Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 23:50
Behavioral task
behavioral1
Sample
8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe
-
Size
205KB
-
MD5
b95793ca87f6834e4210a63a68f75483
-
SHA1
a7321604e34ea7c26a4778c95c605044af44a413
-
SHA256
8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e
-
SHA512
9c9e9d570cb0aa7e001704aa012d1b878c1599e0dd4b4b9e8b86a2abecbc192aa9c16cbb44a4e143890d663143de083ac7ad2b15eba7feb46ab156af91a68506
-
SSDEEP
6144:rcm4FmowdHoStBuhW246lCXb7YpdnSj6KsaB:x4wFHoSLjr0+HsaB
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2176-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2192-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2124-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2576-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2804-46-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2768-64-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2492-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/556-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1692-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2380-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1116-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2244-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2656-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1136-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2656-208-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/3008-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1740-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1780-245-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2136-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2912-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2060-296-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1668-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2228-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2840-342-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2732-349-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2736-356-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1336-404-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1108-467-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3016-508-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1740-533-0x0000000000280000-0x00000000002B6000-memory.dmp family_blackmoon behavioral1/memory/2960-605-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2524-680-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1140-749-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1604-788-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2880-813-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/2880-815-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2364-878-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2592-997-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2456-1005-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2176-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2176-8-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2176-3-0x0000000001BA0000-0x0000000001BD6000-memory.dmp UPX behavioral1/memory/2192-12-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x000b000000012280-10.dat UPX behavioral1/files/0x002d000000015c68-17.dat UPX behavioral1/memory/2124-27-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2576-28-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0008000000015cb2-25.dat UPX behavioral1/files/0x0007000000015cb9-35.dat UPX behavioral1/memory/2576-37-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000015cd2-44.dat UPX behavioral1/memory/2804-46-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2600-55-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000015cf2-53.dat UPX behavioral1/files/0x0009000000015dc5-65.dat UPX behavioral1/memory/2132-66-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0008000000016c2a-74.dat UPX behavioral1/files/0x0012000000015c83-81.dat UPX behavioral1/memory/2492-83-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016c76-90.dat UPX behavioral1/memory/556-92-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016c9d-102.dat UPX behavioral1/memory/556-101-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2700-111-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016ccb-110.dat UPX