Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 18:40
Behavioral task
behavioral1
Sample
0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe
-
Size
540KB
-
MD5
19a082720cae7b5ea2832a528fb44686
-
SHA1
d06c5bec3e9615f7096eaf9ce2c5defe4ff1b35a
-
SHA256
0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7
-
SHA512
70c4472ad11b372288660b79baeaa5efd83bc45ecec9972e80f49acd075b17d3b1a054536a654d9a5c73c31bf4b593bae490eda288c1806a518f0d8e5d4f366b
-
SSDEEP
6144:Ucm4FmowdHoSEsIR7DsFhraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNDoD7:i4wFHoSEsIR7seFaKHpv/VycgE81lg8
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2216-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2476-17-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1836-26-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2292-29-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2004-38-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2912-48-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2648-63-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2684-81-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2524-84-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2104-93-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1608-103-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1508-149-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2116-169-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/828-166-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2080-178-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2496-194-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/672-204-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1616-207-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/604-229-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2336-237-0x0000000000350000-0x0000000000385000-memory.dmp family_blackmoon behavioral1/memory/1712-242-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2336-240-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/352-253-0x00000000004D0000-0x0000000000505000-memory.dmp family_blackmoon behavioral1/memory/352-259-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1040-283-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1144-292-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2904-305-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1836-342-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2556-394-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2604-413-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3052-421-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2068-452-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1040-573-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/976-587-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2804-626-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2736-936-0x0000000000330000-0x0000000000365000-memory.dmp family_blackmoon behavioral1/memory/2580-982-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/2456-1120-0x00000000003A0000-0x00000000003D5000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2216-3-0x0000000000220000-0x0000000000255000-memory.dmp UPX behavioral1/files/0x000c00000001227b-6.dat UPX behavioral1/memory/2216-8-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0038000000015c7f-18.dat UPX behavioral1/memory/2476-17-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1836-26-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0008000000015cc7-25.dat UPX behavioral1/memory/2292-29-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0008000000015ccf-35.dat UPX behavioral1/memory/2004-38-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0007000000015cf0-45.dat UPX behavioral1/memory/2912-48-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0007000000015d02-54.dat UPX behavioral1/files/0x0007000000015d0c-61.dat UPX behavioral1/memory/2052-65-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2648-63-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0008000000015d28-73.dat UPX behavioral1/memory/2684-81-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x00080000000165a8-83.dat UPX behavioral1/memory/2524-84-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016abb-91.dat UPX behavioral1/memory/2104-93-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016c56-98.dat