Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe
-
Size
347KB
-
MD5
4be015d98c3c8dec9eab81ffb4814fe0
-
SHA1
b69bbcff106cfcb51d89d05e0aa1ba496bc4de27
-
SHA256
c9e83ff948b6da117d2747e040a76d42fc856f72b23076897d69259227842290
-
SHA512
bfb759d38b7168391214411207ae45ab7b337a3cf87729bd82916513fd7bf9ba854f0bde97bf8a37ed353a97c926e7d2716c8122089a92d01e5462284a7a7fb1
-
SSDEEP
6144:9cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4Tr3:/7TcBuGy/Sa+/sie0OpncKe/KFBOfmz/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4264-4-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4052-9-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3832-13-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3672-19-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3152-24-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3744-35-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3120-37-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3648-46-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3496-54-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1836-63-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4564-73-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4376-91-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1736-100-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1912-104-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3148-88-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5104-112-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3996-115-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3016-138-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1976-141-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2128-150-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1760-165-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/448-171-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/748-177-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4832-180-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2948-182-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3360-188-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4120-191-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4020-194-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1412-197-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4740-200-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5024-203-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2692-209-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5076-215-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/800-224-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3440-225-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3672-237-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1460-240-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2032-244-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3020-262-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3308-264-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2460-269-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3928-280-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3304-283-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4616-303-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/932-310-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4656-316-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1924-328-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1828-337-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/840-360-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4388-366-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1468-383-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1844-456-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4852-504-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3272-542-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1040-558-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4424-582-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/720-586-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3860-590-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4376-597-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4856-641-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4892-753-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1804-764-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3860-890-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/416-967-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4052 xvfpxb.exe 3832 fdbjnb.exe 3672 dftfth.exe 3152 jjlhbbd.exe 1512 jhhrd.exe 3120 btrhh.exe 3744 bvvpdlp.exe 3648 lhlbxvl.exe 3656 hvfjxlj.exe 3496 lhttbb.exe 1836 xljdtvx.exe 4700 lppndn.exe 4564 rvdvjl.exe 4776 drrrbl.exe 536 lphpd.exe 3148 rrnvpn.exe 4376 jxnffnn.exe 1736 lhhdlt.exe 1912 hpfxv.exe 5104 xdfbbn.exe 3996 dvftn.exe 4648 ndxvf.exe 3604 nlllvlb.exe 4032 ttpxt.exe 3016 fljhjr.exe 1976 blnvh.exe 1248 trhjl.exe 2128 djtnr.exe 4364 thfxt.exe 1760 plfjhv.exe 4160 xtrhxv.exe 448 tfjrh.exe 748 vnnxp.exe 4832 vvbldl.exe 2948 txxbttf.exe 3360 ptdbnpr.exe 4120 lbphv.exe 4020 lnnjx.exe 1412 vpbjj.exe 4740 jlfrl.exe 5024 ntjnr.exe 1780 jttvdh.exe 2692 vljhdnv.exe 2988 dlbtp.exe 5076 lntjb.exe 3696 vplhtb.exe 4888 rfntltv.exe 800 ntdtf.exe 3440 lpnnxx.exe 3140 bhdldvb.exe 4368 tpdthhb.exe 3672 tfthtp.exe 1460 vjxhdr.exe 2032 rbhbt.exe 1512 xbldtt.exe 408 brlhlh.exe 740 btpnpbt.exe 2328 txxbhx.exe 4396 hjtln.exe 3020 rppddt.exe 3308 dlhnpd.exe 2460 ttjdflr.exe 720 rhphx.exe 4732 flljxn.exe -
