Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 01:13
Behavioral task
behavioral1
Sample
9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe
-
Size
149KB
-
MD5
72d0d2fac5289c067cafd5da1e10e378
-
SHA1
12c5e4d358ac7f76b79c4895b2870317f79bc62a
-
SHA256
9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c
-
SHA512
3b22d763e729ad6d54816d946463c6c583d4e9a121abb00536454d4e797ba0ad386c07d4224a74ddd9d3496c55071dfaadeba0354b99de2daeb8de9f154811a6
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4tz:kcm4FmowdHoSphraHcpOFltH4tz
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1636-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/696-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1420-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-847-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-947-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/592-1060-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/788-1088-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-1176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1636-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1636-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000c000000014890-5.dat UPX behavioral1/memory/1284-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0033000000015083-17.dat UPX behavioral1/files/0x0008000000015662-25.dat UPX behavioral1/memory/2036-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2648-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2648-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000158d9-36.dat UPX behavioral1/files/0x0007000000015ae3-43.dat UPX behavioral1/memory/2692-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015b50-54.dat UPX behavioral1/memory/2692-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2304-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015b85-62.dat UPX behavioral1/memory/2304-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015d9c-71.dat UPX behavioral1/files/0x0006000000015f23-78.dat UPX behavioral1/memory/2444-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1900-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015fa6-90.dat UPX behavioral1/files/0x0006000000016013-96.dat UPX behavioral1/memory/2608-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016122-106.dat UPX behavioral1/memory/2640-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000161ee-115.dat UPX behavioral1/memory/2472-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000164ec-133.dat UPX behavioral1/memory/1648-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000163eb-126.dat UPX behavioral1/files/0x0006000000016575-142.dat UPX behavioral1/memory/2096-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000167bf-149.dat UPX behavioral1/memory/2460-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016a28-160.dat UPX behavioral1/memory/2460-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c1f-167.dat UPX behavioral1/memory/1476-169-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c30-177.dat UPX behavioral1/files/0x0006000000016c38-184.dat UPX behavioral1/memory/2880-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c84-194.dat UPX behavioral1/memory/2224-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cb5-201.dat UPX behavioral1/memory/696-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016ce0-212.dat UPX behavioral1/files/0x0006000000016ced-219.dat UPX behavioral1/memory/1420-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cf3-229.dat UPX behavioral1/files/0x0006000000016cfd-237.dat UPX behavioral1/memory/1812-238-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d06-246.dat UPX behavioral1/files/0x0006000000016d10-253.dat UPX behavioral1/memory/2016-258-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1880-255-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d18-264.dat