Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f86b7599b09ad4efbf902a782bc85ab0_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
f86b7599b09ad4efbf902a782bc85ab0_JC.exe
-
Size
472KB
-
MD5
f86b7599b09ad4efbf902a782bc85ab0
-
SHA1
836e08ae37e5ddfba4cf4699a9e3e7346b099cf3
-
SHA256
ecf9aba40ce3a9353a396ecb294b8407e98efbc00e7f76a50d2ca3e6cb4e49b6
-
SHA512
315d759423e2bcd5748c1416f2562198c1eaca6ace6a52143d7da64240acb31f6e860f56b5cb67eee069fa22b7126cf8bb832a9943676e267d4139a8513f6657
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF2a:I7TcfNWj168w1VjsyvhNFF2a
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/64-12-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4436-17-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2552-19-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4020-4-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/984-27-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3960-35-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3096-43-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/700-49-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2220-59-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1944-64-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3692-73-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3200-70-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2344-83-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2384-89-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2688-82-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1868-100-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1620-97-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2124-108-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5060-111-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1940-125-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1304-132-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/916-150-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5100-156-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3656-160-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1512-148-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2024-139-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2272-171-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1640-175-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/564-127-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4164-182-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4928-191-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2116-194-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2180-200-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3336-205-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2300-209-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1384-217-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4156-220-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3364-245-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2708-260-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2896-261-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4636-267-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/804-280-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4500-287-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2632-295-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3864-320-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3256-317-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1096-335-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