Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe
-
Size
330KB
-
MD5
d77be94cac6d99051f13e19aab3943ec
-
SHA1
7bdcddb54f342197effbde5ef7e3452d6f92df09
-
SHA256
c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70
-
SHA512
2d63b0a658dc024c90fe89704982c642b8ce6c8ce095ff3e57ea5ba4de02a8d10335c17b3a93e8c22548478b193fadd9086f230be7adfa5a24ef280b338e8304
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhK:F7Tc8JdSjylh2b77BoTMA9gX59sTsuT6
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3880-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/340-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/328-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-882-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3880-6-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4900-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4900-12-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3668-20-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2288-38-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3776-44-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3212-33-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2776-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1560-21-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4128-51-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3384-56-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3384-61-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4696-64-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2060-70-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4736-79-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2740-85-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4188-92-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2248-93-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4480-110-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2192-114-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2192-120-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2316-126-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4628-133-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3944-143-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1744-150-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1004-154-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1740-160-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3608-170-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3600-180-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2128-179-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/340-185-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4760-195-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2216-211-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1820-223-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/824-227-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3140-228-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5104-233-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2140-237-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2836-243-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1056-247-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1800-251-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1656-270-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/640-294-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1852-292-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4628-312-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2108-313-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2108-317-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5028-341-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/328-350-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4960-354-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1620-376-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1620-380-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4588-441-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4772-445-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3496-461-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5056-468-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3492-487-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4100-497-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3892-549-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1380-559-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/640-569-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4164-588-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1560-622-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3044-641-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4900 