UPX behavioral1/files/0x0006000000016d21-272.dat UPX behavioral1/memory/1272-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1272-282-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d29-281.dat UPX behavioral1/memory/900-290-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2200-297-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1332-322-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1284 pjddj.exe 2036 1lllfll.exe 2648 1thhbh.exe 2964 jvjdv.exe 2692 xlrxfxf.exe 2304 thtbbh.exe 2372 tthbhn.exe 2444 9vjvv.exe 1900 xflrxxf.exe 2608 5llxflr.exe 2640 3nnbnb.exe 2472 5pjpj.exe 272 jvdvv.exe 1648 lxrlrlx.exe 1728 rfrflll.exe 2096 1btntt.exe 2460 jdpvd.exe 1476 7pjjv.exe 1708 xlrllfl.exe 2880 hnbbbn.exe 2208 nhtbhb.exe 2224 9ppvd.exe 696 djpjp.exe 1420 1rllffl.exe 1756 lfrfrrx.exe 1500 nttnhb.exe 1812 1pdjp.exe 1880 flrllfr.exe 2016 1xxrxrr.exe 1952 nbhttb.exe 1272 vpjdj.exe 1628 pjppv.exe 900 rlxfflx.exe 2200 3bhtnh.exe 1540 nbtbbh.exe 864 vpjdj.exe 2916 jvdvd.exe 1332 rffffll.exe 2648 7lrrrlr.exe 2984 hbthtt.exe 2680 nhbnth.exe 2684 thnhhh.exe 2304 1pppj.exe 2436 xflffxx.exe 2392 rlfrxrr.exe 2448 rlxrlff.exe 2636 tttntt.exe 2632 dpppv.exe 2764 dpjpv.exe 2696 fxlxlrf.exe 288 llfrfll.exe 812 5bntbt.exe 1868 5ddjp.exe 320 vpdvd.exe 2432 lrlxfff.exe 1620 nbhnnt.exe 2348 bbthhb.exe 1572 pdppd.exe 1464 lxlrxxl.exe 2468 lxlxfll.exe 2216 bbhthn.exe 2064 vdddj.exe 1856 flxrffl.exe 296 lllrffl.exe -
resource yara_rule behavioral1/memory/1636-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000014890-5.dat upx behavioral1/memory/1284-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0033000000015083-17.dat upx behavioral1/files/0x0008000000015662-25.dat upx behavioral1/memory/2036-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000158d9-36.dat upx behavioral1/files/0x0007000000015ae3-43.dat upx behavioral1/memory/2692-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015b50-54.dat upx behavioral1/memory/2692-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015b85-62.dat upx behavioral1/memory/2304-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d9c-71.dat upx behavioral1/files/0x0006000000015f23-78.dat upx behavioral1/memory/2444-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1900-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015fa6-90.dat upx behavioral1/files/0x0006000000016013-96.dat upx behavioral1/memory/2608-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016122-106.dat upx behavioral1/memory/2640-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000161ee-115.dat upx behavioral1/memory/2472-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164ec-133.dat upx behavioral1/memory/1648-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000163eb-126.dat upx behavioral1/files/0x0006000000016575-142.dat upx behavioral1/memory/2096-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167bf-149.dat upx behavioral1/memory/2460-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a28-160.dat upx behavioral1/memory/2460-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1f-167.dat upx behavioral1/memory/1476-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c30-177.dat upx behavioral1/files/0x0006000000016c38-184.dat upx behavioral1/memory/2880-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c84-194.dat upx behavioral1/memory/2224-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb5-201.dat upx behavioral1/memory/696-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ce0-212.dat upx behavioral1/files/0x0006000000016ced-219.dat upx behavioral1/memory/1420-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cf3-229.dat upx behavioral1/files/0x0006000000016cfd-237.dat upx behavioral1/memory/1812-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d06-246.dat