996 1388 dvjpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe"C:\Users\Admin\AppData\Local\Temp\2caf7128f3e65a44e74237abbef7d05805d32bf776b032c3f25248eca0278178.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lllfrfr.exec:\lllfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\9frrffl.exec:\9frrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\9hnhth.exec:\9hnhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\nbnthn.exec:\nbnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dvvjd.exec:\dvvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\thhbbb.exec:\thhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1dpvd.exec:\1dpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\5lxxfxf.exec:\5lxxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nhbhtt.exec:\nhbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dvdpp.exec:\dvdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hbnthb.exec:\hbnthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nhbntb.exec:\nhbntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\3xllxxx.exec:\3xllxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\hbnttb.exec:\hbnttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\dvjpv.exec:\dvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\bthhtt.exec:\bthhtt.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jdvpj.exec:\jdvpj.exe18⤵
- Executes dropped EXE
PID:696 -
\??\c:\xlllflf.exec:\xlllflf.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ddpvd.exec:\ddpvd.exe20⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vpvdv.exec:\vpvdv.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\btnbhn.exec:\btnbhn.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7vjpv.exec:\7vjpv.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\1fxxfll.exec:\1fxxfll.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\htnnnt.exec:\htnnnt.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jpjdj.exec:\jpjdj.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xfrxrxf.exec:\xfrxrxf.exe27⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ttbhtb.exec:\ttbhtb.exe28⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dpdjp.exec:\dpdjp.exe29⤵
- Executes dropped EXE
PID:960 -
\??\c:\5rlrllx.exec:\5rlrllx.exe30⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhtbnh.exec:\nhtbnh.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\pjddp.exec:\pjddp.exe32⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tntbtb.exec:\tntbtb.exe33⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1dvdp.exec:\1dvdp.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7fllllx.exec:\7fllllx.exe35⤵
- Executes dropped EXE
PID:1740 -
\??\c:\5xllrrr.exec:\5xllrrr.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bnbhtb.exec:\bnbhtb.exe37⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jdjjv.exec:\jdjjv.exe38⤵
- Executes dropped EXE
PID:548 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9rxlrxf.exec:\9rxlrxf.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tnbhbb.exec:\tnbhbb.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tntttn.exec:\tntttn.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dvdjp.exec:\dvdjp.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xrfflrx.exec:\xrfflrx.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9xxllxf.exec:\9xxllxf.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5nttbb.exec:\5nttbb.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9vpvj.exec:\9vpvj.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1vjdj.exec:\1vjdj.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9llrfrx.exec:\9llrfrx.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5bnbnn.exec:\5bnbnn.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jdppv.exec:\jdppv.exe52⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrfffxf.exec:\xrfffxf.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\htbbhh.exec:\htbbhh.exe54⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hhbnnt.exec:\hhbnnt.exe55⤵