resource yara_rule behavioral2/memory/4264-4-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4052-9-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3832-13-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3672-19-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3152-24-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3744-35-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3648-42-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3120-37-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3648-46-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3496-54-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1836-59-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1836-63-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4564-73-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4376-91-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1736-100-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1912-104-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5104-107-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3148-88-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5104-112-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3996-115-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3604-123-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3016-138-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1976-141-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2128-150-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1760-165-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/448-171-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4832-176-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/748-177-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4832-180-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2948-182-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3360-185-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3360-188-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4120-191-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4020-194-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1412-197-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4740-200-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5024-203-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2692-209-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5076-215-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/800-224-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3440-225-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3672-237-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2032-241-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1460-240-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2032-244-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3020-262-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3308-264-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2460-269-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3928-280-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3304-283-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4616-303-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/932-310-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4656-316-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1924-323-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1924-328-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1828-337-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/840-360-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4388-366-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1468-383-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1844-456-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4852-504-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3272-542-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1040-558-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4424-582-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4264 wrote to memory of 4052 4264 NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe 81 PID 4264 wrote to memory of 4052 4264 NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe 81 PID 4264 wrote to memory of 4052 4264 NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe 81 PID 4052 wrote to memory of 3832 4052 xvfpxb.exe 82 PID 4052 wrote to memory of 3832 4052 xvfpxb.exe 82 PID 4052 wrote to memory of 3832 4052 xvfpxb.exe 82 PID 3832 wrote to memory of 3672 3832 fdbjnb.exe 83 PID 3832 wrote to memory of 3672 3832 fdbjnb.exe 83 PID 3832 wrote to memory of 3672 3832 fdbjnb.exe 83 PID 3672 wrote to memory of 3152 3672 dftfth.exe 85 