Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 20:33
Behavioral task
behavioral1
Sample
33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe
-
Size
80KB
-
MD5
1c6a4f6c80f6476fd1cbf8a771b07633
-
SHA1
8cdde1f4a857ac6fef21db0e53a3a6795ad6d2e0
-
SHA256
33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37
-
SHA512
812649ec2e4c1a0d36329845a668834fead12a8b5de0a3475fbf8d23434ee8358f88b63c4cd3e74bb1090f5b41828629ab6afb0cea07617c5c7f6f1ea30c1dab
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TVqMJ89V:zhOmTsF93UYfwC6GIoutiTU2HVS6cMJO
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2588-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/384-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-286-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/2608-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-340-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2672-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1376-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-438-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/956-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/488-478-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1916-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-528-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1724-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-688-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2444-877-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-1024-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1920-1034-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-1191-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1572-8084-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/1572-8357-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/1572-10788-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/1572-11059-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/1572-16459-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/1572-17325-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/1572-30027-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/1572-31192-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/1572-32365-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b000000013420-7.dat UPX behavioral1/memory/2588-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2100-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2588-12-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x003a000000013a84-16.dat UPX behavioral1/memory/2512-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2512-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b000000014175-26.dat UPX behavioral1/memory/2512-24-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x0007000000014186-34.dat UPX behavioral1/memory/2600-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014207-42.dat UPX behavioral1/memory/2688-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2532-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014228-51.dat UPX behavioral1/memory/2116-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014246-58.dat UPX behavioral1/files/0x000800000001471a-65.dat UPX behavioral1/files/0x0006000000014a9a-82.dat UPX behavioral1/files/0x000600000001487f-76.dat UPX behavioral1/memory/2908-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2420-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014b18-89.dat UPX behavioral1/memory/1940-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014b4c-97.dat UPX behavioral1/memory/2472-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014bbc-105.dat UPX behavioral1/files/0x0006000000014e71-112.dat UPX behavioral1/memory/1012-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000014fa2-119.dat UPX behavioral1/memory/2084-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001535e-128.dat UPX behavioral1/files/0x000600000001564f-135.dat UPX behavioral1/files/0x0006000000015653-142.dat UPX behavioral1/files/0x000600000001565d-149.dat UPX