Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 00:22
Behavioral task
behavioral1
Sample
8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe
-
Size
73KB
-
MD5
4af63e0bcfbb51c69c20e11badc12931
-
SHA1
f90c4bdb305146ddc1e264727b9fce64cf51a820
-
SHA256
8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4
-
SHA512
911da05db59a0bcce3347e9add00ffc4fd81d2d2071cd237cae8b2a280b091b43d06963df1beb6f271359f721caa14161e2bf9714d010d6589e98bd3f3313f8f
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cn/uiYs6Ug:xhOmTsF93UYfwC6GIout0fmCnmiYJUg
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1664-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-293-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1664-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-356-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2904-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-512-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1404-508-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2040-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-316-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2644-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-190-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2812-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/372-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-95-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1664-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1664-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000c00000001224e-5.dat UPX behavioral1/files/0x0007000000015c7c-35.dat UPX behavioral1/files/0x0007000000015c87-43.dat UPX behavioral1/files/0x00080000000165ae-60.dat UPX behavioral1/memory/2672-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000018ae2-83.dat UPX behavioral1/memory/2804-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000018ae8-92.dat UPX behavioral1/files/0x0006000000018b15-102.dat UPX behavioral1/memory/2652-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000018b37-117.dat UPX behavioral1/memory/2812-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1636-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000018b6a-141.dat UPX behavioral1/files/0x0006000000018b73-150.dat UPX behavioral1/memory/2400-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2400-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1196-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000018d06-180.dat UPX behavioral1/files/0x000500000001931b-202.dat UPX behavioral1/files/0x0005000000019333-210.dat UPX behavioral1/files/0x0005000000019368-217.dat UPX behavioral1/files/0x0005000000019377-224.dat UPX behavioral1/files/0x000500000001939b-231.dat UPX behavioral1/files/0x00050000000193b0-240.dat UPX behavioral1/files/0x0005000000019410-246.dat UPX behavioral1/files/0x000500000001946b-254.dat UPX behavioral1/memory/2976-266-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/980-260-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2416-305-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1664-299-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1564-317-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/884-328-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1172-379-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2904-378-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2840-395-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1888-408-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2788-414-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1164-420-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2724-446-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2424-564-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2040-505-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2336-627-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2228-591-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2824-485-