Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 19:50
Behavioral task
behavioral1
Sample
f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe
-
Size
182KB
-
MD5
f45623acbabbf29e34ad8fab16e4d3a0
-
SHA1
2e7af3874d4ebcbbf448cca3825fce050db7c7d1
-
SHA256
d0d8132c69781a69cb370143c763ae2731d82e8658d8b1d58f9ecceb5a416db2
-
SHA512
4f52a110e9256db85e3308e8e4d01fd358455a2dfb63b5116cec0fcdf536ff79fd20725634b698d0d87beeb45c27c1af133fd2de8e92cfdd3fe746c24565184e
-
SSDEEP
3072:8hOmTsF93UYfwC6GIoutKHrpi8rY9AABa1U+a8+9JwHJqw2QvGlzFLIQ//OPpZqd:8cm4FmowdHoS8rddWX+a/rkJqw2QvGJ5
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5108-4-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2136-9-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4604-14-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2844-19-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4440-27-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3984-26-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2816-35-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4556-41-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4456-49-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1304-57-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4396-59-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3916-72-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4568-70-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4396-63-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4244-83-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2564-92-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2500-97-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5072-103-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3732-107-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4332-122-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2632-147-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3776-150-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4216-162-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1436-178-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3736-176-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2368-183-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4804-187-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/448-189-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5020-196-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2660-201-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2484-207-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4920-210-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3912-225-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4608-241-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2892-243-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4152-246-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1612-260-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3948-283-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/772-289-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2040-302-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2900-318-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2632-325-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/956-327-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3824-342-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