Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe
-
Size
229KB
-
MD5
20dfc6eb8377513ad0500f565bd49150
-
SHA1
537f512d80b7020f974598ab7dd65191c6dca50c
-
SHA256
f0d7d0a5a80e1013d69efca5c953d96b91811d701c9a704f2981d89c3f60782d
-
SHA512
1d0acc7ab94eb044940e576de080c5408184d710c5376e745492c5d90e043a37eeb2b66ad31ba5e52a93d0ae5024d254861ed69855fde4dd5bbb6ff1f552f6fd
-
SSDEEP
6144:n3C9BRo7tvnJ9oEz2Eu9XgcVyDOoZU0Wm4:n3C9ytvnV2NQAo20Wm4
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral2/memory/3588-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3872 ldpdrl.exe 2872 nrtrfhj.exe 1680 jhfdvxf.exe 2856 vlrxbf.exe 3400 jlxlp.exe 3560 hhdnrh.exe 1216 bpbrtl.exe 1228 trfvv.exe 1324 pndnlrp.exe 4800 hxhlxft.exe 4420 nrhrnp.exe 512 htxvf.exe 3708 ppxlph.exe 1800 rtpdf.exe 4772 tjvxvf.exe 2484 xpldxth.exe 3772 hnjxb.exe 2220 hvfdvdv.exe 4788 jdtphdl.exe 4708 rtrdxff.exe 3776 tfxxx.exe 1352 bflrf.exe 116 fdpbvd.exe 1376 dnjlxd.exe 3828 npdxp.exe 4076 rdfdpld.exe 3236 jfjxjdl.exe 904 rjnxt.exe 4136 xlfthlr.exe 4140 tpxxbdb.exe 3512 lfpdp.exe 4912 vdpbrbx.exe 2356 jtdjfvf.exe 4476 njlbp.exe 3656 jhfhpd.exe 4992 lndrxd.exe 3872 lptndn.exe 456 txrnnt.exe 2724 tpjjd.exe 2312 txrxr.exe 3476 ltfpvtj.exe 216 tvxvpr.exe 4380 dhnhvx.exe 4384 lnlltp.exe 1308 phfhjlt.exe 4976 fddtrb.exe 2296 prvvhvx.exe 2348 xfphxx.exe 4324 jjrndjl.exe 5008 nhntn.exe 3964 pxbhppn.exe 1120 rxvft.exe 3564 jhbjnxn.exe 336 dtbdv.exe 820 hldrvn.exe 1348 hpbvdjr.exe 3684 rtpdfd.exe 4568 lllxddn.exe 4612 rjxhx.exe 4908 dvpnrtp.exe 5056 trdvv.exe 3416 lxbprl.exe 2128 ddnhlp.exe 4292 btdtbd.exe -
resource yara_rule behavioral2/memory/3588-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3872 3588 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 81 PID 3588 wrote to memory of 3872 3588 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 81 PID 3588 wrote to memory of 3872 3588 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 81 PID 3872 wrote to memory of 2872 3872 ldpdrl.exe 82 PID 3872 wrote to memory of 2872 3872 ldpdrl.exe 82 PID 3872 wrote to memory of 2872 3872 ldpdrl.exe 82 PID 2872 wrote to memory of 1680 2872 nrtrfhj.exe 83 PID 2872 wrote to memory of 1680 2872 nrtrfhj.exe 83 PID 2872 wrote to memory of 1680 2872 nrtrfhj.exe 83 PID 1680 wrote to memory of 2856 1680 jhfdvxf.exe 85 PID 1680 wrote to memory of 2856 1680 jhfdvxf.exe 85 PID 1680 wrote to memory of 2856 1680 jhfdvxf.exe 85 PID 2856 wrote to memory of 3400 2856 vlrxbf.exe 86 PID 2856 wrote to memory of 3400 2856 vlrxbf.exe 86 PID 2856 wrote to memory of 3400 2856 vlrxbf.exe 86 PID 3400 wrote to memory of 3560 3400 jlxlp.exe 87 PID 3400 wrote to memory of 3560 3400 jlxlp.exe 87 PID 3400 wrote to memory of 3560 3400 jlxlp.exe 87 PID 3560 wrote to memory of 1216 