behavioral1/memory/1020-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015677-157.dat UPX behavioral1/memory/1952-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015684-165.dat UPX behavioral1/memory/2888-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c87-173.dat UPX behavioral1/files/0x0006000000015c9e-180.dat UPX behavioral1/memory/1968-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cae-189.dat UPX behavioral1/memory/2468-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cb6-196.dat UPX behavioral1/memory/384-198-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015ccd-204.dat UPX behavioral1/memory/2336-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2136-214-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cd9-213.dat UPX behavioral1/files/0x0006000000015ce3-220.dat UPX behavioral1/files/0x0006000000015cff-227.dat UPX behavioral1/files/0x0006000000015d20-234.dat UPX behavioral1/files/0x0006000000015d42-242.dat UPX behavioral1/memory/2272-241-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/836-243-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d4e-250.dat UPX behavioral1/memory/1456-262-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1592-264-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1536-274-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1572-285-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1572-286-0x00000000775E0000-0x00000000776FF000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2588 1btbth.exe 2512 bthbbn.exe 2600 pjvdj.exe 2688 fxrfrfx.exe 2532 tnhntt.exe 2116 jjppp.exe 2672 7jvdp.exe 2420 1xxxxfl.exe 2908 xrlxlxf.exe 1940 ttnnbb.exe 2472 jdpdp.exe 2716 vjdvv.exe 2712 xrrrflr.exe 1012 ffxlxxf.exe 2084 hbnnbb.exe 1008 tthnbb.exe 2268 jjddv.exe 1020 xxxxflx.exe 1952 fllrlrr.exe 1748 hnnntt.exe 2888 7btthh.exe 1968 vvvjv.exe 2204 dpdjj.exe 2468 7lfrllx.exe 384 hbntbh.exe 2336 hbnttt.exe 2136 ddppv.exe 1704 vpdjj.exe 1316 vpvvd.exe 2272 rlfrflr.exe 836 hbbntb.exe 2112 jdjjj.exe 1456 xfrffxx.exe 1592 9rllxxl.exe 1536 9tnthh.exe 2700 1vvdj.exe 2932 vdjvp.exe 1572 fxrxffl.exe 2452 hbtbbt.exe 2476 dvdvj.exe 2480 7dppp.exe 2608 1frrrfr.exe 2988 xrxxfrr.exe 2524 nnhbht.exe 2900 vpppd.exe 2532 ddppv.exe 2428 3pvjd.exe 2384 fxflrxf.exe 2672 5hbnbb.exe 2420 5bnnnh.exe 2132 pjdjp.exe 2624 7pjdv.exe 768 lfrfxfx.exe 2748 xxlrflf.exe 2724 btbnnn.exe 2008 nnhntb.exe 2028 9pjdp.exe 2256 jjdjj.exe 1984 ddpjv.exe 2300 xrxxlxf.exe 1948 xrxflrx.exe 2440 hhtttn.exe 1376 7thnnn.exe 616 1vpvj.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000013420-7.dat upx behavioral1/memory/2588-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-12-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x003a000000013a84-16.dat upx behavioral1/memory/2512-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000014175-26.dat upx behavioral1/memory/2512-24-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000014186-34.dat upx behavioral1/memory/2600-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014207-42.dat upx behavioral1/memory/2688-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014228-51.dat upx behavioral1/memory/2116-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014246-58.dat upx behavioral1/files/0x000800000001471a-65.dat upx behavioral1/files/0x0006000000014a9a-82.dat upx behavioral1/files/0x000600000001487f-76.dat upx behavioral1/memory/2908-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b18-89.dat upx behavioral1/memory/1940-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b4c-97.dat upx behavioral1/memory/2472-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014bbc-105.dat upx behavioral1/files/0x0006000000014e71-112.dat upx behavioral1/memory/1012-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014fa2-119.dat upx behavioral1/memory/2084-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001535e-128.dat upx behavioral1/files/0x000600000001564f-135.dat upx behavioral1/files/0x0006000000015653-142.dat upx behavioral1/files/0x000600000001565d-149.dat upx