Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 01:09
Behavioral task
behavioral1
Sample
95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe
-
Size
59KB
-
MD5
0defae42a8f832681dd30359192a4cf7
-
SHA1
4fe6f5baf91ee4267bc2577323fcfa3f3202c8a7
-
SHA256
95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83
-
SHA512
3a357be71c232915caf2eca2d80a78e62ab19d4eca6215844fcc18b986769d979be9effb45b9e91d041be5c5584e277c4436aab0f33924c51a95d39029d19c98
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPhbM9:zhOmTsF93UYfwC6GIoutiTm5hI9
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1916-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/696-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-699-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1088-828-0x00000000774F0000-0x000000007760F000-memory.dmp family_blackmoon behavioral1/memory/2744-1140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1088-13031-0x00000000774F0000-0x000000007760F000-memory.dmp family_blackmoon behavioral1/memory/1088-13559-0x00000000773F0000-0x00000000774EA000-memory.dmp family_blackmoon behavioral1/memory/1088-14083-0x00000000773F0000-0x00000000774EA000-memory.dmp family_blackmoon behavioral1/memory/1088-14082-0x00000000774F0000-0x000000007760F000-memory.dmp family_blackmoon behavioral1/memory/1088-14607-0x00000000773F0000-0x00000000774EA000-memory.dmp family_blackmoon behavioral1/memory/1088-23877-0x00000000774F0000-0x000000007760F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b0000000141a2-9.dat UPX behavioral1/memory/1916-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2360-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3060-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000143ec-16.dat UPX behavioral1/memory/3060-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000014539-25.dat UPX behavioral1/files/0x0007000000014667-31.dat UPX behavioral1/memory/2932-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2324-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2324-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000146a2-42.dat UPX behavioral1/memory/2664-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a0000000146b8-50.dat UPX behavioral1/files/0x00090000000146c0-57.dat UPX behavioral1/memory/2940-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b000000014825-65.dat UPX behavioral1/memory/2912-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000149f5-72.dat UPX behavioral1/memory/2512-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014abe-81.dat UPX behavioral1/memory/2476-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014af6-88.dat UPX behavioral1/memory/2924-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014b31-97.dat UPX behavioral1/memory/2924-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014b70-105.dat UPX behavioral1/memory/2860-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014de9-113.dat UPX behavioral1/files/0x0006000000014ef8-120.dat UPX behavioral1/memory/2756-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015018-128.dat UPX behavioral1/memory/2020-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000155ed-135.dat UPX behavioral1/memory/2020-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1764-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000155f3-145.dat UPX behavioral1/memory/2844-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000155f7-153.dat UPX behavioral1/files/0x0006000000015605-160.dat UPX behavioral1/files/0x0006000000015616-167.dat UPX behavioral1/memory/1620-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015626-175.dat UPX behavioral1/memory/3004-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015b6f-182.dat UPX behavioral1/files/0x0006000000015c3d-190.dat UPX behavioral1/files/0x0006000000015c52-197.dat UPX behavioral1/memory/696-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c6b-206.dat