4364-384-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3320-397-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1352-407-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1384-413-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1444-441-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2216-454-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1956-497-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1132-524-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5072-575-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3728-612-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2632-695-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1488-910-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4268-1008-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4316-1007-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2748-1036-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3904-1316-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3768-1531-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 64 rbhrxn.exe 2552 plnxdjn.exe 4436 dnltp.exe 984 rvxjxr.exe 2748 ndltp.exe 3960 hlbrbbb.exe 3096 tbxbxtl.exe 4656 xdjjh.exe 700 rbxxvp.exe 2220 tnfpxvr.exe 1944 xfbvffx.exe 3200 txtjvrd.exe 3692 ftjnbp.exe 2344 fftfdl.exe 2688 hflrp.exe 2384 fntdx.exe 1620 xxvhhp.exe 1868 jplthf.exe 2124 nnbvf.exe 5060 ntbtntb.exe 1748 hrnpvtp.exe 564 btnjpd.exe 1940 plnnt.exe 1304 fpjdn.exe 2024 hvfpv.exe 916 lnntrtp.exe 1512 pdfhhp.exe 5100 xjhpdh.exe 3656 vjnjjn.exe 2272 rbftpx.exe 1640 pfrpphf.exe 5072 nhltxrt.exe 4164 rdblnjt.exe 416 fbvhvn.exe 4892 jphdvr.exe 4928 hdhvdl.exe 2116 dtrrhbp.exe 4628 rxffpd.exe 2180 bvjdjx.exe 460 dpvhff.exe 3336 jxhfbjd.exe 2300 pvxpbx.exe 2900 xfflrpf.exe 1384 hblbvhf.exe 4156 ndjtntx.exe 4912 pbrvlj.exe 4256 llbxdrp.exe 2044 xbpff.exe 4376 hvltjxd.exe 1528 fvxtj.exe 2752 fvjjpb.exe 4436 jnvpdjv.exe 4776 jtxlhxd.exe 3364 jrvplv.exe 4180 blvbff.exe 1680 vfrtpvr.exe 424 prnldl.exe 2708 dndflx.exe 2896 rrblnf.exe 4636 rjfxbbr.exe 4480 nxtbrhb.exe 2580 fblpfrl.exe 560 lhvtv.exe 804 fjfxdj.exe -
resource yara_rule behavioral2/memory/64-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/64-12-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2552-11-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4436-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2552-19-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4020-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/984-27-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3960-35-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3096-43-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/700-49-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2220-59-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1944-64-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3692-73-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3200-70-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2344-83-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2384-89-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2688-82-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1868-100-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1620-97-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2124-108-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5060-111-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1940-125-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1304-132-