Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 04:29
Behavioral task
behavioral1
Sample
fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe
-
Size
484KB
-
MD5
01d65cd7d4d41a9221c27ca5952e72c7
-
SHA1
2c78a641091b52bbfd388ce6849be923d5d07542
-
SHA256
fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6
-
SHA512
3f185108978feb11c76c2cc26f336da1c67115c95642c6d1b0e942235fbfef439d0cb0701bcb7f575b88fb10cc12b60c62fd51efe11778505fff52373ae601af
-
SSDEEP
12288:N4wFHoSMu49P9mPh2kkkkK4kXkkkkkkkkl888888888888888888nv:Cu49lmPh2kkkkK4kXkkkkkkkkx
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1740-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2216-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2984-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2920-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2796-87-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/628-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2808-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1636-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1704-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1668-300-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2596-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2564-336-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2424-388-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2284-441-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2420-454-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/796-478-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon behavioral1/memory/1620-552-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1144-767-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2004-1037-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2012-781-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2020-468-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2256-427-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2560-350-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1996-309-0x0000000077470000-0x000000007758F000-memory.dmp family_blackmoon behavioral1/memory/2324-301-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/756-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2332-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2788-233-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2188-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1136-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/292-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1628-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1444-96-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2360-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1940-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2572-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1740-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1740-7-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x000d00000001449a-5.dat UPX behavioral1/files/0x0034000000014701-18.dat UPX behavioral1/memory/2216-15-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2572-29-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2984-28-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x00070000000149ea-26.dat UPX behavioral1/memory/2984-19-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2920-48-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000014c25-49.dat UPX behavioral1/files/0x0007000000014e5a-55.dat UPX behavioral1/memory/1940-59-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000015023-69.dat UPX behavioral1/files/0x000a0000000155e3-79.dat UPX behavioral1/memory/2796-78-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2796-87-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/628-106-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000015cca-107.dat UPX behavioral1/files/0x0006000000015cdb-114.dat UPX behavioral1/files/0x0006000000015cf7-129.dat UPX behavioral1/memory/2808-160-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1636-169-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000015f1b-170.dat UPX behavioral1/files/0x0006000000015f9e-182.dat UPX behavioral1/files/0x0006000000016277-218.dat UPX behavioral1/files/0x0006000000016411-226.dat UPX behavioral1/files/0x0006000000016525-234.dat UPX behavioral1/files/0x0006000000016597-244.dat UPX behavioral1/memory/1704-251-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x00060000000167ef-250.dat