UPX behavioral1/files/0x0006000000015c78-212.dat UPX behavioral1/files/0x0006000000015c83-219.dat UPX behavioral1/memory/1240-227-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c9f-226.dat UPX behavioral1/files/0x0006000000015cb6-234.dat UPX behavioral1/memory/980-242-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cce-241.dat UPX behavioral1/memory/2212-244-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cee-250.dat UPX behavioral1/memory/2044-267-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2168-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2024-279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2024-285-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1972-316-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1916 1jjdj.exe 3060 vpjvv.exe 2932 5lflrrr.exe 2324 ttnbhb.exe 2664 jdjpj.exe 2952 3fxxrxx.exe 2940 hbhnbt.exe 2912 nhthth.exe 2512 dpvvd.exe 2476 rllxlrf.exe 2924 frxffxx.exe 2272 bttnhn.exe 2860 7pvdp.exe 1392 fxlxxll.exe 2756 3lxxfxf.exe 2020 9bttnh.exe 1764 vjvdd.exe 2844 dvpvv.exe 1548 rlflrxf.exe 1620 hbnbhn.exe 2552 bthtbh.exe 3004 pjpdj.exe 1724 lxlrxfl.exe 2032 lfxxxlr.exe 696 9tnntt.exe 2948 3thntt.exe 1148 1dvjj.exe 1240 fxrxxfl.exe 1552 lfxfrrx.exe 980 bnhnbb.exe 2212 jvdvp.exe 1076 jjvvd.exe 2976 xlfffxl.exe 2044 3rrlrxl.exe 1344 7htnhh.exe 2168 5djpv.exe 2024 dvpdv.exe 1868 9lffllx.exe 2360 lfxrffl.exe 1916 hbhhth.exe 2536 btnntb.exe 3008 jjjjj.exe 1824 vpjjp.exe 1972 pdvvj.exe 2560 ffflxfr.exe 2712 fxrllrl.exe 2648 hbttbh.exe 2664 5tnbht.exe 2808 jdjpp.exe 2496 dvppv.exe 2568 lfxxffl.exe 2460 rrlrrrx.exe 2516 1bnntt.exe 3028 rrlxlrf.exe 2068 rflrfrf.exe 1696 htbtnt.exe 2872 ttnnnt.exe 2860 jvdpp.exe 2696 dvvvd.exe 2840 frflllf.exe 2756 rfrrxxf.exe 2768 htbtnn.exe 2852 nhtthn.exe 2816 1dpjp.exe -
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000141a2-9.dat upx behavioral1/memory/1916-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000143ec-16.dat upx behavioral1/memory/3060-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014539-25.dat upx behavioral1/files/0x0007000000014667-31.dat upx behavioral1/memory/2932-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000146a2-42.dat upx behavioral1/memory/2664-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000146b8-50.dat upx behavioral1/files/0x00090000000146c0-57.dat upx behavioral1/memory/2940-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000014825-65.dat upx behavioral1/memory/2912-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000149f5-72.dat upx behavioral1/memory/2512-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014abe-81.dat upx behavioral1/memory/2476-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014af6-88.dat upx behavioral1/memory/2924-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b31-97.dat upx behavioral1/memory/2924-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b70-105.dat upx behavioral1/memory/2860-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014de9-113.dat upx behavioral1/files/0x0006000000014ef8-120.dat upx behavioral1/memory/2756-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015018-128.dat upx behavioral1/memory/2020-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155ed-135.dat upx behavioral1/memory/2020-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155f3-145.dat upx behavioral1/memory/2844-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155f7-153.dat upx behavioral1/files/0x0006000000015605-160.dat upx behavioral1/files/0x0006000000015616-167.dat upx behavioral1/memory/1620-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015626-175.dat upx behavioral1/memory/3004-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b6f-182.dat upx behavioral1/files/0x0006000000015c3d-190.dat upx behavioral1/files/0x0006000000015c52-197.dat upx