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/916-150-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5100-156-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3656-160-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1512-148-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2024-139-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2272-171-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1640-175-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/564-127-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4164-182-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4928-191-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2116-194-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2180-200-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3336-205-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2300-209-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1384-217-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4156-220-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3364-245-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2708-260-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2896-261-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4636-267-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/804-280-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4500-287-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2632-295-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3864-320-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3256-317-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1748-327-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1096-335-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4364-384-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3320-397-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1352-407-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1384-413-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1444-441-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2216-454-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1956-497-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3380-517-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1132-524-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5072-575-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3728-612-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2632-695-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1488-910-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1164-921-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 64 4020 f86b7599b09ad4efbf902a782bc85ab0_JC.exe 83 PID 4020 wrote to memory of 64 4020 f86b7599b09ad4efbf902a782bc85ab0_JC.exe 83 PID 4020 wrote to memory of 64 4020 f86b7599b09ad4efbf902a782bc85ab0_JC.exe 83 PID 64 wrote to memory of 2552 64 rbhrxn.exe 84 PID 64 wrote to memory of 2552 64 rbhrxn.exe 84 PID 64 wrote to memory of 2552 64 rbhrxn.exe 84 PID 2552 wrote to memory of 4436 2552 plnxdjn.exe 85 PID 2552 wrote to memory of 4436 2552 plnxdjn.exe 85 PID 2552 wrote to memory of 4436 2552 plnxdjn.exe 85 PID 4436 wrote to memory of 984 4436 dnltp.exe 86 PID 4436 wrote to memory of 984 4436 dnltp.exe 86 PID 4436 wrote to memory of 984 4436 dnltp.exe 86 PID 984 wrote to memory of 2748 984 rvxjxr.exe 87 PID 984 wrote to memory of 2748 984 rvxjxr.exe 87 PID 984 wrote to memory of 2748 984 rvxjxr.exe 87 PID 2748 wrote to memory of 3960 2748 ndltp.exe 88 PID 2748 wrote to memory of 3960 2748 ndltp.exe 