Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 18:12
Behavioral task
behavioral1
Sample
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
General
-
Target
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
-
Size
94KB
-
MD5
fa561f5076f3425f1d910882f7096bc1
-
SHA1
aa6e59d89ca18465328f2a9dfe534d8ce1a87b57
-
SHA256
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255
-
SHA512
a64a0cb7b51937bc47486d91911ccf453dd44a02897d5ccc5113beaa8f14f4d1efc9ce25e8fce9e4b477d2d26ce949a315d51fbf6f09a30954a6461c5244d384
-
SSDEEP
1536:GvQBeOGtrYS3srx93UBWfwC6Ggnouy8STCRBHkOl0JnSLa:GhOmTsF93UYfwC6GIoutXBO/
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2040-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-139-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/628-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-454-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-702-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/240-831-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1292-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-897-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-967-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-1033-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-13167-0x0000000077620000-0x000000007771A000-memory.dmp family_blackmoon behavioral1/memory/2164-14185-0x0000000077620000-0x000000007771A000-memory.dmp family_blackmoon behavioral1/memory/2164-14184-0x0000000077500000-0x000000007761F000-memory.dmp family_blackmoon behavioral1/memory/2164-18382-0x0000000077500000-0x000000007761F000-memory.dmp family_blackmoon behavioral1/memory/2164-20904-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2164-20902-0x0000000077500000-0x000000007761F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 fxlrrrf.exe 2036 bbhnnn.exe 2652 ppppp.exe 2496 5jdjd.exe 2488 3frrlff.exe 2412 7xffffx.exe 2428 5ntttn.exe 2416 htbhbb.exe 2892 dpdjp.exe 1808 7lrrrrx.exe 2588 nhnnnn.exe 2740 nhntbb.exe 1940 pjvjj.exe 2140 5rlrfll.exe 376 lxrlfxf.exe 1644 thttbb.exe 2260 3bhhtn.exe 1620 9jvvd.exe 1568 3rfllll.exe 1528 rrflflr.exe 2076 3bhttt.exe 2236 nhtnbb.exe 2592 vjvjd.exe 1276 xlfxxxf.exe 708 7xxxxff.exe 1912 thbhhh.exe 2104 1dvvv.exe 1548 3vddd.exe 2000 lxrxffl.exe 1656 rfrlflr.exe 1600 thnnnh.exe 828 thbttn.exe 3068 vjvvv.exe 1704 pdppv.exe 628 lxlffxx.exe 2804 lxfxxxr.exe 1440 hbhntn.exe 2872 tntnhh.exe 2040 pjvvv.exe 2108 9dvdp.exe 2520 lfxxflf.exe 2020 1xllfff.exe 2580 nbthtb.exe 2984 thhhbb.exe 2476 pjpjp.exe 2496 dpppv.exe 2488 xrlfflf.exe 2484 xrrrrll.exe 2628 nbbbbt.exe 2672 hnttnh.exe 2112 1pdjj.exe 1900 dvpjd.exe 1944 vvjpp.exe 2604 rlxxxxx.exe 2636 3bnnnb.exe 2780 1bnntn.exe 2472 vjjjv.exe 1940 9dddj.exe 1648 ppvvv.exe 1924 rxlfxll.exe 2256 llxlflf.exe 2096 hbbnhh.exe 2260 tthnnh.exe 1364 dpvpp.exe -
resource yara_rule behavioral1/memory/2040-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000014890-5.dat upx behavioral1/memory/2972-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-12-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2972-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0033000000015083-16.dat upx behavioral1/files/0x0008000000015662-24.dat upx behavioral1/memory/2036-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000158d9-33.dat upx behavioral1/memory/2496-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ae3-41.dat upx behavioral1/memory/2496-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015b50-52.dat upx behavioral1/files/0x0007000000015b85-59.dat upx behavioral1/memory/2428-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d9c-67.dat upx behavioral1/files/0x0006000000015f23-74.dat upx behavioral1/memory/2416-75-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000015fa6-83.dat upx behavioral1/memory/2892-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016013-90.dat upx behavioral1/files/0x0006000000016122-98.dat upx behavioral1/memory/2588-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000161ee-107.dat upx behavioral1/memory/1940-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000163eb-115.dat