Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 19:37
Behavioral task
behavioral1
Sample
4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe
-
Size
351KB
-
MD5
4a2b1358e4cb33f55c8df200648c0ef0
-
SHA1
6391cbee6cdff7bbcb15c3ec9771530f0049cbc8
-
SHA256
9fbd158fe59f7344fe12196ba1440c0fdaa8eebee2e2088eb94b8682e0fc152a
-
SHA512
c95da8e96f81fac7ca20c0865ca30c70a87c6fff3c1982dee47464fd12c23df66b995c001a20e9aee2ba6051fc50d90b8119431266721252f22744a33451aa10
-
SSDEEP
6144:ccm4FmowdHoS5ddWhROAGwdZopQUeh5nR:K4wFHoS5ddWhRtHAQUejR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1924-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-623-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-842-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-891-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-1154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-1377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-1583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-1689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-1775-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3720 vbntlp.exe 336 tlnxbh.exe 996 hpxvt.exe 2040 tpjpfj.exe 4572 xjdfdnj.exe 3488 hlffhpj.exe 4160 ppjfrn.exe 1668 nltrhj.exe 4432 dxxhhhj.exe 1048 rjrjd.exe 2872 jvllt.exe 3372 fvrjnb.exe 2736 vrpfnd.exe 216 tpvdn.exe 2784 brvvlnn.exe 1952 jxlvnv.exe 4164 bdvhx.exe 4136 ndrfr.exe 3160 nbfvnp.exe 4048 dnbdfn.exe 3492 vlfdv.exe 4376 hvtpbv.exe 3836 bhjvhpv.exe 4052 tjxpdvr.exe 2324 btrpxxf.exe 2120 djbxlbv.exe 4952 jlphrn.exe 4144 fvlfbx.exe 3328 dllbvnf.exe 544 tbtfxfj.exe 2916 pxjxr.exe 2688 tbvdd.exe 4120 trjdlx.exe 4380 rpjrr.exe 1008 ldfftdd.exe 3892 vhxvlv.exe 648 fpfnjj.exe 3572 lndpt.exe 3352 xtxbh.exe 1616 vrfjxll.exe 3848 fblht.exe 3176 jpxflf.exe 4056 tlhpjbp.exe 2200 nbtxbd.exe 1100 ttfbfr.exe 2984 nxndnfj.exe 1044 dxpldn.exe 5036 tprrnfh.exe 1336 tjlvdj.exe 3780 pxnrtdh.exe 460 dfblr.exe 4180 tvvnvpl.exe 3760 xrxtl.exe 4432 hxpfjjv.exe 5052 vvlhv.exe 4992 xltxntl.exe 2196 jltflld.exe 3212 ftxlbb.exe 4068 pxbfjdd.exe 5024 xrvdvt.exe 2736 dfdrr.exe 1852 dpfhxvv.exe 1416 hvnltlr.exe 4128 lhjtbj.exe -
resource yara_rule behavioral2/memory/1924-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023167-5.dat upx behavioral2/memory/1924-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3720-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023233-10.dat upx behavioral2/files/0x0008000000023233-9.dat upx behavioral2/files/0x0009000000023167-3.dat upx behavioral2/memory/336-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023258-11.dat upx behavioral2/files/0x0006000000023258-17.dat upx behavioral2/files/0x0006000000023258-15.dat upx behavioral2/files/0x0006000000023259-22.dat upx behavioral2/files/0x0006000000023259-23.dat upx behavioral2/memory/996-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325a-26.dat upx behavioral2/memory/2040-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325a-28.dat upx behavioral2/files/0x0008000000023237-31.dat upx behavioral2/files/0x0008000000023237-32.dat upx behavioral2/files/0x000600000002325c-36.dat upx behavioral2/memory/3488-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325c-37.dat