88 PID 2748 wrote to memory of 3960 2748 ndltp.exe 88 PID 3960 wrote to memory of 3096 3960 hlbrbbb.exe 89 PID 3960 wrote to memory of 3096 3960 hlbrbbb.exe 89 PID 3960 wrote to memory of 3096 3960 hlbrbbb.exe 89 PID 3096 wrote to memory of 4656 3096 tbxbxtl.exe 90 PID 3096 wrote to memory of 4656 3096 tbxbxtl.exe 90 PID 3096 wrote to memory of 4656 3096 tbxbxtl.exe 90 PID 4656 wrote to memory of 700 4656 xdjjh.exe 91 PID 4656 wrote to memory of 700 4656 xdjjh.exe 91 PID 4656 wrote to memory of 700 4656 xdjjh.exe 91 PID 700 wrote to memory of 2220 700 rbxxvp.exe 92 PID 700 wrote to memory of 2220 700 rbxxvp.exe 92 PID 700 wrote to memory of 2220 700 rbxxvp.exe 92 PID 2220 wrote to memory of 1944 2220 tnfpxvr.exe 93 PID 2220 wrote to memory of 1944 2220 tnfpxvr.exe 93 PID 2220 wrote to memory of 1944 2220 tnfpxvr.exe 93 PID 1944 wrote to memory of 3200 1944 xfbvffx.exe 94 PID 1944 wrote to memory of 3200 1944 xfbvffx.exe 94 PID 1944 wrote to memory of 3200 1944 xfbvffx.exe 94 PID 3200 wrote to memory of 3692 3200 txtjvrd.exe 95 PID 3200 wrote to memory of 3692 3200 txtjvrd.exe 95 PID 3200 wrote to memory of 3692 3200 txtjvrd.exe 95 PID 3692 wrote to memory of 2344 3692 ftjnbp.exe 96 PID 3692 wrote to memory of 2344 3692 ftjnbp.exe 96 PID 3692 wrote to memory of 2344 3692 ftjnbp.exe 96 PID 2344 wrote to memory of 2688 2344 fftfdl.exe 97 PID 2344 wrote to memory of 2688 2344 fftfdl.exe 97 PID 2344 wrote to memory of 2688 2344 fftfdl.exe 97 PID 2688 wrote to memory of 2384 2688 hflrp.exe 99 PID 2688 wrote to memory of 2384 2688 hflrp.exe 99 PID 2688 wrote to memory of 2384 2688 hflrp.exe 99 PID 2384 wrote to memory of 1620 2384 fntdx.exe 98 PID 2384 wrote to memory of 1620 2384 fntdx.exe 98 PID 2384 wrote to memory of 1620 2384 fntdx.exe 98 PID 1620 wrote to memory of 1868 1620 xxvhhp.exe 100 PID 1620 wrote to memory of 1868 1620 xxvhhp.exe 100 PID 1620 wrote to memory of 1868 1620 xxvhhp.exe 100 PID 1868 wrote to memory of 2124 1868 jplthf.exe 101 PID 1868 wrote to memory of 2124 1868 jplthf.exe 101 PID 1868 wrote to memory of 2124 1868 jplthf.exe 101 PID 2124 wrote to memory of 5060 2124 nnbvf.exe 102 PID 2124 wrote to memory of 5060 2124 nnbvf.exe 102 PID 2124 wrote to memory of 5060 2124 nnbvf.exe 102 PID 5060 wrote to memory of 1748 5060 ntbtntb.exe 103 PID 5060 wrote to memory of 1748 5060 ntbtntb.exe 103 PID 5060 wrote to memory of 1748 5060 ntbtntb.exe 103 PID 1748 wrote to memory of 564 1748 hrnpvtp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f86b7599b09ad4efbf902a782bc85ab0_JC.exe"C:\Users\Admin\AppData\Local\Temp\f86b7599b09ad4efbf902a782bc85ab0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\rbhrxn.exec:\rbhrxn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\plnxdjn.exec:\plnxdjn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dnltp.exec:\dnltp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\rvxjxr.exec:\rvxjxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\ndltp.exec:\ndltp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\hlbrbbb.exec:\hlbrbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\tbxbxtl.exec:\tbxbxtl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\xdjjh.exec:\xdjjh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\rbxxvp.exec:\rbxxvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\tnfpxvr.exec:\tnfpxvr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xfbvffx.exec:\xfbvffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\txtjvrd.exec:\txtjvrd