behavioral1/memory/696-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c6b-206.dat upx behavioral1/files/0x0006000000015c78-212.dat upx behavioral1/files/0x0006000000015c83-219.dat upx behavioral1/memory/1240-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9f-226.dat upx behavioral1/files/0x0006000000015cb6-234.dat upx behavioral1/memory/980-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cce-241.dat upx behavioral1/memory/2212-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cee-250.dat upx behavioral1/memory/2044-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2024-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2024-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1916 2360 95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe 28 PID 2360 wrote to memory of 1916 2360 95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe 28 PID 2360 wrote to memory of 1916 2360 95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe 28 PID 2360 wrote to memory of 1916 2360 95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe 28 PID 1916 wrote to memory of 3060 1916 1jjdj.exe 29 PID 1916 wrote to memory of 3060 1916 1jjdj.exe 29 PID 1916 wrote to memory of 3060 1916 1jjdj.exe 29 PID 1916 wrote to memory of 3060 1916 1jjdj.exe 29 PID 3060 wrote to memory of 2932 3060 vpjvv.exe 30 PID 3060 wrote to memory of 2932 3060 vpjvv.exe 30 PID 3060 wrote to memory of 2932 3060 vpjvv.exe 30 PID 3060 wrote to memory of 2932 3060 vpjvv.exe 30 PID 2932 wrote to memory of 2324 2932 5lflrrr.exe 31 PID 2932 wrote to memory of 2324 2932 5lflrrr.exe 31 PID 2932 wrote to memory of 2324 2932 5lflrrr.exe 31 PID 2932 wrote to memory of 2324 2932 5lflrrr.exe 31 PID 2324 wrote to memory of 2664 2324 ttnbhb.exe 32 PID 2324 wrote to memory of 2664 2324 ttnbhb.exe 32 PID 2324 wrote to memory of 2664 2324 ttnbhb.exe 32 PID 2324 wrote to memory of 2664 2324 ttnbhb.exe 32 PID 2664 wrote to memory of 2952 2664 jdjpj.exe 33 PID 2664 wrote to memory of 2952 2664 jdjpj.exe 33 PID 2664 wrote to memory of 2952 2664 jdjpj.exe 33 PID 2664 wrote to memory of 2952 2664 jdjpj.exe 33 PID 2952 wrote to memory of 2940 2952 3fxxrxx.exe 34 PID 2952 wrote to memory of 2940 2952 3fxxrxx.exe 34 PID 2952 wrote to memory of 2940 2952 3fxxrxx.exe 34 PID 2952 wrote to memory of 2940 2952 3fxxrxx.exe 34 PID 2940 wrote to memory of 2912 2940 hbhnbt.exe 35 PID 2940 wrote to memory of 2912 2940 hbhnbt.exe 35 PID 2940 wrote to memory of 2912 2940 hbhnbt.exe 35 PID 2940 wrote to memory of 2912 2940 hbhnbt.exe 35 PID 2912 wrote to memory of 2512 2912 nhthth.exe 36 PID 2912 wrote to memory of 2512 2912 nhthth.exe 36 PID 2912 wrote to memory of 2512 2912 nhthth.exe 36 PID 2912 wrote to memory of 2512 2912 nhthth.exe 36 PID 2512 wrote to memory of 2476 2512 dpvvd.exe 37 PID 2512 wrote to memory of 2476 2512 dpvvd.exe 37 PID 2512 wrote to memory of 2476 2512 dpvvd.exe 37 PID 2512 wrote to memory of 2476 2512 dpvvd.exe 37 PID 2476 wrote to memory of 2924 2476 rllxlrf.exe 38 PID 2476 wrote to memory of 2924 2476 rllxlrf.exe 38 PID 2476 wrote to memory of 2924 2476 rllxlrf.exe 38 PID 2476 wrote to memory of 2924 2476 rllxlrf.exe 38 PID 2924 wrote to memory of 2272 2924 frxffxx.exe 39 PID 2924 wrote to memory of 2272 2924 frxffxx.exe 39 PID 2924 wrote to memory of 2272 2924 frxffxx.exe 39 PID 2924 wrote to memory of 2272 2924 frxffxx.exe 39 PID 2272 wrote to memory of 2860 2272 bttnhn.exe 40 PID 2272 wrote to memory of 2860 2272 bttnhn.exe 40 PID 2272 wrote to memory of 2860 2272 bttnhn.exe 40 PID 2272 wrote to memory of 2860 2272 bttnhn.exe 40 PID 2860 wrote to memory of 1392 2860 7pvdp.exe 41 PID 2860 wrote to memory of 1392 2860 7pvdp.exe 41 PID 2860 wrote to memory of 1392 2860 7pvdp.exe 41 PID 2860 wrote to memory of 1392 2860 7pvdp.exe 41 PID 1392 wrote to memory of 2756 1392 fxlxxll.exe 42 PID 1392 wrote to memory of 2756 1392 fxlxxll.exe 42 PID 1392 wrote to memory