Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe
-
Size
55KB
-
MD5
bee693a3e88bdbaead4311e06455974e
-
SHA1
461131c90f5ce809358aa02dca8d2a9d88b03ef0
-
SHA256
4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05
-
SHA512
3fa10ade5d45dcbf0639de5666efe9291d948480990f14b02720e62acdddb2fd643c1df4b801e5bacb229f56308ac51ceaccf3661b4d39cc8e016f522e6b749d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIv6u:ymb3NkkiQ3mdBjFIv/
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral2/memory/2516-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-434-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-450-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral2/memory/2516-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2516-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2780-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2780-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2780-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/996-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4736-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2420-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2536-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2536-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2992-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/860-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/860-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1100-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/992-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/532-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1880-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1880-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4404-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1008-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1180-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4892-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/388-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/704-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4624-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3716-275-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2684-279-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3248-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1692-302-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3448-310-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-319-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/972-334-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1880-342-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2956-348-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/872-351-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2188-359-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3928-363-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1612-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2516-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-407-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4268-412-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-421-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2588-434-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1436-443-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3368-450-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1528-469-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2780 3pvjd.exe 996 vdjjj.exe 1188 1lrxrxr.exe 1112 vppdv.exe 4736 htbbbb.exe 2420 vjjjj.exe 2536 lfrlxxx.exe 2992 ddddd.exe 860 xrffrrl.exe 4468 3vvpj.exe 1100 5nhbhn.exe 4044 btbbbn.exe 4608 xlfxrxr.exe 2224 5jppp.exe 3764 rrffxxx.exe 1644 9vddv.exe 992 rflfxxr.exe 5028 dpvpd.exe 532 7llfffx.exe 1880 btbtbb.exe 4404 3dvdd.exe 4344 frrlflf.exe 1008 nbbtnn.exe 4496 dddjp.exe 2816 ttnbnh.exe 4620 1vjdj.exe 