Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 18:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.817a5f9e187de87149c31f39f3688c70.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
NEAS.817a5f9e187de87149c31f39f3688c70.exe
-
Size
94KB
-
MD5
817a5f9e187de87149c31f39f3688c70
-
SHA1
b090b4cee1629c4b7822571951dbe7f8b48a9c15
-
SHA256
eb442cc4599239a901e6d9dc4e73234c3cffd9c73a88d2fd4599bdc1cc7fef1b
-
SHA512
e2d3dc78594a0e1c84f0d45dee59108792c85bdd0b2572e87c0936b2897202bca3b93aca54f279d621957a83ff450fa02268ee33c93ccfdf7a9b78aae4d36512
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7MJeS051zTtglh78q4:ymb3NkkiQ3mdBjFo7oefXKLY9
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral1/memory/1120-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1120 jxprhnl.exe 2648 lbhvnh.exe 2612 hjdnl.exe 2372 bprvdl.exe 2432 jddtb.exe 2600 brvvb.exe 2416 htttbxd.exe 476 rnjrvhf.exe 2820 lbpfp.exe 1388 dxpvff.exe 2904 jdlxbb.exe 2756 nxphtj.exe 2176 vpfdnrn.exe 1984 lxpnhbv.exe 2860 pftvtpd.exe 1580 ltxllpp.exe 1504 jjvdr.exe 2356 pxvjh.exe 2848 ljrdth.exe 3068 pxrtb.exe 1872 hdftpl.exe 2940 bhvxjf.exe 1780 lptftv.exe 2192 xrvlr.exe 968 ffhfx.exe 1656 ldpntbp.exe 1472 ppbjphd.exe 872 vxjpxh.exe 840 bbfdr.exe 2380 vhjlvvt.exe 2096 dptvv.exe 2580 ddxrhdl.exe 2720 dntrtb.exe 2640 jnfpxh.exe 2596 hnhxh.exe 2372 bprvdl.exe 3004 nfhvnrj.exe 2436 pbxbt.exe 1360 rtfbjjd.exe 2416 htttbxd.exe 2856 xnvxn.exe 2788 txlvnvl.exe 1276 pjfpv.exe 2500 hbxppnn.exe 1736 vdxbfhp.exe 2764 jdnhff.exe 2016 dbrlxjf.exe 1576 tlfth.exe 2808 ttvnn.exe 1640 rpxrhp.exe 1744 xfndfb.exe 2320 ntjhllh.exe 2392 njbrx.exe 2108 xrblj.exe 2912 xprfd.exe 640 thrjrxh.exe 1872 hdftpl.exe 1536 nhjhpjn.exe 2972 pdvnv.exe 1212 bbjft.exe 1888 flltr.exe 1676 pflvpn.exe 2216 thdjbfh.exe 1980 xxpvh.exe -
resource yara_rule behavioral1/memory/2736-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-415-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1388-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 1120 2736 NEAS.817a5f9e187de87149c31f39f3688c70.exe 359 PID 2736 wrote to memory of 1120 2736 NEAS.817a5f9e187de87149c31f39f3688c70.exe 359 PID 2736 wrote to memory of 1120 2736 NEAS.817a5f9e187de87149c31f39f3688c70.exe 359 PID 2736 wrote to memory of 1120 2736 NEAS.817a5f9e187de87149c31f39f3688c70.exe 359 PID 1120 wrote to memory of 2648 1120 jxprhnl.exe 117 PID 1120 wrote to memory of 2648 1120 jxprhnl.exe 117 PID 1120 wrote to memory of 2648 1120 jxprhnl.exe 117 PID 1120 wrote to memory of 2648 1120 jxprhnl.exe 117 PID 2648 wrote to memory of 2612 2648 lbhvnh.exe 357 PID 2648 wrote to memory of 2612 2648 lbhvnh.exe 357 PID 2648 wrote to memory of 2612 2648 lbhvnh.exe 357 PID 2648 wrote to memory of 2612 2648 lbhvnh.exe 357 PID 2612 wrote to memory of 2372 2612 hjdnl.exe 355 PID 2612 wrote to memory of 2372 2612 hjdnl.exe 355 PID 2612 wrote to memory of 2372 2612 hjdnl.exe 355 PID 2612 wrote to memory of 2372 2612 rrfvxpx.exe 355 PID 2372 wrote to memory of 2432 2372 bprvdl.exe 353 PID 2372 wrote to memory of 2432 2372 bprvdl.exe 353 PID 2372 wrote to memory of 2432 2372 bprvdl.exe 353 PID 2372 wrote to memory of 2432 2372 bprvdl.exe 353 PID 2432 wrote to memory of 2600 2432 jddtb.exe 351 PID 2432 wrote to memory of 2600 2432 jddtb.exe 351 PID 2432 wrote to memory of 2600 2432 jddtb.exe 351 PID 2432 wrote to memory of 2600 2432 jddtb.exe 351 PID 2600 wrote to memory of 2416 2600 brvvb.exe 349 PID 2600 wrote to memory of 2416 2600 brvvb.exe 349 PID 2600 wrote to memory of 2416 2600 brvvb.exe 349 PID 2600 wrote to memory of 2416 2600 brvvb.exe 349 PID 2416 wrote to memory of 476 2416 htttbxd.exe 165 PID 2416 wrote to memory of 476 2416 htttbxd.exe 165 PID 2416 wrote to memory of 476 2416 htttbxd.exe 165 PID 2416 wrote to memory of 476 2416 