PID 3672 wrote to memory of 3152 3672 dftfth.exe 85 PID 3672 wrote to memory of 3152 3672 dftfth.exe 85 PID 3152 wrote to memory of 1512 3152 jjlhbbd.exe 86 PID 3152 wrote to memory of 1512 3152 jjlhbbd.exe 86 PID 3152 wrote to memory of 1512 3152 jjlhbbd.exe 86 PID 1512 wrote to memory of 3120 1512 jhhrd.exe 87 PID 1512 wrote to memory of 3120 1512 jhhrd.exe 87 PID 1512 wrote to memory of 3120 1512 jhhrd.exe 87 PID 3120 wrote to memory of 3744 3120 btrhh.exe 88 PID 3120 wrote to memory of 3744 3120 btrhh.exe 88 PID 3120 wrote to memory of 3744 3120 btrhh.exe 88 PID 3744 wrote to memory of 3648 3744 bvvpdlp.exe 89 PID 3744 wrote to memory of 3648 3744 bvvpdlp.exe 89 PID 3744 wrote to memory of 3648 3744 bvvpdlp.exe 89 PID 3648 wrote to memory of 3656 3648 lhlbxvl.exe 90 PID 3648 wrote to memory of 3656 3648 lhlbxvl.exe 90 PID 3648 wrote to memory of 3656 3648 lhlbxvl.exe 90 PID 3656 wrote to memory of 3496 3656 hvfjxlj.exe 91 PID 3656 wrote to memory of 3496 3656 hvfjxlj.exe 91 PID 3656 wrote to memory of 3496 3656 hvfjxlj.exe 91 PID 3496 wrote to memory of 1836 3496 lhttbb.exe 92 PID 3496 wrote to memory of 1836 3496 lhttbb.exe 92 PID 3496 wrote to memory of 1836 3496 lhttbb.exe 92 PID 1836 wrote to memory of 4700 1836 xljdtvx.exe 93 PID 1836 wrote to memory of 4700 1836 xljdtvx.exe 93 PID 1836 wrote to memory of 4700 1836 xljdtvx.exe 93 PID 4700 wrote to memory of 4564 4700 lppndn.exe 94 PID 4700 wrote to memory of 4564 4700 lppndn.exe 94 PID 4700 wrote to memory of 4564 4700 lppndn.exe 94 PID 4564 wrote to memory of 4776 4564 rvdvjl.exe 95 PID 4564 wrote to memory of 4776 4564 rvdvjl.exe 95 PID 4564 wrote to memory of 4776 4564 rvdvjl.exe 95 PID 4776 wrote to memory of 536 4776 drrrbl.exe 96 PID 4776 wrote to memory of 536 4776 drrrbl.exe 96 PID 4776 wrote to memory of 536 4776 drrrbl.exe 96 PID 536 wrote to memory of 3148 536 lphpd.exe 97 PID 536 wrote to memory of 3148 536 lphpd.exe 97 PID 536 wrote to memory of 3148 536 lphpd.exe 97 PID 3148 wrote to memory of 4376 3148 rrnvpn.exe 98 PID 3148 wrote to memory of 4376 3148 rrnvpn.exe 98 PID 3148 wrote to memory of 4376 3148 rrnvpn.exe 98 PID 4376 wrote to memory of 1736 4376 jxnffnn.exe 99 PID 4376 wrote to memory of 1736 4376 jxnffnn.exe 99 PID 4376 wrote to memory of 1736 4376 jxnffnn.exe 99 PID 1736 wrote to memory of 1912 1736 lhhdlt.exe 100 PID 1736 wrote to memory of 1912 1736 lhhdlt.exe 100 PID 1736 wrote to memory of 1912 1736 lhhdlt.exe 100 PID 1912 wrote to memory of 5104 1912 hpfxv.exe 101 PID 1912 wrote to memory of 5104 1912 hpfxv.exe 101 PID 1912 wrote to memory of 5104 1912 hpfxv.exe 101 PID 5104 wrote to memory of 3996 5104 xdfbbn.exe 102 PID 5104 wrote to memory of 3996 5104 xdfbbn.exe 102 PID 5104 wrote to memory of 3996 5104 xdfbbn.exe 102 PID 3996 wrote to memory of 4648 3996 dvftn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4be015d98c3c8dec9eab81ffb4814fe0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\xvfpxb.exec:\xvfpxb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\fdbjnb.exec:\fdbjnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\dftfth.exec:\dftfth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\jjlhbbd.exec:\jjlhbbd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\jhhrd.exec:\jhhrd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\btrhh.exec:\btrhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\bvvpdlp.exec:\bvvpdlp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\lhlbxvl.exec:\lhlbxvl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\hvfjxlj.exec:\hvfjxlj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\lhttbb.exec:\lhttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\xljdtvx.exec:\xljdtvx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\lppndn.exec:\lppndn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rvdvjl.exec:\rvdvjl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\drrrbl.exec:\drrrbl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\lphpd.exec:\lphpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rrnvpn.exec:\rrnvpn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\jxnffnn.exec:\jxnffnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\lhhdlt.exec:\lhhdlt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\hpfxv.exec:\hpfxv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xdfbbn.exec:\xdfbbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\dvftn.exec:\dvftn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\ndxvf.exec:\ndxvf.exe23⤵
- Executes dropped EXE
PID:4648 -
\??\c:\nlllvlb.exec:\nlllvlb.exe24⤵
- Executes dropped EXE
PID:3604 -
\??\c:\ttpxt.exec:\ttpxt.exe25⤵
- Executes dropped EXE
PID:4032 -
\??\c:\fljhjr.exec:\fljhjr.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\blnvh.exec:\blnvh.exe27⤵
- Executes dropped EXE
PID:1976 -
\??\c:\trhjl.exec:\trhjl.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\djtnr.exec:\djtnr.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thfxt.exec:\thfxt.exe30⤵
- Executes dropped EXE
PID:4364 -
\??\c:\plfjhv.exec:\plfjhv.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xtrhxv.exec:\xtrhxv.exe32⤵