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2744-462-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2816-407-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2816-401-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2348-359-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2908-330-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1476-287-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2644-239-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3068-212-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1996-209-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00050000000192f4-195.dat UPX behavioral1/files/0x00050000000192c9-187.dat UPX behavioral1/files/0x0010000000015c3c-173.dat UPX behavioral1/files/0x0006000000018ba2-166.dat UPX behavioral1/files/0x0006000000018b96-158.dat UPX behavioral1/files/0x0006000000018b4a-134.dat UPX behavioral1/memory/2812-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000018b42-126.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 2300 hxrxbjt.exe 2992 lnnlbb.exe 2968 tttxlvp.exe 2540 rtfnjd.exe 2456 ljnrrlj.exe 2512 rxhvb.exe 2672 vrrrhdn.exe 2496 nfnnf.exe 2348 rxbddjr.exe 2804 rbjhrr.exe 2844 ldfldj.exe 1332 txbjfpr.exe 372 nrtvjll.exe 2652 nltbpxh.exe 2812 xplfr.exe 1636 lpvtpl.exe 1988 jrvdhv.exe 2400 bjjbjdl.exe 1196 hhxrx.exe 768 ptpnvd.exe 1996 txftvt.exe 2740 nlpfbnr.exe 2972 dlnln.exe 2084 ptxfhxx.exe 1404 rjrtxjr.exe 3068 hnbnp.exe 1544 bbbhvnb.exe 1532 ftlxf.exe 2644 lljbflb.exe 3016 hdnhtrj.exe 2020 fxxtx.exe 980 vjtrh.exe 2976 jdphn.exe 1464 bhhlx.exe 1660 tjdrbvd.exe 240 vxphj.exe 2780 bdvvdh.exe 1476 tnlvhnr.exe 2168 jptfrrv.exe 1664 plvjfft.exe 2416 nfttdhb.exe 1564 xbpxvrv.exe 2532 flfbpfp.exe 884 tbbldnv.exe 2908 bbxrbnx.exe 2640 vffhhtf.exe 2704 btrxn.exe 2364 rflxnf.exe 2496 jbtbvpf.exe 2348 ffnjtd.exe 1916 lvlfb.exe 2504 vdrfbdx.exe 2904 prdlb.exe 1172 flttndp.exe 2996 ndnpl.exe 2840 hpfpj.exe 1116 bdnrp.exe 2816 rfntllf.exe 1888 bftlv.exe 2788 bdptbtf.exe 1164 vtdvtf.exe 1176 xjxvnr.exe 1720 vtnxb.exe 2256 vtjhxd.exe -
resource yara_rule behavioral1/memory/1664-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001224e-5.dat upx behavioral1/files/0x0007000000015c7c-35.dat upx behavioral1/files/0x0007000000015c87-43.dat upx behavioral1/files/0x00080000000165ae-60.dat upx behavioral1/memory/2672-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ae2-83.dat upx behavioral1/memory/2804-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ae8-92.dat upx behavioral1/files/0x0006000000018b15-102.dat upx behavioral1/memory/2652-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b37-117.dat upx behavioral1/memory/2812-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b6a-141.dat upx behavioral1/files/0x0006000000018b73-150.dat upx behavioral1/memory/2400-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1196-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d06-180.dat upx behavioral1/files/0x000500000001931b-202.dat upx behavioral1/files/0x0005000000019333-210.dat upx behavioral1/files/0x0005000000019368-217.dat upx behavioral1/files/0x0005000000019377-224.dat upx behavioral1/files/0x000500000001939b-231.dat upx behavioral1/files/0x00050000000193b0-240.dat upx behavioral1/files/0x0005000000019410-246.dat upx behavioral1/files/0x000500000001946b-254.dat upx behavioral1/memory/2976-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/980-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1564-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/884-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1172-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1888-408-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-414-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1164-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-446-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2424-564-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-505-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2336-627-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-591-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-485-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-407-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-401-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-359-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1476-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192f4-195.dat