Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 18:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.a817272715ed8da8f201512bc354d0e0.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
NEAS.a817272715ed8da8f201512bc354d0e0.exe
-
Size
208KB
-
MD5
a817272715ed8da8f201512bc354d0e0
-
SHA1
0a8a94d890353a7ebf091329962f0411e4a39425
-
SHA256
7daa4de0c319eb63d55feb2cf02df0b3c8fc96de3be2d7357e3cebefe717801b
-
SHA512
5e0c58c9bfa120d09f9bab70b63e92d9e311a4fbb7d3ec2741aab253a74c78e895046084ac90eba73f8e1d210975ced05e2dfc540a05178c17f5550e292854a7
-
SSDEEP
1536:avQBeOGtrYSSsrc93UBIfdC67m6AJiqAfg3Cip8iXAsG5R88t:ahOm2sI93UufdC67ciffmCiiiXAX
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4128-5-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4448-9-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2328-17-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2844-20-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4192-30-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4160-35-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3920-42-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4056-43-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4348-50-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/736-57-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3884-61-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3892-74-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2564-85-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2204-91-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3864-100-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2780-104-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4332-125-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/312-127-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2492-133-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2540-140-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1828-146-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4536-149-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2900-163-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3848-177-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4048-179-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4684-184-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2108-188-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3396-191-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2512-200-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/540-207-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4848-219-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2472-226-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4956-229-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4652-237-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4860-242-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3192-249-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4244-251-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3864-280-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2884-290-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4952-292-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4196-304-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/116-316-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3040-326-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4680-333-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