1872-357-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3420-372-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2084-388-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3832-395-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2496-439-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4072-448-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2348-453-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3356-477-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4660-511-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4460-519-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4080-525-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3356-621-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5012-655-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3608-726-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2248-756-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3384-774-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2844-786-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2276-830-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4548-869-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2716-970-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2136 vdxfl.exe 4604 vlbtdvp.exe 2844 hvtfdd.exe 3984 xpnvn.exe 4440 nnvtl.exe 2816 vdrvn.exe 4556 pdvtt.exe 4456 pfxnhr.exe 4616 drrplr.exe 1304 rhxbbll.exe 4396 pfxhdb.exe 3916 tnfhxbf.exe 4568 bfrtj.exe 748 tlnnnt.exe 4244 dlvrblh.exe 2564 bdbrpd.exe 2500 rblfb.exe 5072 vpptjnl.exe 3732 jjpthd.exe 2960 ftvjb.exe 5100 bpftvnp.exe 4332 jvbfhtd.exe 1980 xbllbbr.exe 4552 lnhlh.exe 2940 jdrdjbl.exe 1992 rjrbxjr.exe 2632 rdxblxf.exe 3776 hbtrn.exe 968 njxdx.exe 4216 nxdlr.exe 3932 xdjlb.exe 4324 vptrbvt.exe 3736 xrddp.exe 1436 fvrjn.exe 2368 jbvhlpr.exe 4804 ldhnpbr.exe 448 ntrxt.exe 1644 npnbnbx.exe 5020 hhjfvl.exe 2660 fxjnrhf.exe 380 pnjvj.exe 2484 rdbbh.exe 4920 nhlhbfb.exe 1360 dlpfbj.exe 1348 nvrrd.exe 876 dhprvb.exe 4564 btnlf.exe 3912 dbflpr.exe 3380 bjjpjb.exe 4616 bthjx.exe 1500 rnbvf.exe 1936 dvtrlj.exe 2892 bjbtbv.exe 4608 fpfvrd.exe 4152 nhjxp.exe 4860 nnhnj.exe 4716 ltdttxf.exe 4568 jnhvfpj.exe 1612 rfhnddn.exe 3260 tbrdjj.exe 3660 ndjllbx.exe 4924 txhtfrh.exe 2288 lfrjj.exe 3864 lxxbbt.exe -
resource yara_rule behavioral2/memory/5108-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023240-3.dat upx behavioral2/memory/5108-4-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023240-5.dat upx behavioral2/files/0x0002000000022618-8.dat upx behavioral2/memory/2136-9-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0002000000022618-10.dat upx behavioral2/files/0x0007000000023243-11.dat upx behavioral2/files/0x0007000000023243-13.dat upx behavioral2/memory/4604-14-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023243-15.dat upx behavioral2/files/0x0006000000023252-18.dat upx behavioral2/files/0x0006000000023252-20.dat upx behavioral2/memory/2844-19-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4440-27-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023253-24.dat upx behavioral2/files/0x0006000000023253-23.dat upx behavioral2/memory/3984-26-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023254-29.dat upx behavioral2/files/0x0006000000023254-31.dat upx behavioral2/files/0x0008000000023230-34.dat