Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe
-
Size
312KB
-
MD5
affbbe9b24f78ab4da6fdb9a52e56667
-
SHA1
9d482d2ccdf1ebb5d23e92f026b1da1994fff423
-
SHA256
c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8
-
SHA512
e9ce8f7d5785b1527bff05c809ca00a49ca1624ec448d88759cfc2bf6ad7c539fc0e4b3a183a1bd2ee1af77cbfd8e2fac1ad7835c88c8b9c9d27a680c243c5f8
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwu:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q77
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral1/memory/1968-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-472-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-502-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-541-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-549-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-743-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-745-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 62 IoCs
resource yara_rule behavioral1/memory/1968-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2228-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1460-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1620-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1620-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2928-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1928-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1416-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1492-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2808-250-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-262-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-271-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1720-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1720-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1540-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-335-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-343-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-345-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1596-382-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-397-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1464-426-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1464-427-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1876-442-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2212-457-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-472-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1916-487-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/352-502-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1860-517-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2932-532-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/780-541-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2300-548-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2300-549-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2164-564-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1444-579-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1440-594-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-609-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2664-624-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-653-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-668-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-683-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-698-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1568-713-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-728-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1872-743-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/604-745-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2592 1xlxflx.exe 2548 dvvdd.exe 2676 hhtbht.exe 2636 frrxffl.exe 2436 nthnhh.exe 2200 rlxrxfr.exe 2480 httbnn.exe 2228 fffrxfl.exe 2700 3pvvd.exe 2760 hbhbhb.exe 1460 ddvdv.exe 1592 btbntb.exe 1868 lfxxffl.exe 1620 hthtbb.exe 2656 xflxxxx.exe 2928 pdpjd.exe 2036 bthhnn.exe 1928 7vppv.exe 1416 tthbnn.exe 1740 fffllfx.exe 2268 jvjjp.exe 3000 thnttt.exe 1492 dpvdv.exe 1584 rlxxfff.exe 2808 vvppj.exe 2996 fxlrffr.exe 1672 jvdvd.exe 3020 7nbnnb.exe 1652 dvjjp.exe 1720 nttntn.exe 1540 7jdvv.exe 2516 3nhbtb.exe 2688 xlllxxl.exe 2672 jdppv.exe 2680 xrxxxxf.exe 2696 thbbhh.exe 2660 dvjdv.exe 2736 nhnhnt.exe 2200 9vpdj.exe 1596 nhtthh.exe 2508 pjppd.exe 2588 9hhhtt.exe 2732 5jppj.exe 2296 fxrrffl.exe 1452 jjdjp.exe 1464 9lffllx.exe 1876 pjdpp.exe 2288 9bntnn.exe 552 vjvpp.exe 2212 7httth.exe 2044 dvjdj.exe 2096 htnbbn.exe 2124 btnbhh.exe 1916 7fxxxxx.exe 352 hhtbhh.exe 1416 lxlfllx.exe 2360 hbttnn.exe 1860 7vdvv.exe 1240 xrfflll.exe 2932 5tbbnb.exe 780 vvpdv.exe 2300 nbhnbb.exe 820 jdvpv.exe 2164 1tbttt.exe -