htttbxd.exe 165 PID 476 wrote to memory of 2820 476 rnjrvhf.exe 346 PID 476 wrote to memory of 2820 476 rnjrvhf.exe 346 PID 476 wrote to memory of 2820 476 rnjrvhf.exe 346 PID 476 wrote to memory of 2820 476 rnjrvhf.exe 346 PID 2820 wrote to memory of 1388 2820 lbpfp.exe 345 PID 2820 wrote to memory of 1388 2820 lbpfp.exe 345 PID 2820 wrote to memory of 1388 2820 lbpfp.exe 345 PID 2820 wrote to memory of 1388 2820 lbpfp.exe 345 PID 1388 wrote to memory of 2904 1388 dxpvff.exe 17 PID 1388 wrote to memory of 2904 1388 dxpvff.exe 17 PID 1388 wrote to memory of 2904 1388 dxpvff.exe 17 PID 1388 wrote to memory of 2904 1388 dxpvff.exe 17 PID 2904 wrote to memory of 2756 2904 jdlxbb.exe 325 PID 2904 wrote to memory of 2756 2904 jdlxbb.exe 325 PID 2904 wrote to memory of 2756 2904 jdlxbb.exe 325 PID 2904 wrote to memory of 2756 2904 jdlxbb.exe 325 PID 2756 wrote to memory of 2176 2756 nxphtj.exe 19 PID 2756 wrote to memory of 2176 2756 nxphtj.exe 19 PID 2756 wrote to memory of 2176 2756 nxphtj.exe 19 PID 2756 wrote to memory of 2176 2756 nxphtj.exe 19 PID 2176 wrote to memory of 1984 2176 vpfdnrn.exe 340 PID 2176 wrote to memory of 1984 2176 vpfdnrn.exe 340 PID 2176 wrote to memory of 1984 2176 vpfdnrn.exe 340 PID 2176 wrote to memory of 1984 2176 vpfdnrn.exe 340 PID 1984 wrote to memory of 2860 1984 lxpnhbv.exe 342 PID 1984 wrote to memory of 2860 1984 lxpnhbv.exe 342 PID 1984 wrote to memory of 2860 1984 lxpnhbv.exe 342 PID 1984 wrote to memory of 2860 1984 lxpnhbv.exe 342 PID 2860 wrote to memory of 1580 2860 pftvtpd.exe 22 PID 2860 wrote to memory of 1580 2860 pftvtpd.exe 22 PID 2860 wrote to memory of 1580 2860 pftvtpd.exe 22 PID 2860 wrote to memory of 1580 2860 pftvtpd.exe 22
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.817a5f9e187de87149c31f39f3688c70.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.817a5f9e187de87149c31f39f3688c70.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jxprhnl.exec:\jxprhnl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120
-
-
\??\c:\rpxjv.exec:\rpxjv.exe1⤵PID:2648
-
\??\c:\jnjntx.exec:\jnjntx.exe2⤵PID:2068
-
\??\c:\ttdrjdn.exec:\ttdrjdn.exe3⤵PID:3048
-
-
-
\??\c:\bxtnplx.exec:\bxtnplx.exe1⤵PID:476
-
\??\c:\jdlxbb.exec:\jdlxbb.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ppnhrpp.exec:\ppnhrpp.exe2⤵PID:2756
-
\??\c:\vpfdnrn.exec:\vpfdnrn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\vbjjj.exec:\vbjjj.exe4⤵PID:1984
-
\??\c:\xvxdtjn.exec:\xvxdtjn.exe5⤵PID:2860
-
\??\c:\ltxllpp.exec:\ltxllpp.exe6⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hxnhdhv.exec:\hxnhdhv.exe7⤵PID:1504
-
\??\c:\rtrbhp.exec:\rtrbhp.exe8⤵PID:1476
-
-
-
-
-
-
-
\??\c:\dpttjfr.exec:\dpttjfr.exe3⤵PID:2692
-
-
-
\??\c:\pxrtb.exec:\pxrtb.exe1⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ptlpp.exec:\ptlpp.exe2⤵PID:1872
-
-
\??\c:\xbbbnlj.exec:\xbbbnlj.exe2⤵PID:1668
-
-
\??\c:\bhvxjf.exec:\bhvxjf.exe1⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lptftv.exec:\lptftv.exe2⤵
- Executes dropped EXE
PID:1780
-
-
\??\c:\xrfjnh.exec:\xrfjnh.exe2⤵PID:2300
-
-
\??\c:\ffhfx.exec:\ffhfx.exe1⤵
- Executes dropped EXE
PID:968 -
\??\c:\fxrfnd.exec:\fxrfnd.exe2⤵PID:1656
-
-
\??\c:\pvfjjjv.exec:\pvfjjjv.exe2⤵PID:1804
-
\??\c:\npjtj.exec:\npjtj.exe3⤵PID:860
-
\??\c:\xxhptxd.exec:\xxhptxd.exe4⤵PID:1656
-
\??\c:\hltndnb.exec:\hltndnb.exe5⤵PID:1212
-
\??\c:\bdhpdb.exec:\bdhpdb.exe6⤵PID:1596
-
-
\??\c:\xpxphx.exec:\xpxphx.exe6⤵PID:924
-
-
-
-
-
-
\??\c:\nrhdbjx.exec:\nrhdbjx.exe1⤵PID:2192
-
\??\c:\ljrdth.exec:\ljrdth.exe1⤵
- Executes dropped EXE
PID:2848
-
\??\c:\ppbjphd.exec:\ppbjphd.exe1⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bhdjxl.exec:\bhdjxl.exe2⤵PID:872
-
\??\c:\ntdbtb.exec:\ntdbtb.exe3⤵PID:840
-
\??\c:\xdpbx.exec:\xdpbx.exe4⤵PID:2380
-
\??\c:\httvxx.exec:\httvxx.exe5⤵PID:2096