3940 nnhhhn.exe 1180 9djdd.exe 4892 ntnhbb.exe 4576 vpvpj.exe 1972 lfffrrr.exe 1616 tbhhhh.exe 388 frfxlrr.exe 4436 djjdj.exe 4408 rflfxrl.exe 996 9hnhbt.exe 4624 djpjv.exe 704 3bbtnn.exe 1888 pvvjv.exe 3240 xfxrfxr.exe 316 vpvdv.exe 3288 ffffrrl.exe 3716 dvvvp.exe 2684 lffxrrr.exe 3248 nbnntb.exe 4560 pppjv.exe 3112 nhbnhh.exe 2200 vjppj.exe 1692 3xxxrxx.exe 1700 hbbbtb.exe 3448 lxffrxx.exe 1632 btbbtt.exe 2712 frrllrr.exe 3192 3vvdv.exe 4880 fxxrrlr.exe 972 nnnnbb.exe 1640 flrlfff.exe 1880 vpvdv.exe 2956 ddpvv.exe 872 rllxrrl.exe 2188 5jvpj.exe 3928 fxlfllr.exe 3980 pdjvv.exe 4656 bnbbnn.exe -
resource yara_rule behavioral2/memory/2516-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-469-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2780 2516 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 91 PID 2516 wrote to memory of 2780 2516 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 91 PID 2516 wrote to memory of 2780 2516 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 91 PID 2780 wrote to memory of 996 2780 3pvjd.exe 92 PID 2780 wrote to memory of 996 2780 3pvjd.exe 92 PID 2780 wrote to memory of 996 2780 3pvjd.exe 92 PID 996 wrote to memory of 1188 996 vdjjj.exe 93 PID 996 wrote to memory of 1188 996 vdjjj.exe 93 PID 996 wrote to memory of 1188 996 vdjjj.exe 93 PID 1188 wrote to memory of 1112 1188 1lrxrxr.exe 94 PID 1188 wrote to memory of 1112 1188 1lrxrxr.exe 94 PID 1188 wrote to memory of 1112 1188 1lrxrxr.exe 94 PID 1112 wrote to memory of 4736 1112 vppdv.exe 95 PID 1112 wrote to memory of 4736 1112 vppdv.exe 95 PID 1112 wrote to memory of 4736 1112 vppdv.exe 95 PID 4736 wrote to memory of 2420 4736 htbbbb.exe 96 PID 4736 wrote to memory of 2420 4736 htbbbb.exe 96 PID 4736 wrote to memory of 2420 4736 htbbbb.exe 96 PID 2420 wrote to memory of 2536 2420 vjjjj.exe 97 PID 2420 wrote to memory of 2536 2420 vjjjj.exe 97 PID 2420 wrote to memory of 2536 2420 vjjjj.exe 97 PID 2536 wrote to memory of 2992 2536 lfrlxxx.exe 98 PID 2536 wrote to memory of 2992 2536 lfrlxxx.exe 98 PID 2536 wrote to memory of 2992 2536 lfrlxxx.exe 98 PID 2992 wrote to memory of 860 2992 ddddd.exe 99 PID 2992 wrote to memory of 860 2992 ddddd.exe 99 PID 2992 wrote to memory of 860 2992 ddddd.exe 99 PID 860 wrote to memory of 4468 860 xrffrrl.exe 100 PID 860 wrote to memory of 4468 860 xrffrrl.exe 100 PID 860 wrote to memory of 4468 860 xrffrrl.exe 100 PID 4468 wrote to memory of 1100 4468 3vvpj.exe 101 PID 4468 wrote to memory of 1100 4468 3vvpj.exe 101 PID 4468 wrote to memory of 1100 4468 3vvpj.exe 101 PID 1100 wrote to memory of 4044 1100 5nhbhn.exe 102 PID 1100 wrote to memory of 4044 1100 5nhbhn.exe 102 PID 1100 wrote to memory of 4044 1100 5nhbhn.exe 102 PID 4044 wrote to memory of 4608 4044 btbbbn.exe 103 PID 4044 wrote to memory of 4608 4044 btbbbn.exe 103 PID 4044 wrote to memory of 4608 4044 btbbbn.exe 103 PID 4608 wrote to memory of 2224 4608 xlfxrxr.exe 104 PID 4608 wrote to memory of 2224 4608 xlfxrxr.exe 104 PID 4608 wrote to memory of 2224 4608 xlfxrxr.exe 104 PID 2224 wrote to memory of 3764 2224 5jppp.exe 105 PID 2224 wrote to memory of 3764 2224 5jppp.exe 105 PID 2224 wrote to memory of 3764 2224 5jppp.exe 105 PID 3764 wrote to memory of 1644 3764 rrffxxx.exe 106 PID 3764 wrote to memory of 1644 3764 rrffxxx.exe 106 PID 3764 wrote to memory of 1644 3764 rrffxxx.exe 106 PID 1644 wrote to memory of 992 1644 9vddv.exe 107 PID 1644 wrote to memory of 992 1644 9vddv.exe 107 PID 1644 wrote to memory of 992 1644 9vddv.exe 107 PID 992 wrote to memory of 5028 992 rflfxxr.exe 108 PID 992 wrote to memory of 5028 992 rflfxxr.exe 108 PID 992 wrote to memory of 5028 992 rflfxxr.exe 108 PID 5028 wrote to memory of 532 5028 dpvpd.exe 109 PID 5028 wrote to memory of 532 5028 dpvpd.exe 109 PID 5028 wrote to memory of 532 5028 dpvpd.exe 109 