UPX behavioral1/files/0x0006000000016a45-259.dat UPX behavioral1/files/0x0006000000016c17-270.dat UPX behavioral1/files/0x0006000000016c26-277.dat UPX behavioral1/memory/1668-300-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2596-329-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2564-336-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2424-388-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2252-412-0x0000000001C70000-0x0000000001CA6000-memory.dmp UPX behavioral1/memory/2256-420-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2284-441-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2420-454-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/796-478-0x00000000003A0000-0x00000000003D6000-memory.dmp UPX behavioral1/memory/1620-552-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2720-623-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2376-649-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2484-687-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1144-767-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2344-806-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1740-863-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/836-1024-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/876-1044-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1720-1082-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2480-896-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2492-875-0x0000000000220000-0x0000000000256000-memory.dmp UPX behavioral1/memory/1668-856-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1204-825-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2012-781-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2012-774-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2672-712-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2368-630-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2596-610-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1836-583-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2020-468-0x0000000000400000-0x0000000000436000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2216 lfxrllr.exe 2984 3httnh.exe 2572 dpvpd.exe 2920 ppvpp.exe 2060 7frxlff.exe 1940 nhthtt.exe 2360 vppjj.exe 2796 vdpvv.exe 1444 fxrrllx.exe 628 7btnnb.exe 2660 ddvjp.exe 1840 dvddp.exe 1016 flfxlfr.exe 1628 nbtnnb.exe 292 btntbh.exe 2808 7fflxfl.exe 1636 htttnb.exe 1136 bhbtbn.exe 3008 rlrrlrr.exe 1680 nbhtht.exe 2188 ppdjv.exe 488 fxrxlrr.exe 588 7nbhhb.exe 2788 lrrrxxl.exe 2332 tnttht.exe 1704 9flxrxr.exe 1264 3pddp.exe 756 fxlrxxf.exe 572 dvjjj.exe 2300 5rrfllf.exe 872 tbthnt.exe 1668 3pddp.exe 2324 xffrffr.exe 1996 tnbbht.exe 1528 rfrfxlf.exe 2508 lrxfrfx.exe 2596 bttbhn.exe 2564 jjdjv.exe 2560 pvpjd.exe 2464 lrrrffx.exe 2272 hnbnhb.exe 2396 ppvdp.exe 2880 vvvdv.exe 2796 rllrflx.exe 1444 bttttt.exe 2424 vpvpj.exe 2440 llrxrxr.exe 2428 bnbnbn.exe 2252 1jddv.exe 1820 vpppj.exe 2256 xffxflr.exe 1184 httbhb.exe 2284 dvpvj.exe 1244 rlffrrr.exe 1324 ffrxlxr.exe 2420 nnbntn.exe 2020 vjjvp.exe 2180 rrlrxxf.exe 796 xfxrllr.exe 336 nnhnbn.exe 2072 djdpj.exe 2024 xrrxlrf.exe 2308 fxllxxf.exe 960 5hthth.exe -
resource yara_rule behavioral1/memory/1740-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1740-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000d00000001449a-5.dat upx behavioral1/files/0x0034000000014701-18.dat upx behavioral1/memory/2216-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2572-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2984-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000149ea-26.dat upx behavioral1/memory/2984-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2920-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014c25-49.dat upx behavioral1/files/0x0007000000014e5a-55.dat upx behavioral1/memory/1940-59-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015023-69.dat upx behavioral1/files/0x000a0000000155e3-79.dat upx behavioral1/memory/2796-78-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2796-87-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/628-106-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015cca-107.dat upx behavioral1/files/0x0006000000015cdb-114.dat upx behavioral1/files/0x0006000000015cf7-129.dat upx behavioral1/memory/2808-160-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1636-169-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015f1b-170.dat