-
-
\??\c:\dtxvnl.exec:\dtxvnl.exe5⤵PID:2340
-
\??\c:\xpxnd.exec:\xpxnd.exe6⤵PID:2300
-
\??\c:\phrxn.exec:\phrxn.exe7⤵PID:2468
-
\??\c:\jtbbn.exec:\jtbbn.exe8⤵PID:2084
-
-
-
-
\??\c:\dpfnr.exec:\dpfnr.exe6⤵PID:1904
-
-
-
-
\??\c:\hxbxjbl.exec:\hxbxjbl.exe4⤵PID:1288
-
-
-
-
\??\c:\ndjrh.exec:\ndjrh.exe1⤵PID:3004
-
\??\c:\brrdnb.exec:\brrdnb.exe2⤵PID:2436
-
-
\??\c:\tphpxl.exec:\tphpxl.exe1⤵PID:2372
-
\??\c:\jddtb.exec:\jddtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432
-
-
\??\c:\tndljrd.exec:\tndljrd.exe1⤵PID:2596
-
\??\c:\rtfbjjd.exec:\rtfbjjd.exe1⤵
- Executes dropped EXE
PID:1360 -
\??\c:\npbhp.exec:\npbhp.exe2⤵PID:2416
-
-
\??\c:\dbjtx.exec:\dbjtx.exe1⤵PID:2856
-
\??\c:\bbfjpx.exec:\bbfjpx.exe2⤵PID:2788
-
\??\c:\pjfpv.exec:\pjfpv.exe3⤵
- Executes dropped EXE
PID:1276
-
-
-
\??\c:\plfbnnp.exec:\plfbnnp.exe2⤵PID:2412
-
-
\??\c:\vdxbfhp.exec:\vdxbfhp.exe1⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pnbnhn.exec:\pnbnhn.exe2⤵PID:2764
-
-
\??\c:\dhrfpt.exec:\dhrfpt.exe1⤵PID:2016
-
\??\c:\tlfth.exec:\tlfth.exe2⤵
- Executes dropped EXE
PID:1576
-
-
\??\c:\tnbhnj.exec:\tnbhnj.exe2⤵PID:1940
-
\??\c:\dvjdnb.exec:\dvjdnb.exe3⤵PID:2764
-
-
-
\??\c:\blhdtln.exec:\blhdtln.exe1⤵PID:2808
-
\??\c:\rpxrhp.exec:\rpxrhp.exe2⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xlhlvd.exec:\xlhlvd.exe3⤵PID:1744
-
\??\c:\ntjhllh.exec:\ntjhllh.exe4⤵
- Executes dropped EXE
PID:2320 -
\??\c:\njbrx.exec:\njbrx.exe5⤵
- Executes dropped EXE
PID:2392
-
-
\??\c:\lvnbtdx.exec:\lvnbtdx.exe5⤵PID:2676
-
-
-
-
\??\c:\pbhnfnp.exec:\pbhnfnp.exe3⤵PID:2992
-
-
-
\??\c:\vppxjt.exec:\vppxjt.exe1⤵PID:2500
-
\??\c:\npldprj.exec:\npldprj.exe1⤵PID:2108
-
\??\c:\dtlvdx.exec:\dtlvdx.exe2⤵PID:2912
-
\??\c:\bfvrpv.exec:\bfvrpv.exe3⤵PID:640
-
-
-
\??\c:\xfpdd.exec:\xfpdd.exe2⤵PID:2968
-
\??\c:\lxlhn.exec:\lxlhn.exe3⤵PID:640
-
\??\c:\vnnvp.exec:\vnnvp.exe4⤵PID:2132
-
\??\c:\xhfddf.exec:\xhfddf.exe5⤵PID:620
-
-
-
\??\c:\nxrhrr.exec:\nxrhrr.exe4⤵PID:2304
-
\??\c:\xxhxf.exec:\xxhxf.exe5⤵PID:1536
-
\??\c:\lltdpj.exec:\lltdpj.exe6⤵PID:1988
-
-
-
-
-
-
\??\c:\xlddjv.exec:\xlddjv.exe1⤵PID:1872
-
\??\c:\dnbxnx.exec:\dnbxnx.exe2⤵PID:1536
-
\??\c:\ntfbj.exec:\ntfbj.exe3⤵PID:2972
-
\??\c:\jpljxbt.exec:\jpljxbt.exe4⤵PID:1548
-
\??\c:\xdrlj.exec:\xdrlj.exe5⤵PID:1828
-
-
-
-
\??\c:\xrvlr.exec:\xrvlr.exe3⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jtnntdd.exec:\jtnntdd.exe4⤵PID:1548
-
-
-
-
\??\c:\dfvbpl.exec:\dfvbpl.exe2⤵PID:2304
-
\??\c:\dtxlll.exec:\dtxlll.exe3⤵PID:1008
-
-
\??\c:\nhjhpjn.exec:\nhjhpjn.exe3⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vhvpj.exec:\vhvpj.exe4⤵PID:1656
-
\??\c:\xfbtp.exec:\xfbtp.exe5⤵PID:1828
-
-
-
-
-
\??\c:\dlndbjv.exec:\dlndbjv.exe1⤵PID:1888
-
\??\c:\nfhldb.exec:\nfhldb.exe2⤵PID:1676
-
\??\c:\vvrtl.exec:\vvrtl.exe3⤵PID:2216
-
-
-
\??\c:\xxpvh.exec:\xxpvh.exe1⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vphhxt.exec:\vphhxt.exe2⤵PID:564
-
-
\??\c:\vxjpxh.exec:\vxjpxh.exe1⤵
- Executes dropped EXE
PID:872 -
\??\c:\fhvfxd.exec:\fhvfxd.exe2⤵PID:840
-
-
\??\c:\xdprfbt.exec:\xdprfbt.exe1⤵PID:2300
-
\??\c:\hddtrh.exec:\hddtrh.exe2⤵PID:3044
-
\??\c:\ddxrhdl.exec:\ddxrhdl.exe3⤵
- Executes dropped EXE
PID:2580
-
-
-
\??\c:\brrrv.exec:\brrrv.exe1⤵PID:2464
-
\??\c:\hfhnf.exec:\hfhnf.exe2⤵PID:2064
-
-
\??\c:\tpxntpf.exec:\tpxntpf.exe1⤵PID:2412
-
\??\c:\jptfjh.exec:\jptfjh.exe2⤵PID:2836
-
-
\??\c:\lhrdhfp.exec:\lhrdhfp.exe2⤵PID:1168
-
\??\c:\xlxjxh.exec:\xlxjxh.exe3⤵PID:2788
-
\??\c:\lljxl.exec:\lljxl.exe4⤵PID:2688
-
\??\c:\xhrphjp.exec:\xhrphjp.exe5⤵PID:948
-
\??\c:\hhtlxv.exec:\hhtlxv.exe6⤵PID:2908
-
\??\c:\fxtfdxt.exec:\fxtfdxt.exe7⤵PID:2492
-
-
-
-
-
-
-
\??\c:\hvpbl.exec:\hvpbl.exe2⤵PID:3020
-
\??\c:\pbfxrt.exec:\pbfxrt.exe3⤵PID:2788
-
\??\c:\bbhxpfh.exec:\bbhxpfh.exe4⤵PID:2688
-