3432-335-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3748-341-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2968-345-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4624-367-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2472-385-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4592-421-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3948-430-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/944-436-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1368-456-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4544-471-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2036-505-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2872-533-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2348-585-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3088-658-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5036-687-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4456-755-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1304-762-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/536-787-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4508-960-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/684-1110-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4448 vrtffl.exe 2328 hrbpvv.exe 2844 xrhrnxj.exe 3420 hvfflf.exe 4192 xlpdvlx.exe 4160 lvprthj.exe 4056 dnbpt.exe 3920 dfnjtn.exe 4348 nvhvjx.exe 736 pjrdv.exe 3884 trhdjpp.exe 3828 njrjt.exe 3220 ffxhp.exe 3892 frrjxxd.exe 3620 pbrbbx.exe 2564 bndjf.exe 2204 hhxhpln.exe 3864 pfvrl.exe 2780 brtvv.exe 1528 vlnxrhb.exe 3648 ddjrtnd.exe 800 vffjb.exe 312 tlhtp.exe 4332 rrnddf.exe 2492 bldljf.exe 2540 rdrjnrf.exe 1828 pnjxf.exe 4536 nxjjfr.exe 4388 jhffbv.exe 2900 hhrhb.exe 3776 nhpnjj.exe 4680 ffdhpv.exe 832 phjdfrh.exe 3848 rpxft.exe 4048 vjntp.exe 4684 rnrvvln.exe 2108 dnvbrb.exe 3396 bldlt.exe 4912 dndnl.exe 4508 fjhbvj.exe 2512 dlpjbr.exe 384 vxnvj.exe 540 rvprrl.exe 2972 ttnndh.exe 3684 rtlxh.exe 4848 rlhfj.exe 4056 jldvxl.exe 2472 vlbdffn.exe 4956 vvxvxdb.exe 736 jjbvbd.exe 3832 nrpftbx.exe 4652 djpbdl.exe 4860 fxtrtjr.exe 3828 jxldjj.exe 3192 vlfxxjv.exe 4244 ddvbf.exe 4344 hhxjjh.exe 1492 dlnxj.exe 3924 vfvvp.exe 1348 xfnlpbl.exe 5116 bjbthdd.exe 2304 ljddx.exe 4936 nhvtvpp.exe 3948 fjpfn.exe -
resource yara_rule behavioral2/memory/4128-5-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4448-9-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2844-15-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2328-17-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2844-20-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4192-30-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4160-35-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3920-42-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4056-43-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4348-50-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/736-57-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3884-61-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3892-74-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2564-85-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2204-91-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3864-100-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2780-104-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4332-125-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/312-127-