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\ftjnbp.exec:\ftjnbp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\fftfdl.exec:\fftfdl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\hflrp.exec:\hflrp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fntdx.exec:\fntdx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\xxvhhp.exec:\xxvhhp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jplthf.exec:\jplthf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\nnbvf.exec:\nnbvf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ntbtntb.exec:\ntbtntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\hrnpvtp.exec:\hrnpvtp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\btnjpd.exec:\btnjpd.exe6⤵
- Executes dropped EXE
PID:564 -
\??\c:\plnnt.exec:\plnnt.exe7⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fpjdn.exec:\fpjdn.exe8⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hvfpv.exec:\hvfpv.exe9⤵
- Executes dropped EXE
PID:2024
-
-
-
-
-
-
-
-
-
\??\c:\lnntrtp.exec:\lnntrtp.exe1⤵
- Executes dropped EXE
PID:916 -
\??\c:\pdfhhp.exec:\pdfhhp.exe2⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xjhpdh.exec:\xjhpdh.exe3⤵
- Executes dropped EXE
PID:5100
-
-
-
\??\c:\rbftpx.exec:\rbftpx.exe1⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pfrpphf.exec:\pfrpphf.exe2⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nhltxrt.exec:\nhltxrt.exe3⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rdblnjt.exec:\rdblnjt.exe4⤵
- Executes dropped EXE
PID:4164 -
\??\c:\fbvhvn.exec:\fbvhvn.exe5⤵
- Executes dropped EXE
PID:416 -
\??\c:\jphdvr.exec:\jphdvr.exe6⤵
- Executes dropped EXE
PID:4892 -
\??\c:\hdhvdl.exec:\hdhvdl.exe7⤵
- Executes dropped EXE
PID:4928
-
-
-
-
-
-
-
\??\c:\vjnjjn.exec:\vjnjjn.exe1⤵
- Executes dropped EXE
PID:3656
-
\??\c:\dtrrhbp.exec:\dtrrhbp.exe1⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rxffpd.exec:\rxffpd.exe2⤵
- Executes dropped EXE
PID:4628 -
\??\c:\bvjdjx.exec:\bvjdjx.exe3⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dpvhff.exec:\dpvhff.exe4⤵
- Executes dropped EXE
PID:460 -
\??\c:\jxhfbjd.exec:\jxhfbjd.exe5⤵
- Executes dropped EXE
PID:3336 -
\??\c:\pvxpbx.exec:\pvxpbx.exe6⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xfflrpf.exec:\xfflrpf.exe7⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hblbvhf.exec:\hblbvhf.exe8⤵
- Executes dropped EXE
PID:1384 -
\??\c:\ndjtntx.exec:\ndjtntx.exe9⤵
- Executes dropped EXE
PID:4156 -
\??\c:\pbrvlj.exec:\pbrvlj.exe10⤵
- Executes dropped EXE
PID:4912 -
\??\c:\llbxdrp.exec:\llbxdrp.exe11⤵
- Executes dropped EXE
PID:4256 -
\??\c:\xbpff.exec:\xbpff.exe12⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hvltjxd.exec:\hvltjxd.exe13⤵
- Executes dropped EXE
PID:4376 -
\??\c:\fvxtj.exec:\fvxtj.exe14⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fvjjpb.exec:\fvjjpb.exe15⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jnvpdjv.exec:\jnvpdjv.exe16⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jtxlhxd.exec:\jtxlhxd.exe17⤵
- Executes dropped EXE
PID:4776 -
\??\c:\jrvplv.exec:\jrvplv.exe18⤵
- Executes dropped EXE
PID:3364 -
\??\c:\blvbff.exec:\blvbff.exe19⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vfrtpvr.exec:\vfrtpvr.exe20⤵
- Executes dropped EXE
PID:1680 -
\??\c:\prnldl.exec:\prnldl.exe21⤵
- Executes dropped EXE
PID:424 -
\??\c:\dndflx.exec:\dndflx.exe22⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rrblnf.exec:\rrblnf.exe23⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rjfxbbr.exec:\rjfxbbr.exe24⤵