resource yara_rule behavioral1/memory/1968-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-426-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-472-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-487-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-502-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-517-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-548-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-549-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-564-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-579-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-609-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-624-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-653-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-668-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-683-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-698-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-713-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-728-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-743-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-745-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2592 1968 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 28 PID 1968 wrote to memory of 2592 1968 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 28 PID 1968 wrote to memory of 2592 1968 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 28 PID 1968 wrote to memory of 2592 1968 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 28 PID 2592 wrote to memory of 2548 2592 1xlxflx.exe 29 PID 2592 wrote to memory of 2548 2592 1xlxflx.exe 29 PID 2592 wrote to memory of 2548 2592 1xlxflx.exe 29 PID 2592 wrote to memory of 2548 2592 1xlxflx.exe 29 PID 2548 wrote to memory of 2676 2548 dvvdd.exe 30 PID 2548 wrote to memory of 2676 2548 dvvdd.exe 30 PID 2548 wrote to memory of 2676 2548 dvvdd.exe 30 PID 2548 wrote to memory of 2676 2548 dvvdd.exe 30 PID 2676 wrote to memory of 2636 2676 hhtbht.exe 31 PID 2676 wrote to memory of 2636 2676 hhtbht.exe 31 PID 2676 wrote to memory of 2636 2676 hhtbht.exe 31 PID 2676 wrote to memory of 2636 2676 hhtbht.exe 31 PID 2636 wrote to memory of 2436 2636 frrxffl.exe 32 PID 2636 wrote to memory of 2436 2636 frrxffl.exe 32 PID 2636 wrote to memory of 2436 2636 frrxffl.exe 32 PID 2636 wrote to memory of 2436 2636 frrxffl.exe 32 PID 2436 wrote to memory of 2200 2436 nthnhh.exe 33 PID 2436 wrote to memory of 2200 2436 nthnhh.exe 33 PID 2436 wrote to memory of 2200 2436 nthnhh.exe 33 PID 2436 wrote to memory of 2200 2436 nthnhh.exe 33 PID 2200 wrote to memory of 2480 2200 rlxrxfr.exe 34 PID 2200 wrote to memory of 2480 2200 rlxrxfr.exe 34 PID 2200 wrote to memory of 2480 2200 rlxrxfr.exe 34 PID 2200 wrote to memory of 2480 2200 rlxrxfr.exe 34 PID 2480 wrote to memory of 2228 2480 httbnn.exe 35 PID 2480 wrote to memory of 2228 2480 httbnn.exe 35 PID 2480 wrote to memory of 2228 2480 httbnn.exe 35 PID 2480 wrote to memory of 2228 2480 httbnn.exe 35 PID 2228 wrote to memory of 2700 2228 fffrxfl.exe 36 PID 2228 wrote to memory of 2700 2228 fffrxfl.exe 36 PID 2228 wrote to memory of 2700 2228 fffrxfl.exe 36 PID 2228 wrote to memory of 2700 2228 fffrxfl.exe 36 PID 2700 wrote to memory of 2760 2700 3pvvd.exe 37 PID 2700 wrote to memory of 2760 2700 3pvvd.exe 37 PID 2700 wrote to memory of 2760 2700 3pvvd.exe 37 PID 2700 wrote to memory of 2760 2700 3pvvd.exe 37 PID 2760 wrote to memory of 1460 2760 hbhbhb.exe 38 PID 2760 wrote to memory of 1460 2760 hbhbhb.exe 38 PID 2760 wrote to memory of 1460 2760 hbhbhb.exe 38 PID 2760 wrote to memory of 