behavioral1/memory/1020-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015677-157.dat upx behavioral1/memory/1952-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015684-165.dat upx behavioral1/memory/2888-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c87-173.dat upx behavioral1/files/0x0006000000015c9e-180.dat upx behavioral1/memory/1968-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cae-189.dat upx behavioral1/memory/2468-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb6-196.dat upx behavioral1/memory/384-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ccd-204.dat upx behavioral1/memory/2336-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2136-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cd9-213.dat upx behavioral1/files/0x0006000000015ce3-220.dat upx behavioral1/files/0x0006000000015cff-227.dat upx behavioral1/files/0x0006000000015d20-234.dat upx behavioral1/files/0x0006000000015d42-242.dat upx behavioral1/memory/2272-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d4e-250.dat upx behavioral1/memory/1456-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1536-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-286-0x00000000775E0000-0x00000000776FF000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2588 2100 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 28 PID 2100 wrote to memory of 2588 2100 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 28 PID 2100 wrote to memory of 2588 2100 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 28 PID 2100 wrote to memory of 2588 2100 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 28 PID 2588 wrote to memory of 2512 2588 1btbth.exe 29 PID 2588 wrote to memory of 2512 2588 1btbth.exe 29 PID 2588 wrote to memory of 2512 2588 1btbth.exe 29 PID 2588 wrote to memory of 2512 2588 1btbth.exe 29 PID 2512 wrote to memory of 2600 2512 bthbbn.exe 30 PID 2512 wrote to memory of 2600 2512 bthbbn.exe 30 PID 2512 wrote to memory of 2600 2512 bthbbn.exe 30 PID 2512 wrote to memory of 2600 2512 bthbbn.exe 30 PID 2600 wrote to memory of 2688 2600 pjvdj.exe 31 PID 2600 wrote to memory of 2688 2600 pjvdj.exe 31 PID 2600 wrote to memory of 2688 2600 pjvdj.exe 31 PID 2600 wrote to memory of 2688 2600 pjvdj.exe 31 PID 2688 wrote to memory of 2532 2688 fxrfrfx.exe 32 PID 2688 wrote to memory of 2532 2688 fxrfrfx.exe 32 PID 2688 wrote to memory of 2532 2688 fxrfrfx.exe 32 PID 2688 wrote to memory of 2532 2688 fxrfrfx.exe 32 PID 2532 wrote to memory of 2116 2532 tnhntt.exe 33 PID 2532 wrote to memory of 2116 2532 tnhntt.exe 33 PID 2532 wrote to memory of 2116 2532 tnhntt.exe 33 PID 2532 wrote to memory of 2116 2532 tnhntt.exe 33 PID 2116 wrote to memory of 2672 2116 jjppp.exe 34 PID 2116 wrote to memory of 2672 2116 jjppp.exe 34 PID 2116 wrote to memory of 2672 2116 jjppp.exe 34 PID 2116 wrote to memory of 2672 2116 jjppp.exe 34 PID 2672 wrote to memory of 2420 2672 7jvdp.exe 35 PID 2672 wrote to memory of 2420 2672 7jvdp.exe 35 PID 2672 wrote to memory of 2420 2672 7jvdp.exe 35 PID 2672 wrote to memory of 2420 2672 7jvdp.exe 35 PID 2420 wrote to memory of 2908 2420 1xxxxfl.exe 36 PID 2420 wrote to memory of 2908 2420 1xxxxfl.exe 36 PID 2420 wrote to memory of 2908 2420 1xxxxfl.exe 36 PID 2420 wrote to memory of 2908 2420 1xxxxfl.exe 36 PID 2908 wrote to memory of 1940 2908 xrlxlxf.exe 37 PID 2908 wrote to memory of 1940 2908 xrlxlxf.exe 37 PID 2908 wrote to memory of 1940 2908 xrlxlxf.exe 37 PID 2908 wrote to memory of 1940 2908 xrlxlxf.exe 37 PID 1940 wrote to memory of 2472 1940 ttnnbb.exe 38 PID 1940 wrote to memory of 2472 1940 ttnnbb.exe 38 PID 1940 wrote to memory of 2472 1940 ttnnbb.exe 38 PID 1940 wrote to memory of 2472 1940 ttnnbb.exe 38 PID 2472 wrote to memory of 2716 2472 jdpdp.exe 39 PID 2472 wrote to memory of 2716 2472 jdpdp.exe 39 PID 2472 wrote to memory of 2716 2472 jdpdp.exe 39 PID 2472 wrote to memory of 2716 2472 jdpdp.exe 39 PID 2716 wrote to memory of 2712 2716 vjdvv.exe 40 PID 2716 wrote to memory of 2712 2716 vjdvv.exe 40 PID 2716 wrote to memory of 