upx behavioral1/files/0x00060000000164ec-122.dat upx behavioral1/files/0x0006000000016575-129.dat upx behavioral1/memory/1644-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167bf-136.dat upx behavioral1/files/0x0006000000016a28-145.dat upx behavioral1/memory/1620-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1f-153.dat upx behavioral1/files/0x0006000000016c30-161.dat upx behavioral1/memory/1568-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c38-169.dat upx behavioral1/files/0x0006000000016c84-177.dat upx behavioral1/files/0x0006000000016cb5-184.dat upx behavioral1/memory/2592-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ce0-192.dat upx behavioral1/memory/2592-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ced-200.dat upx behavioral1/files/0x0006000000016cf3-207.dat upx behavioral1/files/0x0006000000016cfd-214.dat upx behavioral1/memory/2104-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d06-221.dat upx behavioral1/files/0x0006000000016d10-229.dat upx behavioral1/memory/2000-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d18-237.dat upx behavioral1/files/0x0006000000016d21-244.dat upx behavioral1/files/0x0006000000016d29-251.dat upx behavioral1/memory/628-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1440-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-318-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1532 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1532 Process not Found -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found 1532 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2972 2040 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 28 PID 2040 wrote to memory of 2972 2040 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 28 PID 2040 wrote to memory of 2972 2040 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 28 PID 2040 wrote to memory of 2972 2040 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 28 PID 2972 wrote to memory of 2036 2972 fxlrrrf.exe 29 PID 2972 wrote to memory of 2036 2972 fxlrrrf.exe 29 PID 2972 wrote to memory of 2036 2972 fxlrrrf.exe 29 PID 2972 wrote to memory of 2036 2972 fxlrrrf.exe 29 PID 2036 wrote to memory of 2652 2036 bbhnnn.exe 30 PID 2036 wrote to memory of 2652 2036 bbhnnn.exe 30 PID 2036 wrote to memory of 2652 2036 bbhnnn.exe 30 PID 2036 wrote to memory of 2652 2036 bbhnnn.exe 30 PID 2652 wrote to memory of 2496 2652 ppppp.exe 31 PID 2652 wrote to memory of 2496 2652 ppppp.exe 31 PID 2652 wrote to memory of 2496 2652 ppppp.exe 31 PID 2652 wrote to memory of 2496 2652 ppppp.exe 31 PID 2496 wrote to memory of 2488 2496 5jdjd.exe 32 PID 2496 wrote to memory of 2488 2496 5jdjd.exe 32 PID 2496 wrote to memory of 2488 2496 5jdjd.exe 32 PID 2496 wrote to memory of 2488 2496 5jdjd.exe 32 PID 2488 wrote to memory of 2412 2488 3frrlff.exe 33 PID 2488 wrote to memory of 2412 2488 3frrlff.exe 33 PID 2488 wrote to memory of 2412 2488 3frrlff.exe 33 PID 2488 wrote to memory of 2412 2488 3frrlff.exe 33 PID 2412 wrote to memory of 2428 2412 7xffffx.exe 34 PID 2412 wrote to memory of 2428 2412 7xffffx.exe 34 PID 2412 wrote to memory of 2428 2412 7xffffx.exe 34 PID 2412 wrote to memory of 2428 2412 7xffffx.exe 34 PID 2428 wrote to memory of 2416 2428 5ntttn.exe 35 PID 2428 wrote to memory of 2416 2428 5ntttn.exe 35 PID 2428 wrote to memory of 2416 2428 5ntttn.exe 35 PID 2428 wrote to memory of 2416 2428 5ntttn.exe 35 PID 2416 wrote to memory of 2892 2416 htbhbb.exe 36 PID 2416 wrote to memory of 2892 2416 htbhbb.exe 36 PID 2416 wrote to memory of 2892 2416 htbhbb.exe 36 PID 2416 wrote to memory of 2892 2416 htbhbb.exe 36 PID 2892 wrote to memory of 1808 2892 dpdjp.exe 37 PID 2892 wrote to memory of 1808 2892 dpdjp.exe 37 PID 2892 wrote to memory of 1808 2892 dpdjp.exe 37 PID 2892 wrote to memory of 1808 2892 dpdjp.exe 37 PID 1808 wrote to memory of 2588 1808 7lrrrrx.exe 38 PID 1808 wrote to memory of 2588 1808 7lrrrrx.exe 38 PID 1808 wrote to memory of 2588 1808 7lrrrrx.exe 38 PID 1808 wrote to memory of 2588 1808 7lrrrrx.exe 38 PID 2588 wrote to memory of 