Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 19:16
Behavioral task
behavioral1
Sample
1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe
-
Size
57KB
-
MD5
995526e457052e072c2b60995842177b
-
SHA1
8ef54728730cea0a1cb771bda598d69e251bd0a5
-
SHA256
1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5
-
SHA512
d1561dfa104ed2d6ea5358dbaa68484757516f493c40900cc26b5f738581bd79a76b544d7636b382b6b637d19398733b66fa2eebd504614760b3cf8cbc09bd3d
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPhbMie:zhOmTsF93UYfwC6GIoutiTm5hIie
Malware Config
Signatures
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1584-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/400-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-142-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1508-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1376-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-175-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1936-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-192-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3036-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/112-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-286-0x0000000077310000-0x000000007742F000-memory.dmp family_blackmoon behavioral1/memory/2580-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1472-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-539-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2404-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-581-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1892-653-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/3040-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-846-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-890-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-906-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-961-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1592-1000-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-11894-0x0000000077430000-0x000000007752A000-memory.dmp family_blackmoon behavioral1/memory/1696-12691-0x0000000077310000-0x000000007742F000-memory.dmp family_blackmoon behavioral1/memory/1696-14748-0x0000000077430000-0x000000007752A000-memory.dmp family_blackmoon behavioral1/memory/1696-23168-0x0000000077310000-0x000000007742F000-memory.dmp family_blackmoon behavioral1/memory/1696-21435-0x0000000077430000-0x000000007752A000-memory.dmp family_blackmoon behavioral1/memory/1696-19421-0x0000000077430000-0x000000007752A000-memory.dmp family_blackmoon behavioral1/memory/1696-30947-0x0000000077430000-0x000000007752A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1584-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b00000001444f-6.dat UPX behavioral1/memory/1672-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1672-11-0x00000000001B0000-0x00000000001D7000-memory.dmp UPX behavioral1/files/0x0031000000014665-16.dat UPX behavioral1/memory/3064-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000149ea-23.dat UPX behavioral1/files/0x0007000000014c25-39.dat UPX behavioral1/memory/2604-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014b12-32.dat UPX behavioral1/memory/2748-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014e5a-46.dat UPX behavioral1/memory/3060-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2652-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000015136-55.dat UPX behavioral1/memory/2616-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015ca5-63.dat UPX behavioral1/memory/2616-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2460-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2460-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cad-72.dat UPX behavioral1/files/0x0006000000015cb9-82.dat UPX behavioral1/memory/2976-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3020-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cc1-89.dat UPX behavioral1/files/0x0006000000015cca-96.dat UPX behavioral1/files/0x0006000000015cdb-104.dat UPX behavioral1/memory/2708-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cec-111.dat UPX