\??\c:\hnrtnn.exec:\hnrtnn.exe5⤵PID:680
-
\??\c:\vtxbpfp.exec:\vtxbpfp.exe6⤵PID:1948
-
\??\c:\pnlpjnf.exec:\pnlpjnf.exe7⤵PID:2748
-
-
-
-
\??\c:\vvnvljn.exec:\vvnvljn.exe5⤵PID:2664
-
-
-
-
\??\c:\xdlxx.exec:\xdlxx.exe3⤵PID:2688
-
-
-
\??\c:\tpllj.exec:\tpllj.exe1⤵PID:2520
-
\??\c:\ldlphn.exec:\ldlphn.exe2⤵PID:2868
-
-
\??\c:\rdlbv.exec:\rdlbv.exe1⤵PID:2900
-
\??\c:\hbxppnn.exec:\hbxppnn.exe2⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tvjhhh.exec:\tvjhhh.exe3⤵PID:2864
-
-
-
\??\c:\vljlb.exec:\vljlb.exe1⤵PID:1388
-
\??\c:\xldjbxh.exec:\xldjbxh.exe1⤵PID:2764
-
\??\c:\hxtxjt.exec:\hxtxjt.exe2⤵PID:2768
-
\??\c:\xdnnp.exec:\xdnnp.exe3⤵PID:2472
-
\??\c:\dtbjhjv.exec:\dtbjhjv.exe4⤵PID:1588
-
-
-
\??\c:\vvnbp.exec:\vvnbp.exe3⤵PID:1920
-
\??\c:\nrhdjrl.exec:\nrhdjrl.exe4⤵PID:2884
-
\??\c:\brhdjf.exec:\brhdjf.exe5⤵PID:1148
-
\??\c:\hpxjj.exec:\hpxjj.exe6⤵PID:2296
-
\??\c:\lnhxrxl.exec:\lnhxrxl.exe7⤵PID:1956
-
\??\c:\pltrd.exec:\pltrd.exe8⤵PID:2952
-
-
-
-
-
-
\??\c:\llppfdn.exec:\llppfdn.exe4⤵PID:844
-
-
-
-
\??\c:\pfjvpdp.exec:\pfjvpdp.exe2⤵PID:2768
-
\??\c:\rpxpb.exec:\rpxpb.exe3⤵PID:1364
-
\??\c:\xfndfb.exec:\xfndfb.exe4⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pbnxhh.exec:\pbnxhh.exe5⤵PID:2816
-
-
-
\??\c:\jbdfjh.exec:\jbdfjh.exe4⤵PID:2992
-
\??\c:\htlhpv.exec:\htlhpv.exe5⤵PID:2352
-
-
-
\??\c:\ldprrn.exec:\ldprrn.exe4⤵PID:2288
-
\??\c:\xhpfnvl.exec:\xhpfnvl.exe5⤵PID:1704
-
-
-
-
-
\??\c:\bpfnt.exec:\bpfnt.exe1⤵PID:2036
-
\??\c:\dhfrrr.exec:\dhfrrr.exe2⤵PID:3020
-
\??\c:\tdttdx.exec:\tdttdx.exe3⤵PID:324
-
-
-
\??\c:\tjtbvt.exec:\tjtbvt.exe1⤵PID:2448
-
\??\c:\bhddx.exec:\bhddx.exe1⤵PID:2712
-
\??\c:\pjnxxvv.exec:\pjnxxvv.exe2⤵PID:3012
-
-
\??\c:\xlpvpf.exec:\xlpvpf.exe1⤵PID:2944
-
\??\c:\ndpxl.exec:\ndpxl.exe1⤵PID:2068
-
\??\c:\jvfjj.exec:\jvfjj.exe1⤵PID:2652
-
\??\c:\bbjft.exec:\bbjft.exe1⤵
- Executes dropped EXE
PID:1212
-
\??\c:\hfnhvn.exec:\hfnhvn.exe1⤵PID:1644
-
\??\c:\vhplnjh.exec:\vhplnjh.exe2⤵PID:1756
-
\??\c:\vvphj.exec:\vvphj.exe3⤵PID:2128
-
\??\c:\njpvv.exec:\njpvv.exe4⤵PID:1976
-
\??\c:\bpfdp.exec:\bpfdp.exe5⤵PID:3064
-
\??\c:\rrdhbn.exec:\rrdhbn.exe6⤵PID:2304
-
-
-
-
-
\??\c:\fvpppdl.exec:\fvpppdl.exe3⤵PID:2528
-
\??\c:\rnxvbp.exec:\rnxvbp.exe4⤵PID:2608
-
-
-
-
\??\c:\dpbjdp.exec:\dpbjdp.exe1⤵PID:1732
-
\??\c:\jbfhr.exec:\jbfhr.exe2⤵PID:2356
-
\??\c:\lrrnvb.exec:\lrrnvb.exe3⤵PID:1012
-
\??\c:\jpbnh.exec:\jpbnh.exe4⤵PID:2104
-
\??\c:\ffxnlh.exec:\ffxnlh.exe5⤵PID:1976
-
\??\c:\hdftpl.exec:\hdftpl.exe6⤵
- Executes dropped EXE
PID:1872
-
-
-
-
-
-
\??\c:\ddrnhh.exec:\ddrnhh.exe1⤵PID:1100
-
\??\c:\xprfd.exec:\xprfd.exe2⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jrdhln.exec:\jrdhln.exe3⤵PID:1812
-
\??\c:\jjdjv.exec:\jjdjv.exe4⤵PID:2172
-
\??\c:\npfbxn.exec:\npfbxn.exe5⤵PID:1184
-
-
-
-
-
\??\c:\trvjf.exec:\trvjf.exe1⤵PID:1616
-
\??\c:\flvpv.exec:\flvpv.exe2⤵PID:944
-
\??\c:\ndprxjv.exec:\ndprxjv.exe3⤵PID:1888
-
\??\c:\llfdvd.exec:\llfdvd.exe4⤵PID:1676
-
\??\c:\nvvnnd.exec:\nvvnnd.exe5⤵PID:2116
-
\??\c:\jpxfp.exec:\jpxfp.exe6⤵PID:1900
-
\??\c:\bvjjfd.exec:\bvjjfd.exe7⤵PID:3060
-
-
-
-
-
\??\c:\nnftf.exec:\nnftf.exe4⤵PID:1184
-
\??\c:\nvfhx.exec:\nvfhx.exe5⤵PID:1716
-
-
-
-
-
\??\c:\rfnfh.exec:\rfnfh.exe1⤵PID:2640
-
\??\c:\dntrtb.exec:\dntrtb.exe1⤵
- Executes dropped EXE
PID:2720
-
\??\c:\ppnnv.exec:\ppnnv.exe1⤵PID:2652
-
\??\c:\jnrxl.exec:\jnrxl.exe2⤵PID:1904
-
\??\c:\xthxppn.exec:\xthxppn.exe3⤵PID:1972
-
\??\c:\xxrlrp.exec:\xxrlrp.exe4⤵PID:2624
-
-
\??\c:\pnfvltf.exec:\pnfvltf.exe4⤵PID:2068
-
-
-
\??\c:\jbnhnv.exec:\jbnhnv.exe3⤵PID:1284
-
\??\c:\ptnpdx.exec:\ptnpdx.exe4⤵PID:2588
-
-
-
\??\c:\xltrb.exec:\xltrb.exe3⤵PID:2704
-
-
-
\??\c:\vpvhlp.exec:\vpvhlp.exe2⤵PID:1304
-
\??\c:\jvnjpr.exec:\jvnjpr.exe3⤵PID:2004
-
-
-
\??\c:\bpfjd.exec:\bpfjd.exe1⤵PID:2524
-