2740 2588 nhnnnn.exe 39 PID 2588 wrote to memory of 2740 2588 nhnnnn.exe 39 PID 2588 wrote to memory of 2740 2588 nhnnnn.exe 39 PID 2588 wrote to memory of 2740 2588 nhnnnn.exe 39 PID 2740 wrote to memory of 1940 2740 nhntbb.exe 40 PID 2740 wrote to memory of 1940 2740 nhntbb.exe 40 PID 2740 wrote to memory of 1940 2740 nhntbb.exe 40 PID 2740 wrote to memory of 1940 2740 nhntbb.exe 40 PID 1940 wrote to memory of 2140 1940 pjvjj.exe 41 PID 1940 wrote to memory of 2140 1940 pjvjj.exe 41 PID 1940 wrote to memory of 2140 1940 pjvjj.exe 41 PID 1940 wrote to memory of 2140 1940 pjvjj.exe 41 PID 2140 wrote to memory of 376 2140 5rlrfll.exe 42 PID 2140 wrote to memory of 376 2140 5rlrfll.exe 42 PID 2140 wrote to memory of 376 2140 5rlrfll.exe 42 PID 2140 wrote to memory of 376 2140 5rlrfll.exe 42 PID 376 wrote to memory of 1644 376 lxrlfxf.exe 43 PID 376 wrote to memory of 1644 376 lxrlfxf.exe 43 PID 376 wrote to memory of 1644 376 lxrlfxf.exe 43 PID 376 wrote to memory of 1644 376 lxrlfxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe"C:\Users\Admin\AppData\Local\Temp\f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bbhnnn.exec:\bbhnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\ppppp.exec:\ppppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5jdjd.exec:\5jdjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3frrlff.exec:\3frrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\7xffffx.exec:\7xffffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\5ntttn.exec:\5ntttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\htbhbb.exec:\htbhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\dpdjp.exec:\dpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7lrrrrx.exec:\7lrrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nhnnnn.exec:\nhnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nhntbb.exec:\nhntbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjvjj.exec:\pjvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\5rlrfll.exec:\5rlrfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\lxrlfxf.exec:\lxrlfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\thttbb.exec:\thttbb.exe17⤵
- Executes dropped EXE
PID:1644 -
\??\c:\3bhhtn.exec:\3bhhtn.exe18⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9jvvd.exec:\9jvvd.exe19⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3rfllll.exec:\3rfllll.exe20⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rrflflr.exec:\rrflflr.exe21⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3bhttt.exec:\3bhttt.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nhtnbb.exec:\nhtnbb.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjvjd.exec:\vjvjd.exe24⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7xxxxff.exec:\7xxxxff.exe26⤵
- Executes dropped EXE
PID:708 -
\??\c:\thbhhh.exec:\thbhhh.exe27⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1dvvv.exec:\1dvvv.exe28⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3vddd.exec:\3vddd.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lxrxffl.exec:\lxrxffl.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rfrlflr.exec:\rfrlflr.exe31⤵
- Executes dropped EXE
PID:1656 -
\??\c:\thnnnh.exec:\thnnnh.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\thbttn.exec:\thbttn.exe33⤵
- Executes dropped EXE
PID:828 -
\??\c:\vjvvv.exec:\vjvvv.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pdppv.exec:\pdppv.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lxlffxx.exec:\lxlffxx.exe36⤵
- Executes dropped EXE