1460 2760 hbhbhb.exe 38 PID 1460 wrote to memory of 1592 1460 ddvdv.exe 39 PID 1460 wrote to memory of 1592 1460 ddvdv.exe 39 PID 1460 wrote to memory of 1592 1460 ddvdv.exe 39 PID 1460 wrote to memory of 1592 1460 ddvdv.exe 39 PID 1592 wrote to memory of 1868 1592 btbntb.exe 40 PID 1592 wrote to memory of 1868 1592 btbntb.exe 40 PID 1592 wrote to memory of 1868 1592 btbntb.exe 40 PID 1592 wrote to memory of 1868 1592 btbntb.exe 40 PID 1868 wrote to memory of 1620 1868 lfxxffl.exe 41 PID 1868 wrote to memory of 1620 1868 lfxxffl.exe 41 PID 1868 wrote to memory of 1620 1868 lfxxffl.exe 41 PID 1868 wrote to memory of 1620 1868 lfxxffl.exe 41 PID 1620 wrote to memory of 2656 1620 hthtbb.exe 42 PID 1620 wrote to memory of 2656 1620 hthtbb.exe 42 PID 1620 wrote to memory of 2656 1620 hthtbb.exe 42 PID 1620 wrote to memory of 2656 1620 hthtbb.exe 42 PID 2656 wrote to memory of 2928 2656 xflxxxx.exe 43 PID 2656 wrote to memory of 2928 2656 xflxxxx.exe 43 PID 2656 wrote to memory of 2928 2656 xflxxxx.exe 43 PID 2656 wrote to memory of 2928 2656 xflxxxx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe"C:\Users\Admin\AppData\Local\Temp\c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1xlxflx.exec:\1xlxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\dvvdd.exec:\dvvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hhtbht.exec:\hhtbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\frrxffl.exec:\frrxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nthnhh.exec:\nthnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\httbnn.exec:\httbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fffrxfl.exec:\fffrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\3pvvd.exec:\3pvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hbhbhb.exec:\hbhbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ddvdv.exec:\ddvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\btbntb.exec:\btbntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\lfxxffl.exec:\lfxxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\hthtbb.exec:\hthtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xflxxxx.exec:\xflxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pdpjd.exec:\pdpjd.exe17⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bthhnn.exec:\bthhnn.exe18⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7vppv.exec:\7vppv.exe19⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tthbnn.exec:\tthbnn.exe20⤵
- Executes dropped EXE
PID:1416 -
\??\c:\fffllfx.exec:\fffllfx.exe21⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jvjjp.exec:\jvjjp.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thnttt.exec:\thnttt.exe23⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dpvdv.exec:\dpvdv.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rlxxfff.exec:\rlxxfff.exe25⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vvppj.exec:\vvppj.exe26⤵
- Executes dropped EXE
PID:2808 -
\??\c:\fxlrffr.exec:\fxlrffr.exe27⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jvdvd.exec:\jvdvd.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7nbnnb.exec:\7nbnnb.exe29⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dvjjp.exec:\dvjjp.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nttntn.exec:\nttntn.exe31⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7jdvv.exec:\7jdvv.exe32⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3nhbtb.exec:\3nhbtb.exe33⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xlllxxl.exec:\xlllxxl.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\thbbhh.exec:\thbbhh.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvjdv.exec:\dvjdv.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhnhnt.exec:\nhnhnt.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9vpdj.exec:\9vpdj.exe40⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhtthh.exec:\nhtthh.exe41⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjppd.exec:\pjppd.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9hhhtt.exec:\9hhhtt.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\5jppj.exec:\5jppj.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fxrrffl.exec:\fxrrffl.exe45⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jjdjp.exec:\jjdjp.exe46⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9lffllx.exec:\9lffllx.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pjdpp.exec:\pjdpp.exe48⤵