upx behavioral2/memory/2816-35-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000023230-36.dat upx behavioral2/memory/4456-42-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4556-41-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023255-40.dat upx behavioral2/files/0x0006000000023255-39.dat upx behavioral2/memory/4456-49-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4616-47-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023256-46.dat upx behavioral2/files/0x0006000000023257-52.dat upx behavioral2/files/0x0006000000023257-53.dat upx behavioral2/files/0x0006000000023258-56.dat upx behavioral2/files/0x0006000000023258-58.dat upx behavioral2/memory/1304-57-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023256-45.dat upx behavioral2/memory/4396-59-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000600000002325a-62.dat upx behavioral2/files/0x000600000002325a-64.dat upx behavioral2/files/0x000600000002325b-68.dat upx behavioral2/files/0x000600000002325b-69.dat upx behavioral2/memory/3916-72-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4568-70-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3916-66-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4396-63-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000600000002325c-75.dat upx behavioral2/files/0x000600000002325c-74.dat upx behavioral2/files/0x000600000002325d-79.dat upx behavioral2/memory/4244-83-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000600000002325d-81.dat upx behavioral2/memory/2564-88-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0002000000022616-86.dat upx behavioral2/files/0x0002000000022616-85.dat upx behavioral2/files/0x000600000002325e-91.dat upx behavioral2/memory/2564-92-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000600000002325e-93.dat upx behavioral2/files/0x000600000002325f-96.dat upx behavioral2/memory/2500-97-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000600000002325f-98.dat upx behavioral2/files/0x0006000000023260-102.dat upx behavioral2/files/0x0006000000023260-101.dat upx behavioral2/memory/5072-103-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023261-106.dat upx behavioral2/files/0x0006000000023261-108.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 2136 5108 f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe 82 PID 5108 wrote to memory of 2136 5108 f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe 82 PID 5108 wrote to memory of 2136 5108 f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe 82 PID 2136 wrote to memory of 4604 2136 vdxfl.exe 83 PID 2136 wrote to memory of 4604 2136 vdxfl.exe 83 PID 2136 wrote to memory of 4604 2136 vdxfl.exe 83 PID 4604 wrote to memory of 2844 4604 vlbtdvp.exe 84 PID 4604 wrote to memory of 2844 4604 vlbtdvp.exe 84 PID 4604 wrote to memory of 2844 4604 vlbtdvp.exe 84 PID 2844 wrote to memory of 3984 2844 hvtfdd.exe 85 PID 2844 wrote to memory of 3984 2844 hvtfdd.exe 85 PID 2844 wrote to memory of 3984 2844 hvtfdd.exe 85 PID 3984 wrote to memory of 4440 3984 xpnvn.exe 86 PID 3984 wrote to memory of 4440 3984 xpnvn.exe 86 PID 3984 wrote to memory of 4440 3984 xpnvn.exe 86 PID 4440 wrote to memory of 2816 4440 nnvtl.exe 88 PID 4440 wrote to memory of 2816 4440 nnvtl.exe 88 PID 4440 wrote to memory of 2816 4440 nnvtl.exe 88 