5vjpp.exe 3668 nbnhhh.exe 1560 vdjjd.exe 3212 hnbbhb.exe 2776 jjdjp.exe 2288 xfrrrlf.exe 3776 xrrlffx.exe 4128 3bbhhh.exe 3384 dpvpj.exe 4696 nhnhhh.exe 2060 pjdvj.exe 4736 1rllfrr.exe 2740 vpppj.exe 4188 bnhhtt.exe 2248 rrfllxx.exe 3892 nhnntt.exe 2480 dpjjj.exe 4480 xllllrr.exe 2192 vdjjd.exe 2316 3xfxxxx.exe 644 7djjp.exe 4628 rfxfxrf.exe 3944 xxxrflf.exe 1744 9lxrrxx.exe 1004 7flfllx.exe 1740 lxxxxrr.exe 5008 fxxrlfx.exe 3608 hbbbbt.exe 2128 pvdpj.exe 3600 7hbtnn.exe 340 pvdvp.exe 4760 xrxrrlf.exe 3980 bntnnh.exe 4424 jvpjd.exe 4416 rlllffx.exe 400 7ntntb.exe 1416 vjjdj.exe 2216 flrlllr.exe 3556 3tthhh.exe 3796 ppjpd.exe 1820 vpjjj.exe 824 nnbtnn.exe 3140 nhhnhh.exe 5104 3vpjd.exe 2140 rxrrrll.exe 2836 hnttbb.exe 1056 ddpjd.exe 1948 9rxrrrr.exe 1800 hbbtnb.exe 512 pdvpj.exe 4632 fxrxrrl.exe 2536 rxffflr.exe 4736 tbhbtt.exe 1656 9djvp.exe 2324 lfxrlxr.exe 1528 hbtnbb.exe 1544 thhbnh.exe 3448 vvppp.exe 3684 5xxxllf.exe 2760 nhnhtn.exe 1852 bttnhb.exe 640 pvpjv.exe 904 frfrrrx.exe 2228 fxrlfxr.exe -
resource yara_rule behavioral2/memory/3880-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/340-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/328-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-641-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 4900 3880 c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe 84 PID 3880 wrote to memory of 4900 3880 c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe 84 PID 3880 wrote to memory of 4900 3880 c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe 84 PID 4900 wrote to memory of 3668 4900 5vjpp.exe 85 PID 4900 wrote to memory of 3668 4900 5vjpp.exe 85 PID 4900 wrote to memory of 3668 4900 5vjpp.exe 85 PID 3668 wrote to memory of 1560 3668 nbnhhh.exe 86 PID 3668 wrote to memory of 1560 3668 nbnhhh.exe 86 PID 3668 wrote to memory of 1560 3668 nbnhhh.exe 86 PID 1560 wrote to memory of 3212 1560 vdjjd.exe 87 PID 1560 wrote to memory of 3212 1560 vdjjd.exe 87 PID 1560 wrote to memory of 3212 1560 vdjjd.exe 87 PID 3212 wrote to memory of 2776 3212 hnbbhb.exe 88 PID 3212 wrote to memory of 2776 3212 hnbbhb.exe 88 PID 3212 wrote to memory of 2776 3212 hnbbhb.exe 88 PID 2776 wrote to memory of 2288 2776 jjdjp.exe 89 PID 2776 wrote to memory of 2288 2776 jjdjp.exe 89 PID 2776 wrote to memory of 2288 2776 jjdjp.exe 89 PID 2288 wrote to memory of 3776 2288 xfrrrlf.exe 90 PID 2288 wrote to memory of 3776 2288 xfrrrlf.exe 90 PID 2288 wrote to memory of 3776 2288 xfrrrlf.exe 90 PID 3776 wrote to memory of 4128 3776 xrrlffx.exe 91 PID 3776 wrote to memory of 4128 3776 xrrlffx.exe 91 PID 3776 wrote to memory of 4128 3776 xrrlffx.exe 91 PID 4128 wrote to memory of 3384 4128 3bbhhh.exe 92 PID 4128 wrote to memory of 3384 4128 3bbhhh.exe 92 PID 4128 wrote to memory of 3384 4128 3bbhhh.exe 92 PID 3384 wrote to memory of 4696 3384 dpvpj.exe 93 PID 3384 wrote to memory of 4696 3384 dpvpj.exe 93 PID 3384 wrote to memory of 4696 3384 dpvpj.exe 93 PID 4696 wrote to memory of 2060 4696 nhnhhh.exe 94 PID 4696 wrote to memory of 2060 4696 nhnhhh.exe 94 PID 4696 wrote to memory of 2060 4696 nhnhhh.exe 94 PID 2060 wrote to memory of 4736 2060 pjdvj.exe 95 PID 2060 wrote to memory of 4736 2060 pjdvj.exe 95 PID 2060 wrote to memory of 4736 2060 pjdvj.exe 95 PID 4736 wrote to memory of 2740 4736 1rllfrr.exe 97 PID 4736 wrote to memory of 2740 4736 1rllfrr.exe 97 PID 4736 wrote to memory of 2740 4736 1rllfrr.exe 97 PID 2740 wrote to memory of 4188 2740 vpppj.exe 98 PID 2740 wrote to memory of 4188 2740 vpppj.exe 98 PID 2740 wrote to memory of 4188 2740 vpppj.exe 98 PID 4188 wrote to memory of 2248 4188 bnhhtt.exe 99 PID 4188 wrote to memory of 2248 4188 bnhhtt.exe 99 PID 4188 wrote to memory of 2248 4188 bnhhtt.exe 99 PID 2248 