upx behavioral1/files/0x0006000000015f9e-182.dat upx behavioral1/files/0x0006000000016277-218.dat upx behavioral1/files/0x0006000000016411-226.dat upx behavioral1/files/0x0006000000016525-234.dat upx behavioral1/files/0x0006000000016597-244.dat upx behavioral1/memory/1704-251-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000167ef-250.dat upx behavioral1/files/0x0006000000016a45-259.dat upx behavioral1/files/0x0006000000016c17-270.dat upx behavioral1/files/0x0006000000016c26-277.dat upx behavioral1/memory/1668-300-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2596-329-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2564-336-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2424-388-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2252-412-0x0000000001C70000-0x0000000001CA6000-memory.dmp upx behavioral1/memory/2256-420-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2284-441-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2420-454-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/796-478-0x00000000003A0000-0x00000000003D6000-memory.dmp upx behavioral1/memory/1620-552-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2720-623-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2376-649-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2484-687-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1144-767-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2344-806-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1740-863-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/836-1024-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/876-1044-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1720-1082-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2480-896-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2492-875-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/1668-856-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1204-825-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2012-781-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2012-774-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2672-712-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2368-630-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2596-610-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1836-583-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2020-468-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2216 1740 fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe 28 PID 1740 wrote to memory of 2216 1740 fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe 28 PID 1740 wrote to memory of 2216 1740 fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe 28 PID 1740 wrote to memory of 2216 1740 fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe 28 PID 2216 wrote to memory of 2984 2216 lfxrllr.exe 29 PID 2216 wrote to memory of 2984 2216 lfxrllr.exe 29 PID 2216 wrote to memory of 2984 2216 lfxrllr.exe 29 PID 2216 wrote to memory of 2984 2216 lfxrllr.exe 29 PID 2984 wrote to memory of 2572 2984 3httnh.exe 109 PID 2984 wrote to memory of 2572 2984 3httnh.exe 109 PID 2984 wrote to memory of 2572 2984 3httnh.exe 109 PID 2984 wrote to memory of 2572 2984 3httnh.exe 109 PID 2572 wrote to memory of 2920 2572 dpvpd.exe 31 PID 2572 wrote to memory of 2920 2572 dpvpd.exe 31 PID 2572 wrote to memory of 2920 2572 dpvpd.exe 31 PID 2572 wrote to memory of 2920 2572 dpvpd.exe 31 PID 2920 wrote to memory of 2060 2920 ppvpp.exe 32 PID 2920 wrote to memory of 2060 2920 ppvpp.exe 32 PID 2920 wrote to memory of 2060 2920 ppvpp.exe 32 PID 2920 wrote to memory of 2060 2920 ppvpp.exe 32 PID 2060 wrote to memory of 1940 2060 7frxlff.exe 33 PID 2060 wrote to memory of 1940 2060 7frxlff.exe 33 PID 2060 wrote to memory of 1940 2060 7frxlff.exe 33 PID 2060 wrote to memory of 1940 2060 7frxlff.exe 33 PID 1940 wrote to memory of 2360 1940 nhthtt.exe 34 PID 1940 wrote to memory of 2360 1940 nhthtt.exe 34 PID 1940 wrote to memory of 2360 1940 nhthtt.exe 34 PID 1940 wrote to memory of 2360 1940 nhthtt.exe 34 PID 2360 wrote to memory of 2796 2360 vppjj.exe 35 PID 2360 wrote to memory of 2796 2360 vppjj.exe 35 PID 2360 wrote to memory of 2796 2360 vppjj.exe 35 PID 2360 wrote to memory of 2796 2360 vppjj.exe 35 PID 2796 wrote to memory of 1444 2796 vdpvv.exe 36 PID 2796 wrote to memory of 1444 2796 vdpvv.exe 36 PID 2796 wrote to