PID 2816 wrote to memory of 4556 2816 vdrvn.exe 89 PID 2816 wrote to memory of 4556 2816 vdrvn.exe 89 PID 2816 wrote to memory of 4556 2816 vdrvn.exe 89 PID 4556 wrote to memory of 4456 4556 pdvtt.exe 90 PID 4556 wrote to memory of 4456 4556 pdvtt.exe 90 PID 4556 wrote to memory of 4456 4556 pdvtt.exe 90 PID 4456 wrote to memory of 4616 4456 pfxnhr.exe 91 PID 4456 wrote to memory of 4616 4456 pfxnhr.exe 91 PID 4456 wrote to memory of 4616 4456 pfxnhr.exe 91 PID 4616 wrote to memory of 1304 4616 drrplr.exe 92 PID 4616 wrote to memory of 1304 4616 drrplr.exe 92 PID 4616 wrote to memory of 1304 4616 drrplr.exe 92 PID 1304 wrote to memory of 4396 1304 rhxbbll.exe 93 PID 1304 wrote to memory of 4396 1304 rhxbbll.exe 93 PID 1304 wrote to memory of 4396 1304 rhxbbll.exe 93 PID 4396 wrote to memory of 3916 4396 pfxhdb.exe 94 PID 4396 wrote to memory of 3916 4396 pfxhdb.exe 94 PID 4396 wrote to memory of 3916 4396 pfxhdb.exe 94 PID 3916 wrote to memory of 4568 3916 tnfhxbf.exe 95 PID 3916 wrote to memory of 4568 3916 tnfhxbf.exe 95 PID 3916 wrote to memory of 4568 3916 tnfhxbf.exe 95 PID 4568 wrote to memory of 748 4568 bfrtj.exe 96 PID 4568 wrote to memory of 748 4568 bfrtj.exe 96 PID 4568 wrote to memory of 748 4568 bfrtj.exe 96 PID 748 wrote to memory of 4244 748 tlnnnt.exe 97 PID 748 wrote to memory of 4244 748 tlnnnt.exe 97 PID 748 wrote to memory of 4244 748 tlnnnt.exe 97 PID 4244 wrote to memory of 2564 4244 dlvrblh.exe 98 PID 4244 wrote to memory of 2564 4244 dlvrblh.exe 98 PID 4244 wrote to memory of 2564 4244 dlvrblh.exe 98 PID 2564 wrote to memory of 2500 2564 bdbrpd.exe 99 PID 2564 wrote to memory of 2500 2564 bdbrpd.exe 99 PID 2564 wrote to memory of 2500 2564 bdbrpd.exe 99 PID 2500 wrote to memory of 5072 2500 rblfb.exe 100 PID 2500 wrote to memory of 5072 2500 rblfb.exe 100 PID 2500 wrote to memory of 5072 2500 rblfb.exe 100 PID 5072 wrote to memory of 3732 5072 vpptjnl.exe 101 PID 5072 wrote to memory of 3732 5072 vpptjnl.exe 101 PID 5072 wrote to memory of 3732 5072 vpptjnl.exe 101 PID 3732 wrote to memory of 2960 3732 jjpthd.exe 103 PID 3732 wrote to memory of 2960 3732 jjpthd.exe 103 PID 3732 wrote to memory of 2960 3732 jjpthd.exe 103 PID 2960 wrote to memory of 5100 2960 ftvjb.exe 104 PID 2960 wrote to memory of 5100 2960 ftvjb.exe 104 PID 2960 wrote to memory of 5100 2960 ftvjb.exe 104 PID 5100 wrote to memory of 4332 5100 bpftvnp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe"C:\Users\Admin\AppData\Local\Temp\f45623acbabbf29e34ad8fab16e4d3a0_exe32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\vdxfl.exec:\vdxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vlbtdvp.exec:\vlbtdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\hvtfdd.exec:\hvtfdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xpnvn.exec:\xpnvn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\nnvtl.exec:\nnvtl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\vdrvn.exec:\vdrvn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pdvtt.exec:\pdvtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\pfxnhr.exec:\pfxnhr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\drrplr.exec:\drrplr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\rhxbbll.exec:\rhxbbll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\pfxhdb.exec:\pfxhdb