2712 2716 vjdvv.exe 40 PID 2716 wrote to memory of 2712 2716 vjdvv.exe 40 PID 2712 wrote to memory of 1012 2712 xrrrflr.exe 41 PID 2712 wrote to memory of 1012 2712 xrrrflr.exe 41 PID 2712 wrote to memory of 1012 2712 xrrrflr.exe 41 PID 2712 wrote to memory of 1012 2712 xrrrflr.exe 41 PID 1012 wrote to memory of 2084 1012 ffxlxxf.exe 42 PID 1012 wrote to memory of 2084 1012 ffxlxxf.exe 42 PID 1012 wrote to memory of 2084 1012 ffxlxxf.exe 42 PID 1012 wrote to memory of 2084 1012 ffxlxxf.exe 42 PID 2084 wrote to memory of 1008 2084 hbnnbb.exe 43 PID 2084 wrote to memory of 1008 2084 hbnnbb.exe 43 PID 2084 wrote to memory of 1008 2084 hbnnbb.exe 43 PID 2084 wrote to memory of 1008 2084 hbnnbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe"C:\Users\Admin\AppData\Local\Temp\33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\1btbth.exec:\1btbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\bthbbn.exec:\bthbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\pjvdj.exec:\pjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fxrfrfx.exec:\fxrfrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\tnhntt.exec:\tnhntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjppp.exec:\jjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7jvdp.exec:\7jvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1xxxxfl.exec:\1xxxxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ttnnbb.exec:\ttnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\jdpdp.exec:\jdpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vjdvv.exec:\vjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xrrrflr.exec:\xrrrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ffxlxxf.exec:\ffxlxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\hbnnbb.exec:\hbnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tthnbb.exec:\tthnbb.exe17⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jjddv.exec:\jjddv.exe18⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxxxflx.exec:\xxxxflx.exe19⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fllrlrr.exec:\fllrlrr.exe20⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hnnntt.exec:\hnnntt.exe21⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7btthh.exec:\7btthh.exe22⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vvvjv.exec:\vvvjv.exe23⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpdjj.exec:\dpdjj.exe24⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7lfrllx.exec:\7lfrllx.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbntbh.exec:\hbntbh.exe26⤵
- Executes dropped EXE
PID:384 -
\??\c:\hbnttt.exec:\hbnttt.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ddppv.exec:\ddppv.exe28⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vpdjj.exec:\vpdjj.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vpvvd.exec:\vpvvd.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlfrflr.exec:\rlfrflr.exe31⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hbbntb.exec:\hbbntb.exe32⤵
- Executes dropped EXE
PID:836 -
\??\c:\jdjjj.exec:\jdjjj.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xfrffxx.exec:\xfrffxx.exe34⤵
- Executes dropped EXE
PID:1456 -
\??\c:\9rllxxl.exec:\9rllxxl.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9tnthh.exec:\9tnthh.exe36⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1vvdj.exec:\1vvdj.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vdjvp.exec:\vdjvp.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fxrxffl.exec:\fxrxffl.exe39⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rllflrx.exec:\rllflrx.exe40⤵PID:1244
-