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2492-133-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2540-140-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1828-146-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4536-149-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2900-163-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3848-177-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4048-179-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4684-184-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2108-188-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3396-191-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2512-200-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/540-207-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2972-211-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4848-219-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2472-226-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4956-229-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4652-237-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4860-242-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3192-249-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4244-251-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1492-257-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3864-280-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2884-290-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4952-292-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4196-304-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/116-316-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3040-326-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4680-333-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3432-335-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3748-341-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2968-345-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4624-367-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2472-385-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4592-421-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3948-430-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/944-436-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1368-456-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4544-471-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2036-505-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2872-533-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4700-550-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1196-581-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2348-585-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1988-638-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3088-658-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 4448 4128 NEAS.a817272715ed8da8f201512bc354d0e0.exe 83 PID 4128 wrote to memory of 4448 4128 NEAS.a817272715ed8da8f201512bc354d0e0.exe 83 PID 4128 wrote to memory of 4448 4128 NEAS.a817272715ed8da8f201512bc354d0e0.exe 83 PID 4448 wrote to memory of 2328 4448 vrtffl.exe 84 PID 4448 wrote to memory of 2328 4448 vrtffl.exe 84 PID 4448 wrote to memory of 2328 4448 vrtffl.exe 84 PID 2328 wrote to memory of 2844 2328 hrbpvv.exe 85 PID 2328 wrote to memory of 2844 2328 hrbpvv.exe 85 PID 2328 wrote to memory of 2844 2328 hrbpvv.exe 85 PID 2844 wrote to memory of 3420 