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\tnfhxbf.exec:\tnfhxbf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\bfrtj.exec:\bfrtj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\tlnnnt.exec:\tlnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\dlvrblh.exec:\dlvrblh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\bdbrpd.exec:\bdbrpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rblfb.exec:\rblfb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vpptjnl.exec:\vpptjnl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\jjpthd.exec:\jjpthd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\ftvjb.exec:\ftvjb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bpftvnp.exec:\bpftvnp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\jvbfhtd.exec:\jvbfhtd.exe23⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xbllbbr.exec:\xbllbbr.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lnhlh.exec:\lnhlh.exe25⤵
- Executes dropped EXE
PID:4552 -
\??\c:\jdrdjbl.exec:\jdrdjbl.exe26⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rjrbxjr.exec:\rjrbxjr.exe27⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rdxblxf.exec:\rdxblxf.exe28⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbtrn.exec:\hbtrn.exe29⤵
- Executes dropped EXE
PID:3776 -
\??\c:\njxdx.exec:\njxdx.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\nxdlr.exec:\nxdlr.exe31⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xdjlb.exec:\xdjlb.exe32⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vptrbvt.exec:\vptrbvt.exe33⤵
- Executes dropped EXE
PID:4324 -
\??\c:\xrddp.exec:\xrddp.exe34⤵
- Executes dropped EXE
PID:3736 -
\??\c:\fvrjn.exec:\fvrjn.exe35⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jbvhlpr.exec:\jbvhlpr.exe36⤵
- Executes dropped EXE
PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\ldhnpbr.exec:\ldhnpbr.exe1⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ntrxt.exec:\ntrxt.exe2⤵
- Executes dropped EXE
PID:448 -
\??\c:\npnbnbx.exec:\npnbnbx.exe3⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhjfvl.exec:\hhjfvl.exe4⤵
- Executes dropped EXE
PID:5020 -
\??\c:\fxjnrhf.exec:\fxjnrhf.exe5⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pnjvj.exec:\pnjvj.exe6⤵
- Executes dropped EXE
PID:380 -
\??\c:\rdbbh.exec:\rdbbh.exe7⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nhlhbfb.exec:\nhlhbfb.exe8⤵
- Executes dropped EXE
PID:4920 -
\??\c:\dlpfbj.exec:\dlpfbj.exe9⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nvrrd.exec:\nvrrd.exe10⤵
- Executes dropped EXE
PID:1348 -
\??\c:\dhprvb.exec:\dhprvb.exe11⤵
- Executes dropped EXE
PID:876 -
\??\c:\btnlf.exec:\btnlf.exe12⤵
- Executes dropped EXE
PID:4564 -
\??\c:\dbflpr.exec:\dbflpr.exe13⤵
- Executes dropped EXE
PID:3912 -
\??\c:\bjjpjb.exec:\bjjpjb.exe14⤵
- Executes dropped EXE
PID:3380 -
\??\c:\bthjx.exec:\bthjx.exe15⤵
- Executes dropped EXE
PID:4616 -
\??\c:\rnbvf.exec:\rnbvf.exe16⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dvtrlj.exec:\dvtrlj.exe17⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bjbtbv.exec:\bjbtbv.exe18⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fpfvrd.exec:\fpfvrd.exe19⤵
- Executes dropped EXE
PID:4608 -
\??\c:\nhjxp.exec:\nhjxp.exe20⤵
- Executes dropped EXE
PID:4152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\nnhnj.exec:\nnhnj.exe1⤵