upx behavioral1/files/0x0006000000016d10-253.dat upx behavioral1/memory/2016-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1880-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d18-264.dat upx behavioral1/files/0x0006000000016d21-272.dat upx behavioral1/memory/1272-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d29-281.dat upx behavioral1/memory/900-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-322-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1284 1636 9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe 28 PID 1636 wrote to memory of 1284 1636 9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe 28 PID 1636 wrote to memory of 1284 1636 9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe 28 PID 1636 wrote to memory of 1284 1636 9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe 28 PID 1284 wrote to memory of 2036 1284 pjddj.exe 29 PID 1284 wrote to memory of 2036 1284 pjddj.exe 29 PID 1284 wrote to memory of 2036 1284 pjddj.exe 29 PID 1284 wrote to memory of 2036 1284 pjddj.exe 29 PID 2036 wrote to memory of 2648 2036 1lllfll.exe 30 PID 2036 wrote to memory of 2648 2036 1lllfll.exe 30 PID 2036 wrote to memory of 2648 2036 1lllfll.exe 30 PID 2036 wrote to memory of 2648 2036 1lllfll.exe 30 PID 2648 wrote to memory of 2964 2648 1thhbh.exe 31 PID 2648 wrote to memory of 2964 2648 1thhbh.exe 31 PID 2648 wrote to memory of 2964 2648 1thhbh.exe 31 PID 2648 wrote to memory of 2964 2648 1thhbh.exe 31 PID 2964 wrote to memory of 2692 2964 jvjdv.exe 32 PID 2964 wrote to memory of 2692 2964 jvjdv.exe 32 PID 2964 wrote to memory of 2692 2964 jvjdv.exe 32 PID 2964 wrote to memory of 2692 2964 jvjdv.exe 32 PID 2692 wrote to memory of 2304 2692 xlrxfxf.exe 33 PID 2692 wrote to memory of 2304 2692 xlrxfxf.exe 33 PID 2692 wrote to memory of 2304 2692 xlrxfxf.exe 33 PID 2692 wrote to memory of 2304 2692 xlrxfxf.exe 33 PID 2304 wrote to memory of 2372 2304 thtbbh.exe 34 PID 2304 wrote to memory of 2372 2304 thtbbh.exe 34 PID 2304 wrote to memory of 2372 2304 thtbbh.exe 34 PID 2304 wrote to memory of 2372 2304 thtbbh.exe 34 PID 2372 wrote to memory of 2444 2372 tthbhn.exe 35 PID 2372 wrote to memory of 2444 2372 tthbhn.exe 35 PID 2372 wrote to memory of 2444 2372 tthbhn.exe 35 PID 2372 wrote to memory of 2444 2372 tthbhn.exe 35 PID 2444 wrote to memory of 1900 2444 9vjvv.exe 36 PID 2444 wrote to memory of 1900 2444 9vjvv.exe 36 PID 2444 wrote to memory of 1900 2444 9vjvv.exe 36 PID 2444 wrote to memory of 1900 2444 9vjvv.exe 36 PID 1900 wrote to memory of 2608 1900 xflrxxf.exe 37 PID 1900 wrote to memory of 2608 1900 xflrxxf.exe 37 PID 1900 wrote to memory of 2608 1900 xflrxxf.exe 37 PID 1900 wrote to memory of 2608 1900 xflrxxf.exe 37 PID 2608 wrote to memory of 2640 2608 5llxflr.exe 38 PID 2608 wrote to memory of 2640 2608 5llxflr.exe 38 PID 2608 wrote to memory of 2640 2608 5llxflr.exe 38 PID 2608 wrote to memory of 2640 2608 5llxflr.exe 38 PID 2640 wrote to memory of 2472 2640 3nnbnb.exe 39 PID 2640 wrote to memory of 2472 2640 3nnbnb.exe 39 PID 2640 wrote to memory of 2472 2640 3nnbnb.exe 39 PID 2640 wrote to memory of 2472 2640 3nnbnb.exe 39 PID 2472 wrote to memory of 272 2472 5pjpj.exe 40 PID 2472 wrote to memory of 272 2472 5pjpj.exe 40 PID 2472 wrote to memory of 272 2472 5pjpj.exe 40 PID 2472 wrote to memory of 272 2472 5pjpj.exe 40 PID 272 wrote to memory of 1648 272 jvdvv.exe 41 PID 272 wrote to memory of 1648 272 jvdvv.exe 41 PID 272 wrote to memory of 1648 272 jvdvv.exe 41 PID 272 wrote to memory of 1648 272 jvdvv.exe 41 PID 1648 wrote to memory of 1728 1648 lxrlrlx.exe 42 PID 1648 wrote to memory of 1728 1648 lxrlrlx.exe 42 PID 1648 wrote to memory of 1728 1648 lxrlrlx.exe 42 PID 1648 wrote to memory of 1728 1648 lxrlrlx.exe 42 PID 1728 wrote to memory of 2096 1728 rfrflll.exe 43 PID 1728 wrote to memory of 2096 1728 rfrflll.exe 43 PID 1728 wrote to memory of 2096 1728 rfrflll.exe 43 PID 1728 wrote to memory of 2096 1728 rfrflll.