of 2756 1392 fxlxxll.exe 42 PID 1392 wrote to memory of 2756 1392 fxlxxll.exe 42 PID 2756 wrote to memory of 2020 2756 3lxxfxf.exe 43 PID 2756 wrote to memory of 2020 2756 3lxxfxf.exe 43 PID 2756 wrote to memory of 2020 2756 3lxxfxf.exe 43 PID 2756 wrote to memory of 2020 2756 3lxxfxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe"C:\Users\Admin\AppData\Local\Temp\95e38d547513568277c8c00f1203433062c81238572d4c2a5b6b59f614254e83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\1jjdj.exec:\1jjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vpjvv.exec:\vpjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\5lflrrr.exec:\5lflrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\ttnbhb.exec:\ttnbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jdjpj.exec:\jdjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3fxxrxx.exec:\3fxxrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hbhnbt.exec:\hbhnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhthth.exec:\nhthth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dpvvd.exec:\dpvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rllxlrf.exec:\rllxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\frxffxx.exec:\frxffxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\bttnhn.exec:\bttnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\7pvdp.exec:\7pvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fxlxxll.exec:\fxlxxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\3lxxfxf.exec:\3lxxfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\9bttnh.exec:\9bttnh.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vjvdd.exec:\vjvdd.exe18⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dvpvv.exec:\dvpvv.exe19⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlflrxf.exec:\rlflrxf.exe20⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hbnbhn.exec:\hbnbhn.exe21⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bthtbh.exec:\bthtbh.exe22⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pjpdj.exec:\pjpdj.exe23⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe24⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lfxxxlr.exec:\lfxxxlr.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9tnntt.exec:\9tnntt.exe26⤵
- Executes dropped EXE
PID:696 -
\??\c:\3thntt.exec:\3thntt.exe27⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1dvjj.exec:\1dvjj.exe28⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe29⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe30⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bnhnbb.exec:\bnhnbb.exe31⤵
- Executes dropped EXE
PID:980 -
\??\c:\jvdvp.exec:\jvdvp.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jjvvd.exec:\jjvvd.exe33⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xlfffxl.exec:\xlfffxl.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3rrlrxl.exec:\3rrlrxl.exe35⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7htnhh.exec:\7htnhh.exe36⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5djpv.exec:\5djpv.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dvpdv.exec:\dvpdv.exe38⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9lffllx.exec:\9lffllx.exe39⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lfxrffl.exec:\lfxrffl.exe40⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hbhhth.exec:\hbhhth.exe41⤵
- Executes dropped EXE
PID:1916 -