behavioral1/memory/1692-109-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2700-120-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016cdc-121.dat UPX behavioral1/files/0x0006000000016ce4-131.dat UPX behavioral1/memory/2380-130-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1116-141-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016cec-140.dat UPX behavioral1/files/0x0006000000016cf8-149.dat UPX behavioral1/memory/2244-157-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016cfe-158.dat UPX behavioral1/files/0x0006000000016d0a-166.dat UPX behavioral1/memory/2656-174-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d0f-173.dat UPX behavioral1/memory/1136-182-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d2b-183.dat UPX behavioral1/files/0x0006000000016d3c-191.dat UPX behavioral1/files/0x0006000000016d4c-199.dat UPX behavioral1/files/0x0006000000016d5b-207.dat UPX behavioral1/memory/1740-217-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d94-219.dat UPX behavioral1/memory/3008-218-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1740-226-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d98-227.dat UPX behavioral1/memory/2344-228-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016e6b-238.dat UPX behavioral1/memory/1780-237-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000017090-246.dat UPX behavioral1/files/0x00060000000170cf-254.dat UPX behavioral1/files/0x0006000000017578-262.dat UPX behavioral1/memory/2136-270-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x00060000000177fe-271.dat UPX behavioral1/files/0x001500000001861a-279.dat UPX behavioral1/files/0x00050000000186a7-289.dat UPX behavioral1/memory/2912-288-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2060-296-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1668-310-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2228-317-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2840-342-0x0000000000400000-0x0000000000436000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2192 vfplb.exe 2124 bdljffx.exe 2576 rhbfnbf.exe 2804 tjxbbdb.exe 2600 lxxntht.exe 2768 frlhhx.exe 2132 jndnlbr.exe 2492 nxlnd.exe 2936 vhdnx.exe 556 xhbhtl.exe 1692 xxvbft.exe 2700 fbjbtt.exe 2380 bpnhrx.exe 1116 jdpnltd.exe 756 vvflbbr.exe 2244 lhfdn.exe 2412 fvxnj.exe 2656 bbrdhfx.exe 1136 lrxtd.exe 1488 jtxfhfv.exe 1120 bvjfpd.exe 2884 jllxfn.exe 3008 jjtlrr.exe 1740 dxxfrb.exe 2344 jbhjllf.exe 1780 tbvdffr.exe 1532 tbldb.exe 3020 tllhhxv.exe 2136 brdxrp.exe 1452 brrhvld.exe 2912 jhhbr.exe 2060 vlpdbpb.exe 2960 xdfnblf.exe 1668 rvhpt.exe 2228 rlthttl.exe 2176 dlvtfj.exe 2192 jnjnfj.exe 1592 nfvhnfb.exe 2840 rjtvnn.exe 2732 flnfd.exe 2736 fjvdnxh.exe 2816 hpbbhxh.exe 2508 jdxtbt.exe 2608 rjbpvn.exe 2636 nvdrx.exe 2544 xbjfdnv.exe 2504 lpvfb.exe 1336 nxxlhvh.exe 2952 frnjjx.exe 2932 dxhxth.exe 2668 dxbrb.exe 1956 ltftdpl.exe 832 vfthn.exe 2380 ndpfrp.exe 1092 lnrvjh.exe 1972 jvxrnj.exe 2388 jdxxpl.exe 1108 brlbjf.exe 1384 hxvxbp.exe 2072 rnpnjb.exe 1648 ffxlnph.exe 1744 rfpbldd.exe 2304 jrbpjl.exe 2876 tbxfvlh.exe -
resource yara_rule behavioral1/memory/2176-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2176-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2176-3-0x0000000001BA0000-0x0000000001BD6000-memory.dmp upx behavioral1/memory/2192-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000012280-10.dat upx behavioral1/files/0x002d000000015c68-17.dat upx behavioral1/memory/2124-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2576-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015cb2-25.dat upx behavioral1/files/0x0007000000015cb9-35.dat upx behavioral1/memory/2576-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015cd2-44.dat upx behavioral1/memory/2804-46-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2600-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015cf2-53.dat upx behavioral1/memory/2768-63-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0009000000015dc5-65.dat upx behavioral1/memory/2768-64-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2132-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000016c2a-74.dat upx behavioral1/files/0x0012000000015c83-81.dat upx behavioral1/memory/2492-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c76-90.dat upx behavioral1/memory/556-92-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c9d-102.dat