- Executes dropped EXE
PID:4636 -
\??\c:\nxtbrhb.exec:\nxtbrhb.exe25⤵
- Executes dropped EXE
PID:4480 -
\??\c:\fblpfrl.exec:\fblpfrl.exe26⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lhvtv.exec:\lhvtv.exe27⤵
- Executes dropped EXE
PID:560 -
\??\c:\fjfxdj.exec:\fjfxdj.exe28⤵
- Executes dropped EXE
PID:804 -
\??\c:\btfbjlf.exec:\btfbjlf.exe29⤵PID:2608
-
\??\c:\vfxhhn.exec:\vfxhhn.exe30⤵PID:4500
-
\??\c:\ltptd.exec:\ltptd.exe31⤵PID:3800
-
\??\c:\jjlpvn.exec:\jjlpvn.exe32⤵PID:3212
-
\??\c:\lfjffb.exec:\lfjffb.exe33⤵PID:2632
-
\??\c:\lxfrrd.exec:\lxfrrd.exe34⤵PID:2688
-
\??\c:\bfrpf.exec:\bfrpf.exe35⤵PID:4836
-
\??\c:\jpntvtv.exec:\jpntvtv.exe36⤵PID:2404
-
\??\c:\vxhrbp.exec:\vxhrbp.exe37⤵PID:1620
-
\??\c:\jbbvxtb.exec:\jbbvxtb.exe38⤵PID:1868
-
\??\c:\bhvhvd.exec:\bhvhvd.exe39⤵PID:3864
-
\??\c:\ffvvvt.exec:\ffvvvt.exe40⤵PID:3256
-
\??\c:\btvflb.exec:\btvflb.exe41⤵PID:404
-
\??\c:\ndxbrv.exec:\ndxbrv.exe42⤵PID:5112
-
\??\c:\btrdj.exec:\btrdj.exe43⤵PID:1748
-
\??\c:\rrbplv.exec:\rrbplv.exe44⤵PID:1096
-
\??\c:\rrdljf.exec:\rrdljf.exe45⤵PID:2656
-
\??\c:\vbdvpb.exec:\vbdvpb.exe46⤵PID:3492
-
\??\c:\pnnxf.exec:\pnnxf.exe47⤵PID:4800
-
\??\c:\bxrtd.exec:\bxrtd.exe48⤵PID:4904
-
\??\c:\fjthbj.exec:\fjthbj.exe49⤵PID:4128
-
\??\c:\fxhlft.exec:\fxhlft.exe50⤵PID:2716
-
\??\c:\jnrdhh.exec:\jnrdhh.exe51⤵PID:1300
-
\??\c:\dpnrl.exec:\dpnrl.exe52⤵PID:2132
-
\??\c:\djbfbx.exec:\djbfbx.exe53⤵PID:2212
-
\??\c:\pbdtnpb.exec:\pbdtnpb.exe54⤵PID:2576
-
\??\c:\pfxvvr.exec:\pfxvvr.exe55⤵PID:4616
-
\??\c:\bnfnpp.exec:\bnfnpp.exe56⤵PID:4524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\dpbvf.exec:\dpbvf.exe1⤵PID:2868
-
\??\c:\hpntfh.exec:\hpntfh.exe2⤵PID:4508
-
\??\c:\xndlp.exec:\xndlp.exe3⤵PID:416
-
\??\c:\jrrhd.exec:\jrrhd.exe4⤵PID:4364
-
\??\c:\phljplf.exec:\phljplf.exe5⤵PID:4928
-
\??\c:\xbprt.exec:\xbprt.exe6⤵PID:2116
-
\??\c:\jxvdf.exec:\jxvdf.exe7⤵PID:4816
-
\??\c:\dvfvn.exec:\dvfvn.exe8⤵PID:3320
-
\??\c:\jtljp.exec:\jtljp.exe9⤵PID:2744
-
\??\c:\ptjldtl.exec:\ptjldtl.exe10⤵PID:808
-
\??\c:\vhffp.exec:\vhffp.exe11⤵PID:3076
-
\??\c:\nttxd.exec:\nttxd.exe12⤵PID:1352
-
\??\c:\bpfnvrj.exec:\bpfnvrj.exe13⤵PID:1384
-
\??\c:\ndxtxr.exec:\ndxtxr.exe14⤵PID:4156
-
\??\c:\bbfbx.exec:\bbfbx.exe15⤵PID:4232
-
\??\c:\flrbv.exec:\flrbv.exe16⤵PID:3676
-
\??\c:\nbjlv.exec:\nbjlv.exe17⤵PID:3532
-
\??\c:\vvxtbbl.exec:\vvxtbbl.exe18⤵PID:1160
-
\??\c:\pfrnn.exec:\pfrnn.exe19⤵PID:3820
-
\??\c:\ftbvv.exec:\ftbvv.exe20⤵PID:3732
-
\??\c:\thffh.exec:\thffh.exe21⤵PID:3500
-
\??\c:\ldvffb.exec:\ldvffb.exe22⤵PID:1444
-
\??\c:\trjhhrh.exec:\trjhhrh.exe23⤵PID:4920
-
\??\c:\rdbnx.exec:\rdbnx.exe24⤵PID:2748
-
\??\c:\xnxjj.exec:\xnxjj.exe25⤵PID:4704
-
\??\c:\vfvtxvl.exec:\vfvtxvl.exe26⤵PID:2216
-
\??\c:\dljllvt.exec:\dljllvt.exe27⤵PID:1732
-
\??\c:\dphxvf.exec:\dphxvf.exe28⤵PID:2896
-
\??\c:\fdnxb.exec:\fdnxb.exe29⤵PID:1392
-
\??\c:\xbrrbpd.exec:\xbrrbpd.exe30⤵PID:944
-
\??\c:\rrxhjt.exec:\rrxhjt.exe31⤵PID:5048
-
\??\c:\djxxb.exec:\djxxb.exe32⤵PID:4168
-
\??\c:\rjxnt.exec:\rjxnt.exe33⤵PID:4200
-
\??\c:\htltvrn.exec:\htltvrn.exe34⤵PID:1272
-
\??\c:\dlxbv.exec:\dlxbv.exe35⤵PID:2776
-
\??\c:\dvvvth.exec:\dvvvth.exe36⤵PID:4676
-
\??\c:\dbxrv.exec:\dbxrv.exe37⤵PID:4036
-
\??\c:\jttrrl.exec:\jttrrl.exe38⤵PID:2692
-
\??\c:\vvxbvxn.exec:\vvxbvxn.exe39⤵PID:3920
-
\??\c:\pdpbbd.exec:\pdpbbd.exe40⤵PID:1956
-
\??\c:\ljhth.exec:\ljhth.exe41⤵PID:1252
-
\??\c:\phnhb.exec:\phnhb.exe42⤵PID:2052
-
\??\c:\xhfpp.exec:\xhfpp.exe43⤵PID:4284
-
\??\c:\nxttvf.exec:\nxttvf.exe44⤵PID:4332
-