memory of 1444 2796 vdpvv.exe 36 PID 2796 wrote to memory of 1444 2796 vdpvv.exe 36 PID 1444 wrote to memory of 628 1444 fxrrllx.exe 37 PID 1444 wrote to memory of 628 1444 fxrrllx.exe 37 PID 1444 wrote to memory of 628 1444 fxrrllx.exe 37 PID 1444 wrote to memory of 628 1444 fxrrllx.exe 37 PID 628 wrote to memory of 2660 628 7btnnb.exe 38 PID 628 wrote to memory of 2660 628 7btnnb.exe 38 PID 628 wrote to memory of 2660 628 7btnnb.exe 38 PID 628 wrote to memory of 2660 628 7btnnb.exe 38 PID 2660 wrote to memory of 1840 2660 ddvjp.exe 39 PID 2660 wrote to memory of 1840 2660 ddvjp.exe 39 PID 2660 wrote to memory of 1840 2660 ddvjp.exe 39 PID 2660 wrote to memory of 1840 2660 ddvjp.exe 39 PID 1840 wrote to memory of 1016 1840 dvddp.exe 40 PID 1840 wrote to memory of 1016 1840 dvddp.exe 40 PID 1840 wrote to memory of 1016 1840 dvddp.exe 40 PID 1840 wrote to memory of 1016 1840 dvddp.exe 40 PID 1016 wrote to memory of 1628 1016 flfxlfr.exe 41 PID 1016 wrote to memory of 1628 1016 flfxlfr.exe 41 PID 1016 wrote to memory of 1628 1016 flfxlfr.exe 41 PID 1016 wrote to memory of 1628 1016 flfxlfr.exe 41 PID 1628 wrote to memory of 292 1628 nbtnnb.exe 42 PID 1628 wrote to memory of 292 1628 nbtnnb.exe 42 PID 1628 wrote to memory of 292 1628 nbtnnb.exe 42 PID 1628 wrote to memory of 292 1628 nbtnnb.exe 42 PID 292 wrote to memory of 2808 292 btntbh.exe 43 PID 292 wrote to memory of 2808 292 btntbh.exe 43 PID 292 wrote to memory of 2808 292 btntbh.exe 43 PID 292 wrote to memory of 2808 292 btntbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe"C:\Users\Admin\AppData\Local\Temp\fe0043477de45213c730f0c39b5d2589a0c17d3fa0a08469282a09eac8ac16c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\lfxrllr.exec:\lfxrllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\3httnh.exec:\3httnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\dpvpd.exec:\dpvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ppvpp.exec:\ppvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\7frxlff.exec:\7frxlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nhthtt.exec:\nhthtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\vppjj.exec:\vppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\vdpvv.exec:\vdpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\fxrrllx.exec:\fxrrllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\7btnnb.exec:\7btnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\ddvjp.exec:\ddvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\dvddp.exec:\dvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\flfxlfr.exec:\flfxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\nbtnnb.exec:\nbtnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\btntbh.exec:\btntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\7fflxfl.exec:\7fflxfl.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\htttnb.exec:\htttnb.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhbtbn.exec:\bhbtbn.exe19⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe20⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbhtht.exec:\nbhtht.exe21⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ppdjv.exec:\ppdjv.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe23⤵
- Executes dropped EXE
PID:488 -
\??\c:\7nbhhb.exec:\7nbhhb.exe24⤵
- Executes dropped EXE
PID:588 -
\??\c:\lrrrxxl.exec:\lrrrxxl.exe25⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnttht.exec:\tnttht.exe26⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9flxrxr.exec:\9flxrxr.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3pddp.exec:\3pddp.exe28⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe29⤵
- Executes dropped EXE
PID:756 -
\??\c:\dvjjj.exec:\dvjjj.exe30⤵
- Executes dropped EXE
PID:572 -
\??\c:\5rrfllf.exec:\5rrfllf.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tbthnt.exec:\tbthnt.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\3pddp.exec:\3pddp.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xffrffr.exec:\xffrffr.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tnbbht.exec:\tnbbht.exe35⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pddjj.exec:\pddjj.exe36⤵PID:2504
-