2844 xrhrnxj.exe 86 PID 2844 wrote to memory of 3420 2844 xrhrnxj.exe 86 PID 2844 wrote to memory of 3420 2844 xrhrnxj.exe 86 PID 3420 wrote to memory of 4192 3420 hvfflf.exe 87 PID 3420 wrote to memory of 4192 3420 hvfflf.exe 87 PID 3420 wrote to memory of 4192 3420 hvfflf.exe 87 PID 4192 wrote to memory of 4160 4192 xlpdvlx.exe 88 PID 4192 wrote to memory of 4160 4192 xlpdvlx.exe 88 PID 4192 wrote to memory of 4160 4192 xlpdvlx.exe 88 PID 4160 wrote to memory of 4056 4160 lvprthj.exe 89 PID 4160 wrote to memory of 4056 4160 lvprthj.exe 89 PID 4160 wrote to memory of 4056 4160 lvprthj.exe 89 PID 4056 wrote to memory of 3920 4056 dnbpt.exe 90 PID 4056 wrote to memory of 3920 4056 dnbpt.exe 90 PID 4056 wrote to memory of 3920 4056 dnbpt.exe 90 PID 3920 wrote to memory of 4348 3920 dfnjtn.exe 92 PID 3920 wrote to memory of 4348 3920 dfnjtn.exe 92 PID 3920 wrote to memory of 4348 3920 dfnjtn.exe 92 PID 4348 wrote to memory of 736 4348 nvhvjx.exe 93 PID 4348 wrote to memory of 736 4348 nvhvjx.exe 93 PID 4348 wrote to memory of 736 4348 nvhvjx.exe 93 PID 736 wrote to memory of 3884 736 pjrdv.exe 94 PID 736 wrote to memory of 3884 736 pjrdv.exe 94 PID 736 wrote to memory of 3884 736 pjrdv.exe 94 PID 3884 wrote to memory of 3828 3884 trhdjpp.exe 95 PID 3884 wrote to memory of 3828 3884 trhdjpp.exe 95 PID 3884 wrote to memory of 3828 3884 trhdjpp.exe 95 PID 3828 wrote to memory of 3220 3828 njrjt.exe 96 PID 3828 wrote to memory of 3220 3828 njrjt.exe 96 PID 3828 wrote to memory of 3220 3828 njrjt.exe 96 PID 3220 wrote to memory of 3892 3220 ffxhp.exe 97 PID 3220 wrote to memory of 3892 3220 ffxhp.exe 97 PID 3220 wrote to memory of 3892 3220 ffxhp.exe 97 PID 3892 wrote to memory of 3620 3892 frrjxxd.exe 98 PID 3892 wrote to memory of 3620 3892 frrjxxd.exe 98 PID 3892 wrote to memory of 3620 3892 frrjxxd.exe 98 PID 3620 wrote to memory of 2564 3620 pbrbbx.exe 99 PID 3620 wrote to memory of 2564 3620 pbrbbx.exe 99 PID 3620 wrote to memory of 2564 3620 pbrbbx.exe 99 PID 2564 wrote to memory of 2204 2564 bndjf.exe 100 PID 2564 wrote to memory of 2204 2564 bndjf.exe 100 PID 2564 wrote to memory of 2204 2564 bndjf.exe 100 PID 2204 wrote to memory of 3864 2204 hhxhpln.exe 101 PID 2204 wrote to memory of 3864 2204 hhxhpln.exe 101 PID 2204 wrote to memory of 3864 2204 hhxhpln.exe 101 PID 3864 wrote to memory of 2780 3864 pfvrl.exe 102 PID 3864 wrote to memory of 2780 3864 pfvrl.exe 102 PID 3864 wrote to memory of 2780 3864 pfvrl.exe 102 PID 2780 wrote to memory of 1528 2780 brtvv.exe 103 PID 2780 wrote to memory of 1528 2780 brtvv.exe 103 PID 2780 wrote to memory of 1528 2780 brtvv.exe 103 PID 1528 wrote to memory of 3648 1528 vlnxrhb.exe 105 PID 1528 wrote to memory of 3648 1528 vlnxrhb.exe 105 PID 1528 wrote to memory of 3648 1528 vlnxrhb.exe 105 PID 3648 wrote to memory of 800 3648 ddjrtnd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a817272715ed8da8f201512bc354d0e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a817272715ed8da8f201512bc354d0e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\vrtffl.exec:\vrtffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\hrbpvv.exec:\hrbpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\xrhrnxj.exec:\xrhrnxj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hvfflf.exec:\hvfflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\xlpdvlx.exec:\xlpdvlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