\??\c:\lbhvnh.exec:\lbhvnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hjdnl.exec:\hjdnl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612
-
-
-
\??\c:\vjvptj.exec:\vjvptj.exe1⤵PID:2696
-
\??\c:\lxdtltx.exec:\lxdtltx.exe2⤵PID:3012
-
\??\c:\rpfdfl.exec:\rpfdfl.exe3⤵PID:2932
-
-
\??\c:\xprrh.exec:\xprrh.exe3⤵PID:716
-
-
-
\??\c:\pbxbt.exec:\pbxbt.exe1⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lhxtb.exec:\lhxtb.exe2⤵PID:2036
-
-
\??\c:\bbbdt.exec:\bbbdt.exe1⤵PID:1004
-
\??\c:\njjdpjp.exec:\njjdpjp.exe2⤵PID:2868
-
\??\c:\dlvpnvh.exec:\dlvpnvh.exe3⤵PID:2908
-
\??\c:\hnxvdlf.exec:\hnxvdlf.exe4⤵PID:1684
-
\??\c:\fflbjbj.exec:\fflbjbj.exe5⤵PID:1768
-
\??\c:\tvllt.exec:\tvllt.exe6⤵PID:460
-
\??\c:\xljhp.exec:\xljhp.exe7⤵PID:2684
-
-
\??\c:\ljjvh.exec:\ljjvh.exe7⤵PID:2420
-
\??\c:\hlvvn.exec:\hlvvn.exe8⤵PID:2044
-
-
-
-
\??\c:\drttv.exec:\drttv.exe6⤵PID:2760
-
\??\c:\vxlvb.exec:\vxlvb.exe7⤵PID:1400
-
\??\c:\nhtrtf.exec:\nhtrtf.exe8⤵PID:2688
-
-
-
-
-
-
-
-
\??\c:\drjphf.exec:\drjphf.exe1⤵PID:2768
-
\??\c:\ttjpnn.exec:\ttjpnn.exe1⤵PID:3044
-
\??\c:\vppjn.exec:\vppjn.exe2⤵PID:2428
-
\??\c:\pjntxx.exec:\pjntxx.exe3⤵PID:2596
-
-
\??\c:\ndxld.exec:\ndxld.exe3⤵PID:868
-
\??\c:\ndbph.exec:\ndbph.exe4⤵PID:2408
-
\??\c:\vnhnrx.exec:\vnhnrx.exe5⤵PID:3012
-
\??\c:\vjrff.exec:\vjrff.exe6⤵PID:2932
-
\??\c:\nprxttr.exec:\nprxttr.exe7⤵PID:2876
-
\??\c:\rfrtxxv.exec:\rfrtxxv.exe8⤵PID:708
-
\??\c:\rndnv.exec:\rndnv.exe9⤵PID:2640
-
-
-
-
-
-
-
\??\c:\plprl.exec:\plprl.exe4⤵PID:1156
-
-
-
-
\??\c:\bnjxp.exec:\bnjxp.exe1⤵PID:2400
-
\??\c:\ftxjf.exec:\ftxjf.exe2⤵PID:2112
-
\??\c:\jbprdr.exec:\jbprdr.exe3⤵PID:620
-
\??\c:\xftlxx.exec:\xftlxx.exe4⤵PID:1548
-
-
-
-
\??\c:\nplpvvd.exec:\nplpvvd.exe1⤵PID:648
-
\??\c:\bhxrnjd.exec:\bhxrnjd.exe2⤵PID:972
-
\??\c:\bdfllfx.exec:\bdfllfx.exe3⤵PID:968
-
-
-
\??\c:\tvfbt.exec:\tvfbt.exe1⤵PID:1184
-
\??\c:\nrhtfb.exec:\nrhtfb.exe2⤵PID:1616
-
\??\c:\bhtxxhd.exec:\bhtxxhd.exe3⤵PID:952
-
\??\c:\nvrpl.exec:\nvrpl.exe4⤵PID:896
-
\??\c:\jntbpt.exec:\jntbpt.exe5⤵PID:1516
-
-
-
\??\c:\bfjnfj.exec:\bfjnfj.exe4⤵PID:1128
-
-
-
\??\c:\trjhrth.exec:\trjhrth.exe3⤵PID:952
-
\??\c:\dnnjpl.exec:\dnnjpl.exe4⤵PID:600
-
\??\c:\hxhlt.exec:\hxhlt.exe5⤵PID:2652
-
-
-
-
-
\??\c:\vhxjxfn.exec:\vhxjxfn.exe2⤵PID:280
-
-
\??\c:\vlxht.exec:\vlxht.exe1⤵PID:2136
-
\??\c:\vpnppr.exec:\vpnppr.exe2⤵PID:600
-
-
\??\c:\btfjpb.exec:\btfjpb.exe1⤵PID:3060
-
\??\c:\hrpbt.exec:\hrpbt.exe2⤵PID:2340
-
-
\??\c:\jhxtvp.exec:\jhxtvp.exe1⤵PID:2444
-
\??\c:\ltxrv.exec:\ltxrv.exe2⤵PID:2592
-
-
\??\c:\pxfltph.exec:\pxfltph.exe1⤵PID:2632
-
\??\c:\ntrph.exec:\ntrph.exe1⤵PID:2712
-
\??\c:\rxjhpv.exec:\rxjhpv.exe2⤵PID:1600
-
\??\c:\ftxxnnl.exec:\ftxxnnl.exe3⤵PID:364
-
-
-
\??\c:\rnjrvhf.exec:\rnjrvhf.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\xnvrff.exec:\xnvrff.exe2⤵PID:3020
-
-
\??\c:\lbpfp.exec:\lbpfp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820
-
-
\??\c:\nnnvv.exec:\nnnvv.exe1⤵PID:2472
-
\??\c:\pnnblfp.exec:\pnnblfp.exe2⤵PID:1920
-
-
\??\c:\ndntdrl.exec:\ndntdrl.exe2⤵PID:1632
-
-
\??\c:\rpfrvt.exec:\rpfrvt.exe1⤵PID:2816
-
\??\c:\xhnxd.exec:\xhnxd.exe2⤵PID:2272
-
\??\c:\bttnn.exec:\bttnn.exe3⤵PID:1476
-
\??\c:\jdfxbjb.exec:\jdfxbjb.exe4⤵PID:2352
-
-
-
-
\??\c:\xrblj.exec:\xrblj.exe1⤵
- Executes dropped EXE
PID:2108
-
\??\c:\pxtjlpj.exec:\pxtjlpj.exe1⤵PID:1696
-
\??\c:\ddjpvht.exec:\ddjpvht.exe2⤵PID:1612
-
\??\c:\pxjrrf.exec:\pxjrrf.exe3⤵PID:2156
-
\??\c:\rndvrpv.exec:\rndvrpv.exe4⤵PID:2380
-
-
-
-
\??\c:\vbxbt.exec:\vbxbt.exe1⤵PID:952
-
\??\c:\tjlntpj.exec:\tjlntpj.exe2⤵PID:1128
-
\??\c:\tdppn.exec:\tdppn.exe3⤵PID:2012
-
-
-
\??\c:\rdnrpvp.exec:\rdnrpvp.exe1⤵PID:1184
-
\??\c:\bdxrb.exec:\bdxrb.exe1⤵PID:2396
-
\??\c:\tbflxlf.exec:\tbflxlf.exe1⤵PID:2448
-
\??\c:\pjpvph.exec:\pjpvph.exe2⤵PID:2812
-
-
\??\c:\vxxdxnb.exec:\vxxdxnb.exe1⤵PID:2792