upx behavioral2/files/0x000600000002325d-40.dat upx behavioral2/memory/4160-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325d-42.dat upx behavioral2/memory/1668-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325e-47.dat upx behavioral2/memory/4432-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325e-46.dat upx behavioral2/files/0x000600000002325f-51.dat upx behavioral2/memory/1048-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002325f-52.dat upx behavioral2/memory/4572-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023260-59.dat upx behavioral2/files/0x0006000000023260-60.dat upx behavioral2/files/0x0006000000023261-63.dat upx behavioral2/files/0x0006000000023261-65.dat upx behavioral2/memory/2872-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023262-68.dat upx behavioral2/files/0x0006000000023262-70.dat upx behavioral2/files/0x0006000000023263-73.dat upx behavioral2/files/0x0006000000023263-75.dat upx behavioral2/files/0x0006000000023264-78.dat upx behavioral2/files/0x0006000000023265-85.dat upx behavioral2/memory/2784-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023265-84.dat upx behavioral2/memory/2784-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023264-80.dat upx behavioral2/files/0x0006000000023266-89.dat upx behavioral2/memory/1952-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023266-91.dat upx behavioral2/files/0x0006000000023267-94.dat upx behavioral2/memory/4164-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023267-96.dat upx behavioral2/files/0x0006000000023268-99.dat upx behavioral2/memory/3160-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023268-101.dat upx behavioral2/memory/4136-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023269-106.dat upx behavioral2/files/0x0006000000023269-105.dat upx behavioral2/files/0x000600000002326b-111.dat upx behavioral2/files/0x000600000002326b-113.dat upx behavioral2/files/0x000600000002326c-116.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 3720 1924 4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe 83 PID 1924 wrote to memory of 3720 1924 4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe 83 PID 1924 wrote to memory of 3720 1924 4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe 83 PID 3720 wrote to memory of 336 3720 vbntlp.exe 84 PID 3720 wrote to memory of 336 3720 vbntlp.exe 84 PID 3720 wrote to memory of 336 3720 vbntlp.exe 84 PID 336 wrote to memory of 996 336 tlnxbh.exe 85 PID 336 wrote to memory of 996 336 tlnxbh.exe 85 PID 336 wrote to memory of 996 336 tlnxbh.exe 85 PID 996 wrote to memory of 2040 996 hpxvt.exe 86 PID 996 wrote to memory of 2040 996 hpxvt.exe 86 PID 996 wrote to memory of 2040 996 hpxvt.exe 86 PID 2040 wrote to memory of 4572 2040 tpjpfj.exe 87 PID 2040 wrote to memory of 4572 2040 tpjpfj.exe 87 PID 2040 wrote to memory of 4572 2040 tpjpfj.exe 87 PID 4572 wrote to memory of 3488 4572 xjdfdnj.exe 88 PID 4572 wrote to memory of 3488 4572 xjdfdnj.exe 88 PID 4572 wrote to memory of 3488 4572 xjdfdnj.exe 88 PID 3488 wrote to memory of 4160 3488 hlffhpj.exe 89 PID 3488 wrote to memory of 4160 3488 hlffhpj.exe 89 PID 3488 wrote to memory of 4160 3488 hlffhpj.exe 89 PID 4160 