\lvprthj.exec:\lvprthj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\dnbpt.exec:\dnbpt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\dfnjtn.exec:\dfnjtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\nvhvjx.exec:\nvhvjx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\pjrdv.exec:\pjrdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\trhdjpp.exec:\trhdjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\njrjt.exec:\njrjt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\ffxhp.exec:\ffxhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\frrjxxd.exec:\frrjxxd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\pbrbbx.exec:\pbrbbx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\bndjf.exec:\bndjf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hhxhpln.exec:\hhxhpln.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\pfvrl.exec:\pfvrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\brtvv.exec:\brtvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vlnxrhb.exec:\vlnxrhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\ddjrtnd.exec:\ddjrtnd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\vffjb.exec:\vffjb.exe1⤵
- Executes dropped EXE
PID:800 -
\??\c:\tlhtp.exec:\tlhtp.exe2⤵
- Executes dropped EXE
PID:312 -
\??\c:\rrnddf.exec:\rrnddf.exe3⤵
- Executes dropped EXE
PID:4332 -
\??\c:\bldljf.exec:\bldljf.exe4⤵
- Executes dropped EXE
PID:2492
-
-
-
-
\??\c:\rdrjnrf.exec:\rdrjnrf.exe1⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pnjxf.exec:\pnjxf.exe2⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nxjjfr.exec:\nxjjfr.exe3⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jhffbv.exec:\jhffbv.exe4⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hhrhb.exec:\hhrhb.exe5⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhpnjj.exec:\nhpnjj.exe6⤵
- Executes dropped EXE
PID:3776 -
\??\c:\ffdhpv.exec:\ffdhpv.exe7⤵
- Executes dropped EXE
PID:4680 -
\??\c:\phjdfrh.exec:\phjdfrh.exe8⤵
- Executes dropped EXE
PID:832 -
\??\c:\rpxft.exec:\rpxft.exe9⤵
- Executes dropped EXE
PID:3848 -
\??\c:\vjntp.exec:\vjntp.exe10⤵
- Executes dropped EXE
PID:4048 -
\??\c:\rnrvvln.exec:\rnrvvln.exe11⤵
- Executes dropped EXE
PID:4684 -
\??\c:\dnvbrb.exec:\dnvbrb.exe12⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bldlt.exec:\bldlt.exe13⤵
- Executes dropped EXE
PID:3396 -
\??\c:\dndnl.exec:\dndnl.exe14⤵
- Executes dropped EXE
PID:4912 -
\??\c:\fjhbvj.exec:\fjhbvj.exe15⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dlpjbr.exec:\dlpjbr.exe16⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vxnvj.exec:\vxnvj.exe17⤵
- Executes dropped EXE
PID:384 -
\??\c:\rvprrl.exec:\rvprrl.exe18⤵
- Executes dropped EXE
PID:540 -
\??\c:\ttnndh.exec:\ttnndh.exe19⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rtlxh.exec:\rtlxh.exe20⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rlhfj.exec:\rlhfj.exe21⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jldvxl.exec:\jldvxl.exe22⤵
- Executes dropped EXE
PID:4056 -
\??\c:\vlbdffn.exec:\vlbdffn.exe23⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vvxvxdb.exec:\vvxvxdb.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\jjbvbd.exec:\jjbvbd.exe25⤵
- Executes dropped EXE
PID:736 -
\??\c:\nrpftbx.exec:\nrpftbx.exe26⤵
- Executes dropped EXE
PID:3832 -
\??\c:\djpbdl.exec:\djpbdl.exe27⤵
- Executes dropped EXE
PID:4652 -
\??\c:\fxtrtjr.exec:\fxtrtjr.exe28⤵