-
\??\c:\vhxdln.exec:\vhxdln.exe2⤵PID:1460
-
\??\c:\xtxhnr.exec:\xtxhnr.exe3⤵PID:1524
-
-
-
\??\c:\vhpvd.exec:\vhpvd.exe2⤵PID:1692
-
-
\??\c:\xtnfp.exec:\xtnfp.exe1⤵PID:1184
-
\??\c:\bpbbxf.exec:\bpbbxf.exe2⤵PID:1616
-
-
\??\c:\vpvdrdb.exec:\vpvdrdb.exe1⤵PID:2352
-
\??\c:\ptfpjht.exec:\ptfpjht.exe2⤵PID:1012
-
\??\c:\hdpdrxh.exec:\hdpdrxh.exe3⤵PID:436
-
-
-
\??\c:\xlvnjhf.exec:\xlvnjhf.exe2⤵PID:400
-
\??\c:\vhlpblt.exec:\vhlpblt.exe3⤵PID:436
-
\??\c:\xbxxprx.exec:\xbxxprx.exe4⤵PID:2120
-
-
-
-
\??\c:\jjvdr.exec:\jjvdr.exe1⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pxvjh.exec:\pxvjh.exe2⤵
- Executes dropped EXE
PID:2356
-
-
\??\c:\xpxxxf.exec:\xpxxxf.exe1⤵PID:2792
-
\??\c:\vhjlvvt.exec:\vhjlvvt.exe1⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bptvjdn.exec:\bptvjdn.exe2⤵PID:2564
-
\??\c:\vlfjvf.exec:\vlfjvf.exe3⤵PID:2568
-
-
-
\??\c:\dvvfhd.exec:\dvvfhd.exe2⤵PID:2464
-
\??\c:\bvhrjlp.exec:\bvhrjlp.exe3⤵PID:2704
-
-
-
\??\c:\vxvtb.exec:\vxvtb.exe1⤵PID:2592
-
\??\c:\drvlrx.exec:\drvlrx.exe2⤵PID:2876
-
\??\c:\dxjppp.exec:\dxjppp.exe3⤵PID:2484
-
\??\c:\jxhphnt.exec:\jxhphnt.exe4⤵PID:1688
-
-
-
-
\??\c:\nbfrh.exec:\nbfrh.exe2⤵PID:2052
-
\??\c:\thvddjt.exec:\thvddjt.exe3⤵PID:3004
-
\??\c:\dtnln.exec:\dtnln.exe4⤵PID:324
-
-
-
-
\??\c:\pltlx.exec:\pltlx.exe1⤵PID:2724
-
\??\c:\hbhrtpr.exec:\hbhrtpr.exe1⤵PID:2004
-
\??\c:\nhnhfh.exec:\nhnhfh.exe2⤵PID:1748
-
-
\??\c:\nxjpb.exec:\nxjpb.exe1⤵PID:2596
-
\??\c:\xhlrppn.exec:\xhlrppn.exe2⤵PID:2600
-
\??\c:\htttbxd.exec:\htttbxd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416
-
-
-
\??\c:\lllltln.exec:\lllltln.exe2⤵PID:2460
-
-
\??\c:\fxpbt.exec:\fxpbt.exe1⤵PID:2836
-
\??\c:\hrlbv.exec:\hrlbv.exe2⤵PID:2844
-
-
\??\c:\vdxxv.exec:\vdxxv.exe1⤵PID:2484
-
\??\c:\fltlbl.exec:\fltlbl.exe1⤵PID:368
-
\??\c:\bjtntpb.exec:\bjtntpb.exe2⤵PID:2412
-
\??\c:\pdbdpx.exec:\pdbdpx.exe3⤵PID:1628
-
\??\c:\txlvnvl.exec:\txlvnvl.exe4⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pvhlfb.exec:\pvhlfb.exe5⤵PID:1456
-
-
\??\c:\hplhjr.exec:\hplhjr.exe5⤵PID:1628
-
\??\c:\tjndhx.exec:\tjndhx.exe6⤵PID:564
-
-
\??\c:\rhddnlv.exec:\rhddnlv.exe6⤵PID:2900
-
\??\c:\vhdrf.exec:\vhdrf.exe7⤵PID:2472
-
-
-
-
-
-
-
\??\c:\dlbfb.exec:\dlbfb.exe1⤵PID:2216
-
\??\c:\drrxf.exec:\drrxf.exe2⤵PID:1516
-
\??\c:\xxxvx.exec:\xxxvx.exe3⤵PID:1868
-
\??\c:\trfft.exec:\trfft.exe4⤵PID:1604
-
\??\c:\hxnrb.exec:\hxnrb.exe5⤵PID:2644
-
\??\c:\fvphhp.exec:\fvphhp.exe6⤵PID:876
-
\??\c:\txntpdr.exec:\txntpdr.exe7⤵PID:2716
-
\??\c:\lhrdd.exec:\lhrdd.exe8⤵PID:112
-
\??\c:\bfphtjv.exec:\bfphtjv.exe9⤵PID:2704
-
\??\c:\lxfvvt.exec:\lxfvvt.exe10⤵PID:2640
-
\??\c:\tfpplrr.exec:\tfpplrr.exe11⤵PID:3052
-
\??\c:\rhnbv.exec:\rhnbv.exe12⤵PID:1564
-
\??\c:\vdtdrd.exec:\vdtdrd.exe13⤵PID:2476
-
\??\c:\nfhvnrj.exec:\nfhvnrj.exe14⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vjnlx.exec:\vjnlx.exe15⤵PID:716
-
\??\c:\ltthdxv.exec:\ltthdxv.exe16⤵PID:1568
-
\??\c:\hjtrhvt.exec:\hjtrhvt.exe17⤵PID:1380
-
\??\c:\trnplx.exec:\trnplx.exe18⤵PID:1652
-
\??\c:\xvpbb.exec:\xvpbb.exe19⤵PID:2520
-
\??\c:\pphrvhp.exec:\pphrvhp.exe20⤵PID:2868
-
\??\c:\nlbfln.exec:\nlbfln.exe21⤵PID:2668
-
\??\c:\bvnvhx.exec:\bvnvhx.exe22⤵PID:2688
-
\??\c:\jvxhl.exec:\jvxhl.exe23⤵PID:2864
-
\??\c:\vlhdt.exec:\vlhdt.exe24⤵PID:1768
-
-
-
-
-
-
-
-
-
-
\??\c:\vnfndx.exec:\vnfndx.exe16⤵PID:1688
-
\??\c:\nxnlxjl.exec:\nxnlxjl.exe17⤵PID:2828
-
\??\c:\nffnnvl.exec:\nffnnvl.exe18⤵PID:2896
-
-
-
-
-
-
\??\c:\rtxtxd.exec:\rtxtxd.exe14⤵PID:2164
-
-
-
-
-
-
\??\c:\phhrl.exec:\phhrl.exe10⤵PID:2468
-
\??\c:\lxrtpxb.exec:\lxrtpxb.exe11⤵PID:3044
-
-
-
-
-
-
-
-
-
-
\??\c:\lxlbhr.exec:\lxlbhr.exe3⤵PID:1996
-
-
-
\??\c:\pvdjxhp.exec:\pvdjxhp.exe1⤵PID:1976
-
\??\c:\pfdddt.exec:\pfdddt.exe2⤵PID:280
-
\??\c:\jjtnn.exec:\jjtnn.exe3⤵PID:1996
-
\??\c:\fdbbxf.exec:\fdbbxf.exe4⤵PID:1472