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe"C:\Users\Admin\AppData\Local\Temp\9a3469cd99a838abfaa4bd8b4f014ce0c976385175965828f4c42223d26e311c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\pjddj.exec:\pjddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\1lllfll.exec:\1lllfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\1thhbh.exec:\1thhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jvjdv.exec:\jvjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xlrxfxf.exec:\xlrxfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\thtbbh.exec:\thtbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\tthbhn.exec:\tthbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\9vjvv.exec:\9vjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xflrxxf.exec:\xflrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\5llxflr.exec:\5llxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\3nnbnb.exec:\3nnbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5pjpj.exec:\5pjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\jvdvv.exec:\jvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\lxrlrlx.exec:\lxrlrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rfrflll.exec:\rfrflll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\1btntt.exec:\1btntt.exe17⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jdpvd.exec:\jdpvd.exe18⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7pjjv.exec:\7pjjv.exe19⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xlrllfl.exec:\xlrllfl.exe20⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hnbbbn.exec:\hnbbbn.exe21⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhtbhb.exec:\nhtbhb.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9ppvd.exec:\9ppvd.exe23⤵
- Executes dropped EXE
PID:2224 -
\??\c:\djpjp.exec:\djpjp.exe24⤵
- Executes dropped EXE
PID:696 -
\??\c:\1rllffl.exec:\1rllffl.exe25⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lfrfrrx.exec:\lfrfrrx.exe26⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nttnhb.exec:\nttnhb.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1pdjp.exec:\1pdjp.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\flrllfr.exec:\flrllfr.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1xxrxrr.exec:\1xxrxrr.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbhttb.exec:\nbhttb.exe31⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vpjdj.exec:\vpjdj.exe32⤵
- Executes dropped EXE
PID:1272 -
\??\c:\pjppv.exec:\pjppv.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rlxfflx.exec:\rlxfflx.exe34⤵
- Executes dropped EXE
PID:900 -
\??\c:\3bhtnh.exec:\3bhtnh.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nbtbbh.exec:\nbtbbh.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpjdj.exec:\vpjdj.exe37⤵
- Executes dropped EXE
PID:864 -
\??\c:\jvdvd.exec:\jvdvd.exe38⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rffffll.exec:\rffffll.exe39⤵
- Executes dropped EXE
PID:1332 -
\??\c:\7lrrrlr.exec:\7lrrrlr.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbthtt.exec:\hbthtt.exe41⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nhbnth.exec:\nhbnth.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\thnhhh.exec:\thnhhh.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1pppj.exec:\1pppj.exe44⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xflffxx.exec:\xflffxx.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlfrxrr.exec:\rlfrxrr.exe46⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rlxrlff.exec:\rlxrlff.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tttntt.exec:\tttntt.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dpppv.exec:\dpppv.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dpjpv.exec:\dpjpv.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\llfrfll.exec:\llfrfll.exe52⤵