- Executes dropped EXE
PID:4860 -
\??\c:\jxldjj.exec:\jxldjj.exe29⤵
- Executes dropped EXE
PID:3828 -
\??\c:\vlfxxjv.exec:\vlfxxjv.exe30⤵
- Executes dropped EXE
PID:3192 -
\??\c:\ddvbf.exec:\ddvbf.exe31⤵
- Executes dropped EXE
PID:4244 -
\??\c:\hhxjjh.exec:\hhxjjh.exe32⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dlnxj.exec:\dlnxj.exe33⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vfvvp.exec:\vfvvp.exe34⤵
- Executes dropped EXE
PID:3924 -
\??\c:\xfnlpbl.exec:\xfnlpbl.exe35⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bjbthdd.exec:\bjbthdd.exe36⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ljddx.exec:\ljddx.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhvtvpp.exec:\nhvtvpp.exe38⤵
- Executes dropped EXE
PID:4936 -
\??\c:\fjpfn.exec:\fjpfn.exe39⤵
- Executes dropped EXE
PID:3948 -
\??\c:\dxptd.exec:\dxptd.exe40⤵PID:3864
-
\??\c:\tjtxfd.exec:\tjtxfd.exe41⤵PID:508
-
\??\c:\pnlxpvh.exec:\pnlxpvh.exe42⤵PID:4952
-
\??\c:\bjfvn.exec:\bjfvn.exe43⤵PID:2884
-
\??\c:\frbbhn.exec:\frbbhn.exe44⤵PID:4692
-
\??\c:\ltlvj.exec:\ltlvj.exe45⤵PID:3940
-
\??\c:\dhjhtv.exec:\dhjhtv.exe46⤵PID:940
-
\??\c:\ljdvfv.exec:\ljdvfv.exe47⤵PID:4196
-
\??\c:\dpjbn.exec:\dpjbn.exe48⤵PID:1460
-
\??\c:\frtvjnp.exec:\frtvjnp.exe49⤵PID:116
-
\??\c:\rhxfft.exec:\rhxfft.exe50⤵PID:3452
-
\??\c:\flrht.exec:\flrht.exe51⤵PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\rtjlhlp.exec:\rtjlhlp.exe1⤵PID:2244
-
\??\c:\nbxrvr.exec:\nbxrvr.exe2⤵PID:3040
-
\??\c:\xplrx.exec:\xplrx.exe3⤵PID:4164
-
\??\c:\bbffj.exec:\bbffj.exe4⤵PID:4680
-
\??\c:\vbpxll.exec:\vbpxll.exe5⤵PID:3432
-
\??\c:\htfhx.exec:\htfhx.exe6⤵PID:3748
-
\??\c:\bpfvj.exec:\bpfvj.exe7⤵PID:2968
-
\??\c:\vxpvv.exec:\vxpvv.exe8⤵PID:4684
-
\??\c:\vrvfffj.exec:\vrvfffj.exe9⤵PID:1420
-
\??\c:\fdbnnvj.exec:\fdbnnvj.exe10⤵PID:2748
-
\??\c:\dbplv.exec:\dbplv.exe11⤵PID:224
-
\??\c:\ndfbf.exec:\ndfbf.exe12⤵PID:3036
-
\??\c:\fdndn.exec:\fdndn.exe13⤵PID:4448
-
\??\c:\fbxjbjp.exec:\fbxjbjp.exe14⤵PID:4624
-
\??\c:\rnrdfv.exec:\rnrdfv.exe15⤵PID:5064
-
\??\c:\tpxtd.exec:\tpxtd.exe16⤵PID:3976
-
\??\c:\pbdbh.exec:\pbdbh.exe17⤵PID:4564
-
\??\c:\rjnfnj.exec:\rjnfnj.exe18⤵PID:4632
-
\??\c:\fvnnr.exec:\fvnnr.exe19⤵PID:2472
-
\??\c:\nprpnjr.exec:\nprpnjr.exe20⤵PID:3320
-
\??\c:\thrpbjn.exec:\thrpbjn.exe21⤵PID:4116
-
\??\c:\tvhbflp.exec:\tvhbflp.exe22⤵PID:5092
-
\??\c:\nljjhlj.exec:\nljjhlj.exe23⤵PID:4652
-
\??\c:\vvblvb.exec:\vvblvb.exe24⤵PID:4764
-
\??\c:\rbhnlfr.exec:\rbhnlfr.exe25⤵PID:3660
-
\??\c:\xnnppj.exec:\xnnppj.exe26⤵PID:724
-
\??\c:\vrdhd.exec:\vrdhd.exe27⤵PID:4924
-
\??\c:\ljptjbh.exec:\ljptjbh.exe28⤵PID:1400
-
\??\c:\bvpvlrf.exec:\bvpvlrf.exe29⤵PID:2332
-
\??\c:\ldxxxf.exec:\ldxxxf.exe30⤵PID:3844
-
\??\c:\xvpbpt.exec:\xvpbpt.exe31⤵PID:1816
-
\??\c:\vhxbvvn.exec:\vhxbvvn.exe32⤵PID:4592
-
\??\c:\bfbdh.exec:\bfbdh.exe33⤵PID:3332
-
\??\c:\brnxv.exec:\brnxv.exe34⤵PID:3948
-
\??\c:\xrrhxlv.exec:\xrrhxlv.exe35⤵PID:3548
-
\??\c:\hhbnt.exec:\hhbnt.exe36⤵PID:944
-
\??\c:\ljvxfp.exec:\ljvxfp.exe37⤵PID:4952
-
\??\c:\jvfxfr.exec:\jvfxfr.exe38⤵PID:672
-
\??\c:\bnfxb.exec:\bnfxb.exe39⤵PID:872
-
\??\c:\lbvfv.exec:\lbvfv.exe40⤵PID:1740
-
\??\c:\hjjfdpn.exec:\hjjfdpn.exe41⤵PID:4368
-
\??\c:\rtvdr.exec:\rtvdr.exe42⤵PID:1368
-
\??\c:\fpvhtph.exec:\fpvhtph.exe43⤵PID:2864
-
\??\c:\xbphjhj.exec:\xbphjhj.exe44⤵PID:4336
-
\??\c:\vxjxbdf.exec:\vxjxbdf.exe45⤵PID:2160
-
\??\c:\hdvnjjd.exec:\hdvnjjd.exe46⤵PID:4544
-