UPX behavioral1/memory/1608-103-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016c71-109.dat UPX behavioral1/files/0x0006000000016c7a-116.dat UPX behavioral1/files/0x0006000000016cc3-124.dat UPX behavioral1/files/0x0038000000015c93-132.dat UPX behavioral1/files/0x0006000000016ce7-141.dat UPX behavioral1/memory/1508-149-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016d1b-151.dat UPX behavioral1/files/0x0006000000016d2c-158.dat UPX behavioral1/files/0x0006000000016d34-167.dat UPX behavioral1/memory/2116-169-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/828-166-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2080-178-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016d3d-177.dat UPX behavioral1/files/0x0006000000016d45-186.dat UPX behavioral1/files/0x0006000000016d4e-195.dat UPX behavioral1/memory/2496-194-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/672-204-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016d61-201.dat UPX behavioral1/memory/1616-207-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016d65-213.dat UPX behavioral1/files/0x0006000000016d69-221.dat UPX behavioral1/files/0x0006000000016d71-230.dat UPX behavioral1/memory/604-229-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1712-242-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016dda-241.dat UPX behavioral1/memory/2336-240-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016dde-249.dat UPX behavioral1/memory/352-253-0x00000000004D0000-0x0000000000505000-memory.dmp UPX behavioral1/files/0x0006000000016de7-256.dat UPX behavioral1/memory/352-259-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016eb9-267.dat UPX behavioral1/files/0x0006000000017042-275.dat UPX behavioral1/files/0x0006000000017477-284.dat UPX behavioral1/memory/1040-283-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1144-292-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2904-305-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1836-342-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2668-355-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2896-362-0x0000000000400000-0x0000000000435000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2476 lfrxllx.exe 1836 xrfllrx.exe 2292 vpvpv.exe 2004 9fflflr.exe 2912 hbtnbh.exe 2648 vvvpd.exe 2052 bbnthn.exe 2684 dvvjd.exe 2524 lfrflrr.exe 2104 5jjjv.exe 1608 5jdpv.exe 3056 9nbhth.exe 2764 vvpvj.exe 2972 lfxlxfr.exe 2176 nhtbhn.exe 1508 lfrfrxf.exe 1196 hbbtnt.exe 828 vvvdv.exe 2116 7bbhnt.exe 2080 3jdjd.exe 2496 5frfxfr.exe 672 vvvvp.exe 1616 bttnnt.exe 1252 5djvp.exe 604 pjdvj.exe 2336 3lxrxxx.exe 1712 ttthnn.exe 352 pjdvv.exe 660 5tnbth.exe 692 9dpdj.exe 1040 1nbbnt.exe 1576 ttnbnb.exe 1144 1fflrlx.exe 1748 dvpvj.exe 2904 fxffrxl.exe 1572 bthnbb.exe 2192 7hhhhh.exe 1724 vvpdj.exe 3044 xrflxxl.exe 1836 hbtbhn.exe 2724 jvjjj.exe 2664 9vdvp.exe 2668 rxrrxfl.exe 2896 ttnbnt.exe 2696 dvjpd.exe 1980 vpppv.exe 2508 rllfrfx.exe 2556 bbbnnn.exe 3012 pdvdj.exe 3016 rxfrxrr.exe 2604 lfrflfr.exe 3052 3hnnhn.exe 1716 ppjvj.exe 2756 ffrfrrx.exe 1320 hthnbb.exe 2320 pjvjp.exe 2816 5dvvd.exe 2068 xxflxlf.exe 2084 tnnbtb.exe 1248 pjddp.exe 2472 jdppv.exe 2924 9lxxfxx.exe 2080 hthntt.exe 2496 5dpvd.exe -
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2216-3-0x0000000000220000-0x0000000000255000-memory.dmp upx behavioral1/files/0x000c00000001227b-6.dat upx behavioral1/memory/2216-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0038000000015c7f-18.dat upx behavioral1/memory/2476-17-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1836-26-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015cc7-25.dat upx behavioral1/memory/2292-29-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015ccf-35.dat upx behavioral1/memory/2004-38-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000015cf0-45.dat upx behavioral1/memory/2912-48-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000015d02-54.dat upx behavioral1/files/0x0007000000015d0c-61.dat upx behavioral1/memory/2052-65-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2648-63-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015d28-73.dat upx behavioral1/memory/2684-81-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00080000000165a8-83.dat upx behavioral1/memory/2524-84-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016abb-91.dat