wrote to memory of 3892 2248 rrfllxx.exe 100 PID 2248 wrote to memory of 3892 2248 rrfllxx.exe 100 PID 2248 wrote to memory of 3892 2248 rrfllxx.exe 100 PID 3892 wrote to memory of 2480 3892 nhnntt.exe 101 PID 3892 wrote to memory of 2480 3892 nhnntt.exe 101 PID 3892 wrote to memory of 2480 3892 nhnntt.exe 101 PID 2480 wrote to memory of 4480 2480 dpjjj.exe 102 PID 2480 wrote to memory of 4480 2480 dpjjj.exe 102 PID 2480 wrote to memory of 4480 2480 dpjjj.exe 102 PID 4480 wrote to memory of 2192 4480 xllllrr.exe 104 PID 4480 wrote to memory of 2192 4480 xllllrr.exe 104 PID 4480 wrote to memory of 2192 4480 xllllrr.exe 104 PID 2192 wrote to memory of 2316 2192 vdjjd.exe 105 PID 2192 wrote to memory of 2316 2192 vdjjd.exe 105 PID 2192 wrote to memory of 2316 2192 vdjjd.exe 105 PID 2316 wrote to memory of 644 2316 3xfxxxx.exe 106 PID 2316 wrote to memory of 644 2316 3xfxxxx.exe 106 PID 2316 wrote to memory of 644 2316 3xfxxxx.exe 106 PID 644 wrote to memory of 4628 644 7djjp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe"C:\Users\Admin\AppData\Local\Temp\c5185c224bb6856673f4c5b32ef3c9bdf3f6b1deab99ad93361dcf8b35e12f70.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\5vjpp.exec:\5vjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\nbnhhh.exec:\nbnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\vdjjd.exec:\vdjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\hnbbhb.exec:\hnbbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\jjdjp.exec:\jjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xfrrrlf.exec:\xfrrrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xrrlffx.exec:\xrrlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\3bbhhh.exec:\3bbhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\dpvpj.exec:\dpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\nhnhhh.exec:\nhnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\pjdvj.exec:\pjdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\1rllfrr.exec:\1rllfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\vpppj.exec:\vpppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bnhhtt.exec:\bnhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\rrfllxx.exec:\rrfllxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nhnntt.exec:\nhnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\dpjjj.exec:\dpjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xllllrr.exec:\xllllrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\vdjjd.exec:\vdjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\3xfxxxx.exec:\3xfxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\7djjp.exec:\7djjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\rfxfxrf.exec:\rfxfxrf.exe23⤵
- Executes dropped EXE
PID:4628 -
\??\c:\xxxrflf.exec:\xxxrflf.exe24⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9lxrrxx.exec:\9lxrrxx.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7flfllx.exec:\7flfllx.exe26⤵
- Executes dropped EXE
PID:1004 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe27⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe28⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hbbbbt.exec:\hbbbbt.exe29⤵
- Executes dropped EXE
PID:3608 -
\??\c:\pvdpj.exec:\pvdpj.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7hbtnn.exec:\7hbtnn.exe31⤵
- Executes dropped EXE
PID:3600 -
\??\c:\pvdvp.exec:\pvdvp.exe32⤵
- Executes dropped EXE
PID:340 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe33⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bntnnh.exec:\bntnnh.exe34⤵
- Executes dropped EXE
PID:3980 -
\??\c:\jvpjd.exec:\jvpjd.exe35⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rlllffx.exec:\rlllffx.exe36⤵
- Executes dropped EXE
PID:4416 -
\??\c:\7ntntb.exec:\7ntntb.exe37⤵
- Executes dropped EXE
PID:400 -
\??\c:\vjjdj.exec:\vjjdj.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\flrlllr.exec:\flrlllr.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3tthhh.exec:\3tthhh.exe40⤵
- Executes dropped EXE
PID:3556 -
\??\c:\ppjpd.exec:\ppjpd.exe41⤵
- Executes dropped EXE
PID:3796 -
\??\c:\vpjjj.exec:\vpjjj.exe42⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nnbtnn.exec:\nnbtnn.exe43⤵
- Executes dropped EXE
PID:824 -