\??\c:\dlvbbt.exec:\dlvbbt.exe47⤵PID:968
-
\??\c:\txtpprn.exec:\txtpprn.exe48⤵PID:1140
-
\??\c:\dvtvrx.exec:\dvtvrx.exe49⤵PID:3848
-
\??\c:\rbftjr.exec:\rbftjr.exe50⤵PID:3896
-
\??\c:\brrftx.exec:\brrftx.exe51⤵PID:1516
-
\??\c:\xrftl.exec:\xrftl.exe52⤵PID:3700
-
\??\c:\tnhnhfh.exec:\tnhnhfh.exe53⤵PID:1840
-
\??\c:\dxftbn.exec:\dxftbn.exe54⤵PID:1244
-
\??\c:\bjfpd.exec:\bjfpd.exe55⤵PID:4112
-
\??\c:\bfpvv.exec:\bfpvv.exe56⤵PID:4604
-
\??\c:\tjvbdv.exec:\tjvbdv.exe57⤵PID:2036
-
\??\c:\fjtnxbj.exec:\fjtnxbj.exe58⤵PID:2816
-
\??\c:\bvdtht.exec:\bvdtht.exe59⤵PID:5064
-
\??\c:\lftfbd.exec:\lftfbd.exe60⤵PID:4396
-
\??\c:\vrrlt.exec:\vrrlt.exe61⤵PID:4564
-
\??\c:\jnlvxf.exec:\jnlvxf.exe62⤵PID:3696
-
\??\c:\rflddrf.exec:\rflddrf.exe63⤵PID:3832
-
\??\c:\ddnjf.exec:\ddnjf.exe64⤵PID:464
-
\??\c:\hnfbnnx.exec:\hnfbnnx.exe65⤵PID:3664
-
\??\c:\hxppv.exec:\hxppv.exe66⤵PID:2872
-
\??\c:\fvjrbff.exec:\fvjrbff.exe67⤵PID:3544
-
\??\c:\xvbhjh.exec:\xvbhjh.exe68⤵PID:4344
-
\??\c:\rnrvfj.exec:\rnrvfj.exe69⤵PID:3624
-
\??\c:\bpprxxd.exec:\bpprxxd.exe70⤵PID:1116
-
\??\c:\lbvdl.exec:\lbvdl.exe71⤵PID:1276
-
\??\c:\lxjjdnr.exec:\lxjjdnr.exe72⤵PID:748
-
\??\c:\fjfxrh.exec:\fjfxrh.exe73⤵PID:4700
-
\??\c:\xdbbl.exec:\xdbbl.exe74⤵PID:2828
-
\??\c:\pfrvjj.exec:\pfrvjj.exe75⤵PID:2232
-
\??\c:\rtlppd.exec:\rtlppd.exe76⤵PID:1528
-
\??\c:\nrvlhrf.exec:\nrvlhrf.exe77⤵PID:3864
-
\??\c:\xxfpj.exec:\xxfpj.exe78⤵PID:3948
-
\??\c:\fhdhr.exec:\fhdhr.exe79⤵PID:5076
-
\??\c:\nftnff.exec:\nftnff.exe80⤵PID:3100
-
\??\c:\vrtbj.exec:\vrtbj.exe81⤵PID:3372
-
\??\c:\xjvdvp.exec:\xjvdvp.exe82⤵PID:1088
-
\??\c:\tndvf.exec:\tndvf.exe83⤵PID:1196
-
\??\c:\pxfjjrb.exec:\pxfjjrb.exe84⤵PID:2348
-
\??\c:\htbjfjd.exec:\htbjfjd.exe85⤵PID:2832
-
\??\c:\tljrht.exec:\tljrht.exe86⤵PID:2508
-
\??\c:\bnxfrrv.exec:\bnxfrrv.exe87⤵PID:1676
-
\??\c:\rdjttv.exec:\rdjttv.exe88⤵PID:2244
-
\??\c:\vjjfttr.exec:\vjjfttr.exe89⤵PID:2160
-
\??\c:\pdjnb.exec:\pdjnb.exe90⤵PID:3932
-
\??\c:\vxdfrtn.exec:\vxdfrtn.exe91⤵PID:4324
-
\??\c:\nllvbtn.exec:\nllvbtn.exe92⤵PID:3432
-
\??\c:\lrjfxd.exec:\lrjfxd.exe93⤵PID:4484
-
\??\c:\fjfxn.exec:\fjfxn.exe94⤵PID:2840
-
\??\c:\lftfdj.exec:\lftfdj.exe95⤵PID:4748
-
\??\c:\tlpbvp.exec:\tlpbvp.exe96⤵PID:4408
-
\??\c:\dxvtr.exec:\dxvtr.exe97⤵PID:1360
-
\??\c:\vfblvj.exec:\vfblvj.exe98⤵PID:540
-
\??\c:\rdjbr.exec:\rdjbr.exe99⤵PID:1260
-
\??\c:\vvthxfl.exec:\vvthxfl.exe100⤵PID:5064
-
\??\c:\btvjhnr.exec:\btvjhnr.exe101⤵PID:4396
-
\??\c:\dnjnjr.exec:\dnjnjr.exe102⤵PID:1988
-
\??\c:\pfnlh.exec:\pfnlh.exe103⤵PID:1936
-
\??\c:\bnfnj.exec:\bnfnj.exe104⤵PID:4416
-
\??\c:\xflpf.exec:\xflpf.exe105⤵PID:1180
-
\??\c:\fnvpjrr.exec:\fnvpjrr.exe106⤵PID:1792
-
\??\c:\vnpfb.exec:\vnpfb.exe107⤵PID:536
-
\??\c:\bthlbjp.exec:\bthlbjp.exe108⤵PID:3088
-
\??\c:\jnlfdrh.exec:\jnlfdrh.exe109⤵PID:5028
-
\??\c:\xvtrtrl.exec:\xvtrtrl.exe110⤵PID:3620
-
\??\c:\lvvfjhf.exec:\lvvfjhf.exe111⤵PID:2720
-
\??\c:\nxrtp.exec:\nxrtp.exe112⤵PID:3544
-
\??\c:\dfrxjfv.exec:\dfrxjfv.exe113⤵PID:2988
-
\??\c:\bxlbdxl.exec:\bxlbdxl.exe114⤵PID:4924
-
\??\c:\rnrvf.exec:\rnrvf.exe115⤵PID:4516
-
\??\c:\jbdtxjj.exec:\jbdtxjj.exe116⤵PID:5036
-
\??\c:\nphnp.exec:\nphnp.exe117⤵PID:2204
-
\??\c:\dnxfhhl.exec:\dnxfhhl.exe118⤵PID:1584
-
\??\c:\nnhbx.exec:\nnhbx.exe119⤵PID:4968
-
\??\c:\lfjjlx.exec:\lfjjlx.exe120⤵PID:2276
-
\??\c:\xdfht.exec:\xdfht.exe121⤵PID:3864
-
\??\c:\ljrpxl.exec:\ljrpxl.exe122⤵PID:3872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-