\??\c:\hbtbbt.exec:\hbtbbt.exe41⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dvdvj.exec:\dvdvj.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7dppp.exec:\7dppp.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1frrrfr.exec:\1frrrfr.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrxxfrr.exec:\xrxxfrr.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nnhbht.exec:\nnhbht.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vpppd.exec:\vpppd.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ddppv.exec:\ddppv.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3pvjd.exec:\3pvjd.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxflrxf.exec:\fxflrxf.exe50⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5hbnbb.exec:\5hbnbb.exe51⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5bnnnh.exec:\5bnnnh.exe52⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjdjp.exec:\pjdjp.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7pjdv.exec:\7pjdv.exe54⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lfrfxfx.exec:\lfrfxfx.exe55⤵
- Executes dropped EXE
PID:768 -
\??\c:\xxlrflf.exec:\xxlrflf.exe56⤵
- Executes dropped EXE
PID:2748 -
\??\c:\btbnnn.exec:\btbnnn.exe57⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnhntb.exec:\nnhntb.exe58⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9pjdp.exec:\9pjdp.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjdjj.exec:\jjdjj.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ddpjv.exec:\ddpjv.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrxxlxf.exec:\xrxxlxf.exe62⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrxflrx.exec:\xrxflrx.exe63⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhtttn.exec:\hhtttn.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7thnnn.exec:\7thnnn.exe65⤵
- Executes dropped EXE
PID:1376 -
\??\c:\1vpvj.exec:\1vpvj.exe66⤵
- Executes dropped EXE
PID:616 -
\??\c:\9vvdd.exec:\9vvdd.exe67⤵PID:2920
-
\??\c:\9frrrrf.exec:\9frrrrf.exe68⤵PID:2808
-
\??\c:\xrrxllr.exec:\xrrxllr.exe69⤵PID:2228
-
\??\c:\bhtthh.exec:\bhtthh.exe70⤵PID:2352
-
\??\c:\hthhtt.exec:\hthhtt.exe71⤵PID:1472
-
\??\c:\rlflllr.exec:\rlflllr.exe72⤵PID:2356
-
\??\c:\9lxlxxx.exec:\9lxlxxx.exe73⤵PID:956
-
\??\c:\thtttn.exec:\thtttn.exe74⤵PID:488
-
\??\c:\vdjdj.exec:\vdjdj.exe75⤵PID:2336
-
\??\c:\jjdvd.exec:\jjdvd.exe76⤵PID:1696
-
\??\c:\rfrfxxf.exec:\rfrfxxf.exe77⤵PID:988
-
\??\c:\ffxflrx.exec:\ffxflrx.exe78⤵PID:1640
-
\??\c:\nhhnbb.exec:\nhhnbb.exe79⤵PID:1916
-
\??\c:\vpjjp.exec:\vpjjp.exe80⤵PID:1912
-
\??\c:\jjdpv.exec:\jjdpv.exe81⤵PID:1452
-
\??\c:\xrxlxfx.exec:\xrxlxfx.exe82⤵PID:2836
-
\??\c:\rxfrxxl.exec:\rxfrxxl.exe83⤵PID:1544
-
\??\c:\htbhnh.exec:\htbhnh.exe84⤵PID:2168
-
\??\c:\tnbtbb.exec:\tnbtbb.exe85⤵PID:1548
-
\??\c:\dvjjp.exec:\dvjjp.exe86⤵PID:1724
-
\??\c:\xrlrrxl.exec:\xrlrrxl.exe87⤵PID:1876
-
\??\c:\3fflffl.exec:\3fflffl.exe88⤵PID:1664
-
\??\c:\3hnhtb.exec:\3hnhtb.exe89⤵PID:2088
-
\??\c:\jvjpv.exec:\jvjpv.exe90⤵PID:2984
-
\??\c:\vvvvp.exec:\vvvvp.exe91⤵PID:1628
-
\??\c:\9rrxxxl.exec:\9rrxxxl.exe92⤵PID:2520
-
\??\c:\5rrxlrx.exec:\5rrxlrx.exe93⤵PID:2480
-
\??\c:\9thnnt.exec:\9thnnt.exe94⤵PID:1444
-
\??\c:\3bhbtn.exec:\3bhbtn.exe95⤵PID:2692
-
\??\c:\jdjjj.exec:\jdjjj.exe96⤵PID:2832
-
\??\c:\dvjvv.exec:\dvjvv.exe97⤵PID:2684
-
\??\c:\rrffllr.exec:\rrffllr.exe98⤵PID:2532
-
\??\c:\rrlxllr.exec:\rrlxllr.exe99⤵PID:2116
-
\??\c:\lfxfxll.exec:\lfxfxll.exe100⤵PID:2544
-
\??\c:\thtnnn.exec:\thtnnn.exe101⤵PID:2436
-
\??\c:\vvjpp.exec:\vvjpp.exe102⤵PID:2424
-
\??\c:\jpvjj.exec:\jpvjj.exe103⤵PID:2548
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe104⤵PID:2708
-
\??\c:\5xxflrx.exec:\5xxflrx.exe105⤵PID:2732
-
\??\c:\3bttnt.exec:\3bttnt.exe106⤵PID:2756
-
\??\c:\nnbbhn.exec:\nnbbhn.exe107⤵PID:2668
-
\??\c:\1nhntt.exec:\1nhntt.exe108⤵PID:2036
-
\??\c:\jdvdp.exec:\jdvdp.exe109⤵PID:1012
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe110⤵PID:2084
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe111⤵PID:2288
-
\??\c:\bbbnht.exec:\bbbnht.exe112⤵PID:1600
-
\??\c:\3nnhnn.exec:\3nnhnn.exe113⤵PID:2264
-
\??\c:\nhthnn.exec:\nhthnn.exe114⤵PID:1228
-
\??\c:\ddpjd.exec:\ddpjd.exe115⤵PID:1376
-
\??\c:\llfffrl.exec:\llfffrl.exe116⤵PID:1212
-
\??\c:\lflrfff.exec:\lflrfff.exe117⤵PID:2628
-
\??\c:\7bntbb.exec:\7bntbb.exe118⤵PID:2808
-
\??\c:\tnhtbh.exec:\tnhtbh.exe119⤵PID:2240
-
\??\c:\vpvpv.exec:\vpvpv.exe120⤵PID:2460
-
\??\c:\jvjjv.exec:\jvjjv.exe121⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-