upx behavioral1/memory/2104-93-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016c56-98.dat upx behavioral1/memory/1608-103-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016c71-109.dat upx behavioral1/files/0x0006000000016c7a-116.dat upx behavioral1/files/0x0006000000016cc3-124.dat upx behavioral1/files/0x0038000000015c93-132.dat upx behavioral1/files/0x0006000000016ce7-141.dat upx behavioral1/memory/1508-149-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d1b-151.dat upx behavioral1/files/0x0006000000016d2c-158.dat upx behavioral1/files/0x0006000000016d34-167.dat upx behavioral1/memory/2116-169-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/828-166-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2080-178-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d3d-177.dat upx behavioral1/files/0x0006000000016d45-186.dat upx behavioral1/files/0x0006000000016d4e-195.dat upx behavioral1/memory/2496-194-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/672-204-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d61-201.dat upx behavioral1/memory/1616-207-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d65-213.dat upx behavioral1/files/0x0006000000016d69-221.dat upx behavioral1/files/0x0006000000016d71-230.dat upx behavioral1/memory/604-229-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1712-242-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016dda-241.dat upx behavioral1/memory/2336-240-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016dde-249.dat upx behavioral1/memory/352-253-0x00000000004D0000-0x0000000000505000-memory.dmp upx behavioral1/files/0x0006000000016de7-256.dat upx behavioral1/memory/352-259-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016eb9-267.dat upx behavioral1/files/0x0006000000017042-275.dat upx behavioral1/files/0x0006000000017477-284.dat upx behavioral1/memory/1040-283-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1144-292-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2904-305-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1836-342-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2668-355-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2896-362-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2476 2216 0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe 28 PID 2216 wrote to memory of 2476 2216 0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe 28 PID 2216 wrote to memory of 2476 2216 0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe 28 PID 2216 wrote to memory of 2476 2216 0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe 28 PID 2476 wrote to memory of 1836 2476 lfrxllx.exe 29 PID 2476 wrote to memory of 1836 2476 lfrxllx.exe 29 PID 2476 wrote to memory of 1836 2476 lfrxllx.exe 29 PID 2476 wrote to memory of 1836 2476 lfrxllx.exe 29 PID 1836 wrote to memory of 2292 1836 xrfllrx.exe 30 PID 1836 wrote to memory of 2292 1836 xrfllrx.exe 30 PID 1836 wrote to memory of 2292 1836 xrfllrx.exe 30 PID 1836 wrote to memory of 2292 1836 xrfllrx.exe 30 PID 2292 wrote to memory of 2004 2292 vpvpv.exe 31 PID 2292 wrote to memory of 2004 2292 vpvpv.exe 31 PID 2292 wrote to memory of 2004 2292 vpvpv.exe 31 PID 2292 wrote to memory of 2004 2292 vpvpv.exe 31 PID 2004 wrote to memory of 2912 2004 9fflflr.exe 32 PID 2004 wrote to memory of 2912 2004 9fflflr.exe 32 PID 2004 wrote to memory of 2912 2004 9fflflr.exe 32 PID 2004 wrote to memory of 2912 2004 9fflflr.exe 32 PID 2912 wrote to memory of 2648 2912 hbtnbh.exe 33 PID 2912 wrote to memory of 2648 2912 hbtnbh.exe 33 PID 2912 wrote to memory of 2648 2912 hbtnbh.exe 33 PID 2912 wrote to memory of 2648 2912 hbtnbh.exe 33 PID 2648 wrote to memory of 2052 2648 vvvpd.exe 34 PID 2648 wrote to memory of 2052 2648 vvvpd.exe 34 PID 2648 wrote to memory of 2052 2648 vvvpd.exe 34 PID 2648 wrote to memory of 2052 2648 vvvpd.exe 34 PID 2052 wrote to memory of 2684 2052 bbnthn.exe 35 PID 2052 wrote to memory of 2684 2052 bbnthn.exe 35 PID 2052 wrote to memory of 2684 2052 bbnthn.exe 35 PID 2052 wrote to memory of 2684 2052 bbnthn.exe 35 PID 2684 wrote to memory of 2524 2684 dvvjd.exe 36 PID 2684 wrote to memory of 2524 2684 dvvjd.exe 36 PID 2684 wrote to memory of 2524 2684 dvvjd.exe 36 PID 2684 wrote to memory of 2524 2684 dvvjd.exe 36 PID 2524 wrote to memory of 2104 2524 lfrflrr.exe 37 