- Executes dropped EXE
PID:1876 -
\??\c:\9bntnn.exec:\9bntnn.exe49⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjvpp.exec:\vjvpp.exe50⤵
- Executes dropped EXE
PID:552 -
\??\c:\7httth.exec:\7httth.exe51⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvjdj.exec:\dvjdj.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\htnbbn.exec:\htnbbn.exe53⤵
- Executes dropped EXE
PID:2096 -
\??\c:\btnbhh.exec:\btnbhh.exe54⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7fxxxxx.exec:\7fxxxxx.exe55⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hhtbhh.exec:\hhtbhh.exe56⤵
- Executes dropped EXE
PID:352 -
\??\c:\lxlfllx.exec:\lxlfllx.exe57⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hbttnn.exec:\hbttnn.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7vdvv.exec:\7vdvv.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrfflll.exec:\xrfflll.exe60⤵
- Executes dropped EXE
PID:1240 -
\??\c:\5tbbnb.exec:\5tbbnb.exe61⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvpdv.exec:\vvpdv.exe62⤵
- Executes dropped EXE
PID:780 -
\??\c:\nbhnbb.exec:\nbhnbb.exe63⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jdvpv.exec:\jdvpv.exe64⤵
- Executes dropped EXE
PID:820 -
\??\c:\1tbttt.exec:\1tbttt.exe65⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrlxflf.exec:\xrlxflf.exe66⤵PID:3036
-
\??\c:\nbbbtt.exec:\nbbbtt.exe67⤵PID:1444
-
\??\c:\vpjpj.exec:\vpjpj.exe68⤵PID:1756
-
\??\c:\1nbhnt.exec:\1nbhnt.exe69⤵PID:1440
-
\??\c:\7ppvj.exec:\7ppvj.exe70⤵PID:2192
-
\??\c:\5fffllr.exec:\5fffllr.exe71⤵PID:2492
-
\??\c:\hbhnbb.exec:\hbhnbb.exe72⤵PID:3056
-
\??\c:\xrffffr.exec:\xrffffr.exe73⤵PID:2664
-
\??\c:\vpjjp.exec:\vpjjp.exe74⤵PID:2776
-
\??\c:\9bnhnt.exec:\9bnhnt.exe75⤵PID:2600
-
\??\c:\frlfllr.exec:\frlfllr.exe76⤵PID:2580
-
\??\c:\3pddp.exec:\3pddp.exe77⤵PID:2544
-
\??\c:\xxlrrxr.exec:\xxlrrxr.exe78⤵PID:2660
-
\??\c:\dpddp.exec:\dpddp.exe79⤵PID:2736
-
\??\c:\rfrrfxl.exec:\rfrrfxl.exe80⤵PID:2484
-
\??\c:\jdvdv.exec:\jdvdv.exe81⤵PID:2596
-
\??\c:\9frxffl.exec:\9frxffl.exe82⤵PID:2848
-
\??\c:\pvvpp.exec:\pvvpp.exe83⤵PID:2864
-
\??\c:\3lffxxl.exec:\3lffxxl.exe84⤵PID:2732
-
\??\c:\dvjpv.exec:\dvjpv.exe85⤵PID:1568
-
\??\c:\xrllfrx.exec:\xrllfrx.exe86⤵PID:1452
-
\??\c:\pjvjv.exec:\pjvjv.exe87⤵PID:2380
-
\??\c:\frflffl.exec:\frflffl.exe88⤵PID:1872
-
\??\c:\pjdjp.exec:\pjdjp.exe89⤵PID:604
-
\??\c:\5xlxxrr.exec:\5xlxxrr.exe90⤵PID:1228
-
\??\c:\bnbhnt.exec:\bnbhnt.exe91⤵PID:2016
-
\??\c:\1lxfllr.exec:\1lxfllr.exe92⤵PID:2904
-
\??\c:\bnnnhh.exec:\bnnnhh.exe93⤵PID:2232
-
\??\c:\1pvdd.exec:\1pvdd.exe94⤵PID:328
-
\??\c:\hbbhbh.exec:\hbbhbh.exe95⤵PID:1952
-
\??\c:\5jdvv.exec:\5jdvv.exe96⤵PID:2364
-
\??\c:\hbnntt.exec:\hbnntt.exe97⤵PID:1836
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe98⤵PID:2360
-
\??\c:\bbttbh.exec:\bbttbh.exe99⤵PID:1324
-
\??\c:\5rlfffl.exec:\5rlfffl.exe100⤵PID:1608
-
\??\c:\hhthtb.exec:\hhthtb.exe101⤵PID:280
-
\??\c:\3xrlllr.exec:\3xrlllr.exe102⤵PID:1476
-
\??\c:\hbhhhh.exec:\hbhhhh.exe103⤵PID:628
-
\??\c:\7jdjj.exec:\7jdjj.exe104⤵PID:820
-
\??\c:\3httht.exec:\3httht.exe105⤵PID:2132
-
\??\c:\vvjpp.exec:\vvjpp.exe106⤵PID:2000
-
\??\c:\nhtbnn.exec:\nhtbnn.exe107⤵PID:288
-
\??\c:\vpdjp.exec:\vpdjp.exe108⤵PID:1732
-
\??\c:\5thhtt.exec:\5thhtt.exe109⤵PID:2892
-
\??\c:\jvjjp.exec:\jvjjp.exe110⤵PID:2192
-
\??\c:\7htnnt.exec:\7htnnt.exe111⤵PID:2492
-
\??\c:\jvpvd.exec:\jvpvd.exe112⤵PID:2648
-
\??\c:\hhtthh.exec:\hhtthh.exe113⤵PID:2560
-
\??\c:\3dddj.exec:\3dddj.exe114⤵PID:2336
-
\??\c:\5nnttn.exec:\5nnttn.exe115⤵PID:2620
-
\??\c:\jvjjp.exec:\jvjjp.exe116⤵PID:2600
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe117⤵PID:2604
-
\??\c:\hththh.exec:\hththh.exe118⤵PID:2572
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe119⤵PID:1764
-
\??\c:\1hthtt.exec:\1hthtt.exe120⤵PID:2584
-
\??\c:\9vvdv.exec:\9vvdv.exe121⤵PID:2704
-
\??\c:\9hbhnn.exec:\9hbhnn.exe122⤵PID:1216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-