\??\c:\rfrfxlf.exec:\rfrfxlf.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lrxfrfx.exec:\lrxfrfx.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bttbhn.exec:\bttbhn.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjdjv.exec:\jjdjv.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pvpjd.exec:\pvpjd.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lrrrffx.exec:\lrrrffx.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hnbnhb.exec:\hnbnhb.exe43⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ppvdp.exec:\ppvdp.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvvdv.exec:\vvvdv.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rllrflx.exec:\rllrflx.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bttttt.exec:\bttttt.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vpvpj.exec:\vpvpj.exe48⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llrxrxr.exec:\llrxrxr.exe49⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bnbnbn.exec:\bnbnbn.exe50⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1jddv.exec:\1jddv.exe51⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpppj.exec:\vpppj.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xffxflr.exec:\xffxflr.exe53⤵
- Executes dropped EXE
PID:2256 -
\??\c:\httbhb.exec:\httbhb.exe54⤵
- Executes dropped EXE
PID:1184 -
\??\c:\dvpvj.exec:\dvpvj.exe55⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rlffrrr.exec:\rlffrrr.exe56⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ffrxlxr.exec:\ffrxlxr.exe57⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nnbntn.exec:\nnbntn.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vjjvp.exec:\vjjvp.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xfxrllr.exec:\xfxrllr.exe61⤵
- Executes dropped EXE
PID:796 -
\??\c:\nnhnbn.exec:\nnhnbn.exe62⤵
- Executes dropped EXE
PID:336 -
\??\c:\djdpj.exec:\djdpj.exe63⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxllxxf.exec:\fxllxxf.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5hthth.exec:\5hthth.exe66⤵
- Executes dropped EXE
PID:960 -
\??\c:\3dpvj.exec:\3dpvj.exe67⤵PID:1700
-
\??\c:\ddddj.exec:\ddddj.exe68⤵PID:1544
-
\??\c:\xxrflll.exec:\xxrflll.exe69⤵PID:1704
-
\??\c:\9bnbbb.exec:\9bnbbb.exe70⤵PID:3056
-
\??\c:\9vjpv.exec:\9vjpv.exe71⤵PID:756
-
\??\c:\ffxrxrx.exec:\ffxrxrx.exe72⤵PID:2696
-
\??\c:\fxrxflx.exec:\fxrxflx.exe73⤵PID:1620
-
\??\c:\7tnbbh.exec:\7tnbbh.exe74⤵PID:2200
-
\??\c:\ppppj.exec:\ppppj.exe75⤵PID:2240
-
\??\c:\dvpjv.exec:\dvpjv.exe76⤵PID:1980
-
\??\c:\1xllrxl.exec:\1xllrxl.exe77⤵PID:1964
-
\??\c:\bththn.exec:\bththn.exe78⤵PID:1836
-
\??\c:\jdvvd.exec:\jdvvd.exe79⤵PID:2704
-
\??\c:\ppjpd.exec:\ppjpd.exe80⤵PID:1536
-
\??\c:\rxrlflf.exec:\rxrlflf.exe81⤵PID:2456
-
\??\c:\ttbhth.exec:\ttbhth.exe82⤵PID:2596
-
\??\c:\jdpvp.exec:\jdpvp.exe83⤵PID:2572
-
\??\c:\fffflrf.exec:\fffflrf.exe84⤵PID:2720
-
\??\c:\7fxlrxf.exec:\7fxlrxf.exe85⤵PID:2368
-
\??\c:\bbttht.exec:\bbttht.exe86⤵PID:2476
-
\??\c:\bttnht.exec:\bttnht.exe87⤵PID:2728
-
\??\c:\pdvpp.exec:\pdvpp.exe88⤵PID:2376
-
\??\c:\xrxfrxl.exec:\xrxfrxl.exe89⤵PID:2624
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe90⤵PID:2668
-
\??\c:\bbbbbb.exec:\bbbbbb.exe91⤵PID:2820
-
\??\c:\vvpvj.exec:\vvpvj.exe92⤵PID:1256
-
\??\c:\7djvd.exec:\7djvd.exe93⤵PID:888
-
\??\c:\xxrflxl.exec:\xxrflxl.exe94⤵PID:2484
-
\??\c:\bttbnh.exec:\bttbnh.exe95⤵PID:1612
-
\??\c:\pvddp.exec:\pvddp.exe96⤵PID:1728
-
\??\c:\1jjpd.exec:\1jjpd.exe97⤵PID:2256
-
\??\c:\3flxrfr.exec:\3flxrfr.exe98⤵PID:2672
-
\??\c:\7hhbth.exec:\7hhbth.exe99⤵PID:2276
-
\??\c:\hbhbht.exec:\hbhbht.exe100⤵PID:2680
-
\??\c:\jppvj.exec:\jppvj.exe101⤵PID:2176
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe102⤵PID:3052
-
\??\c:\llllrrl.exec:\llllrrl.exe103⤵PID:3008
-
\??\c:\9hntbb.exec:\9hntbb.exe104⤵PID:2732
-
\??\c:\vdjjv.exec:\vdjjv.exe105⤵PID:812
-
\??\c:\ppjvj.exec:\ppjvj.exe106⤵PID:1412
-
\??\c:\1xxxlrf.exec:\1xxxlrf.exe107⤵PID:1144
-
\??\c:\hhntbh.exec:\hhntbh.exe108⤵PID:2012
-
\??\c:\hnbbhn.exec:\hnbbhn.exe109⤵PID:2288
-
\??\c:\7pdpd.exec:\7pdpd.exe110⤵PID:1808
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe111⤵PID:1928
-
\??\c:\lllrxfr.exec:\lllrxfr.exe112⤵PID:956
-
\??\c:\tnhbbn.exec:\tnhbbn.exe113⤵PID:2344
-
\??\c:\hnthht.exec:\hnthht.exe114⤵PID:1580
-
\??\c:\jvjpj.exec:\jvjpj.exe115⤵PID:904
-
\??\c:\llrxxrl.exec:\llrxxrl.exe116⤵PID:1204
-
\??\c:\nnhbbt.exec:\nnhbbt.exe117⤵PID:3016
-
\??\c:\nnbnbb.exec:\nnbnbb.exe118⤵PID:2148
-
\??\c:\jjpdj.exec:\jjpdj.exe119⤵PID:872
-
\??\c:\xxrxrlr.exec:\xxrxrlr.exe120⤵PID:1436
-
\??\c:\lllrflx.exec:\lllrflx.exe121⤵PID:1668
-
\??\c:\bnthnh.exec:\bnthnh.exe122⤵PID:1740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-