PID 532 wrote to memory of 1880 532 7llfffx.exe 110 PID 532 wrote to memory of 1880 532 7llfffx.exe 110 PID 532 wrote to memory of 1880 532 7llfffx.exe 110 PID 1880 wrote to memory of 4404 1880 btbtbb.exe 111 PID 1880 wrote to memory of 4404 1880 btbtbb.exe 111 PID 1880 wrote to memory of 4404 1880 btbtbb.exe 111 PID 4404 wrote to memory of 4344 4404 3dvdd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe"C:\Users\Admin\AppData\Local\Temp\4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\3pvjd.exec:\3pvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vdjjj.exec:\vdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\1lrxrxr.exec:\1lrxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\vppdv.exec:\vppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\htbbbb.exec:\htbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\vjjjj.exec:\vjjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ddddd.exec:\ddddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xrffrrl.exec:\xrffrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\3vvpj.exec:\3vvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\5nhbhn.exec:\5nhbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\btbbbn.exec:\btbbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\xlfxrxr.exec:\xlfxrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\5jppp.exec:\5jppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\rrffxxx.exec:\rrffxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\9vddv.exec:\9vddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rflfxxr.exec:\rflfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\dpvpd.exec:\dpvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\7llfffx.exec:\7llfffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\btbtbb.exec:\btbtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\3dvdd.exec:\3dvdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\frrlflf.exec:\frrlflf.exe23⤵
- Executes dropped EXE
PID:4344 -
\??\c:\nbbtnn.exec:\nbbtnn.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\dddjp.exec:\dddjp.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ttnbnh.exec:\ttnbnh.exe26⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1vjdj.exec:\1vjdj.exe27⤵
- Executes dropped EXE
PID:4620 -
\??\c:\nnhhhn.exec:\nnhhhn.exe28⤵
- Executes dropped EXE
PID:3940 -
\??\c:\9djdd.exec:\9djdd.exe29⤵
- Executes dropped EXE
PID:1180 -
\??\c:\ntnhbb.exec:\ntnhbb.exe30⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vpvpj.exec:\vpvpj.exe31⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lfffrrr.exec:\lfffrrr.exe32⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tbhhhh.exec:\tbhhhh.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\frfxlrr.exec:\frfxlrr.exe34⤵
- Executes dropped EXE
PID:388 -
\??\c:\djjdj.exec:\djjdj.exe35⤵
- Executes dropped EXE
PID:4436 -
\??\c:\rflfxrl.exec:\rflfxrl.exe36⤵
- Executes dropped EXE
PID:4408 -
\??\c:\9hnhbt.exec:\9hnhbt.exe37⤵
- Executes dropped EXE
PID:996 -
\??\c:\djpjv.exec:\djpjv.exe38⤵
- Executes dropped EXE
PID:4624 -
\??\c:\3bbtnn.exec:\3bbtnn.exe39⤵
- Executes dropped EXE
PID:704 -
\??\c:\pvvjv.exec:\pvvjv.exe40⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe41⤵
- Executes dropped EXE
PID:3240 -
\??\c:\vpvdv.exec:\vpvdv.exe42⤵
- Executes dropped EXE
PID:316 -
\??\c:\ffffrrl.exec:\ffffrrl.exe43⤵
- Executes dropped EXE
PID:3288 -
\??\c:\dvvvp.exec:\dvvvp.exe44⤵
- Executes dropped EXE
PID:3716 -
\??\c:\lffxrrr.exec:\lffxrrr.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nbnntb.exec:\nbnntb.exe46⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pppjv.exec:\pppjv.exe47⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nhbnhh.exec:\nhbnhh.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vjppj.exec:\vjppj.exe49⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3xxxrxx.exec:\3xxxrxx.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbbbtb.exec:\hbbbtb.exe51⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lxffrxx.exec:\lxffrxx.exe52⤵