-
\??\c:\rtxxrtf.exec:\rtxxrtf.exe5⤵PID:1660
-
\??\c:\tjlpx.exec:\tjlpx.exe6⤵PID:2328
-
-
\??\c:\dxdptx.exec:\dxdptx.exe6⤵PID:2004
-
\??\c:\fjdjdf.exec:\fjdjdf.exe7⤵PID:2588
-
\??\c:\pvbxbrd.exec:\pvbxbrd.exe8⤵PID:2636
-
\??\c:\xxlnxr.exec:\xxlnxr.exe9⤵PID:2544
-
\??\c:\vrntfn.exec:\vrntfn.exe10⤵PID:2284
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:896
-
\??\c:\rrhfrv.exec:\rrhfrv.exe1⤵PID:2016
-
\??\c:\flltr.exec:\flltr.exe1⤵
- Executes dropped EXE
PID:1888
-
\??\c:\pdvnv.exec:\pdvnv.exe1⤵
- Executes dropped EXE
PID:2972
-
\??\c:\thrjrxh.exec:\thrjrxh.exe1⤵
- Executes dropped EXE
PID:640
-
\??\c:\xxttn.exec:\xxttn.exe1⤵PID:2760
-
\??\c:\fvnfbl.exec:\fvnfbl.exe1⤵PID:2692
-
\??\c:\bprjh.exec:\bprjh.exe2⤵PID:540
-
-
\??\c:\xnvxn.exec:\xnvxn.exe1⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hpbrhj.exec:\hpbrhj.exe2⤵PID:1088
-
-
\??\c:\llplfx.exec:\llplfx.exe1⤵PID:2712
-
\??\c:\hnhxh.exec:\hnhxh.exe1⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fllxtdj.exec:\fllxtdj.exe2⤵PID:2508
-
-
\??\c:\pnljrr.exec:\pnljrr.exe1⤵PID:2076
-
\??\c:\bhdxnx.exec:\bhdxnx.exe1⤵PID:1904
-
\??\c:\lldxfnt.exec:\lldxfnt.exe1⤵PID:1304
-
\??\c:\nltfdx.exec:\nltfdx.exe2⤵PID:2720
-
\??\c:\rbdptlh.exec:\rbdptlh.exe3⤵PID:2084
-
\??\c:\pnbbrbt.exec:\pnbbrbt.exe4⤵PID:2704
-
\??\c:\xhdhtd.exec:\xhdhtd.exe5⤵PID:2612
-
\??\c:\tbndpx.exec:\tbndpx.exe6⤵PID:2488
-
\??\c:\dnfpn.exec:\dnfpn.exe7⤵PID:2160
-
\??\c:\pnllnf.exec:\pnllnf.exe8⤵PID:2596
-
-
-
-
-
\??\c:\thhpfxd.exec:\thhpfxd.exe5⤵PID:2784
-
\??\c:\xdldflt.exec:\xdldflt.exe6⤵PID:2780
-
-
-
-
-
\??\c:\ljhflld.exec:\ljhflld.exe3⤵PID:1980
-
\??\c:\nlthrf.exec:\nlthrf.exe4⤵PID:2380
-
-
-
-
\??\c:\jlvpbf.exec:\jlvpbf.exe1⤵PID:952
-
\??\c:\nxhdfv.exec:\nxhdfv.exe1⤵PID:1732
-
\??\c:\fnjlxfh.exec:\fnjlxfh.exe1⤵PID:1768
-
\??\c:\lxpnhbv.exec:\lxpnhbv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pftvtpd.exec:\pftvtpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\hbxfhhp.exec:\hbxfhhp.exe4⤵PID:2916
-
\??\c:\pvrdhdh.exec:\pvrdhdh.exe5⤵PID:1588
-
\??\c:\bfxdb.exec:\bfxdb.exe6⤵PID:1148
-
\??\c:\dvplx.exec:\dvplx.exe7⤵PID:2280
-
\??\c:\nvljhpl.exec:\nvljhpl.exe8⤵PID:1732
-
\??\c:\rdvrn.exec:\rdvrn.exe9⤵PID:2072
-
\??\c:\flxjx.exec:\flxjx.exe10⤵PID:2656
-
\??\c:\rrtpvff.exec:\rrtpvff.exe11⤵PID:1044
-
\??\c:\nlhvtn.exec:\nlhvtn.exe12⤵PID:1544
-
\??\c:\txdxxv.exec:\txdxxv.exe13⤵PID:648
-
\??\c:\nddvlb.exec:\nddvlb.exe14⤵PID:1056
-
\??\c:\vbpnr.exec:\vbpnr.exe15⤵PID:1408
-
\??\c:\ldpntbp.exec:\ldpntbp.exe16⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pflvpn.exec:\pflvpn.exe17⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nxpvdl.exec:\nxpvdl.exe18⤵PID:1232
-
\??\c:\hvbfphv.exec:\hvbfphv.exe19⤵PID:1936
-
\??\c:\pdvnx.exec:\pdvnx.exe20⤵PID:600
-
\??\c:\bbfdr.exec:\bbfdr.exe21⤵
- Executes dropped EXE
PID:840 -
\??\c:\dptvv.exec:\dptvv.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ptldx.exec:\ptldx.exe23⤵PID:868
-
\??\c:\tdhxpn.exec:\tdhxpn.exe24⤵PID:2300
-
\??\c:\npjlt.exec:\npjlt.exe25⤵PID:2348
-
\??\c:\rrfvxpx.exec:\rrfvxpx.exe26⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\bjpxnvx.exec:\bjpxnvx.exe27⤵PID:2452
-
\??\c:\jnfpxh.exec:\jnfpxh.exe28⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bprjfvx.exec:\bprjfvx.exe29⤵PID:2064
-
\??\c:\pbltt.exec:\pbltt.exe30⤵PID:2552
-
\??\c:\btxlhbh.exec:\btxlhbh.exe31⤵PID:528
-
\??\c:\vfrbvbf.exec:\vfrbvbf.exe32⤵PID:2036
-
\??\c:\pxxdxl.exec:\pxxdxl.exe33⤵PID:716
-
\??\c:\xbnnxhl.exec:\xbnnxhl.exe34⤵PID:1568
-
\??\c:\htbxpvp.exec:\htbxpvp.exe35⤵PID:1168
-
\??\c:\tdttf.exec:\tdttf.exe36⤵PID:1652
-
\??\c:\vbptn.exec:\vbptn.exe37⤵PID:2412
-
\??\c:\vrjbvh.exec:\vrjbvh.exe38⤵PID:948
-
\??\c:\rbjjhlp.exec:\rbjjhlp.exe39⤵PID:656
-
\??\c:\dhvplnt.exec:\dhvplnt.exe40⤵PID:1992
-