\??\c:\btnntb.exec:\btnntb.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jjjjj.exec:\jjjjj.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vpjjp.exec:\vpjjp.exe44⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pdvvj.exec:\pdvvj.exe45⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ffflxfr.exec:\ffflxfr.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxrllrl.exec:\fxrllrl.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbttbh.exec:\hbttbh.exe48⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5tnbht.exec:\5tnbht.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdjpp.exec:\jdjpp.exe50⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvppv.exec:\dvppv.exe51⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lfxxffl.exec:\lfxxffl.exe52⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rrlrrrx.exec:\rrlrrrx.exe53⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1bnntt.exec:\1bnntt.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe55⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rflrfrf.exec:\rflrfrf.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\htbtnt.exec:\htbtnt.exe57⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ttnnnt.exec:\ttnnnt.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jvdpp.exec:\jvdpp.exe59⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvvvd.exec:\dvvvd.exe60⤵
- Executes dropped EXE
PID:2696 -
\??\c:\frflllf.exec:\frflllf.exe61⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe62⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htbtnn.exec:\htbtnn.exe63⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhtthn.exec:\nhtthn.exe64⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1dpjp.exec:\1dpjp.exe65⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7pppj.exec:\7pppj.exe66⤵PID:2844
-
\??\c:\rxlxrxr.exec:\rxlxrxr.exe67⤵PID:1820
-
\??\c:\nnnbnh.exec:\nnnbnh.exe68⤵PID:2056
-
\??\c:\5thhhb.exec:\5thhhb.exe69⤵PID:2908
-
\??\c:\dvpdj.exec:\dvpdj.exe70⤵PID:2316
-
\??\c:\jvvdj.exec:\jvvdj.exe71⤵PID:1860
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe72⤵PID:1752
-
\??\c:\llfflrf.exec:\llfflrf.exe73⤵PID:2112
-
\??\c:\3hbbnn.exec:\3hbbnn.exe74⤵PID:2636
-
\??\c:\hhbnnh.exec:\hhbnnh.exe75⤵PID:344
-
\??\c:\9dpdp.exec:\9dpdp.exe76⤵PID:1760
-
\??\c:\5rlfrrx.exec:\5rlfrrx.exe77⤵PID:2964
-
\??\c:\xrflxxl.exec:\xrflxxl.exe78⤵PID:1812
-
\??\c:\5hbhnn.exec:\5hbhnn.exe79⤵PID:1240
-
\??\c:\bthnnn.exec:\bthnnn.exe80⤵PID:1880
-
\??\c:\djjpv.exec:\djjpv.exe81⤵PID:976
-
\??\c:\7dpdd.exec:\7dpdd.exe82⤵PID:2384
-
\??\c:\7rlrlfl.exec:\7rlrlfl.exe83⤵PID:328
-
\??\c:\1fxlxlx.exec:\1fxlxlx.exe84⤵PID:2332
-
\??\c:\frlrrlr.exec:\frlrrlr.exe85⤵PID:1612
-
\??\c:\9bttbb.exec:\9bttbb.exe86⤵PID:792
-
\??\c:\bbhtbn.exec:\bbhtbn.exe87⤵PID:2372
-
\??\c:\1jpjp.exec:\1jpjp.exe88⤵PID:1572
-
\??\c:\dvvjj.exec:\dvvjj.exe89⤵PID:1692
-
\??\c:\xrflxxf.exec:\xrflxxf.exe90⤵PID:768
-
\??\c:\xlxfrlx.exec:\xlxfrlx.exe91⤵PID:3012
-
\??\c:\7tttbb.exec:\7tttbb.exe92⤵PID:2360
-
\??\c:\dvjpv.exec:\dvjpv.exe93⤵PID:1916
-
\??\c:\jvpvv.exec:\jvpvv.exe94⤵PID:2804
-
\??\c:\jdppv.exec:\jdppv.exe95⤵PID:3008
-
\??\c:\7xxffrx.exec:\7xxffrx.exe96⤵PID:2092
-
\??\c:\lfrflrr.exec:\lfrflrr.exe97⤵PID:1972
-
\??\c:\1tnbtn.exec:\1tnbtn.exe98⤵PID:2956
-
\??\c:\nbtbht.exec:\nbtbht.exe99⤵PID:2896
-
\??\c:\jdjpj.exec:\jdjpj.exe100⤵PID:2616
-
\??\c:\vjpdj.exec:\vjpdj.exe101⤵PID:2692
-
\??\c:\frlxflf.exec:\frlxflf.exe102⤵PID:2492
-
\??\c:\xrfrllr.exec:\xrfrllr.exe103⤵PID:2496
-
\??\c:\hbbhtt.exec:\hbbhtt.exe104⤵PID:2452
-
\??\c:\5hhthn.exec:\5hhthn.exe105⤵PID:2460
-
\??\c:\vpjjp.exec:\vpjjp.exe106⤵PID:2528
-
\??\c:\ppjpj.exec:\ppjpj.exe107⤵PID:2488
-
\??\c:\rrlxllx.exec:\rrlxllx.exe108⤵PID:2556
-
\??\c:\xxxfxll.exec:\xxxfxll.exe109⤵PID:1208
-
\??\c:\9hnthh.exec:\9hnthh.exe110⤵PID:2524
-
\??\c:\hbhtnn.exec:\hbhtnn.exe111⤵PID:2688
-
\??\c:\5bthhh.exec:\5bthhh.exe112⤵PID:2824
-
\??\c:\pdpvd.exec:\pdpvd.exe113⤵PID:1456
-
\??\c:\jdvdj.exec:\jdvdj.exe114⤵PID:2544
-
\??\c:\xlrfffx.exec:\xlrfffx.exe115⤵PID:2892
-
\??\c:\3ffflrf.exec:\3ffflrf.exe116⤵PID:1988
-
\??\c:\tthhtb.exec:\tthhtb.exe117⤵PID:1628
-
\??\c:\hbnbbn.exec:\hbnbbn.exe118⤵PID:1532
-
\??\c:\jvvvj.exec:\jvvvj.exe119⤵PID:2916
-
\??\c:\jdddj.exec:\jdddj.exe120⤵PID:2296
-
\??\c:\jdvvd.exec:\jdvvd.exe121⤵PID:1300
-
\??\c:\xrxlxfx.exec:\xrxlxfx.exe122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-