- Executes dropped EXE
PID:4160 -
\??\c:\tfjrh.exec:\tfjrh.exe33⤵
- Executes dropped EXE
PID:448 -
\??\c:\vnnxp.exec:\vnnxp.exe34⤵
- Executes dropped EXE
PID:748 -
\??\c:\vvbldl.exec:\vvbldl.exe35⤵
- Executes dropped EXE
PID:4832 -
\??\c:\txxbttf.exec:\txxbttf.exe36⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ptdbnpr.exec:\ptdbnpr.exe37⤵
- Executes dropped EXE
PID:3360 -
\??\c:\lbphv.exec:\lbphv.exe38⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lnnjx.exec:\lnnjx.exe39⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vpbjj.exec:\vpbjj.exe40⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jlfrl.exec:\jlfrl.exe41⤵
- Executes dropped EXE
PID:4740 -
\??\c:\ntjnr.exec:\ntjnr.exe42⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jttvdh.exec:\jttvdh.exe43⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vljhdnv.exec:\vljhdnv.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dlbtp.exec:\dlbtp.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lntjb.exec:\lntjb.exe46⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vplhtb.exec:\vplhtb.exe47⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rfntltv.exec:\rfntltv.exe48⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ntdtf.exec:\ntdtf.exe49⤵
- Executes dropped EXE
PID:800 -
\??\c:\lpnnxx.exec:\lpnnxx.exe50⤵
- Executes dropped EXE
PID:3440 -
\??\c:\bhdldvb.exec:\bhdldvb.exe51⤵
- Executes dropped EXE
PID:3140 -
\??\c:\tpdthhb.exec:\tpdthhb.exe52⤵
- Executes dropped EXE
PID:4368 -
\??\c:\tfthtp.exec:\tfthtp.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vjxhdr.exec:\vjxhdr.exe54⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rbhbt.exec:\rbhbt.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xbldtt.exec:\xbldtt.exe56⤵
- Executes dropped EXE
PID:1512 -
\??\c:\brlhlh.exec:\brlhlh.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\btpnpbt.exec:\btpnpbt.exe58⤵
- Executes dropped EXE
PID:740 -
\??\c:\txxbhx.exec:\txxbhx.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hjtln.exec:\hjtln.exe60⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rppddt.exec:\rppddt.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dlhnpd.exec:\dlhnpd.exe62⤵
- Executes dropped EXE
PID:3308 -
\??\c:\ttjdflr.exec:\ttjdflr.exe63⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rhphx.exec:\rhphx.exe64⤵
- Executes dropped EXE
PID:720 -
\??\c:\flljxn.exec:\flljxn.exe65⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pbhrphb.exec:\pbhrphb.exe66⤵PID:3928
-
\??\c:\dxbnr.exec:\dxbnr.exe67⤵PID:3304
-
\??\c:\dntxf.exec:\dntxf.exe68⤵PID:1280
-
\??\c:\nlrpjn.exec:\nlrpjn.exe69⤵PID:1008
-
\??\c:\nplxxvt.exec:\nplxxvt.exe70⤵PID:3536
-
\??\c:\nttbj.exec:\nttbj.exe71⤵PID:4536
-
\??\c:\nplnn.exec:\nplnn.exe72⤵PID:4604
-
\??\c:\nfjxxj.exec:\nfjxxj.exe73⤵PID:4616
-
\??\c:\llfhnj.exec:\llfhnj.exe74⤵PID:4004
-
\??\c:\tntvvpn.exec:\tntvvpn.exe75⤵PID:932
-
\??\c:\rtxrnd.exec:\rtxrnd.exe76⤵PID:4676
-
\??\c:\xxjprxx.exec:\xxjprxx.exe77⤵PID:4656
-
\??\c:\vvtvj.exec:\vvtvj.exe78⤵PID:2160
-
\??\c:\jfvxft.exec:\jfvxft.exe79⤵PID:1240
-
\??\c:\hbprll.exec:\hbprll.exe80⤵PID:1924
-
\??\c:\vthdvdd.exec:\vthdvdd.exe81⤵PID:4712
-
\??\c:\bbjnhfx.exec:\bbjnhfx.exe82⤵PID:2472
-
\??\c:\blvxx.exec:\blvxx.exe83⤵PID:3268
-
\??\c:\rbnxxj.exec:\rbnxxj.exe84⤵PID:1828
-
\??\c:\xjnjt.exec:\xjnjt.exe85⤵PID:1968
-
\??\c:\lxfxdfn.exec:\lxfxdfn.exe86⤵PID:4852
-
\??\c:\dfnjf.exec:\dfnjf.exe87⤵PID:4832
-
\??\c:\nnhtb.exec:\nnhtb.exe88⤵PID:4192
-
\??\c:\xnhfpb.exec:\xnhfpb.exe89⤵PID:3360
-
\??\c:\drjfnpl.exec:\drjfnpl.exe90⤵PID:464
-
\??\c:\tftnhfd.exec:\tftnhfd.exe91⤵PID:840
-
\??\c:\ppxlrp.exec:\ppxlrp.exe92⤵PID:4388
-
\??\c:\njffn.exec:\njffn.exe93⤵PID:4740
-
\??\c:\rxhtt.exec:\rxhtt.exe94⤵PID:1072
-
\??\c:\fdpptx.exec:\fdpptx.exe95⤵PID:1780
-
\??\c:\fpldv.exec:\fpldv.exe96⤵PID:3888
-
\??\c:\jjfntv.exec:\jjfntv.exe97⤵PID:2988
-
\??\c:\lpjfnh.exec:\lpjfnh.exe98⤵PID:1468
-
\??\c:\dtnbfnd.exec:\dtnbfnd.exe99⤵PID:3696
-
\??\c:\bdtlbfl.exec:\bdtlbfl.exe100⤵PID:624
-
\??\c:\dfvhbv.exec:\dfvhbv.exe101⤵PID:4264
-
\??\c:\flxjjv.exec:\flxjjv.exe102⤵PID:4052
-
\??\c:\xffhpr.exec:\xffhpr.exe103⤵PID:5052
-
\??\c:\lltpf.exec:\lltpf.exe104⤵PID:3296
-
\??\c:\bdjdj.exec:\bdjdj.exe105⤵PID:3152
-
\??\c:\vfxrj.exec:\vfxrj.exe106⤵PID:2580
-
\??\c:\vrxjhbn.exec:\vrxjhbn.exe107⤵PID:3624
-
\??\c:\llfrxtb.exec:\llfrxtb.exe108⤵PID:408
-
\??\c:\rtttt.exec:\rtttt.exe109⤵PID:4408
-
\??\c:\dtlrjlb.exec:\dtlrjlb.exe110⤵PID:2328
-
\??\c:\dprjj.exec:\dprjj.exe111⤵PID:1620
-
\??\c:\ffvnx.exec:\ffvnx.exe112⤵PID:3020
-
\??\c:\pxdfxb.exec:\pxdfxb.exe113⤵PID:2232
-
\??\c:\nlfxvn.exec:\nlfxvn.exe114⤵PID:1644
-
\??\c:\rxnvtv.exec:\rxnvtv.exe115⤵PID:4436
-
\??\c:\bldxnj.exec:\bldxnj.exe116⤵PID:536
-
\??\c:\dvtnv.exec:\dvtnv.exe117⤵PID:3928
-
\??\c:\vfdbdfn.exec:\vfdbdfn.exe118⤵PID:4216
-
\??\c:\ntjndrh.exec:\ntjndrh.exe119⤵PID:4184
-
\??\c:\flhrtpr.exec:\flhrtpr.exe120⤵PID:2784
-
\??\c:\pppbnj.exec:\pppbnj.exe121⤵PID:1844
-
\??\c:\tdrdlh.exec:\tdrdlh.exe122⤵PID:868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-