- Executes dropped EXE
PID:3448 -
\??\c:\btbbtt.exec:\btbbtt.exe53⤵
- Executes dropped EXE
PID:1632 -
\??\c:\frrllrr.exec:\frrllrr.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3vvdv.exec:\3vvdv.exe55⤵
- Executes dropped EXE
PID:3192 -
\??\c:\fxxrrlr.exec:\fxxrrlr.exe56⤵
- Executes dropped EXE
PID:4880 -
\??\c:\nnnnbb.exec:\nnnnbb.exe57⤵
- Executes dropped EXE
PID:972 -
\??\c:\flrlfff.exec:\flrlfff.exe58⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vpvdv.exec:\vpvdv.exe59⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ddpvv.exec:\ddpvv.exe60⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rllxrrl.exec:\rllxrrl.exe61⤵
- Executes dropped EXE
PID:872 -
\??\c:\5jvpj.exec:\5jvpj.exe62⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxlfllr.exec:\fxlfllr.exe63⤵
- Executes dropped EXE
PID:3928 -
\??\c:\pdjvv.exec:\pdjvv.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bnbbnn.exec:\bnbbnn.exe65⤵
- Executes dropped EXE
PID:4656 -
\??\c:\pjjdv.exec:\pjjdv.exe66⤵PID:1612
-
\??\c:\7rrxrrr.exec:\7rrxrrr.exe67⤵PID:3476
-
\??\c:\htntnh.exec:\htntnh.exe68⤵PID:4572
-
\??\c:\pjvvj.exec:\pjvvj.exe69⤵PID:3528
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe70⤵PID:4400
-
\??\c:\9ddjj.exec:\9ddjj.exe71⤵PID:4392
-
\??\c:\htnttt.exec:\htnttt.exe72⤵PID:2516
-
\??\c:\5xfxrff.exec:\5xfxrff.exe73⤵PID:1616
-
\??\c:\nntnnn.exec:\nntnnn.exe74⤵PID:4268
-
\??\c:\vdvpj.exec:\vdvpj.exe75⤵PID:4436
-
\??\c:\3bhbtt.exec:\3bhbtt.exe76⤵PID:4408
-
\??\c:\pjppd.exec:\pjppd.exe77⤵PID:1112
-
\??\c:\nnbnht.exec:\nnbnht.exe78⤵PID:2588
-
\??\c:\ddjjj.exec:\ddjjj.exe79⤵PID:2152
-
\??\c:\tnhnhh.exec:\tnhnhh.exe80⤵PID:1436
-
\??\c:\fxfrfxf.exec:\fxfrfxf.exe81⤵PID:1852
-
\??\c:\nhhnnh.exec:\nhhnnh.exe82⤵PID:3368
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe83⤵PID:804
-
\??\c:\1tnhbb.exec:\1tnhbb.exe84⤵PID:3992
-
\??\c:\vppvj.exec:\vppvj.exe85⤵PID:4636
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe86⤵PID:1528
-
\??\c:\tnbbtt.exec:\tnbbtt.exe87⤵PID:4504
-
\??\c:\9lfffff.exec:\9lfffff.exe88⤵PID:3112
-
\??\c:\htthbt.exec:\htthbt.exe89⤵PID:1676
-
\??\c:\ffrrrlx.exec:\ffrrrlx.exe90⤵PID:1116
-
\??\c:\bnnhbt.exec:\bnnhbt.exe91⤵PID:3208
-
\??\c:\jdjdv.exec:\jdjdv.exe92⤵PID:1644
-
\??\c:\hbhbnn.exec:\hbhbnn.exe93⤵PID:4224
-
\??\c:\pvjjd.exec:\pvjjd.exe94⤵PID:632
-
\??\c:\rfrlxlf.exec:\rfrlxlf.exe95⤵PID:1904
-
\??\c:\jjvvp.exec:\jjvvp.exe96⤵PID:3816
-
\??\c:\flrlflf.exec:\flrlflf.exe97⤵PID:3428
-
\??\c:\5bbtnb.exec:\5bbtnb.exe98⤵PID:4852
-
\??\c:\frfxxff.exec:\frfxxff.exe99⤵PID:1988
-
\??\c:\hhhhbb.exec:\hhhhbb.exe100⤵PID:656
-
\??\c:\frfrxrf.exec:\frfrxrf.exe101⤵PID:4796
-
\??\c:\nhttnn.exec:\nhttnn.exe102⤵PID:4496
-
\??\c:\vdjdd.exec:\vdjdd.exe103⤵PID:3024
-
\??\c:\nbntbh.exec:\nbntbh.exe104⤵PID:3740
-
\??\c:\dvvpd.exec:\dvvpd.exe105⤵PID:1220
-
\??\c:\thhhtn.exec:\thhhtn.exe106⤵PID:3200
-
\??\c:\jpppj.exec:\jpppj.exe107⤵PID:1180
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe108⤵PID:4372
-
\??\c:\tnntbh.exec:\tnntbh.exe109⤵PID:3040
-
\??\c:\5ddpv.exec:\5ddpv.exe110⤵PID:2940
-
\??\c:\5xxlxrl.exec:\5xxlxrl.exe111⤵PID:964
-
\??\c:\hnttnn.exec:\hnttnn.exe112⤵PID:2644
-
\??\c:\vvdvv.exec:\vvdvv.exe113⤵PID:2476
-
\??\c:\frffrrr.exec:\frffrrr.exe114⤵PID:4396
-
\??\c:\nnbbbn.exec:\nnbbbn.exe115⤵PID:4532
-
\??\c:\xflfxxr.exec:\xflfxxr.exe116⤵PID:2024
-
\??\c:\5hbtnn.exec:\5hbtnn.exe117⤵PID:5068
-
\??\c:\vpjdv.exec:\vpjdv.exe118⤵PID:4316
-
\??\c:\5hnbtt.exec:\5hnbtt.exe119⤵PID:1732
-
\??\c:\vpppv.exec:\vpppv.exe120⤵PID:4672
-
\??\c:\rxfxxxl.exec:\rxfxxxl.exe121⤵PID:3716
-
\??\c:\7bnhbb.exec:\7bnhbb.exe122⤵PID:3756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-