PID 2524 wrote to memory of 2104 2524 lfrflrr.exe 37 PID 2524 wrote to memory of 2104 2524 lfrflrr.exe 37 PID 2524 wrote to memory of 2104 2524 lfrflrr.exe 37 PID 2104 wrote to memory of 1608 2104 5jjjv.exe 38 PID 2104 wrote to memory of 1608 2104 5jjjv.exe 38 PID 2104 wrote to memory of 1608 2104 5jjjv.exe 38 PID 2104 wrote to memory of 1608 2104 5jjjv.exe 38 PID 1608 wrote to memory of 3056 1608 5jdpv.exe 39 PID 1608 wrote to memory of 3056 1608 5jdpv.exe 39 PID 1608 wrote to memory of 3056 1608 5jdpv.exe 39 PID 1608 wrote to memory of 3056 1608 5jdpv.exe 39 PID 3056 wrote to memory of 2764 3056 9nbhth.exe 40 PID 3056 wrote to memory of 2764 3056 9nbhth.exe 40 PID 3056 wrote to memory of 2764 3056 9nbhth.exe 40 PID 3056 wrote to memory of 2764 3056 9nbhth.exe 40 PID 2764 wrote to memory of 2972 2764 vvpvj.exe 41 PID 2764 wrote to memory of 2972 2764 vvpvj.exe 41 PID 2764 wrote to memory of 2972 2764 vvpvj.exe 41 PID 2764 wrote to memory of 2972 2764 vvpvj.exe 41 PID 2972 wrote to memory of 2176 2972 lfxlxfr.exe 42 PID 2972 wrote to memory of 2176 2972 lfxlxfr.exe 42 PID 2972 wrote to memory of 2176 2972 lfxlxfr.exe 42 PID 2972 wrote to memory of 2176 2972 lfxlxfr.exe 42 PID 2176 wrote to memory of 1508 2176 nhtbhn.exe 43 PID 2176 wrote to memory of 1508 2176 nhtbhn.exe 43 PID 2176 wrote to memory of 1508 2176 nhtbhn.exe 43 PID 2176 wrote to memory of 1508 2176 nhtbhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe"C:\Users\Admin\AppData\Local\Temp\0c9a957b19227b48aa802652461b525fb9dd7654a5d057cc390d3f560e150ea7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\lfrxllx.exec:\lfrxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xrfllrx.exec:\xrfllrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\vpvpv.exec:\vpvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\9fflflr.exec:\9fflflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\hbtnbh.exec:\hbtnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vvvpd.exec:\vvvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bbnthn.exec:\bbnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\dvvjd.exec:\dvvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lfrflrr.exec:\lfrflrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5jjjv.exec:\5jjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5jdpv.exec:\5jdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\9nbhth.exec:\9nbhth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vvpvj.exec:\vvpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nhtbhn.exec:\nhtbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe17⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbbtnt.exec:\hbbtnt.exe18⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vvvdv.exec:\vvvdv.exe19⤵
- Executes dropped EXE
PID:828 -
\??\c:\7bbhnt.exec:\7bbhnt.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3jdjd.exec:\3jdjd.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\5frfxfr.exec:\5frfxfr.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vvvvp.exec:\vvvvp.exe23⤵
- Executes dropped EXE
PID:672 -
\??\c:\bttnnt.exec:\bttnnt.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5djvp.exec:\5djvp.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pjdvj.exec:\pjdvj.exe26⤵
- Executes dropped EXE
PID:604 -
\??\c:\3lxrxxx.exec:\3lxrxxx.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ttthnn.exec:\ttthnn.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pjdvv.exec:\pjdvv.exe29⤵
- Executes dropped EXE
PID:352 -
\??\c:\5tnbth.exec:\5tnbth.exe30⤵
- Executes dropped EXE
PID:660 -
\??\c:\9dpdj.exec:\9dpdj.exe31⤵
- Executes dropped EXE
PID:692 -
\??\c:\1nbbnt.exec:\1nbbnt.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ttnbnb.exec:\ttnbnb.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1fflrlx.exec:\1fflrlx.exe34⤵
- Executes dropped EXE
PID:1144 -