wrote to memory of 1668 4160 ppjfrn.exe 90 PID 4160 wrote to memory of 1668 4160 ppjfrn.exe 90 PID 4160 wrote to memory of 1668 4160 ppjfrn.exe 90 PID 1668 wrote to memory of 4432 1668 nltrhj.exe 91 PID 1668 wrote to memory of 4432 1668 nltrhj.exe 91 PID 1668 wrote to memory of 4432 1668 nltrhj.exe 91 PID 4432 wrote to memory of 1048 4432 dxxhhhj.exe 92 PID 4432 wrote to memory of 1048 4432 dxxhhhj.exe 92 PID 4432 wrote to memory of 1048 4432 dxxhhhj.exe 92 PID 1048 wrote to memory of 2872 1048 rjrjd.exe 93 PID 1048 wrote to memory of 2872 1048 rjrjd.exe 93 PID 1048 wrote to memory of 2872 1048 rjrjd.exe 93 PID 2872 wrote to memory of 3372 2872 jvllt.exe 94 PID 2872 wrote to memory of 3372 2872 jvllt.exe 94 PID 2872 wrote to memory of 3372 2872 jvllt.exe 94 PID 3372 wrote to memory of 2736 3372 fvrjnb.exe 95 PID 3372 wrote to memory of 2736 3372 fvrjnb.exe 95 PID 3372 wrote to memory of 2736 3372 fvrjnb.exe 95 PID 2736 wrote to memory of 216 2736 vrpfnd.exe 96 PID 2736 wrote to memory of 216 2736 vrpfnd.exe 96 PID 2736 wrote to memory of 216 2736 vrpfnd.exe 96 PID 216 wrote to memory of 2784 216 tpvdn.exe 97 PID 216 wrote to memory of 2784 216 tpvdn.exe 97 PID 216 wrote to memory of 2784 216 tpvdn.exe 97 PID 2784 wrote to memory of 1952 2784 brvvlnn.exe 98 PID 2784 wrote to memory of 1952 2784 brvvlnn.exe 98 PID 2784 wrote to memory of 1952 2784 brvvlnn.exe 98 PID 1952 wrote to memory of 4164 1952 jxlvnv.exe 99 PID 1952 wrote to memory of 4164 1952 jxlvnv.exe 99 PID 1952 wrote to memory of 4164 1952 jxlvnv.exe 99 PID 4164 wrote to memory of 4136 4164 bdvhx.exe 100 PID 4164 wrote to memory of 4136 4164 bdvhx.exe 100 PID 4164 wrote to memory of 4136 4164 bdvhx.exe 100 PID 4136 wrote to memory of 3160 4136 ndrfr.exe 101 PID 4136 wrote to memory of 3160 4136 ndrfr.exe 101 PID 4136 wrote to memory of 3160 4136 ndrfr.exe 101 PID 3160 wrote to memory of 4048 3160 nbfvnp.exe 102 PID 3160 wrote to memory of 4048 3160 nbfvnp.exe 102 PID 3160 wrote to memory of 4048 3160 nbfvnp.exe 102 PID 4048 wrote to memory of 3492 4048 dnbdfn.exe 103 PID 4048 wrote to memory of 3492 4048 dnbdfn.exe 103 PID 4048 wrote to memory of 3492 4048 dnbdfn.exe 103 PID 3492 wrote to memory of 4376 3492 vlfdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe"C:\Users\Admin\AppData\Local\Temp\4a2b1358e4cb33f55c8df200648c0ef0_exe32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vbntlp.exec:\vbntlp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\tlnxbh.exec:\tlnxbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\hpxvt.exec:\hpxvt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\tpjpfj.exec:\tpjpfj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xjdfdnj.exec:\xjdfdnj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\hlffhpj.exec:\hlffhpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\ppjfrn.exec:\ppjfrn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\nltrhj.exec:\nltrhj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\dxxhhhj.exec:\dxxhhhj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\rjrjd.exec:\rjrjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\jvllt.exec:\jvllt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\fvrjnb.exec:\fvrjnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\vrpfnd.exec:\vrpfnd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tpvdn.exec:\tpvdn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\brvvlnn.exec:\brvvlnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jxlvnv.exec:\jxlvnv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\bdvhx.exec:\bdvhx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\ndrfr.exec:\ndrfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\nbfvnp.exec:\nbfvnp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\dnbdfn.exec:\dnbdfn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\vlfdv.exec:\vlfdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\hvtpbv.exec:\hvtpbv.exe23⤵
- Executes dropped EXE
PID:4376 -
\??\c:\bhjvhpv.exec:\bhjvhpv.exe24⤵
- Executes dropped EXE
PID:3836 -
\??\c:\tjxpdvr.exec:\tjxpdvr.exe25⤵
- Executes dropped EXE
PID:4052 -
\??\c:\btrpxxf.exec:\btrpxxf.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\djbxlbv.exec:\djbxlbv.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jlphrn.exec:\jlphrn.exe28⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fvlfbx.exec:\fvlfbx.exe29⤵
- Executes dropped EXE
PID:4144 -
\??\c:\dllbvnf.exec:\dllbvnf.exe30⤵
- Executes dropped EXE
PID:3328 -
\??\c:\tbtfxfj.exec:\tbtfxfj.exe31⤵
- Executes dropped EXE
PID:544 -
\??\c:\pxjxr.exec:\pxjxr.exe32⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tbvdd.exec:\tbvdd.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\trjdlx.exec:\trjdlx.exe34⤵
- Executes dropped EXE
PID:4120 -
\??\c:\rpjrr.exec:\rpjrr.exe35⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ldfftdd.exec:\ldfftdd.exe36⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vhxvlv.exec:\vhxvlv.exe37⤵
- Executes dropped EXE
PID:3892 -
\??\c:\fpfnjj.exec:\fpfnjj.exe38⤵
- Executes dropped EXE
PID:648 -
\??\c:\lndpt.exec:\lndpt.exe39⤵
- Executes dropped EXE
PID:3572 -
\??\c:\xtxbh.exec:\xtxbh.exe40⤵
- Executes dropped EXE
PID:3352 -
\??\c:\vrfjxll.exec:\vrfjxll.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fblht.exec:\fblht.exe42⤵
- Executes dropped EXE
PID:3848 -
\??\c:\jpxflf.exec:\jpxflf.exe43⤵
- Executes dropped EXE
PID:3176 -
\??\c:\tlhpjbp.exec:\tlhpjbp.exe44⤵
- Executes dropped EXE
PID:4056 -
\??\c:\nbtxbd.exec:\nbtxbd.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ttfbfr.exec:\ttfbfr.exe46⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nxndnfj.exec:\nxndnfj.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dxpldn.exec:\dxpldn.exe48⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tprrnfh.exec:\tprrnfh.exe49⤵
- Executes dropped EXE
PID:5036 -
\??\c:\tjlvdj.exec:\tjlvdj.exe50⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pxnrtdh.exec:\pxnrtdh.exe51⤵
- Executes dropped EXE
PID:3780 -
\??\c:\dfblr.exec:\dfblr.exe52⤵
- Executes dropped EXE
PID:460 -
\??\c:\tvvnvpl.exec:\tvvnvpl.exe53⤵
- Executes dropped EXE
PID:4180 -
\??\c:\xrxtl.exec:\xrxtl.exe54⤵
- Executes dropped EXE
PID:3760 -