upx behavioral1/memory/556-101-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2700-111-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016ccb-110.dat upx behavioral1/memory/1692-109-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2700-120-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cdc-121.dat upx behavioral1/files/0x0006000000016ce4-131.dat upx behavioral1/memory/2380-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1116-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cec-140.dat upx behavioral1/files/0x0006000000016cf8-149.dat upx behavioral1/memory/2244-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cfe-158.dat upx behavioral1/files/0x0006000000016d0a-166.dat upx behavioral1/memory/2656-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d0f-173.dat upx behavioral1/memory/1136-182-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d2b-183.dat upx behavioral1/files/0x0006000000016d3c-191.dat upx behavioral1/files/0x0006000000016d4c-199.dat upx behavioral1/files/0x0006000000016d5b-207.dat upx behavioral1/memory/1740-217-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d94-219.dat upx behavioral1/memory/3008-218-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1740-226-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d98-227.dat upx behavioral1/memory/2344-228-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016e6b-238.dat upx behavioral1/memory/1780-237-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000017090-246.dat upx behavioral1/files/0x00060000000170cf-254.dat upx behavioral1/files/0x0006000000017578-262.dat upx behavioral1/memory/2136-270-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000177fe-271.dat upx behavioral1/files/0x001500000001861a-279.dat upx behavioral1/files/0x00050000000186a7-289.dat upx behavioral1/memory/2912-288-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2060-296-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1668-310-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2192 2176 8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe 28 PID 2176 wrote to memory of 2192 2176 8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe 28 PID 2176 wrote to memory of 2192 2176 8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe 28 PID 2176 wrote to memory of 2192 2176 8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe 28 PID 2192 wrote to memory of 2124 2192 vfplb.exe 29 PID 2192 wrote to memory of 2124 2192 vfplb.exe 29 PID 2192 wrote to memory of 2124 2192 vfplb.exe 29 PID 2192 wrote to memory of 2124 2192 vfplb.exe 29 PID 2124 wrote to memory of 2576 2124 bdljffx.exe 30 PID 2124 wrote to memory of 2576 2124 bdljffx.exe 30 PID 2124 wrote to memory of 2576 2124 bdljffx.exe 30 PID 2124 wrote to memory of 2576 2124 bdljffx.exe 30 PID 2576 wrote to memory of 2804 2576 rhbfnbf.exe 31 PID 2576 wrote to memory of 2804 2576 rhbfnbf.exe 31 PID 2576 wrote to memory of 2804 2576 rhbfnbf.exe 31 PID 2576 wrote to memory of 2804 2576 rhbfnbf.exe 31 PID 2804 wrote to memory of 2600 2804 tjxbbdb.exe 32 PID 2804 wrote to memory of 2600 2804 tjxbbdb.exe 32 PID 2804 wrote to memory of 2600 2804 tjxbbdb.exe 32 PID 2804 wrote to memory of 2600 2804 tjxbbdb.exe 32 PID 2600 wrote to memory of 2768 2600 lxxntht.exe 33 PID 2600 wrote to memory of 2768 2600 lxxntht.exe 33 PID 2600 wrote to memory of 2768 2600 lxxntht.exe 33 PID 2600 wrote to memory of 2768 2600 lxxntht.exe 33 PID 2768 wrote to memory of 2132 2768 frlhhx.exe 34 PID 2768 wrote to memory of 2132 2768 frlhhx.exe 34 PID 2768 wrote to memory of 2132 2768 frlhhx.exe 34 PID 2768 wrote to memory of 2132 2768 frlhhx.exe 34 PID 2132 wrote to memory of 2492 2132 jndnlbr.exe 35 PID 2132 wrote to memory of 2492 2132 jndnlbr.exe 35 PID 2132 wrote to memory of 2492 2132 jndnlbr.exe 35 PID 2132 wrote to memory of 2492 2132 jndnlbr.exe 35 PID 2492 wrote to memory of 2936 2492 nxlnd.exe 36 PID 2492 wrote to memory of 2936 2492 nxlnd.exe 36 PID 2492 wrote to memory of 2936 2492 nxlnd.exe 36 PID 2492 wrote to memory of 2936 2492 nxlnd.exe 36 PID 2936 wrote to memory of 556 2936 vhdnx.exe 37 PID 2936 wrote to memory of 556 2936 vhdnx.exe 37 PID 2936 wrote to memory of 556 2936 vhdnx.exe 37 PID 2936 wrote to memory of 556 2936 vhdnx.exe 37 PID 556 wrote to memory of 1692 556 xhbhtl.exe 38 PID 556 wrote to memory of 