\??\c:\dvpvj.exec:\dvpvj.exe35⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fxffrxl.exec:\fxffrxl.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bthnbb.exec:\bthnbb.exe37⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7hhhhh.exec:\7hhhhh.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvpdj.exec:\vvpdj.exe39⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrflxxl.exec:\xrflxxl.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hbtbhn.exec:\hbtbhn.exe41⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jvjjj.exec:\jvjjj.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9vdvp.exec:\9vdvp.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ttnbnt.exec:\ttnbnt.exe45⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvjpd.exec:\dvjpd.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpppv.exec:\vpppv.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rllfrfx.exec:\rllfrfx.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bbbnnn.exec:\bbbnnn.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pdvdj.exec:\pdvdj.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rxfrxrr.exec:\rxfrxrr.exe51⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lfrflfr.exec:\lfrflfr.exe52⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3hnnhn.exec:\3hnnhn.exe53⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppjvj.exec:\ppjvj.exe54⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe55⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hthnbb.exec:\hthnbb.exe56⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pjvjp.exec:\pjvjp.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5dvvd.exec:\5dvvd.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xxflxlf.exec:\xxflxlf.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tnnbtb.exec:\tnnbtb.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pjddp.exec:\pjddp.exe61⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9lxxfxx.exec:\9lxxfxx.exe63⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hthntt.exec:\hthntt.exe64⤵
- Executes dropped EXE
PID:2080 -
\??\c:\5dpvd.exec:\5dpvd.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrxflfl.exec:\rrxflfl.exe66⤵PID:1036
-
\??\c:\rlflrrf.exec:\rlflrrf.exe67⤵PID:1468
-
\??\c:\5bnbbt.exec:\5bnbbt.exe68⤵PID:1792
-
\??\c:\vppvd.exec:\vppvd.exe69⤵PID:1592
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe70⤵PID:1128
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe71⤵PID:2348
-
\??\c:\thbntt.exec:\thbntt.exe72⤵PID:784
-
\??\c:\dpjjp.exec:\dpjjp.exe73⤵PID:1340
-
\??\c:\9xlflrx.exec:\9xlflrx.exe74⤵PID:2360
-
\??\c:\hhttbb.exec:\hhttbb.exe75⤵PID:464
-
\??\c:\tnnthh.exec:\tnnthh.exe76⤵PID:552
-
\??\c:\dpdvd.exec:\dpdvd.exe77⤵PID:756
-
\??\c:\lfllrrr.exec:\lfllrrr.exe78⤵PID:1040
-
\??\c:\nhbntb.exec:\nhbntb.exe79⤵PID:976
-
\??\c:\3bnttn.exec:\3bnttn.exe80⤵PID:2252
-
\??\c:\jvdjd.exec:\jvdjd.exe81⤵PID:1772
-
\??\c:\1xlrrlx.exec:\1xlrrlx.exe82⤵PID:328
-
\??\c:\hhthht.exec:\hhthht.exe83⤵PID:1692
-
\??\c:\dpvpv.exec:\dpvpv.exe84⤵PID:372
-
\??\c:\rlrlfff.exec:\rlrlfff.exe85⤵PID:2804
-
\??\c:\fxffllr.exec:\fxffllr.exe86⤵PID:2188
-
\??\c:\3nbhtb.exec:\3nbhtb.exe87⤵PID:2716
-
\??\c:\3jppj.exec:\3jppj.exe88⤵PID:2740
-
\??\c:\lfllxfl.exec:\lfllxfl.exe89⤵PID:2672
-
\??\c:\9lrllfl.exec:\9lrllfl.exe90⤵PID:1804
-
\??\c:\tnbtbb.exec:\tnbtbb.exe91⤵PID:2880
-
\??\c:\jvjjj.exec:\jvjjj.exe92⤵PID:2572
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe93⤵PID:2680
-
\??\c:\3tnthn.exec:\3tnthn.exe94⤵PID:2588
-
\??\c:\nhbhtb.exec:\nhbhtb.exe95⤵PID:2276
-
\??\c:\7jvjd.exec:\7jvjd.exe96⤵PID:2824
-
\??\c:\rrllxfl.exec:\rrllxfl.exe97⤵PID:3048
-
\??\c:\hbhnnn.exec:\hbhnnn.exe98⤵PID:2300
-
\??\c:\1htbtt.exec:\1htbtt.exe99⤵PID:2552
-
\??\c:\jvpdp.exec:\jvpdp.exe100⤵PID:2072
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe101⤵PID:1300
-
\??\c:\5nhntb.exec:\5nhntb.exe102⤵PID:236
-
\??\c:\dpdpv.exec:\dpdpv.exe103⤵PID:2616
-
\??\c:\rfrrxrx.exec:\rfrrxrx.exe104⤵PID:2832
-
\??\c:\xrrxffr.exec:\xrrxffr.exe105⤵PID:1384
-
\??\c:\hhhthb.exec:\hhhthb.exe106⤵PID:2128
-
\??\c:\5jdvv.exec:\5jdvv.exe107⤵PID:2244
-
\??\c:\fxflxrr.exec:\fxflxrr.exe108⤵PID:1660
-
\??\c:\dvpvv.exec:\dvpvv.exe109⤵PID:1664
-
\??\c:\xrfrxrx.exec:\xrfrxrx.exe110⤵PID:1256
-
\??\c:\btbhtt.exec:\btbhtt.exe111⤵PID:1612
-
\??\c:\pjvpd.exec:\pjvpd.exe112⤵PID:300
-
\??\c:\fxlrflf.exec:\fxlrflf.exe113⤵PID:584
-
\??\c:\7nhhtt.exec:\7nhhtt.exe114⤵PID:2480
-
\??\c:\3dddd.exec:\3dddd.exe115⤵PID:2256
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe116⤵PID:1764
-
\??\c:\7xlflfl.exec:\7xlflfl.exe117⤵PID:284
-
\??\c:\hbtbth.exec:\hbtbth.exe118⤵PID:784
-
\??\c:\pjjvj.exec:\pjjvj.exe119⤵PID:2892
-
\??\c:\rrlrflx.exec:\rrlrflx.exe120⤵PID:2284
-
\??\c:\bnhnnt.exec:\bnhnnt.exe121⤵PID:2036
-
\??\c:\1hbhnn.exec:\1hbhnn.exe122⤵PID:552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-