3560 hhdnrh.exe 88 PID 3560 wrote to memory of 1216 3560 hhdnrh.exe 88 PID 3560 wrote to memory of 1216 3560 hhdnrh.exe 88 PID 1216 wrote to memory of 1228 1216 bpbrtl.exe 89 PID 1216 wrote to memory of 1228 1216 bpbrtl.exe 89 PID 1216 wrote to memory of 1228 1216 bpbrtl.exe 89 PID 1228 wrote to memory of 1324 1228 trfvv.exe 90 PID 1228 wrote to memory of 1324 1228 trfvv.exe 90 PID 1228 wrote to memory of 1324 1228 trfvv.exe 90 PID 1324 wrote to memory of 4800 1324 pndnlrp.exe 91 PID 1324 wrote to memory of 4800 1324 pndnlrp.exe 91 PID 1324 wrote to memory of 4800 1324 pndnlrp.exe 91 PID 4800 wrote to memory of 4420 4800 hxhlxft.exe 92 PID 4800 wrote to memory of 4420 4800 hxhlxft.exe 92 PID 4800 wrote to memory of 4420 4800 hxhlxft.exe 92 PID 4420 wrote to memory of 512 4420 nrhrnp.exe 93 PID 4420 wrote to memory of 512 4420 nrhrnp.exe 93 PID 4420 wrote to memory of 512 4420 nrhrnp.exe 93 PID 512 wrote to memory of 3708 512 htxvf.exe 94 PID 512 wrote to memory of 3708 512 htxvf.exe 94 PID 512 wrote to memory of 3708 512 htxvf.exe 94 PID 3708 wrote to memory of 1800 3708 ppxlph.exe 95 PID 3708 wrote to memory of 1800 3708 ppxlph.exe 95 PID 3708 wrote to memory of 1800 3708 ppxlph.exe 95 PID 1800 wrote to memory of 4772 1800 rtpdf.exe 96 PID 1800 wrote to memory of 4772 1800 rtpdf.exe 96 PID 1800 wrote to memory of 4772 1800 rtpdf.exe 96 PID 4772 wrote to memory of 2484 4772 tjvxvf.exe 97 PID 4772 wrote to memory of 2484 4772 tjvxvf.exe 97 PID 4772 wrote to memory of 2484 4772 tjvxvf.exe 97 PID 2484 wrote to memory of 3772 2484 xpldxth.exe 98 PID 2484 wrote to memory of 3772 2484 xpldxth.exe 98 PID 2484 wrote to memory of 3772 2484 xpldxth.exe 98 PID 3772 wrote to memory of 2220 3772 hnjxb.exe 99 PID 3772 wrote to memory of 2220 3772 hnjxb.exe 99 PID 3772 wrote to memory of 2220 3772 hnjxb.exe 99 PID 2220 wrote to memory of 4788 2220 hvfdvdv.exe 100 PID 2220 wrote to memory of 4788 2220 hvfdvdv.exe 100 PID 2220 wrote to memory of 4788 2220 hvfdvdv.exe 100 PID 4788 wrote to memory of 4708 4788 jdtphdl.exe 101 PID 4788 wrote to memory of 4708 4788 jdtphdl.exe 101 PID 4788 wrote to memory of 4708 4788 jdtphdl.exe 101 PID 4708 wrote to memory of 3776 4708 rtrdxff.exe 102 PID 4708 wrote to memory of 3776 4708 rtrdxff.exe 102 PID 4708 wrote to memory of 3776 4708 rtrdxff.exe 102 PID 3776 wrote to memory of 1352 3776 tfxxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe"C:\Users\Admin\AppData\Local\Temp\20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\ldpdrl.exec:\ldpdrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\nrtrfhj.exec:\nrtrfhj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jhfdvxf.exec:\jhfdvxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\vlrxbf.exec:\vlrxbf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jlxlp.exec:\jlxlp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\hhdnrh.exec:\hhdnrh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\bpbrtl.exec:\bpbrtl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\trfvv.exec:\trfvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\pndnlrp.exec:\pndnlrp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\hxhlxft.exec:\hxhlxft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\nrhrnp.exec:\nrhrnp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\htxvf.exec:\htxvf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\ppxlph.exec:\ppxlph.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\rtpdf.exec:\rtpdf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\tjvxvf.exec:\tjvxvf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xpldxth.exec:\xpldxth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\hnjxb.exec:\hnjxb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\hvfdvdv.exec:\hvfdvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jdtphdl.exec:\jdtphdl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\rtrdxff.exec:\rtrdxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\tfxxx.exec:\tfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\bflrf.exec:\bflrf.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\fdpbvd.exec:\fdpbvd.exe24⤵
- Executes dropped EXE
PID:116 -
\??\c:\dnjlxd.exec:\dnjlxd.exe25⤵
- Executes dropped EXE
PID:1376 -
\??\c:\npdxp.exec:\npdxp.exe26⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rdfdpld.exec:\rdfdpld.exe27⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jfjxjdl.exec:\jfjxjdl.exe28⤵
- Executes dropped EXE
PID:3236 -
\??\c:\rjnxt.exec:\rjnxt.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\xlfthlr.exec:\xlfthlr.exe30⤵
- Executes dropped EXE
PID:4136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\tpxxbdb.exec:\tpxxbdb.exe1⤵
- Executes dropped EXE
PID:4140 -
\??\c:\lfpdp.exec:\lfpdp.exe2⤵
- Executes dropped EXE
PID:3512 -
\??\c:\vdpbrbx.exec:\vdpbrbx.exe3⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jtdjfvf.exec:\jtdjfvf.exe4⤵
- Executes dropped EXE
PID:2356 -
\??\c:\njlbp.exec:\njlbp.exe5⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jhfhpd.exec:\jhfhpd.exe6⤵
- Executes dropped EXE
PID:3656 -
\??\c:\lndrxd.exec:\lndrxd.exe7⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lptndn.exec:\lptndn.exe8⤵
- Executes dropped EXE
PID:3872 -
\??\c:\txrnnt.exec:\txrnnt.exe9⤵
- Executes dropped EXE
PID:456 -
\??\c:\tpjjd.exec:\tpjjd.exe10⤵
- Executes dropped EXE
PID:2724 -
\??\c:\txrxr.exec:\txrxr.exe11⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ltfpvtj.exec:\ltfpvtj.exe12⤵
- Executes dropped EXE
PID:3476 -