1692 556 xhbhtl.exe 38 PID 556 wrote to memory of 1692 556 xhbhtl.exe 38 PID 556 wrote to memory of 1692 556 xhbhtl.exe 38 PID 1692 wrote to memory of 2700 1692 xxvbft.exe 39 PID 1692 wrote to memory of 2700 1692 xxvbft.exe 39 PID 1692 wrote to memory of 2700 1692 xxvbft.exe 39 PID 1692 wrote to memory of 2700 1692 xxvbft.exe 39 PID 2700 wrote to memory of 2380 2700 fbjbtt.exe 40 PID 2700 wrote to memory of 2380 2700 fbjbtt.exe 40 PID 2700 wrote to memory of 2380 2700 fbjbtt.exe 40 PID 2700 wrote to memory of 2380 2700 fbjbtt.exe 40 PID 2380 wrote to memory of 1116 2380 bpnhrx.exe 41 PID 2380 wrote to memory of 1116 2380 bpnhrx.exe 41 PID 2380 wrote to memory of 1116 2380 bpnhrx.exe 41 PID 2380 wrote to memory of 1116 2380 bpnhrx.exe 41 PID 1116 wrote to memory of 756 1116 jdpnltd.exe 42 PID 1116 wrote to memory of 756 1116 jdpnltd.exe 42 PID 1116 wrote to memory of 756 1116 jdpnltd.exe 42 PID 1116 wrote to memory of 756 1116 jdpnltd.exe 42 PID 756 wrote to memory of 2244 756 vvflbbr.exe 43 PID 756 wrote to memory of 2244 756 vvflbbr.exe 43 PID 756 wrote to memory of 2244 756 vvflbbr.exe 43 PID 756 wrote to memory of 2244 756 vvflbbr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe"C:\Users\Admin\AppData\Local\Temp\8f0e8a2825ce3e716f5e99fedf5004972f0284b89b4cf0251b01778b8684bf9e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\vfplb.exec:\vfplb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bdljffx.exec:\bdljffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\rhbfnbf.exec:\rhbfnbf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tjxbbdb.exec:\tjxbbdb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lxxntht.exec:\lxxntht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\frlhhx.exec:\frlhhx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jndnlbr.exec:\jndnlbr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nxlnd.exec:\nxlnd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vhdnx.exec:\vhdnx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xhbhtl.exec:\xhbhtl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\xxvbft.exec:\xxvbft.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\fbjbtt.exec:\fbjbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bpnhrx.exec:\bpnhrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\jdpnltd.exec:\jdpnltd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\vvflbbr.exec:\vvflbbr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lhfdn.exec:\lhfdn.exe17⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fvxnj.exec:\fvxnj.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bbrdhfx.exec:\bbrdhfx.exe19⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lrxtd.exec:\lrxtd.exe20⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jtxfhfv.exec:\jtxfhfv.exe21⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bvjfpd.exec:\bvjfpd.exe22⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jllxfn.exec:\jllxfn.exe23⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jjtlrr.exec:\jjtlrr.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dxxfrb.exec:\dxxfrb.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jbhjllf.exec:\jbhjllf.exe26⤵
- Executes dropped EXE
PID:2344 -
\??\c:\tbvdffr.exec:\tbvdffr.exe27⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tbldb.exec:\tbldb.exe28⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tllhhxv.exec:\tllhhxv.exe29⤵
- Executes dropped EXE
PID:3020 -
\??\c:\brdxrp.exec:\brdxrp.exe30⤵
- Executes dropped EXE
PID:2136 -
\??\c:\brrhvld.exec:\brrhvld.exe31⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jhhbr.exec:\jhhbr.exe32⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vlpdbpb.exec:\vlpdbpb.exe33⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xdfnblf.exec:\xdfnblf.exe34⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rvhpt.exec:\rvhpt.exe35⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlthttl.exec:\rlthttl.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dlvtfj.exec:\dlvtfj.exe37⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jnjnfj.exec:\jnjnfj.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nfvhnfb.exec:\nfvhnfb.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rjtvnn.exec:\rjtvnn.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\flnfd.exec:\flnfd.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fjvdnxh.exec:\fjvdnxh.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hpbbhxh.exec:\hpbbhxh.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jdxtbt.exec:\jdxtbt.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rjbpvn.exec:\rjbpvn.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nvdrx.exec:\nvdrx.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xbjfdnv.exec:\xbjfdnv.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lpvfb.exec:\lpvfb.exe48⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nxxlhvh.exec:\nxxlhvh.exe49⤵