- Executes dropped EXE
PID:4860 -
\??\c:\ltdttxf.exec:\ltdttxf.exe2⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jnhvfpj.exec:\jnhvfpj.exe3⤵
- Executes dropped EXE
PID:4568 -
\??\c:\rfhnddn.exec:\rfhnddn.exe4⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tbrdjj.exec:\tbrdjj.exe5⤵
- Executes dropped EXE
PID:3260 -
\??\c:\ndjllbx.exec:\ndjllbx.exe6⤵
- Executes dropped EXE
PID:3660 -
\??\c:\txhtfrh.exec:\txhtfrh.exe7⤵
- Executes dropped EXE
PID:4924 -
\??\c:\lfrjj.exec:\lfrjj.exe8⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxxbbt.exec:\lxxbbt.exe9⤵
- Executes dropped EXE
PID:3864 -
\??\c:\lfjfpjj.exec:\lfjfpjj.exe10⤵PID:4592
-
\??\c:\ljvbvlp.exec:\ljvbvlp.exe11⤵PID:3948
-
\??\c:\ptjbxb.exec:\ptjbxb.exe12⤵PID:2496
-
\??\c:\fhppt.exec:\fhppt.exe13⤵PID:772
-
\??\c:\xtndr.exec:\xtndr.exe14⤵PID:3100
-
\??\c:\dvlnblt.exec:\dvlnblt.exe15⤵PID:4812
-
\??\c:\xpjvnjv.exec:\xpjvnjv.exe16⤵PID:1308
-
\??\c:\rjffhlx.exec:\rjffhlx.exe17⤵PID:2040
-
\??\c:\bbxfhvf.exec:\bbxfhvf.exe18⤵PID:1740
-
\??\c:\lxbvtj.exec:\lxbvtj.exe19⤵PID:5024
-
\??\c:\tjhhx.exec:\tjhhx.exe20⤵PID:1196
-
\??\c:\jfbpb.exec:\jfbpb.exe21⤵PID:4388
-
\??\c:\bdbjfb.exec:\bdbjfb.exe22⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\phdlxv.exec:\phdlxv.exe1⤵PID:2632
-
\??\c:\vtbdbp.exec:\vtbdbp.exe2⤵PID:956
-
\??\c:\njlfh.exec:\njlfh.exe3⤵PID:2480
-
\??\c:\bxxnlf.exec:\bxxnlf.exe4⤵PID:2896
-
\??\c:\tftlh.exec:\tftlh.exe5⤵PID:3328
-
\??\c:\vlbxlr.exec:\vlbxlr.exe6⤵PID:4748
-
\??\c:\fxbjl.exec:\fxbjl.exe7⤵PID:3824
-
\??\c:\tnbjf.exec:\tnbjf.exe8⤵PID:4912
-
\??\c:\pnfpfh.exec:\pnfpfh.exe9⤵PID:1728
-
\??\c:\pxrbxn.exec:\pxrbxn.exe10⤵PID:2368
-
\??\c:\jhflb.exec:\jhflb.exe11⤵PID:2240
-
\??\c:\fpllbxn.exec:\fpllbxn.exe12⤵PID:1872
-
\??\c:\hfthffh.exec:\hfthffh.exe13⤵PID:4660
-
\??\c:\dbbbrv.exec:\dbbbrv.exe14⤵PID:3780
-
\??\c:\nxnpt.exec:\nxnpt.exe15⤵PID:4460
-
\??\c:\jvbpn.exec:\jvbpn.exe16⤵PID:380
-
\??\c:\bnvpnnr.exec:\bnvpnnr.exe17⤵PID:3420
-
\??\c:\xnrnnbb.exec:\xnrnnbb.exe18⤵PID:1560
-
\??\c:\brxdfx.exec:\brxdfx.exe19⤵PID:2972
-
\??\c:\jdvtj.exec:\jdvtj.exe20⤵PID:2096
-
\??\c:\vpbjtd.exec:\vpbjtd.exe21⤵PID:2084
-
\??\c:\xrprtb.exec:\xrprtb.exe22⤵PID:640
-
\??\c:\rthrp.exec:\rthrp.exe23⤵PID:3832
-
\??\c:\tfvlxx.exec:\tfvlxx.exe24⤵PID:2112
-
\??\c:\xxftd.exec:\xxftd.exe25⤵PID:3220
-
\??\c:\bpnxv.exec:\bpnxv.exe26⤵PID:2188
-
\??\c:\dpjphx.exec:\dpjphx.exe27⤵PID:4152
-
\??\c:\ntdhtv.exec:\ntdhtv.exe28⤵PID:4664
-
\??\c:\dtxfpv.exec:\dtxfpv.exe29⤵PID:1576
-
\??\c:\fxxdn.exec:\fxxdn.exe30⤵PID:4568
-
\??\c:\jrxbbf.exec:\jrxbbf.exe31⤵PID:3436
-
\??\c:\prjhxh.exec:\prjhxh.exe32⤵PID:1112
-
\??\c:\lfvjnx.exec:\lfvjnx.exe33⤵PID:2332
-
\??\c:\vrnbrhr.exec:\vrnbrhr.exe34⤵PID:3708
-
\??\c:\lxhtfv.exec:\lxhtfv.exe35⤵PID:4592
-
\??\c:\lxlfvpt.exec:\lxlfvpt.exe36⤵PID:1288
-
\??\c:\hfbjr.exec:\hfbjr.exe37⤵PID:2496
-
\??\c:\frjfvpn.exec:\frjfvpn.exe38⤵PID:1460
-
\??\c:\bdbjjj.exec:\bdbjjj.exe39⤵PID:872
-
\??\c:\vlrfj.exec:\vlrfj.exe40⤵PID:4072
-
\??\c:\npxtjfx.exec:\npxtjfx.exe41⤵PID:3452
-
\??\c:\vtpdtj.exec:\vtpdtj.exe42⤵PID:2348
-
\??\c:\vxttj.exec:\vxttj.exe43⤵PID:5024
-
\??\c:\jjhvxp.exec:\jjhvxp.exe44⤵PID:3684
-
\??\c:\brxpdrb.exec:\brxpdrb.exe45⤵PID:1992
-
\??\c:\jbhlr.exec:\jbhlr.exe46⤵PID:3168
-
\??\c:\lldrxxd.exec:\lldrxxd.exe47⤵PID:3352
-
\??\c:\lxpth.exec:\lxpth.exe48⤵PID:3356