behavioral1/memory/2828-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cf7-119.dat UPX behavioral1/memory/400-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d06-126.dat UPX behavioral1/files/0x0006000000015d5d-134.dat UPX behavioral1/files/0x0006000000015d6e-143.dat UPX behavioral1/memory/2336-141-0x0000000000430000-0x0000000000457000-memory.dmp UPX behavioral1/memory/1508-146-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015f1b-151.dat UPX behavioral1/memory/1652-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015f9e-158.dat UPX behavioral1/memory/1376-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016056-167.dat UPX behavioral1/memory/2400-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2400-175-0x0000000000230000-0x0000000000257000-memory.dmp UPX behavioral1/files/0x00060000000160f8-176.dat UPX behavioral1/files/0x0006000000016277-184.dat UPX behavioral1/memory/1936-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016411-191.dat UPX behavioral1/memory/2432-192-0x00000000001B0000-0x00000000001D7000-memory.dmp UPX behavioral1/files/0x0006000000016525-199.dat UPX behavioral1/files/0x0006000000016597-207.dat UPX behavioral1/files/0x00060000000167ef-214.dat UPX behavioral1/memory/848-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3036-213-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016a45-222.dat UPX behavioral1/files/0x0006000000016c17-229.dat UPX behavioral1/memory/2644-236-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c26-237.dat UPX behavioral1/files/0x0006000000016c2e-244.dat UPX behavioral1/memory/3052-246-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c7a-252.dat UPX behavioral1/memory/112-259-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1960-270-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1696-286-0x0000000077310000-0x000000007742F000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1672 vpjpj.exe 3064 pdpjp.exe 2748 lfrrffr.exe 2604 tntbnt.exe 3060 nhhnhn.exe 2652 1vvjd.exe 2616 ppddv.exe 2460 rlxlxlx.exe 3020 hthttt.exe 2976 bbntht.exe 2712 hthhnt.exe 2708 dvjpd.exe 2828 9rfxlxl.exe 2832 7hnthh.exe 400 thbntt.exe 1908 pjvdj.exe 2336 3pjpp.exe 1508 rlflxxl.exe 1652 rlxxxfr.exe 1376 bnhnbn.exe 2400 3nbhth.exe 1936 jjdjp.exe 2432 5fffllx.exe 2280 flxxrrx.exe 788 nnhnbt.exe 3036 5bhntt.exe 848 pdvjp.exe 1496 lxrrrrx.exe 2644 xlfflll.exe 1732 tnbbtn.exe 3052 hthntb.exe 2092 vjvvj.exe 112 jdjjp.exe 2532 rfrrxxl.exe 1960 9rffllr.exe 1980 ttnbnh.exe 2192 nhthtt.exe 1696 jdvvv.exe 2544 dvjpd.exe 2580 fxrrfrl.exe 2788 tnnthh.exe 2748 3hbhnt.exe 2576 1btbtt.exe 1048 vpjpj.exe 2852 vpjjv.exe 2564 7jvvd.exe 2220 xlrxxxl.exe 1624 xffrlxr.exe 2464 ththtb.exe 2492 hbttbh.exe 1868 dvpdp.exe 2668 pjvjp.exe 2720 7frrfxf.exe 2716 tnhbhn.exe 2692 thbhnt.exe 2828 jvpvd.exe 320 dvpjv.exe 400 jdvdd.exe 1884 3frfflr.exe 1604 1rrfffl.exe 1684 hbtttt.exe 1380 7hhntb.exe 1336 dpdjp.exe 2656 9ddpp.exe -
resource yara_rule behavioral1/memory/1584-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001444f-6.dat upx behavioral1/memory/1672-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1672-11-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0031000000014665-16.dat upx behavioral1/memory/3064-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000149ea-23.dat upx behavioral1/files/0x0007000000014c25-39.dat upx behavioral1/memory/2604-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014b12-32.dat upx behavioral1/memory/2748-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014e5a-46.dat upx behavioral1/memory/3060-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015136-55.dat upx behavioral1/memory/2616-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ca5-63.dat upx behavioral1/memory/2616-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cad-72.dat upx behavioral1/files/0x0006000000015cb9-82.dat upx behavioral1/memory/2976-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cc1-89.dat upx behavioral1/files/0x0006000000015cca-96.dat upx behavioral1/files/0x0006000000015cdb-104.dat upx behavioral1/memory/2708-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cec-111.dat upx