\??\c:\dbrlxjf.exec:\dbrlxjf.exe41⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ttvnn.exec:\ttvnn.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jdnhff.exec:\jdnhff.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rvhvj.exec:\rvhvj.exe44⤵PID:2860
-
\??\c:\rfltp.exec:\rfltp.exe45⤵PID:1944
-
\??\c:\fdpvv.exec:\fdpvv.exe46⤵PID:2792
-
\??\c:\bftfpbl.exec:\bftfpbl.exe47⤵PID:2356
-
\??\c:\dnttxvh.exec:\dnttxvh.exe48⤵PID:2280
-
\??\c:\xfxxfh.exec:\xfxxfh.exe49⤵PID:2848
-
\??\c:\fprjbj.exec:\fprjbj.exe50⤵PID:2072
-
\??\c:\xprxj.exec:\xprxj.exe51⤵PID:3064
-
\??\c:\rjnbf.exec:\rjnbf.exe52⤵PID:2960
-
\??\c:\lfvlrtd.exec:\lfvlrtd.exe53⤵PID:1780
-
\??\c:\ddldr.exec:\ddldr.exe54⤵PID:1928
-
\??\c:\hllbn.exec:\hllbn.exe55⤵PID:2396
-
\??\c:\dhphjhl.exec:\dhphjhl.exe56⤵PID:1828
-
\??\c:\bdhdb.exec:\bdhdb.exe57⤵PID:2024
-
\??\c:\thdjbfh.exec:\thdjbfh.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rpfnjr.exec:\rpfnjr.exe59⤵PID:1396
-
\??\c:\jrjdvvh.exec:\jrjdvvh.exe60⤵PID:1596
-
\??\c:\lrxtpdl.exec:\lrxtpdl.exe61⤵PID:952
-
\??\c:\jldtnr.exec:\jldtnr.exe62⤵PID:2644
-
\??\c:\pfftn.exec:\pfftn.exe63⤵PID:876
-
\??\c:\ttxlndb.exec:\ttxlndb.exe64⤵PID:2716
-
\??\c:\rvdjb.exec:\rvdjb.exe65⤵PID:2488
-
\??\c:\dhvxrt.exec:\dhvxrt.exe66⤵PID:2456
-
\??\c:\lxfxdrf.exec:\lxfxdrf.exe67⤵PID:2464
-
\??\c:\nhpddh.exec:\nhpddh.exe68⤵PID:2632
-
\??\c:\bxbfl.exec:\bxbfl.exe69⤵PID:2932
-
\??\c:\rhxfpf.exec:\rhxfpf.exe70⤵PID:2596
-
\??\c:\nptvfxr.exec:\nptvfxr.exe71⤵PID:2600
-
\??\c:\vlrvnf.exec:\vlrvnf.exe72⤵PID:528
-
\??\c:\ndpfd.exec:\ndpfd.exe73⤵PID:2832
-
\??\c:\lfvjxl.exec:\lfvjxl.exe74⤵PID:716
-
\??\c:\txflxp.exec:\txflxp.exe75⤵PID:2180
-
\??\c:\dxdpjlx.exec:\dxdpjlx.exe76⤵PID:1168
-
\??\c:\pfhbjt.exec:\pfhbjt.exe77⤵PID:576
-
\??\c:\tvplh.exec:\tvplh.exe78⤵PID:1632
-
\??\c:\vvlpvdv.exec:\vvlpvdv.exe79⤵PID:2492
-
\??\c:\dxfvpv.exec:\dxfvpv.exe80⤵PID:2864
-
\??\c:\xdllvrx.exec:\xdllvrx.exe81⤵PID:1992
-
\??\c:\vrllxv.exec:\vrllxv.exe82⤵PID:540
-
\??\c:\hhvbrdf.exec:\hhvbrdf.exe83⤵PID:2808
-
\??\c:\rttdlt.exec:\rttdlt.exe84⤵PID:1524
-
\??\c:\rlnpfb.exec:\rlnpfb.exe85⤵PID:844
-
\??\c:\ttnppd.exec:\ttnppd.exe86⤵PID:1920
-
\??\c:\tnnht.exec:\tnnht.exe87⤵PID:1664
-
\??\c:\tdnjjl.exec:\tdnjjl.exe88⤵PID:1692
-
\??\c:\nrtlhvd.exec:\nrtlhvd.exe89⤵PID:1476
-
\??\c:\vnvhpp.exec:\vnvhpp.exe90⤵PID:1788
-
\??\c:\nbjvtxn.exec:\nbjvtxn.exe91⤵PID:1812
-
\??\c:\fnbtdn.exec:\fnbtdn.exe92⤵PID:2172
-
\??\c:\ndpll.exec:\ndpll.exe93⤵PID:2008
-
\??\c:\xjllf.exec:\xjllf.exe94⤵PID:2120
-
\??\c:\vfxvbhf.exec:\vfxvbhf.exe95⤵PID:944
-
\??\c:\hjtpf.exec:\hjtpf.exe96⤵PID:1008
-
\??\c:\nxlbrj.exec:\nxlbrj.exe97⤵PID:1988
-
\??\c:\rtjdrbt.exec:\rtjdrbt.exe98⤵PID:2024
-
\??\c:\blnpnbf.exec:\blnpnbf.exe99⤵PID:1884
-
\??\c:\tjptld.exec:\tjptld.exe100⤵PID:1396
-
\??\c:\pdndtn.exec:\pdndtn.exe101⤵PID:1288
-
\??\c:\hpflxxv.exec:\hpflxxv.exe102⤵PID:952
-
\??\c:\ptnrv.exec:\ptnrv.exe103⤵PID:2004
-
\??\c:\xhdnjn.exec:\xhdnjn.exe104⤵PID:2580
-
\??\c:\hxrxppb.exec:\hxrxppb.exe105⤵PID:3044
-
\??\c:\fvhbbp.exec:\fvhbbp.exe106⤵PID:112
-
\??\c:\tbnhndx.exec:\tbnhndx.exe107⤵PID:2888
-
\??\c:\xfdpr.exec:\xfdpr.exe108⤵PID:2640
-
\??\c:\fhnbxr.exec:\fhnbxr.exe109⤵PID:2696
-
\??\c:\rxhfb.exec:\rxhfb.exe110⤵PID:332
-
\??\c:\xnvbt.exec:\xnvbt.exe111⤵PID:2416
-
\??\c:\xdhnvd.exec:\xdhnvd.exe112⤵PID:2448
-
\??\c:\xpdhj.exec:\xpdhj.exe113⤵PID:2436
-
\??\c:\tpdtxt.exec:\tpdtxt.exe114⤵PID:2032
-
\??\c:\vrhxjh.exec:\vrhxjh.exe115⤵PID:3020
-
\??\c:\rdxpf.exec:\rdxpf.exe116⤵PID:2180
-
\??\c:\hlrdvpn.exec:\hlrdvpn.exe117⤵PID:2176
-
\??\c:\bvrbvl.exec:\bvrbvl.exe118⤵PID:576
-
\??\c:\hpvbph.exec:\hpvbph.exe119⤵PID:2772
-
\??\c:\llhxxr.exec:\llhxxr.exe120⤵PID:2676
-
\??\c:\nxnbn.exec:\nxnbn.exe121⤵PID:1636
-
\??\c:\prndbpn.exec:\prndbpn.exe122⤵PID:1984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-