upx behavioral1/files/0x00050000000192c9-187.dat upx behavioral1/files/0x0010000000015c3c-173.dat upx behavioral1/files/0x0006000000018ba2-166.dat upx behavioral1/files/0x0006000000018b96-158.dat upx behavioral1/files/0x0006000000018b4a-134.dat upx behavioral1/memory/2812-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-126.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2300 1664 8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe 28 PID 1664 wrote to memory of 2300 1664 8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe 28 PID 1664 wrote to memory of 2300 1664 8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe 28 PID 1664 wrote to memory of 2300 1664 8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe 28 PID 2300 wrote to memory of 2992 2300 hxrxbjt.exe 29 PID 2300 wrote to memory of 2992 2300 hxrxbjt.exe 29 PID 2300 wrote to memory of 2992 2300 hxrxbjt.exe 29 PID 2300 wrote to memory of 2992 2300 hxrxbjt.exe 29 PID 2992 wrote to memory of 2968 2992 lnnlbb.exe 30 PID 2992 wrote to memory of 2968 2992 lnnlbb.exe 30 PID 2992 wrote to memory of 2968 2992 lnnlbb.exe 30 PID 2992 wrote to memory of 2968 2992 lnnlbb.exe 30 PID 2968 wrote to memory of 2540 2968 tttxlvp.exe 31 PID 2968 wrote to memory of 2540 2968 tttxlvp.exe 31 PID 2968 wrote to memory of 2540 2968 tttxlvp.exe 31 PID 2968 wrote to memory of 2540 2968 tttxlvp.exe 31 PID 2540 wrote to memory of 2456 2540 rtfnjd.exe 32 PID 2540 wrote to memory of 2456 2540 rtfnjd.exe 32 PID 2540 wrote to memory of 2456 2540 rtfnjd.exe 32 PID 2540 wrote to memory of 2456 2540 rtfnjd.exe 32 PID 2456 wrote to memory of 2512 2456 ljnrrlj.exe 33 PID 2456 wrote to memory of 2512 2456 ljnrrlj.exe 33 PID 2456 wrote to memory of 2512 2456 ljnrrlj.exe 33 PID 2456 wrote to memory of 2512 2456 ljnrrlj.exe 33 PID 2512 wrote to memory of 2672 2512 rxhvb.exe 34 PID 2512 wrote to memory of 2672 2512 rxhvb.exe 34 PID 2512 wrote to memory of 2672 2512 rxhvb.exe 34 PID 2512 wrote to memory of 2672 2512 rxhvb.exe 34 PID 2672 wrote to memory of 2496 2672 vrrrhdn.exe 35 PID 2672 wrote to memory of 2496 2672 vrrrhdn.exe 35 PID 2672 wrote to memory of 2496 2672 vrrrhdn.exe 35 PID 2672 wrote to memory of 2496 2672 vrrrhdn.exe 35 PID 2496 wrote to memory of 2348 2496 nfnnf.exe 36 PID 2496 wrote to memory of 2348 2496 nfnnf.exe 36 PID 2496 wrote to memory of 2348 2496 nfnnf.exe 36 PID 2496 wrote to memory of 2348 2496 nfnnf.exe 36 PID 2348 wrote to memory of 2804 2348 rxbddjr.exe 37 PID 2348 wrote to memory of 2804 2348 rxbddjr.exe 37 PID 2348 wrote to memory of 2804 2348 rxbddjr.exe 37 PID 2348 wrote to memory of 2804 2348 rxbddjr.exe 37 PID 2804 wrote to memory of 2844 2804 rbjhrr.exe 38 PID 2804 wrote to memory of 2844 2804 rbjhrr.exe 38 PID 2804 wrote to memory of 2844 2804 rbjhrr.exe 38 PID 2804 wrote to memory of 2844 2804 rbjhrr.exe 38 PID 2844 wrote to memory of 1332 2844 ldfldj.exe 39 PID 2844 wrote to memory of 1332 2844 ldfldj.exe 39 PID 2844 wrote to memory of 1332 2844 ldfldj.exe 39 PID 2844 wrote to memory of 1332 2844 ldfldj.exe 39 PID 1332 wrote to memory of 372 1332 txbjfpr.exe 40 PID 1332 wrote to memory of 372 1332 txbjfpr.exe 40 PID 1332 wrote to memory of 372 1332 txbjfpr.exe 40 PID 1332 wrote to memory of 372 1332 txbjfpr.exe 40 PID 372 wrote to memory of 2652 372 nrtvjll.exe 41 PID 372 wrote to memory of 2652 372 nrtvjll.exe 41 PID 372 wrote to memory of 2652 372 nrtvjll.exe 41 PID 372 wrote to memory of 2652 372 nrtvjll.exe 41 PID 2652 wrote to memory of 2812 2652 nltbpxh.exe 42 PID 2652 