behavioral1/memory/2828-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf7-119.dat upx behavioral1/memory/400-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d06-126.dat upx behavioral1/files/0x0006000000015d5d-134.dat upx behavioral1/files/0x0006000000015d6e-143.dat upx behavioral1/memory/2336-141-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/1508-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f1b-151.dat upx behavioral1/memory/1652-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f9e-158.dat upx behavioral1/memory/1376-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016056-167.dat upx behavioral1/memory/2400-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-175-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x00060000000160f8-176.dat upx behavioral1/files/0x0006000000016277-184.dat upx behavioral1/memory/1936-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016411-191.dat upx behavioral1/memory/2432-192-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0006000000016525-199.dat upx behavioral1/files/0x0006000000016597-207.dat upx behavioral1/files/0x00060000000167ef-214.dat upx behavioral1/memory/848-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3036-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a45-222.dat upx behavioral1/files/0x0006000000016c17-229.dat upx behavioral1/memory/2644-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c26-237.dat upx behavioral1/files/0x0006000000016c2e-244.dat upx behavioral1/memory/3052-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c7a-252.dat upx behavioral1/memory/112-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-286-0x0000000077310000-0x000000007742F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1672 1584 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 28 PID 1584 wrote to memory of 1672 1584 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 28 PID 1584 wrote to memory of 1672 1584 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 28 PID 1584 wrote to memory of 1672 1584 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 28 PID 1672 wrote to memory of 3064 1672 vpjpj.exe 29 PID 1672 wrote to memory of 3064 1672 vpjpj.exe 29 PID 1672 wrote to memory of 3064 1672 vpjpj.exe 29 PID 1672 wrote to memory of 3064 1672 vpjpj.exe 29 PID 3064 wrote to memory of 2748 3064 pdpjp.exe 30 PID 3064 wrote to memory of 2748 3064 pdpjp.exe 30 PID 3064 wrote to memory of 2748 3064 pdpjp.exe 30 PID 3064 wrote to memory of 2748 3064 pdpjp.exe 30 PID 2748 wrote to memory of 2604 2748 lfrrffr.exe 31 PID 2748 wrote to memory of 2604 2748 lfrrffr.exe 31 PID 2748 wrote to memory of 2604 2748 lfrrffr.exe 31 PID 2748 wrote to memory of 2604 2748 lfrrffr.exe 31 PID 2604 wrote to memory of 3060 2604 tntbnt.exe 32 PID 2604 wrote to memory of 3060 2604 tntbnt.exe 32 PID 2604 wrote to memory of 3060 2604 tntbnt.exe 32 PID 2604 wrote to memory of 3060 2604 tntbnt.exe 32 PID 3060 wrote to memory of 2652 3060 nhhnhn.exe 33 PID 3060 wrote to memory of 2652 3060 nhhnhn.exe 33 PID 3060 wrote to memory of 2652 3060 nhhnhn.exe 33 PID 3060 wrote to memory of 2652 3060 nhhnhn.exe 33 PID 2652 wrote to memory of 2616 2652 1vvjd.exe 34 PID 2652 wrote to memory of 2616 2652 1vvjd.exe 34 PID 2652 wrote to memory of 2616 2652 1vvjd.exe 34 PID 2652 wrote to memory of 2616 2652 1vvjd.exe 34 PID 2616 wrote to memory of 2460 2616 ppddv.exe 35 PID 2616 wrote to memory of 2460 2616 ppddv.exe 35 PID 2616 wrote to memory of 2460 2616 ppddv.exe 35 PID 2616 wrote to memory of 2460 2616 ppddv.exe 35 PID 2460 wrote to memory of 3020 2460 rlxlxlx.exe 36 PID 2460 wrote to memory of 3020 2460 rlxlxlx.exe 36 PID 2460 wrote to memory of 3020 2460 rlxlxlx.exe 36 PID 2460 wrote to memory of 3020 2460 rlxlxlx.exe 36 PID 3020 wrote to memory of 2976 3020 hthttt.exe 37 PID 3020 wrote to memory of 2976 3020 hthttt.exe 37 PID 3020 wrote to memory of 2976 3020 hthttt.exe 37 PID 3020 wrote to memory of 2976 3020 hthttt.exe 37 PID 2976 wrote to memory of 2712 2976 bbntht.exe 38 PID 2976 wrote to memory of 2712 2976 bbntht.exe 38 PID 2976 wrote to memory of 2712 2976 bbntht.exe 38 PID 2976 wrote to memory of 2712 2976 bbntht.exe 38 