PID:628 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbhntn.exec:\hbhntn.exe38⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tntnhh.exec:\tntnhh.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjvvv.exec:\pjvvv.exe40⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9dvdp.exec:\9dvdp.exe41⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lfxxflf.exec:\lfxxflf.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1xllfff.exec:\1xllfff.exe43⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbthtb.exec:\nbthtb.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\thhhbb.exec:\thhhbb.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pjpjp.exec:\pjpjp.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dpppv.exec:\dpppv.exe47⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xrlfflf.exec:\xrlfflf.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrrrrll.exec:\xrrrrll.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nbbbbt.exec:\nbbbbt.exe50⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hnttnh.exec:\hnttnh.exe51⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1pdjj.exec:\1pdjj.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dvpjd.exec:\dvpjd.exe53⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vvjpp.exec:\vvjpp.exe54⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3bnnnb.exec:\3bnnnb.exe56⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1bnntn.exec:\1bnntn.exe57⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vjjjv.exec:\vjjjv.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9dddj.exec:\9dddj.exe59⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ppvvv.exec:\ppvvv.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rxlfxll.exec:\rxlfxll.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\llxlflf.exec:\llxlflf.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbbnhh.exec:\hbbnhh.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tthnnh.exec:\tthnnh.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dpvpp.exec:\dpvpp.exe65⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xrrrxrx.exec:\xrrrxrx.exe66⤵PID:1620
-
\??\c:\3rllrrx.exec:\3rllrrx.exe67⤵PID:1456
-
\??\c:\lllllll.exec:\lllllll.exe68⤵PID:2912
-
\??\c:\7hnhht.exec:\7hnhht.exe69⤵PID:2880
-
\??\c:\tnhnbh.exec:\tnhnbh.exe70⤵PID:2076
-
\??\c:\dpvjj.exec:\dpvjj.exe71⤵PID:1668
-
\??\c:\5vddv.exec:\5vddv.exe72⤵PID:600
-
\??\c:\rxfxfxx.exec:\rxfxfxx.exe73⤵PID:2064
-
\??\c:\lxlxllr.exec:\lxlxllr.exe74⤵PID:696
-
\??\c:\bthhtt.exec:\bthhtt.exe75⤵PID:708
-
\??\c:\thnntt.exec:\thnntt.exe76⤵PID:2980
-
\??\c:\pdppv.exec:\pdppv.exe77⤵PID:1116
-
\??\c:\vvjdv.exec:\vvjdv.exe78⤵PID:1228
-
\??\c:\lxflfff.exec:\lxflfff.exe79⤵PID:1304
-
\??\c:\xrlxllr.exec:\xrlxllr.exe80⤵PID:1816
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe81⤵PID:1604
-
\??\c:\5tbbbb.exec:\5tbbbb.exe82⤵PID:240
-
\??\c:\thtnnn.exec:\thtnnn.exe83⤵PID:1052
-
\??\c:\1pdjj.exec:\1pdjj.exe84⤵PID:828
-
\??\c:\3djpp.exec:\3djpp.exe85⤵PID:3068
-
\??\c:\xrfxrlr.exec:\xrfxrlr.exe86⤵PID:1584
-
\??\c:\rlxllrr.exec:\rlxllrr.exe87⤵PID:628
-
\??\c:\bhhnhb.exec:\bhhnhb.exe88⤵PID:2052
-
\??\c:\bnhhnb.exec:\bnhhnb.exe89⤵PID:1144
-
\??\c:\bnhhnh.exec:\bnhhnh.exe90⤵PID:1028
-
\??\c:\jjdvv.exec:\jjdvv.exe91⤵PID:2164
-
\??\c:\vjdjj.exec:\vjdjj.exe92⤵PID:1292
-
\??\c:\lxfrlfl.exec:\lxfrlfl.exe93⤵PID:2108
-
\??\c:\3pddd.exec:\3pddd.exe94⤵PID:2648
-
\??\c:\9vpjp.exec:\9vpjp.exe95⤵PID:2168
-
\??\c:\fxlfffl.exec:\fxlfffl.exe96⤵PID:2580
-
\??\c:\rflllll.exec:\rflllll.exe97⤵PID:2688
-
\??\c:\5xxrrll.exec:\5xxrrll.exe98⤵PID:2680
-
\??\c:\bnhhth.exec:\bnhhth.exe99⤵PID:2508
-
\??\c:\bthttb.exec:\bthttb.exe100⤵PID:2304
-
\??\c:\jvpjp.exec:\jvpjp.exe101⤵PID:2436
-
\??\c:\jvddv.exec:\jvddv.exe102⤵PID:2132
-
\??\c:\pjpjp.exec:\pjpjp.exe103⤵PID:2416
-
\??\c:\rrxrxlr.exec:\rrxrxlr.exe104⤵PID:2888
-
\??\c:\1xlflll.exec:\1xlflll.exe105⤵PID:1900
-
\??\c:\bnnnth.exec:\bnnnth.exe106⤵PID:1944
-
\??\c:\5bbtbt.exec:\5bbtbt.exe107⤵PID:2604
-
\??\c:\dvvvv.exec:\dvvvv.exe108⤵PID:2696
-
\??\c:\vjvjj.exec:\vjvjj.exe109⤵PID:2780
-
\??\c:\7ffffxf.exec:\7ffffxf.exe110⤵PID:2472
-
\??\c:\xrxxxff.exec:\xrxxxff.exe111⤵PID:2736
-
\??\c:\bhtthn.exec:\bhtthn.exe112⤵PID:2332
-
\??\c:\nbhnnh.exec:\nbhnnh.exe113⤵PID:1916
-
\??\c:\thnntn.exec:\thnntn.exe114⤵PID:1700
-
\??\c:\vjpdd.exec:\vjpdd.exe115⤵PID:2144
-
\??\c:\xxrrflr.exec:\xxrrflr.exe116⤵PID:1560
-
\??\c:\lxflfxx.exec:\lxflfxx.exe117⤵PID:2360
-
\??\c:\tnhhbh.exec:\tnhhbh.exe118⤵PID:2868
-
\??\c:\nbtbhn.exec:\nbtbhn.exe119⤵PID:1456
-
\??\c:\5ttbhh.exec:\5ttbhh.exe120⤵PID:2172
-
\??\c:\jdvpv.exec:\jdvpv.exe121⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-