wrote to memory of 2812 2652 nltbpxh.exe 42 PID 2652 wrote to memory of 2812 2652 nltbpxh.exe 42 PID 2652 wrote to memory of 2812 2652 nltbpxh.exe 42 PID 2812 wrote to memory of 1636 2812 xplfr.exe 43 PID 2812 wrote to memory of 1636 2812 xplfr.exe 43 PID 2812 wrote to memory of 1636 2812 xplfr.exe 43 PID 2812 wrote to memory of 1636 2812 xplfr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe"C:\Users\Admin\AppData\Local\Temp\8e7ffd15f4fa0ce6eee30ee3785d6cd16dac80e2820338ff9af5e1bef25d13a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\hxrxbjt.exec:\hxrxbjt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\lnnlbb.exec:\lnnlbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tttxlvp.exec:\tttxlvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rtfnjd.exec:\rtfnjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\ljnrrlj.exec:\ljnrrlj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rxhvb.exec:\rxhvb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vrrrhdn.exec:\vrrrhdn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nfnnf.exec:\nfnnf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rxbddjr.exec:\rxbddjr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rbjhrr.exec:\rbjhrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ldfldj.exec:\ldfldj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\txbjfpr.exec:\txbjfpr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\nrtvjll.exec:\nrtvjll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\nltbpxh.exec:\nltbpxh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xplfr.exec:\xplfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lpvtpl.exec:\lpvtpl.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jrvdhv.exec:\jrvdhv.exe18⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bjjbjdl.exec:\bjjbjdl.exe19⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhxrx.exec:\hhxrx.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ptpnvd.exec:\ptpnvd.exe21⤵
- Executes dropped EXE
PID:768 -
\??\c:\txftvt.exec:\txftvt.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nlpfbnr.exec:\nlpfbnr.exe23⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dlnln.exec:\dlnln.exe24⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ptxfhxx.exec:\ptxfhxx.exe25⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rjrtxjr.exec:\rjrtxjr.exe26⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnbnp.exec:\hnbnp.exe27⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bbbhvnb.exec:\bbbhvnb.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ftlxf.exec:\ftlxf.exe29⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lljbflb.exec:\lljbflb.exe30⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hdnhtrj.exec:\hdnhtrj.exe31⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fxxtx.exec:\fxxtx.exe32⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vjtrh.exec:\vjtrh.exe33⤵
- Executes dropped EXE
PID:980 -
\??\c:\jdphn.exec:\jdphn.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bhhlx.exec:\bhhlx.exe35⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tjdrbvd.exec:\tjdrbvd.exe36⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vxphj.exec:\vxphj.exe37⤵
- Executes dropped EXE
PID:240 -
\??\c:\bdvvdh.exec:\bdvvdh.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnlvhnr.exec:\tnlvhnr.exe39⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jptfrrv.exec:\jptfrrv.exe40⤵
- Executes dropped EXE
PID:2168 -
\??\c:\plvjfft.exec:\plvjfft.exe41⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nfttdhb.exec:\nfttdhb.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xbpxvrv.exec:\xbpxvrv.exe43⤵
- Executes dropped EXE
PID:1564 -
\??\c:\flfbpfp.exec:\flfbpfp.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tbbldnv.exec:\tbbldnv.exe45⤵
- Executes dropped EXE
PID:884 -