\??\c:\drlrbd.exec:\drlrbd.exe45⤵PID:4212
-
\??\c:\dnfjfj.exec:\dnfjfj.exe46⤵PID:2936
-
\??\c:\lhtxr.exec:\lhtxr.exe47⤵PID:3380
-
\??\c:\fvhtbv.exec:\fvhtbv.exe48⤵PID:1132
-
\??\c:\jnrnl.exec:\jnrnl.exe49⤵PID:1304
-
\??\c:\tftpv.exec:\tftpv.exe50⤵PID:1096
-
\??\c:\hxbdnn.exec:\hxbdnn.exe51⤵PID:3352
-
\??\c:\pfrljl.exec:\pfrljl.exe52⤵PID:1380
-
\??\c:\lntfxv.exec:\lntfxv.exe53⤵PID:5080
-
\??\c:\jrfvrx.exec:\jrfvrx.exe54⤵PID:3592
-
\??\c:\jbpvd.exec:\jbpvd.exe55⤵PID:3876
-
\??\c:\rrvvtld.exec:\rrvvtld.exe56⤵PID:4652
-
\??\c:\nrhbf.exec:\nrhbf.exe57⤵PID:916
-
\??\c:\rhbrh.exec:\rhbrh.exe58⤵PID:220
-
\??\c:\jpbbr.exec:\jpbbr.exe59⤵PID:2716
-
\??\c:\xbtbbpb.exec:\xbtbbpb.exe60⤵PID:1832
-
\??\c:\xhdhrrh.exec:\xhdhrrh.exe61⤵PID:236
-
\??\c:\nfhfxld.exec:\nfhfxld.exe62⤵PID:4880
-
\??\c:\btntvtn.exec:\btntvtn.exe63⤵PID:2712
-
\??\c:\xljdl.exec:\xljdl.exe64⤵PID:3988
-
\??\c:\bdfhn.exec:\bdfhn.exe65⤵PID:5072
-
\??\c:\npjjl.exec:\npjjl.exe66⤵PID:2176
-
\??\c:\nfrftd.exec:\nfrftd.exe67⤵PID:3372
-
\??\c:\rllnbr.exec:\rllnbr.exe68⤵PID:3312
-
\??\c:\rfprvt.exec:\rfprvt.exe69⤵PID:1572
-
\??\c:\dlbjl.exec:\dlbjl.exe70⤵PID:4928
-
\??\c:\jtlhdjr.exec:\jtlhdjr.exe71⤵PID:2116
-
\??\c:\bpfnxpn.exec:\bpfnxpn.exe72⤵PID:4816
-
\??\c:\xrxxxdl.exec:\xrxxxdl.exe73⤵PID:3648
-
\??\c:\tvjjddv.exec:\tvjjddv.exe74⤵PID:3336
-
\??\c:\fttdlt.exec:\fttdlt.exe75⤵PID:4120
-
\??\c:\hjpjnx.exec:\hjpjnx.exe76⤵PID:3076
-
\??\c:\pdtpn.exec:\pdtpn.exe77⤵PID:4512
-
\??\c:\pljfbl.exec:\pljfbl.exe78⤵PID:3728
-
\??\c:\rfnppxh.exec:\rfnppxh.exe79⤵PID:1236
-
\??\c:\plrjl.exec:\plrjl.exe80⤵PID:2044
-
\??\c:\dtfpnfh.exec:\dtfpnfh.exe81⤵PID:1344
-
\??\c:\vhxhf.exec:\vhxhf.exe82⤵PID:4376
-
\??\c:\rbttr.exec:\rbttr.exe83⤵PID:3724
-
\??\c:\bxbbtd.exec:\bxbbtd.exe84⤵PID:768
-
\??\c:\rlnllxv.exec:\rlnllxv.exe85⤵PID:4436
-
\??\c:\nrhvr.exec:\nrhvr.exe86⤵PID:4776
-
\??\c:\bjbnjdp.exec:\bjbnjdp.exe87⤵PID:3364
-
\??\c:\flvbjrv.exec:\flvbjrv.exe88⤵PID:5084
-
\??\c:\frpfdn.exec:\frpfdn.exe89⤵PID:1188
-
\??\c:\nhbpr.exec:\nhbpr.exe90⤵PID:1440
-
\??\c:\bbfvbbh.exec:\bbfvbbh.exe91⤵PID:2916
-
\??\c:\ddfxrjn.exec:\ddfxrjn.exe92⤵PID:3356
-
\??\c:\fffdp.exec:\fffdp.exe93⤵PID:700
-
\??\c:\tbblxdr.exec:\tbblxdr.exe94⤵PID:4636
-
\??\c:\hfrttnh.exec:\hfrttnh.exe95⤵PID:2500
-
\??\c:\blvlj.exec:\blvlj.exe96⤵PID:2472
-
\??\c:\prnfv.exec:\prnfv.exe97⤵PID:3636
-
\??\c:\vnhxpb.exec:\vnhxpb.exe98⤵PID:3560
-
\??\c:\tbbpb.exec:\tbbpb.exe99⤵PID:3220
-
\??\c:\pdnbrrn.exec:\pdnbrrn.exe100⤵PID:4500
-
\??\c:\jrlbx.exec:\jrlbx.exe101⤵PID:3908
-
\??\c:\nfhvp.exec:\nfhvp.exe102⤵PID:3800
-
\??\c:\llndvbd.exec:\llndvbd.exe103⤵PID:2536
-
\??\c:\lfrtjjh.exec:\lfrtjjh.exe104⤵PID:2632
-
\??\c:\nxhxvrv.exec:\nxhxvrv.exe105⤵PID:4024
-
\??\c:\jhhltf.exec:\jhhltf.exe106⤵PID:4564
-
\??\c:\vdbhhdl.exec:\vdbhhdl.exe107⤵PID:4868
-
\??\c:\xxxljf.exec:\xxxljf.exe108⤵PID:1288
-
\??\c:\nfvlr.exec:\nfvlr.exe109⤵PID:2368
-
\??\c:\btrvbp.exec:\btrvbp.exe110⤵PID:3864
-
\??\c:\jbjbd.exec:\jbjbd.exe111⤵PID:844
-
\??\c:\fjlpj.exec:\fjlpj.exe112⤵PID:1932
-
\??\c:\xlnxhn.exec:\xlnxhn.exe113⤵PID:3260
-
\??\c:\brxdn.exec:\brxdn.exe114⤵PID:1756
-
\??\c:\hdljtn.exec:\hdljtn.exe115⤵PID:4072
-
\??\c:\tfjtd.exec:\tfjtd.exe116⤵PID:4760
-
\??\c:\frltbdr.exec:\frltbdr.exe117⤵PID:1292
-
\??\c:\jjfptff.exec:\jjfptff.exe118⤵PID:4788
-
\??\c:\rljldhv.exec:\rljldhv.exe119⤵PID:3708
-
\??\c:\ffbjddx.exec:\ffbjddx.exe120⤵PID:1780
-
\??\c:\vdfttbt.exec:\vdfttbt.exe121⤵PID:3592
-
\??\c:\bftfrp.exec:\bftfrp.exe122⤵PID:1492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-