- Executes dropped EXE
PID:288 -
\??\c:\5bntbt.exec:\5bntbt.exe53⤵
- Executes dropped EXE
PID:812 -
\??\c:\5ddjp.exec:\5ddjp.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vpdvd.exec:\vpdvd.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\lrlxfff.exec:\lrlxfff.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nbhnnt.exec:\nbhnnt.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bbthhb.exec:\bbthhb.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pdppd.exec:\pdppd.exe59⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lxlrxxl.exec:\lxlrxxl.exe60⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lxlxfll.exec:\lxlxfll.exe61⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bbhthn.exec:\bbhthn.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vdddj.exec:\vdddj.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\flxrffl.exec:\flxrffl.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lllrffl.exec:\lllrffl.exe65⤵
- Executes dropped EXE
PID:296 -
\??\c:\nnhnbb.exec:\nnhnbb.exe66⤵PID:1416
-
\??\c:\tnnbtb.exec:\tnnbtb.exe67⤵PID:596
-
\??\c:\7pdvd.exec:\7pdvd.exe68⤵PID:1376
-
\??\c:\7rrxfrf.exec:\7rrxfrf.exe69⤵PID:1816
-
\??\c:\fxflrrr.exec:\fxflrrr.exe70⤵PID:1500
-
\??\c:\hhbthn.exec:\hhbthn.exe71⤵PID:1304
-
\??\c:\dvdjp.exec:\dvdjp.exe72⤵PID:672
-
\??\c:\pdjdv.exec:\pdjdv.exe73⤵PID:2016
-
\??\c:\lxlflrf.exec:\lxlflrf.exe74⤵PID:952
-
\??\c:\nhbtbb.exec:\nhbtbb.exe75⤵PID:1952
-
\??\c:\btbhht.exec:\btbhht.exe76⤵PID:1892
-
\??\c:\ddjjp.exec:\ddjjp.exe77⤵PID:2804
-
\??\c:\xrxfllx.exec:\xrxfllx.exe78⤵PID:2232
-
\??\c:\xrfllrx.exec:\xrfllrx.exe79⤵PID:1744
-
\??\c:\bhttnn.exec:\bhttnn.exe80⤵PID:2956
-
\??\c:\btbthh.exec:\btbthh.exe81⤵PID:2560
-
\??\c:\jdjjv.exec:\jdjjv.exe82⤵PID:864
-
\??\c:\pdpjj.exec:\pdpjj.exe83⤵PID:2524
-
\??\c:\xlrxxfl.exec:\xlrxxfl.exe84⤵PID:1332
-
\??\c:\hhnbnn.exec:\hhnbnn.exe85⤵PID:2812
-
\??\c:\7nnntb.exec:\7nnntb.exe86⤵PID:892
-
\??\c:\pjvdd.exec:\pjvdd.exe87⤵PID:2600
-
\??\c:\3ppdd.exec:\3ppdd.exe88⤵PID:2400
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe89⤵PID:2492
-
\??\c:\fxrxffr.exec:\fxrxffr.exe90⤵PID:2424
-
\??\c:\tnhthh.exec:\tnhthh.exe91⤵PID:2416
-
\??\c:\nnnbht.exec:\nnnbht.exe92⤵PID:2596
-
\??\c:\pppdv.exec:\pppdv.exe93⤵PID:2636
-
\??\c:\7dvjv.exec:\7dvjv.exe94⤵PID:2632
-
\??\c:\fflrrxr.exec:\fflrrxr.exe95⤵PID:2764
-
\??\c:\xxlxfff.exec:\xxlxfff.exe96⤵PID:2696
-
\??\c:\5nbntt.exec:\5nbntt.exe97⤵PID:472
-
\??\c:\dvjpp.exec:\dvjpp.exe98⤵PID:2256
-
\??\c:\vjvpv.exec:\vjvpv.exe99⤵PID:1260
-
\??\c:\xxfffrf.exec:\xxfffrf.exe100⤵PID:1936
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe101⤵PID:2144
-
\??\c:\3nbhnt.exec:\3nbhnt.exe102⤵PID:1360
-
\??\c:\btnbtt.exec:\btnbtt.exe103⤵PID:1568
-
\??\c:\vvvdv.exec:\vvvdv.exe104⤵PID:2172
-
\??\c:\vpdpj.exec:\vpdpj.exe105⤵PID:1964
-
\??\c:\1rrfrfx.exec:\1rrfrfx.exe106⤵PID:1668
-
\??\c:\bbtnhn.exec:\bbtnhn.exe107⤵PID:2228
-
\??\c:\lfflxfx.exec:\lfflxfx.exe108⤵PID:324
-
\??\c:\9fflrxf.exec:\9fflrxf.exe109⤵PID:1428
-
\??\c:\3hntbh.exec:\3hntbh.exe110⤵PID:2224
-
\??\c:\nhhnbb.exec:\nhhnbb.exe111⤵PID:1004
-
\??\c:\vvvjp.exec:\vvvjp.exe112⤵PID:1804
-
\??\c:\pppjp.exec:\pppjp.exe113⤵PID:2744
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe114⤵PID:1608
-
\??\c:\5hbtht.exec:\5hbtht.exe115⤵PID:1812
-
\??\c:\btbbnn.exec:\btbbnn.exe116⤵PID:1576
-
\??\c:\ddvjp.exec:\ddvjp.exe117⤵PID:3068
-
\??\c:\fxfrxfl.exec:\fxfrxfl.exe118⤵PID:1584
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe119⤵PID:1748
-
\??\c:\3lxrflx.exec:\3lxrflx.exe120⤵PID:2088
-
\??\c:\bnbhth.exec:\bnbhth.exe121⤵PID:1056
-
\??\c:\1ddpj.exec:\1ddpj.exe122⤵PID:1028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-