\??\c:\tvxvpr.exec:\tvxvpr.exe13⤵
- Executes dropped EXE
PID:216 -
\??\c:\dhnhvx.exec:\dhnhvx.exe14⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lnlltp.exec:\lnlltp.exe15⤵
- Executes dropped EXE
PID:4384 -
\??\c:\phfhjlt.exec:\phfhjlt.exe16⤵
- Executes dropped EXE
PID:1308 -
\??\c:\fddtrb.exec:\fddtrb.exe17⤵
- Executes dropped EXE
PID:4976 -
\??\c:\prvvhvx.exec:\prvvhvx.exe18⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xfphxx.exec:\xfphxx.exe19⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjrndjl.exec:\jjrndjl.exe20⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nhntn.exec:\nhntn.exe21⤵
- Executes dropped EXE
PID:5008 -
\??\c:\pxbhppn.exec:\pxbhppn.exe22⤵
- Executes dropped EXE
PID:3964 -
\??\c:\rxvft.exec:\rxvft.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jhbjnxn.exec:\jhbjnxn.exe24⤵
- Executes dropped EXE
PID:3564 -
\??\c:\dtbdv.exec:\dtbdv.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\hldrvn.exec:\hldrvn.exe26⤵
- Executes dropped EXE
PID:820 -
\??\c:\hpbvdjr.exec:\hpbvdjr.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rtpdfd.exec:\rtpdfd.exe28⤵
- Executes dropped EXE
PID:3684 -
\??\c:\lllxddn.exec:\lllxddn.exe29⤵
- Executes dropped EXE
PID:4568 -
\??\c:\rjxhx.exec:\rjxhx.exe30⤵
- Executes dropped EXE
PID:4612 -
\??\c:\dvpnrtp.exec:\dvpnrtp.exe31⤵
- Executes dropped EXE
PID:4908 -
\??\c:\trdvv.exec:\trdvv.exe32⤵
- Executes dropped EXE
PID:5056 -
\??\c:\lxbprl.exec:\lxbprl.exe33⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ddnhlp.exec:\ddnhlp.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btdtbd.exec:\btdtbd.exe35⤵
- Executes dropped EXE
PID:4292 -
\??\c:\tvjvt.exec:\tvjvt.exe36⤵PID:4412
-
\??\c:\rpnbphb.exec:\rpnbphb.exe37⤵PID:2140
-
\??\c:\jnfddv.exec:\jnfddv.exe38⤵PID:816
-
\??\c:\xvhtj.exec:\xvhtj.exe39⤵PID:4756
-
\??\c:\nhhnb.exec:\nhhnb.exe40⤵PID:4108
-
\??\c:\hbvvhjj.exec:\hbvvhjj.exe41⤵PID:1976
-
\??\c:\jbrjt.exec:\jbrjt.exe42⤵PID:548
-
\??\c:\ltbxh.exec:\ltbxh.exe43⤵PID:2900
-
\??\c:\jffht.exec:\jffht.exe44⤵PID:4736
-
\??\c:\lvtvvfj.exec:\lvtvvfj.exe45⤵PID:3736
-
\??\c:\xpjnpf.exec:\xpjnpf.exe46⤵PID:3940
-
\??\c:\bfblrrp.exec:\bfblrrp.exe47⤵PID:2144
-
\??\c:\dhrhrd.exec:\dhrhrd.exe48⤵PID:4556
-
\??\c:\hhjjj.exec:\hhjjj.exe49⤵PID:3660
-
\??\c:\blnpt.exec:\blnpt.exe50⤵PID:1680
-
\??\c:\xprtnp.exec:\xprtnp.exe51⤵PID:8
-
\??\c:\bnhvn.exec:\bnhvn.exe52⤵PID:2312
-
\??\c:\pnbnvvb.exec:\pnbnvvb.exe53⤵PID:4900
-
\??\c:\pfffvt.exec:\pfffvt.exe54⤵PID:2368
-
\??\c:\bnpdpnt.exec:\bnpdpnt.exe55⤵PID:4384
-
\??\c:\fjnbxdj.exec:\fjnbxdj.exe56⤵PID:4896
-
\??\c:\xflln.exec:\xflln.exe57⤵PID:3808
-
\??\c:\ptnvxtl.exec:\ptnvxtl.exe58⤵PID:512
-
\??\c:\xdrpxrd.exec:\xdrpxrd.exe59⤵PID:3608
-
\??\c:\jrlll.exec:\jrlll.exe60⤵PID:736
-
\??\c:\vxjtjjn.exec:\vxjtjjn.exe61⤵PID:2728