\??\c:\hxpfjjv.exec:\hxpfjjv.exe55⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvlhv.exec:\vvlhv.exe56⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xltxntl.exec:\xltxntl.exe57⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jltflld.exec:\jltflld.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ftxlbb.exec:\ftxlbb.exe59⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pxbfjdd.exec:\pxbfjdd.exe60⤵
- Executes dropped EXE
PID:4068 -
\??\c:\xrvdvt.exec:\xrvdvt.exe61⤵
- Executes dropped EXE
PID:5024 -
\??\c:\dfdrr.exec:\dfdrr.exe62⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dpfhxvv.exec:\dpfhxvv.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hvnltlr.exec:\hvnltlr.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lhjtbj.exec:\lhjtbj.exe65⤵
- Executes dropped EXE
PID:4128 -
\??\c:\hjbdhxf.exec:\hjbdhxf.exe66⤵PID:2656
-
\??\c:\jbtjbj.exec:\jbtjbj.exe67⤵PID:4996
-
\??\c:\prlbrf.exec:\prlbrf.exe68⤵PID:4304
-
\??\c:\lhhfxv.exec:\lhhfxv.exe69⤵PID:672
-
\??\c:\ptrlf.exec:\ptrlf.exe70⤵PID:1424
-
\??\c:\hhjndn.exec:\hhjndn.exe71⤵PID:4612
-
\??\c:\xlrrjp.exec:\xlrrjp.exe72⤵PID:968
-
\??\c:\hjbhp.exec:\hjbhp.exe73⤵PID:4656
-
\??\c:\frxnf.exec:\frxnf.exe74⤵PID:3492
-
\??\c:\bfxnfdx.exec:\bfxnfdx.exe75⤵PID:1308
-
\??\c:\dvrnxh.exec:\dvrnxh.exe76⤵PID:1484
-
\??\c:\rxbtxvd.exec:\rxbtxvd.exe77⤵PID:4660
-
\??\c:\jjvljtt.exec:\jjvljtt.exe78⤵PID:4052
-
\??\c:\ttjbrf.exec:\ttjbrf.exe79⤵PID:4496
-
\??\c:\vlbnph.exec:\vlbnph.exe80⤵PID:1440
-
\??\c:\nbjvjrd.exec:\nbjvjrd.exe81⤵PID:4984
-
\??\c:\tbpjb.exec:\tbpjb.exe82⤵PID:1676
-
\??\c:\vvnpprl.exec:\vvnpprl.exe83⤵PID:1816
-
\??\c:\ljvrjnt.exec:\ljvrjnt.exe84⤵PID:2284
-
\??\c:\bprntjf.exec:\bprntjf.exe85⤵PID:544
-
\??\c:\plrflhd.exec:\plrflhd.exe86⤵PID:3144
-
\??\c:\pfhhdv.exec:\pfhhdv.exe87⤵PID:3320
-
\??\c:\vjxldvt.exec:\vjxldvt.exe88⤵PID:4400
-
\??\c:\rllhlf.exec:\rllhlf.exe89⤵PID:808
-
\??\c:\xjjnnl.exec:\xjjnnl.exe90⤵PID:3332
-
\??\c:\xtplfd.exec:\xtplfd.exe91⤵PID:1008
-
\??\c:\pjftxt.exec:\pjftxt.exe92⤵PID:2380
-
\??\c:\xhltj.exec:\xhltj.exe93⤵PID:3556
-
\??\c:\vfnlrtf.exec:\vfnlrtf.exe94⤵PID:3572
-
\??\c:\bpjplt.exec:\bpjplt.exe95⤵PID:3644
-
\??\c:\rbjjf.exec:\rbjjf.exe96⤵PID:1948
-
\??\c:\htdxdtf.exec:\htdxdtf.exe97⤵PID:412
-
\??\c:\bdhrbj.exec:\bdhrbj.exe98⤵PID:4236
-
\??\c:\rvvfrr.exec:\rvvfrr.exe99⤵PID:4884
-
\??\c:\fnxbft.exec:\fnxbft.exe100⤵PID:2412
-
\??\c:\lxnnx.exec:\lxnnx.exe101⤵PID:4568
-
\??\c:\vpdbbp.exec:\vpdbbp.exe102⤵PID:2772
-
\??\c:\pfdfv.exec:\pfdfv.exe103⤵PID:3508
-
\??\c:\pxpbvj.exec:\pxpbvj.exe104⤵PID:2012
-
\??\c:\dnvpld.exec:\dnvpld.exe105⤵PID:1748
-
\??\c:\plvbxfv.exec:\plvbxfv.exe106⤵PID:1624
-
\??\c:\dtntrx.exec:\dtntrx.exe107⤵PID:3796
-
\??\c:\rtlpnnp.exec:\rtlpnnp.exe108⤵PID:4572
-
\??\c:\hnffrr.exec:\hnffrr.exe109⤵PID:4432
-
\??\c:\vrpdj.exec:\vrpdj.exe110⤵PID:2124
-
\??\c:\bhtpbd.exec:\bhtpbd.exe111⤵PID:472
-
\??\c:\dxjrt.exec:\dxjrt.exe112⤵PID:2220
-
\??\c:\ftpdvxb.exec:\ftpdvxb.exe113⤵PID:540
-
\??\c:\flrrv.exec:\flrrv.exe114⤵PID:5024
-
\??\c:\ptfnh.exec:\ptfnh.exe115⤵PID:1736
-
\??\c:\nlfjvt.exec:\nlfjvt.exe116⤵PID:4956
-
\??\c:\bhtjr.exec:\bhtjr.exe117⤵PID:2208
-
\??\c:\nltnn.exec:\nltnn.exe118⤵PID:468
-
\??\c:\njpbldv.exec:\njpbldv.exe119⤵PID:4164
-
\??\c:\hpplxtt.exec:\hpplxtt.exe120⤵PID:4304
-
\??\c:\xjfdrtn.exec:\xjfdrtn.exe121⤵PID:3344
-
\??\c:\jphvttj.exec:\jphvttj.exe122⤵PID:3828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-