PID 2712 wrote to memory of 2708 2712 hthhnt.exe 39 PID 2712 wrote to memory of 2708 2712 hthhnt.exe 39 PID 2712 wrote to memory of 2708 2712 hthhnt.exe 39 PID 2712 wrote to memory of 2708 2712 hthhnt.exe 39 PID 2708 wrote to memory of 2828 2708 dvjpd.exe 40 PID 2708 wrote to memory of 2828 2708 dvjpd.exe 40 PID 2708 wrote to memory of 2828 2708 dvjpd.exe 40 PID 2708 wrote to memory of 2828 2708 dvjpd.exe 40 PID 2828 wrote to memory of 2832 2828 9rfxlxl.exe 41 PID 2828 wrote to memory of 2832 2828 9rfxlxl.exe 41 PID 2828 wrote to memory of 2832 2828 9rfxlxl.exe 41 PID 2828 wrote to memory of 2832 2828 9rfxlxl.exe 41 PID 2832 wrote to memory of 400 2832 7hnthh.exe 42 PID 2832 wrote to memory of 400 2832 7hnthh.exe 42 PID 2832 wrote to memory of 400 2832 7hnthh.exe 42 PID 2832 wrote to memory of 400 2832 7hnthh.exe 42 PID 400 wrote to memory of 1908 400 thbntt.exe 43 PID 400 wrote to memory of 1908 400 thbntt.exe 43 PID 400 wrote to memory of 1908 400 thbntt.exe 43 PID 400 wrote to memory of 1908 400 thbntt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe"C:\Users\Admin\AppData\Local\Temp\1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\vpjpj.exec:\vpjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\pdpjp.exec:\pdpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lfrrffr.exec:\lfrrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tntbnt.exec:\tntbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhhnhn.exec:\nhhnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\1vvjd.exec:\1vvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ppddv.exec:\ppddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\hthttt.exec:\hthttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\bbntht.exec:\bbntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hthhnt.exec:\hthhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\dvjpd.exec:\dvjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\9rfxlxl.exec:\9rfxlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7hnthh.exec:\7hnthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\thbntt.exec:\thbntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\pjvdj.exec:\pjvdj.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3pjpp.exec:\3pjpp.exe18⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rlflxxl.exec:\rlflxxl.exe19⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe20⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bnhnbn.exec:\bnhnbn.exe21⤵
- Executes dropped EXE
PID:1376 -
\??\c:\3nbhth.exec:\3nbhth.exe22⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjdjp.exec:\jjdjp.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5fffllx.exec:\5fffllx.exe24⤵
- Executes dropped EXE
PID:2432 -
\??\c:\flxxrrx.exec:\flxxrrx.exe25⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nnhnbt.exec:\nnhnbt.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\5bhntt.exec:\5bhntt.exe27⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pdvjp.exec:\pdvjp.exe28⤵
- Executes dropped EXE
PID:848 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xlfflll.exec:\xlfflll.exe30⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnbbtn.exec:\tnbbtn.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hthntb.exec:\hthntb.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vjvvj.exec:\vjvvj.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jdjjp.exec:\jdjjp.exe34⤵
- Executes dropped EXE
PID:112 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9rffllr.exec:\9rffllr.exe36⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ttnbnh.exec:\ttnbnh.exe37⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhthtt.exec:\nhthtt.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdvvv.exec:\jdvvv.exe39⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1jjjv.exec:\1jjjv.exe40⤵PID:3028
-