-
\??\c:\bvdjj.exec:\bvdjj.exe62⤵PID:4548
-
\??\c:\ltrxtp.exec:\ltrxtp.exe63⤵PID:4328
-
\??\c:\jhhnrp.exec:\jhhnrp.exe64⤵PID:180
-
\??\c:\rnrxrx.exec:\rnrxrx.exe65⤵PID:2068
-
\??\c:\ljlhp.exec:\ljlhp.exe66⤵PID:4968
-
\??\c:\pthtp.exec:\pthtp.exe67⤵PID:3912
-
\??\c:\nhthbp.exec:\nhthbp.exe68⤵PID:4612
-
\??\c:\jtjthv.exec:\jtjthv.exe69⤵PID:4908
-
\??\c:\fbrnxl.exec:\fbrnxl.exe70⤵PID:4112
-
\??\c:\vtbdv.exec:\vtbdv.exe71⤵PID:2656
-
\??\c:\rjdxvv.exec:\rjdxvv.exe72⤵PID:2360
-
\??\c:\vbdld.exec:\vbdld.exe73⤵PID:2496
-
\??\c:\rvrddj.exec:\rvrddj.exe74⤵PID:3216
-
\??\c:\dnxlljd.exec:\dnxlljd.exe75⤵PID:2200
-
\??\c:\vvjvb.exec:\vvjvb.exe76⤵PID:4136
-
\??\c:\tlhhtn.exec:\tlhhtn.exe77⤵PID:1900
-
\??\c:\hrlrh.exec:\hrlrh.exe78⤵PID:3692
-
\??\c:\llbnbbf.exec:\llbnbbf.exe79⤵PID:2996
-
\??\c:\tjjlvp.exec:\tjjlvp.exe80⤵PID:1196
-
\??\c:\lnrfd.exec:\lnrfd.exe81⤵PID:4912
-
\??\c:\htjpf.exec:\htjpf.exe82⤵PID:4124
-
\??\c:\dhbvlh.exec:\dhbvlh.exe83⤵PID:3156
-
\??\c:\trdvdt.exec:\trdvdt.exe84⤵PID:2192
-
\??\c:\lnrpnv.exec:\lnrpnv.exe85⤵PID:3592
-
\??\c:\vdntvx.exec:\vdntvx.exe86⤵PID:2408
-
\??\c:\bbbtrdp.exec:\bbbtrdp.exe87⤵PID:372
-
\??\c:\txvxbdr.exec:\txvxbdr.exe88⤵PID:1504
-
\??\c:\bnldhb.exec:\bnldhb.exe89⤵PID:2312
-
\??\c:\vrxjf.exec:\vrxjf.exe90⤵PID:1056
-
\??\c:\djplbx.exec:\djplbx.exe91⤵PID:2368
-
\??\c:\pxtfvjf.exec:\pxtfvjf.exe92⤵PID:1324
-
\??\c:\vtlrtfx.exec:\vtlrtfx.exe93⤵PID:2264
-
\??\c:\llrhf.exec:\llrhf.exe94⤵PID:4324
-
\??\c:\vtrbl.exec:\vtrbl.exe95⤵PID:5008
-
\??\c:\bddvlt.exec:\bddvlt.exe96⤵PID:464
-
\??\c:\rrppvt.exec:\rrppvt.exe97⤵PID:4496
-
\??\c:\lvthhbr.exec:\lvthhbr.exe98⤵PID:4916
-
\??\c:\bhhht.exec:\bhhht.exe99⤵PID:3732
-
\??\c:\vrfldtb.exec:\vrfldtb.exe100⤵PID:3036
-
\??\c:\djtrfn.exec:\djtrfn.exe101⤵PID:5108
-
\??\c:\bprrh.exec:\bprrh.exe102⤵PID:4568
-
\??\c:\pthxh.exec:\pthxh.exe103⤵PID:5020
-
\??\c:\dfvbffn.exec:\dfvbffn.exe104⤵PID:1796
-
\??\c:\drvbxp.exec:\drvbxp.exe105⤵PID:2612
-
\??\c:\btrpbxt.exec:\btrpbxt.exe106⤵PID:2244
-
\??\c:\ltpddh.exec:\ltpddh.exe107⤵PID:4872
-
\??\c:\dtlhnn.exec:\dtlhnn.exe108⤵PID:2456
-
\??\c:\dpnrpb.exec:\dpnrpb.exe109⤵PID:628
-
\??\c:\frhbxdj.exec:\frhbxdj.exe110⤵PID:4136
-
\??\c:\lrllb.exec:\lrllb.exe111⤵PID:1900
-
\??\c:\hfbnhht.exec:\hfbnhht.exe112⤵PID:1156
-
\??\c:\dnjdh.exec:\dnjdh.exe113⤵PID:952
-
\??\c:\njhpn.exec:\njhpn.exe114⤵PID:532
-
\??\c:\fjjxhf.exec:\fjjxhf.exe115⤵PID:3588
-
\??\c:\dtfhx.exec:\dtfhx.exe116⤵PID:1884
-
\??\c:\nhvdnh.exec:\nhvdnh.exe117⤵PID:1364
-
\??\c:\fvjbvp.exec:\fvjbvp.exe118⤵PID:3340
-
\??\c:\rhttlh.exec:\rhttlh.exe119⤵PID:1560
-
\??\c:\rdbdhn.exec:\rdbdhn.exe120⤵PID:3560
-
\??\c:\trhtxl.exec:\trhtxl.exe121⤵PID:3200
-
\??\c:\jpfftf.exec:\jpfftf.exe122⤵PID:3672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-