-
\??\c:\dfjxtj.exec:\dfjxtj.exe49⤵PID:956
-
\??\c:\ptndtd.exec:\ptndtd.exe50⤵PID:832
-
\??\c:\vlpvx.exec:\vlpvx.exe51⤵PID:3432
-
\??\c:\dxfdtp.exec:\dxfdtp.exe52⤵PID:4324
-
\??\c:\fnjjnxj.exec:\fnjjnxj.exe53⤵PID:2720
-
\??\c:\npfnf.exec:\npfnf.exe54⤵PID:4728
-
\??\c:\rfbvn.exec:\rfbvn.exe55⤵PID:4912
-
\??\c:\hbxjjxr.exec:\hbxjjxr.exe56⤵PID:4444
-
\??\c:\fdbhdh.exec:\fdbhdh.exe57⤵PID:448
-
\??\c:\djpjbp.exec:\djpjbp.exe58⤵PID:2368
-
\??\c:\frvtbd.exec:\frvtbd.exe59⤵PID:1872
-
\??\c:\brdlndx.exec:\brdlndx.exe60⤵PID:4660
-
\??\c:\nrjdddb.exec:\nrjdddb.exe61⤵PID:220
-
\??\c:\nxlbnb.exec:\nxlbnb.exe62⤵PID:4460
-
\??\c:\bnltf.exec:\bnltf.exe63⤵PID:4116
-
\??\c:\fxprn.exec:\fxprn.exe64⤵PID:4080
-
\??\c:\pjlrrbp.exec:\pjlrrbp.exe65⤵PID:4056
-
\??\c:\vrpjbpf.exec:\vrpjbpf.exe66⤵PID:736
-
\??\c:\flbrj.exec:\flbrj.exe67⤵PID:3956
-
\??\c:\btrxbhj.exec:\btrxbhj.exe68⤵PID:3704
-
\??\c:\trpbht.exec:\trpbht.exe69⤵PID:3332
-
\??\c:\vtfbph.exec:\vtfbph.exe70⤵PID:464
-
\??\c:\dtprjf.exec:\dtprjf.exe71⤵PID:4500
-
\??\c:\dlfjrl.exec:\dlfjrl.exe72⤵PID:2488
-
\??\c:\hbfphd.exec:\hbfphd.exe73⤵PID:4152
-
\??\c:\fltlrdx.exec:\fltlrdx.exe74⤵PID:3860
-
\??\c:\tbxjdrj.exec:\tbxjdrj.exe75⤵PID:2888
-
\??\c:\vvpdjvl.exec:\vvpdjvl.exe76⤵PID:3980
-
\??\c:\xdjth.exec:\xdjth.exe77⤵PID:3172
-
\??\c:\jthpp.exec:\jthpp.exe78⤵PID:5072
-
\??\c:\nphvt.exec:\nphvt.exe79⤵PID:2232
-
\??\c:\thxdxrx.exec:\thxdxrx.exe80⤵PID:3708
-
\??\c:\jrhfb.exec:\jrhfb.exe81⤵PID:672
-
\??\c:\xjfrtn.exec:\xjfrtn.exe82⤵PID:1288
-
\??\c:\rvjnf.exec:\rvjnf.exe83⤵PID:1240
-
\??\c:\vbnhfh.exec:\vbnhfh.exe84⤵PID:3100
-
\??\c:\pbjdp.exec:\pbjdp.exe85⤵PID:4332
-
\??\c:\rrfbxxd.exec:\rrfbxxd.exe86⤵PID:4528
-
\??\c:\dhvfjd.exec:\dhvfjd.exe87⤵PID:4536
-
\??\c:\vhdvtv.exec:\vhdvtv.exe88⤵PID:5116
-
\??\c:\dxxhjpn.exec:\dxxhjpn.exe89⤵PID:2164
-
\??\c:\flfvfdv.exec:\flfvfdv.exe90⤵PID:3684
-
\??\c:\rxnlrj.exec:\rxnlrj.exe91⤵PID:2832
-
\??\c:\pllnn.exec:\pllnn.exe92⤵PID:2900
-
\??\c:\ltplp.exec:\ltplp.exe93⤵PID:1544
-
\??\c:\tnjdhd.exec:\tnjdhd.exe94⤵PID:3944
-
\??\c:\ttnxl.exec:\ttnxl.exe95⤵PID:956
-
\??\c:\dfnxbp.exec:\dfnxbp.exe96⤵PID:3356
-
\??\c:\rnbtdvr.exec:\rnbtdvr.exe97⤵PID:3328
-
\??\c:\hntjvvt.exec:\hntjvvt.exe98⤵PID:4752
-
\??\c:\plrrd.exec:\plrrd.exe99⤵PID:3824
-
\??\c:\pxnvl.exec:\pxnvl.exe100⤵PID:3736
-
\??\c:\bdjvr.exec:\bdjvr.exe101⤵PID:3376
-
\??\c:\nfprb.exec:\nfprb.exe102⤵PID:208
-
\??\c:\nvrhlr.exec:\nvrhlr.exe103⤵PID:2512
-
\??\c:\thxdxht.exec:\thxdxht.exe104⤵PID:3076
-
\??\c:\tpvlpjj.exec:\tpvlpjj.exe105⤵PID:1004
-
\??\c:\pfntdfj.exec:\pfntdfj.exe106⤵PID:5012
-
\??\c:\rvfhntn.exec:\rvfhntn.exe107⤵PID:3540
-
\??\c:\nlrdrp.exec:\nlrdrp.exe108⤵PID:380
-
\??\c:\hhjvj.exec:\hhjvj.exe109⤵PID:1360
-
\??\c:\tlpff.exec:\tlpff.exe110⤵PID:1560
-
\??\c:\jxbftjn.exec:\jxbftjn.exe111⤵PID:2096
-
\??\c:\ffdjlll.exec:\ffdjlll.exe112⤵PID:2472
-
\??\c:\lxfpd.exec:\lxfpd.exe113⤵PID:3956
-
\??\c:\bfjvrxj.exec:\bfjvrxj.exe114⤵PID:4956
-
\??\c:\bfnhl.exec:\bfnhl.exe115⤵PID:2892
-
\??\c:\xvlrlx.exec:\xvlrlx.exe116⤵PID:1772
-
\??\c:\lrthvl.exec:\lrthvl.exe117⤵PID:3876
-
\??\c:\fbvvxj.exec:\fbvvxj.exe118⤵PID:2588
-
\??\c:\hjrvj.exec:\hjrvj.exe119⤵PID:732
-
\??\c:\rfdvpbx.exec:\rfdvpbx.exe120⤵PID:3172
-
\??\c:\trhbntj.exec:\trhbntj.exe121⤵PID:2276
-
\??\c:\jdpht.exec:\jdpht.exe122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-