- Executes dropped EXE
PID:1336 -
\??\c:\frnjjx.exec:\frnjjx.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dxhxth.exec:\dxhxth.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dxbrb.exec:\dxbrb.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ltftdpl.exec:\ltftdpl.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vfthn.exec:\vfthn.exe54⤵
- Executes dropped EXE
PID:832 -
\??\c:\ndpfrp.exec:\ndpfrp.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lnrvjh.exec:\lnrvjh.exe56⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jvxrnj.exec:\jvxrnj.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jdxxpl.exec:\jdxxpl.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\brlbjf.exec:\brlbjf.exe59⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hxvxbp.exec:\hxvxbp.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rnpnjb.exec:\rnpnjb.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ffxlnph.exec:\ffxlnph.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rfpbldd.exec:\rfpbldd.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jrbpjl.exec:\jrbpjl.exe64⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tbxfvlh.exec:\tbxfvlh.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rdlnpbf.exec:\rdlnpbf.exe66⤵PID:3016
-
\??\c:\lbdfdrv.exec:\lbdfdrv.exe67⤵PID:2040
-
\??\c:\vjdfl.exec:\vjdfl.exe68⤵PID:1068
-
\??\c:\lblpvlj.exec:\lblpvlj.exe69⤵PID:1740
-
\??\c:\pbbrvv.exec:\pbbrvv.exe70⤵PID:2012
-
\??\c:\vjtjnxj.exec:\vjtjnxj.exe71⤵PID:1896
-
\??\c:\rdllvv.exec:\rdllvv.exe72⤵PID:1904
-
\??\c:\jlbfrjb.exec:\jlbfrjb.exe73⤵PID:2756
-
\??\c:\nxvpfx.exec:\nxvpfx.exe74⤵PID:1600
-
\??\c:\rjvvb.exec:\rjvvb.exe75⤵PID:284
-
\??\c:\vhnrtn.exec:\vhnrtn.exe76⤵PID:2360
-
\??\c:\bndph.exec:\bndph.exe77⤵PID:2236
-
\??\c:\trflrx.exec:\trflrx.exe78⤵PID:1728
-
\??\c:\fdthxnn.exec:\fdthxnn.exe79⤵PID:2060
-
\??\c:\rbphf.exec:\rbphf.exe80⤵PID:2960
-
\??\c:\bfhfj.exec:\bfhfj.exe81⤵PID:2424
-
\??\c:\lrddjfl.exec:\lrddjfl.exe82⤵PID:2228
-
\??\c:\rnrjtp.exec:\rnrjtp.exe83⤵PID:2076
-
\??\c:\lbbhj.exec:\lbbhj.exe84⤵PID:2812
-
\??\c:\vjxbbrh.exec:\vjxbbrh.exe85⤵PID:1708
-
\??\c:\lvtdl.exec:\lvtdl.exe86⤵PID:2752
-
\??\c:\fphtrdx.exec:\fphtrdx.exe87⤵PID:2576
-
\??\c:\djpnvjp.exec:\djpnvjp.exe88⤵PID:2868
-
\??\c:\fdrnt.exec:\fdrnt.exe89⤵PID:2480
-
\??\c:\dtbvtvl.exec:\dtbvtvl.exe90⤵PID:1312
-
\??\c:\jpfpfh.exec:\jpfpfh.exe91⤵PID:2852
-
\??\c:\vfftxt.exec:\vfftxt.exe92⤵PID:2836
-
\??\c:\vvnfnb.exec:\vvnfnb.exe93⤵PID:2524
-
\??\c:\xtlfx.exec:\xtlfx.exe94⤵PID:2484
-
\??\c:\lxjjlt.exec:\lxjjlt.exe95⤵PID:2028
-
\??\c:\vnvtv.exec:\vnvtv.exe96⤵PID:264
-
\??\c:\ftvjp.exec:\ftvjp.exe97⤵PID:1976
-
\??\c:\hhjpjrb.exec:\hhjpjrb.exe98⤵PID:1364
-
\??\c:\dbfhdhj.exec:\dbfhdhj.exe99⤵PID:2776
-
\??\c:\nhxpp.exec:\nhxpp.exe100⤵PID:1128
-
\??\c:\nhjdjbn.exec:\nhjdjbn.exe101⤵PID:932
-
\??\c:\nbxnv.exec:\nbxnv.exe102⤵PID:1656
-
\??\c:\dffphtb.exec:\dffphtb.exe103⤵PID:1140
-
\??\c:\vhffthl.exec:\vhffthl.exe104⤵PID:1564
-
\??\c:\xlttvlh.exec:\xlttvlh.exe105⤵PID:1972
-
\??\c:\xrndlp.exec:\xrndlp.exe106⤵PID:2244
-
\??\c:\njfjfxd.exec:\njfjfxd.exe107⤵PID:1804
-
\??\c:\lfphvlh.exec:\lfphvlh.exe108⤵PID:1984
-
\??\c:\nnlhrpl.exec:\nnlhrpl.exe109⤵PID:1604
-
\??\c:\nffxlx.exec:\nffxlx.exe110⤵PID:1648
-
\??\c:\nfptpj.exec:\nfptpj.exe111⤵PID:1444
-
\??\c:\hrhvdp.exec:\hrhvdp.exe112⤵PID:1120
-
\??\c:\njnxfpb.exec:\njnxfpb.exe113⤵PID:2880
-
\??\c:\rnnld.exec:\rnnld.exe114⤵PID:2320
-
\??\c:\dphlfr.exec:\dphlfr.exe115⤵PID:392
-
\??\c:\xvlbn.exec:\xvlbn.exe116⤵PID:3056
-
\??\c:\njxlr.exec:\njxlr.exe117⤵PID:3064
-
\??\c:\ddvdd.exec:\ddvdd.exe118⤵PID:1780
-
\??\c:\lfhhffn.exec:\lfhhffn.exe119⤵PID:1896
-
\??\c:\brxlp.exec:\brxlp.exe120⤵PID:1164
-
\??\c:\brntfpn.exec:\brntfpn.exe121⤵PID:1812
-
\??\c:\vdrxvrd.exec:\vdrxvrd.exe122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-