\??\c:\dvjpd.exec:\dvjpd.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxrrfrl.exec:\fxrrfrl.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnnthh.exec:\tnnthh.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3hbhnt.exec:\3hbhnt.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1btbtt.exec:\1btbtt.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vpjpj.exec:\vpjpj.exe46⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vpjjv.exec:\vpjjv.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7jvvd.exec:\7jvvd.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xlrxxxl.exec:\xlrxxxl.exe49⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xffrlxr.exec:\xffrlxr.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ththtb.exec:\ththtb.exe51⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hbttbh.exec:\hbttbh.exe52⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dvpdp.exec:\dvpdp.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjvjp.exec:\pjvjp.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7frrfxf.exec:\7frrfxf.exe55⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tnhbhn.exec:\tnhbhn.exe56⤵
- Executes dropped EXE
PID:2716 -
\??\c:\thbhnt.exec:\thbhnt.exe57⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jvpvd.exec:\jvpvd.exe58⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvpjv.exec:\dvpjv.exe59⤵
- Executes dropped EXE
PID:320 -
\??\c:\jdvdd.exec:\jdvdd.exe60⤵
- Executes dropped EXE
PID:400 -
\??\c:\3frfflr.exec:\3frfflr.exe61⤵
- Executes dropped EXE
PID:1884 -
\??\c:\1rrfffl.exec:\1rrfffl.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbtttt.exec:\hbtttt.exe63⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7hhntb.exec:\7hhntb.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dpdjp.exec:\dpdjp.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9ddpp.exec:\9ddpp.exe66⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rlxflfr.exec:\rlxflfr.exe67⤵PID:1472
-
\??\c:\thnnbt.exec:\thnnbt.exe68⤵PID:1704
-
\??\c:\1hhthn.exec:\1hhthn.exe69⤵PID:1280
-
\??\c:\pjvvj.exec:\pjvvj.exe70⤵PID:2112
-
\??\c:\vpddd.exec:\vpddd.exe71⤵PID:612
-
\??\c:\3jvpv.exec:\3jvpv.exe72⤵PID:2548
-
\??\c:\5xrrrll.exec:\5xrrrll.exe73⤵PID:2256
-
\??\c:\thhhnh.exec:\thhhnh.exe74⤵PID:796
-
\??\c:\1tbbnn.exec:\1tbbnn.exe75⤵PID:3036
-
\??\c:\1vppd.exec:\1vppd.exe76⤵PID:2396
-
\??\c:\1pjjj.exec:\1pjjj.exe77⤵PID:1304
-
\??\c:\lfxlffr.exec:\lfxlffr.exe78⤵PID:1000
-
\??\c:\1xxxrxl.exec:\1xxxrxl.exe79⤵PID:972
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe80⤵PID:1764
-
\??\c:\tnbhnt.exec:\tnbhnt.exe81⤵PID:2148
-
\??\c:\thnthh.exec:\thnthh.exe82⤵PID:2784
-
\??\c:\dpvdp.exec:\dpvdp.exe83⤵PID:588
-
\??\c:\dvjjj.exec:\dvjjj.exe84⤵PID:2876
-
\??\c:\llffrrx.exec:\llffrrx.exe85⤵PID:1692
-
\??\c:\xrxfxfl.exec:\xrxfxfl.exe86⤵PID:1988
-
\??\c:\bthtbh.exec:\bthtbh.exe87⤵PID:2188
-
\??\c:\nbhhnt.exec:\nbhhnt.exe88⤵PID:2404
-
\??\c:\3pjdp.exec:\3pjdp.exe89⤵PID:1552
-
\??\c:\1jjdj.exec:\1jjdj.exe90⤵PID:2596
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe91⤵PID:2756
-
\??\c:\3frrxxx.exec:\3frrxxx.exe92⤵PID:2872
-
\??\c:\9nbhhh.exec:\9nbhhh.exe93⤵PID:2072
-
\??\c:\7tntbh.exec:\7tntbh.exe94⤵PID:2780
-
\??\c:\pvdjd.exec:\pvdjd.exe95⤵PID:2552
-
\??\c:\1dpvv.exec:\1dpvv.exe96⤵PID:2484
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe97⤵PID:1540
-
\??\c:\lffffxf.exec:\lffffxf.exe98⤵PID:2472
-
\??\c:\7flflfl.exec:\7flflfl.exe99⤵PID:2588
-
\??\c:\9tbnbb.exec:\9tbnbb.exe100⤵PID:2640
-
\??\c:\7bntbt.exec:\7bntbt.exe101⤵PID:3020
-
\??\c:\dpddp.exec:\dpddp.exe102⤵PID:2976
-
\??\c:\3jvjp.exec:\3jvjp.exe103⤵PID:2540
-
\??\c:\pdppv.exec:\pdppv.exe104⤵PID:2800
-
\??\c:\flxxfff.exec:\flxxfff.exe105⤵PID:2436
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe106⤵PID:1892
-
\??\c:\nbnnhh.exec:\nbnnhh.exe107⤵PID:2812
-
\??\c:\tntttn.exec:\tntttn.exe108⤵PID:1528
-
\??\c:\bnbhtn.exec:\bnbhtn.exe109⤵PID:1880
-
\??\c:\dpjvd.exec:\dpjvd.exe110⤵PID:2328
-
\??\c:\1jjdd.exec:\1jjdd.exe111⤵PID:1908
-
\??\c:\xfrfffl.exec:\xfrfffl.exe112⤵PID:2332
-
\??\c:\xlxlxxf.exec:\xlxlxxf.exe113⤵PID:2520
-
\??\c:\nbtbtb.exec:\nbtbtb.exe114⤵PID:2424
-
\??\c:\htbnbt.exec:\htbnbt.exe115⤵PID:1380
-
\??\c:\tnhntt.exec:\tnhntt.exe116⤵PID:1336
-
\??\c:\pddjj.exec:\pddjj.exe117⤵PID:2988
-
\??\c:\jjpvd.exec:\jjpvd.exe118⤵PID:1052
-
\??\c:\frllllr.exec:\frllllr.exe119⤵PID:1704
-
\??\c:\lrxlxrx.exec:\lrxlxrx.exe120⤵PID:2312
-
\??\c:\nnbtth.exec:\nnbtth.exe121⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-