\??\c:\bbxrbnx.exec:\bbxrbnx.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vffhhtf.exec:\vffhhtf.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\btrxn.exec:\btrxn.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rflxnf.exec:\rflxnf.exe49⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jbtbvpf.exec:\jbtbvpf.exe50⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ffnjtd.exec:\ffnjtd.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lvlfb.exec:\lvlfb.exe52⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vdrfbdx.exec:\vdrfbdx.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\prdlb.exec:\prdlb.exe54⤵
- Executes dropped EXE
PID:2904 -
\??\c:\flttndp.exec:\flttndp.exe55⤵
- Executes dropped EXE
PID:1172 -
\??\c:\ndnpl.exec:\ndnpl.exe56⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hpfpj.exec:\hpfpj.exe57⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bdnrp.exec:\bdnrp.exe58⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rfntllf.exec:\rfntllf.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bftlv.exec:\bftlv.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bdptbtf.exec:\bdptbtf.exe61⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vtdvtf.exec:\vtdvtf.exe62⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xjxvnr.exec:\xjxvnr.exe63⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vtnxb.exec:\vtnxb.exe64⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vtjhxd.exec:\vtjhxd.exe65⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pvlvfp.exec:\pvlvfp.exe66⤵PID:2724
-
\??\c:\xjrft.exec:\xjrft.exe67⤵PID:1996
-
\??\c:\prlflx.exec:\prlflx.exe68⤵PID:1712
-
\??\c:\pffrtx.exec:\pffrtx.exe69⤵PID:2744
-
\??\c:\rxxxj.exec:\rxxxj.exe70⤵PID:2712
-
\??\c:\bbbbln.exec:\bbbbln.exe71⤵PID:2852
-
\??\c:\dxttjx.exec:\dxttjx.exe72⤵PID:1404
-
\??\c:\lrddbpl.exec:\lrddbpl.exe73⤵PID:2988
-
\??\c:\rlbxvr.exec:\rlbxvr.exe74⤵PID:2824
-
\??\c:\ntbvl.exec:\ntbvl.exe75⤵PID:1612
-
\??\c:\bbxfl.exec:\bbxfl.exe76⤵PID:1548
-
\??\c:\bfrdnr.exec:\bfrdnr.exe77⤵PID:2040
-
\??\c:\pfjlbx.exec:\pfjlbx.exe78⤵PID:2044
-
\??\c:\hdrxttx.exec:\hdrxttx.exe79⤵PID:2984
-
\??\c:\brnnx.exec:\brnnx.exe80⤵PID:2112
-
\??\c:\xrvhfdd.exec:\xrvhfdd.exe81⤵PID:2056
-
\??\c:\bfnrvnh.exec:\bfnrvnh.exe82⤵PID:880
-
\??\c:\dfttjh.exec:\dfttjh.exe83⤵PID:916
-
\??\c:\jlhhnr.exec:\jlhhnr.exe84⤵PID:2748
-
\??\c:\pfppv.exec:\pfppv.exe85⤵PID:1676
-
\??\c:\tnvtdx.exec:\tnvtdx.exe86⤵PID:2092
-
\??\c:\lxbnfj.exec:\lxbnfj.exe87⤵PID:2172
-
\??\c:\phxjxtf.exec:\phxjxtf.exe88⤵PID:2520
-
\??\c:\xlhhph.exec:\xlhhph.exe89⤵PID:2424
-
\??\c:\bpbvjn.exec:\bpbvjn.exe90⤵PID:1584
-
\??\c:\tdphhfl.exec:\tdphhfl.exe91⤵PID:2620
-
\??\c:\rbjvtxh.exec:\rbjvtxh.exe92⤵PID:2540
-
\??\c:\xpbvhv.exec:\xpbvhv.exe93⤵PID:2448
-
\??\c:\xrjpph.exec:\xrjpph.exe94⤵PID:2228
-
\??\c:\vjpjllb.exec:\vjpjllb.exe95⤵PID:2380
-
\??\c:\pllnn.exec:\pllnn.exe96⤵PID:2344
-
\??\c:\fllntjh.exec:\fllntjh.exe97⤵PID:2012
-
\??\c:\xjxdxf.exec:\xjxdxf.exe98⤵PID:2800
-
\??\c:\jrdnxvx.exec:\jrdnxvx.exe99⤵PID:2340
-
\??\c:\njllff.exec:\njllff.exe100⤵PID:2500
-
\??\c:\nfrbt.exec:\nfrbt.exe101⤵PID:2336
-
\??\c:\vfdhdvn.exec:\vfdhdvn.exe102⤵PID:1956
-
\??\c:\hbxlp.exec:\hbxlp.exe103⤵PID:2904
-
\??\c:\dbtrnnf.exec:\dbtrnnf.exe104⤵PID:1732
-
\??\c:\rlvblr.exec:\rlvblr.exe105⤵PID:2828
-
\??\c:\bnjlrf.exec:\bnjlrf.exe106⤵PID:2008
-
\??\c:\bpxhbjx.exec:\bpxhbjx.exe107⤵PID:1300
-
\??\c:\vtrrrtd.exec:\vtrrrtd.exe108⤵PID:1540
-
\??\c:\xfprfpp.exec:\xfprfpp.exe109⤵PID:2432
-
\??\c:\lvbbnb.exec:\lvbbnb.exe110⤵PID:1400
-
\??\c:\vrphdvj.exec:\vrphdvj.exe111⤵PID:1772
-
\??\c:\hlttjxr.exec:\hlttjxr.exe112⤵PID:1176
-
\??\c:\vdhvhvf.exec:\vdhvhvf.exe113⤵PID:1720
-
\??\c:\jxhtv.exec:\jxhtv.exe114⤵PID:672
-
\??\c:\vbhdrnp.exec:\vbhdrnp.exe115⤵PID:2740
-
\??\c:\pjjfdpx.exec:\pjjfdpx.exe116⤵PID:580
-
\??\c:\pfntb.exec:\pfntb.exe117⤵PID:1472
-
\??\c:\fdvrrpn.exec:\fdvrrpn.exe118⤵PID:336
-
\??\c:\vlrhhvr.exec:\vlrhhvr.exe119⤵PID:584
-
\??\c:\xnxnxp.exec:\xnxnxp.exe120⤵PID:3064
-
\??\c:\nlphjp.exec:\nlphjp.exe121⤵PID:2544
-
\??\c:\tblbrb.exec:\tblbrb.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-