\??\c:\nhhnhh.exec:\nhhnhh.exe44⤵
- Executes dropped EXE
PID:3140 -
\??\c:\3vpjd.exec:\3vpjd.exe45⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rxrrrll.exec:\rxrrrll.exe46⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hnttbb.exec:\hnttbb.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ddpjd.exec:\ddpjd.exe48⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9rxrrrr.exec:\9rxrrrr.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hbbtnb.exec:\hbbtnb.exe50⤵
- Executes dropped EXE
PID:1800 -
\??\c:\pdvpj.exec:\pdvpj.exe51⤵
- Executes dropped EXE
PID:512 -
\??\c:\fxrxrrl.exec:\fxrxrrl.exe52⤵
- Executes dropped EXE
PID:4632 -
\??\c:\rxffflr.exec:\rxffflr.exe53⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tbhbtt.exec:\tbhbtt.exe54⤵
- Executes dropped EXE
PID:4736 -
\??\c:\9djvp.exec:\9djvp.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe56⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hbtnbb.exec:\hbtnbb.exe57⤵
- Executes dropped EXE
PID:1528 -
\??\c:\thhbnh.exec:\thhbnh.exe58⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vvppp.exec:\vvppp.exe59⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5xxxllf.exec:\5xxxllf.exe60⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nhnhtn.exec:\nhnhtn.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bttnhb.exec:\bttnhb.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pvpjv.exec:\pvpjv.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\frfrrrx.exec:\frfrrrx.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe65⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ntbtnn.exec:\ntbtnn.exe66⤵PID:3340
-
\??\c:\jdvpd.exec:\jdvpd.exe67⤵PID:696
-
\??\c:\1jjdj.exec:\1jjdj.exe68⤵PID:4628
-
\??\c:\xxfxrlx.exec:\xxfxrlx.exe69⤵PID:2108
-
\??\c:\7hhhbb.exec:\7hhhbb.exe70⤵PID:4164
-
\??\c:\jjvvp.exec:\jjvvp.exe71⤵PID:3996
-
\??\c:\xrrrrff.exec:\xrrrrff.exe72⤵PID:2372
-
\??\c:\ttnhbb.exec:\ttnhbb.exe73⤵PID:2824
-
\??\c:\hhthhn.exec:\hhthhn.exe74⤵PID:968
-
\??\c:\vjvvj.exec:\vjvvj.exe75⤵PID:4312
-
\??\c:\frxrlfx.exec:\frxrlfx.exe76⤵PID:5100
-
\??\c:\pjjvv.exec:\pjjvv.exe77⤵PID:5028
-
\??\c:\fffrffl.exec:\fffrffl.exe78⤵PID:1052
-
\??\c:\ttthhb.exec:\ttthhb.exe79⤵PID:328
-
\??\c:\vvddd.exec:\vvddd.exe80⤵PID:4960
-
\??\c:\llrffxr.exec:\llrffxr.exe81⤵PID:4152
-
\??\c:\bhnhbt.exec:\bhnhbt.exe82⤵PID:2932
-
\??\c:\thhhhh.exec:\thhhhh.exe83⤵PID:4900
-
\??\c:\vjvpp.exec:\vjvpp.exe84⤵PID:3320
-
\??\c:\fllfxlf.exec:\fllfxlf.exe85⤵PID:668
-
\??\c:\bntnhh.exec:\bntnhh.exe86⤵PID:3832
-
\??\c:\tnnhhh.exec:\tnnhhh.exe87⤵PID:2280
-
\??\c:\5vvvp.exec:\5vvvp.exe88⤵PID:1620
-
\??\c:\xrrlfff.exec:\xrrlfff.exe89⤵PID:4232
-
\??\c:\hnbbtt.exec:\hnbbtt.exe90⤵PID:4496
-
\??\c:\jvvpp.exec:\jvvpp.exe91⤵PID:2836
-
\??\c:\jdvjv.exec:\jdvjv.exe92⤵PID:3960
-
\??\c:\flrrfxr.exec:\flrrfxr.exe93⤵PID:3956
-
\??\c:\1nnhbb.exec:\1nnhbb.exe94⤵PID:4756
-
\??\c:\vddvj.exec:\vddvj.exe95⤵PID:2092
-
\??\c:\lllfxxr.exec:\lllfxxr.exe96⤵PID:688
-
\??\c:\ntbtbb.exec:\ntbtbb.exe97⤵PID:4684
-
\??\c:\jpjdv.exec:\jpjdv.exe98⤵PID:2740
-
\??\c:\lrrrrff.exec:\lrrrrff.exe99⤵PID:3968
-
\??\c:\1hnhbb.exec:\1hnhbb.exe100⤵PID:3544
-
\??\c:\3jjvp.exec:\3jjvp.exe101⤵PID:1544
-
\??\c:\jjpjv.exec:\jjpjv.exe102⤵PID:3448
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe103⤵PID:3684
-
\??\c:\3hbtnn.exec:\3hbtnn.exe104⤵PID:1988
-
\??\c:\jvvdp.exec:\jvvdp.exe105⤵PID:4480
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe106⤵PID:640
-
\??\c:\7fxxrlf.exec:\7fxxrlf.exe107⤵PID:2316
-
\??\c:\3vvpj.exec:\3vvpj.exe108⤵PID:4588
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe109⤵PID:4772
-
\??\c:\tbntnn.exec:\tbntnn.exe110⤵PID:2624
-
\??\c:\rrflllx.exec:\rrflllx.exe111⤵PID:2664
-
\??\c:\hbnhbb.exec:\hbnhbb.exe112⤵PID:1572
-
\??\c:\7jdvj.exec:\7jdvj.exe113⤵PID:3924
-
\??\c:\xllfffx.exec:\xllfffx.exe114⤵PID:3496
-
\??\c:\tbbhht.exec:\tbbhht.exe115⤵PID:5108
-
\??\c:\hbnhnh.exec:\hbnhnh.exe116⤵PID:5056
-
\??\c:\vvjpv.exec:\vvjpv.exe117⤵PID:4700
-
\??\c:\rfflfxl.exec:\rfflfxl.exe118⤵PID:3268
-
\??\c:\frrlffx.exec:\frrlffx.exe119⤵PID:340
-
\??\c:\nttnbt.exec:\nttnbt.exe120⤵PID:116
-
\??\c:\1ppdp.exec:\1ppdp.exe121⤵PID:3980
-
\??\c:\pjdvp.exec:\pjdvp.exe122⤵PID:740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-