- Executes dropped EXE
PID:1216 -
\??\c:\7dvdd.exec:\7dvdd.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vjvvj.exec:\vjvvj.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rllxffr.exec:\rllxffr.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bthnbt.exec:\bthnbt.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nbtnbt.exec:\nbtnbt.exe60⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pjddp.exec:\pjddp.exe61⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fxlrffr.exec:\fxlrffr.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rfrrffl.exec:\rfrrffl.exe63⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnbhnn.exec:\tnbhnn.exe64⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nbhhnh.exec:\nbhhnh.exe65⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dvpvd.exec:\dvpvd.exe66⤵PID:768
-
\??\c:\9rllxxf.exec:\9rllxxf.exe67⤵PID:1724
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe68⤵PID:2496
-
\??\c:\hbtbtb.exec:\hbtbtb.exe69⤵PID:1492
-
\??\c:\pjvpv.exec:\pjvpv.exe70⤵PID:2040
-
\??\c:\dvjpd.exec:\dvjpd.exe71⤵PID:764
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe72⤵PID:1340
-
\??\c:\9hbhnt.exec:\9hbhnt.exe73⤵PID:1596
-
\??\c:\7tbhnn.exec:\7tbhnn.exe74⤵PID:1036
-
\??\c:\pjppv.exec:\pjppv.exe75⤵PID:2024
-
\??\c:\5lxxffr.exec:\5lxxffr.exe76⤵PID:2020
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe77⤵PID:2436
-
\??\c:\5hhtbh.exec:\5hhtbh.exe78⤵PID:3036
-
\??\c:\dvvvd.exec:\dvvvd.exe79⤵PID:2260
-
\??\c:\vpjdd.exec:\vpjdd.exe80⤵PID:2428
-
\??\c:\rfrrxrr.exec:\rfrrxrr.exe81⤵PID:2144
-
\??\c:\xrflxxx.exec:\xrflxxx.exe82⤵PID:1600
-
\??\c:\bnbbnh.exec:\bnbbnh.exe83⤵PID:2888
-
\??\c:\tnbhtb.exec:\tnbhtb.exe84⤵PID:2600
-
\??\c:\pjddd.exec:\pjddd.exe85⤵PID:2112
-
\??\c:\ffllrxf.exec:\ffllrxf.exe86⤵PID:2152
-
\??\c:\fxfxllr.exec:\fxfxllr.exe87⤵PID:2844
-
\??\c:\bthhnn.exec:\bthhnn.exe88⤵PID:2612
-
\??\c:\dvjjp.exec:\dvjjp.exe89⤵PID:2624
-
\??\c:\pjdjj.exec:\pjdjj.exe90⤵PID:3020
-
\??\c:\rfrxlrx.exec:\rfrxlrx.exe91⤵PID:2752
-
\??\c:\nbtttn.exec:\nbtttn.exe92⤵PID:2676
-
\??\c:\tnhhbb.exec:\tnhhbb.exe93⤵PID:2852
-
\??\c:\vppdp.exec:\vppdp.exe94⤵PID:2656
-
\??\c:\3jvdv.exec:\3jvdv.exe95⤵PID:2568
-
\??\c:\lxllflx.exec:\lxllflx.exe96⤵PID:2536
-
\??\c:\nnhnbb.exec:\nnhnbb.exe97⤵PID:2552
-
\??\c:\nhtbnt.exec:\nhtbnt.exe98⤵PID:2940
-
\??\c:\5vppp.exec:\5vppp.exe99⤵PID:1860
-
\??\c:\rffxfxf.exec:\rffxfxf.exe100⤵PID:2208
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe101⤵PID:1912
-
\??\c:\bbbbhh.exec:\bbbbhh.exe102⤵PID:864
-
\??\c:\jdjdj.exec:\jdjdj.exe103⤵PID:1508
-
\??\c:\dvjjp.exec:\dvjjp.exe104⤵PID:2204
-
\??\c:\3lfllll.exec:\3lfllll.exe105⤵PID:1988
-
\??\c:\fxflffl.exec:\fxflffl.exe106⤵PID:2608
-
\??\c:\7htbtt.exec:\7htbtt.exe107⤵PID:2696
-
\??\c:\jvddv.exec:\jvddv.exe108⤵PID:2460
-
\??\c:\3jppp.exec:\3jppp.exe109⤵PID:2268
-
\??\c:\3fxxffl.exec:\3fxxffl.exe110⤵PID:304
-
\??\c:\hbntbh.exec:\hbntbh.exe111⤵PID:348
-
\??\c:\tnbhbt.exec:\tnbhbt.exe112⤵PID:1484
-
\??\c:\jdvjp.exec:\jdvjp.exe113⤵PID:1476
-
\??\c:\9vvvd.exec:\9vvvd.exe114⤵PID:560
-
\??\c:\rfffrrx.exec:\rfffrrx.exe115⤵PID:868
-
\??\c:\hhhhbb.exec:\hhhhbb.exe116⤵PID:1616
-
\??\c:\nhnnnn.exec:\nhnnnn.exe117⤵PID:784
-
\??\c:\vpvvj.exec:\vpvvj.exe118⤵PID:1368
-
\??\c:\ppdjp.exec:\ppdjp.exe119⤵PID:2036
-
\??\c:\frffllr.exec:\frffllr.exe120⤵PID:1544
-
\??\c:\xlxxflr.exec:\xlxxflr.exe121⤵PID:2008
-
\??\c:\1hbhnn.exec:\1hbhnn.exe122⤵PID:836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-