Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 16:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.7b943939f435b6d63c409c6a254a8a80.exe
Resource
win7-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.7b943939f435b6d63c409c6a254a8a80.exe
-
Size
124KB
-
MD5
7b943939f435b6d63c409c6a254a8a80
-
SHA1
ddceba5b26e489a8d64afc99d03231408c9311c1
-
SHA256
670bfc481bb83c797e0f257aaa3981c7df0a2016cb02bc04ef99c57e283d24d5
-
SHA512
4da9301a6588e03f24ab6c8f5c115a1469cca5f6d7fbb7d3a747d7e721981bd4a898a8992994cc973d344d67905bcd1bb4d4793c87fc704ddf22d3299718ef28
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjQH+qNn:n3C9BRo7tvnJ9oH0IRgZvjQeqB
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral2/memory/3156-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4360 ppjftpr.exe 5012 pvxpfx.exe 2304 ndnfb.exe 1284 trfftdj.exe 3420 tlnvfln.exe 3964 pjndxh.exe 4700 hjxptt.exe 1972 fdnvdxh.exe 4448 hplbp.exe 2056 fvhdxx.exe 5032 jjjprp.exe 4636 vbdtlp.exe 3348 prbbbpl.exe 1172 fbjxrdl.exe 3820 rhpvjnj.exe 1888 pfdht.exe 4296 vlpvdfh.exe 912 tbjlbxx.exe 1508 bdfjxfj.exe 232 lpntvlp.exe 3032 prvxrx.exe 1292 xvpxp.exe 1288 dxrtrrv.exe 1720 xvllf.exe 1300 ntjdpnp.exe 4044 fvjhp.exe 5020 jptht.exe 3784 rpvlbj.exe 2080 tlpln.exe 2292 hfbdhdn.exe 1620 nvvfnl.exe 1220 prlvt.exe 3504 ljnthvn.exe 60 tjjpfld.exe 4744 vvbltr.exe 2400 txtnftl.exe 4312 vdtfxvx.exe 536 fldbn.exe 3452 hjlpn.exe 2820 tdtvjxf.exe 764 xnftlfv.exe 1668 jhlhhdl.exe 2960 dllxjf.exe 1132 vndff.exe 2264 djvdbl.exe 3200 fxffxh.exe 3576 xhfhb.exe 2312 rtfvrbt.exe 2276 xrdnff.exe 3532 nbhvt.exe 4792 jjjpt.exe 5032 lnhnfvj.exe 3400 brpfxbt.exe 4128 tdfdptd.exe 2240 hptvrx.exe 456 flrtr.exe 3820 xdbvtfb.exe 1888 pbtlplf.exe 2332 jlxpl.exe 4496 xvnff.exe 4076 vxrpvv.exe 2468 bftxl.exe 892 pdnplr.exe 4812 bhnnt.exe -
resource yara_rule behavioral2/memory/3156-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4360 3156 NEAS.7b943939f435b6d63c409c6a254a8a80.exe 84 PID 3156 wrote to memory of 4360 3156 NEAS.7b943939f435b6d63c409c6a254a8a80.exe 84 PID 3156 wrote to memory of 4360 3156 NEAS.7b943939f435b6d63c409c6a254a8a80.exe 84 PID 4360 wrote to memory of 5012 4360 ppjftpr.exe 86 PID 4360 wrote to memory of 5012 4360 ppjftpr.exe 86 PID 4360 wrote to memory of 5012 4360 ppjftpr.exe 86 PID 5012 wrote to memory of 2304 5012 pvxpfx.exe 85 PID 5012 wrote to memory of 2304 5012 pvxpfx.exe 85 PID 5012 wrote to memory of 2304 5012 pvxpfx.exe 85 PID 2304 wrote to memory of 1284 2304 ndnfb.exe 87 PID 2304 wrote to memory of 1284 2304 ndnfb.exe 87 PID 2304 wrote to memory of 1284 2304 ndnfb.exe 87 PID 1284 wrote to memory of 3420 1284 trfftdj.exe 88 PID 1284 wrote to memory of 3420 1284 trfftdj.exe 88 PID 1284 wrote to memory of 3420 1284 trfftdj.exe 88 PID 3420 wrote to memory of 3964 3420 tlnvfln.exe 89 PID 3420 wrote to memory of 3964 3420 tlnvfln.exe 89 PID 3420 wrote to memory of 3964 3420 tlnvfln.exe 89 PID 3964 wrote to memory of 4700 3964 pjndxh.exe 90 PID 3964 wrote to memory of 4700 3964 pjndxh.exe 90 PID 3964 wrote to memory of 4700 3964 pjndxh.exe 90 PID 4700 wrote to memory of 1972 4700 hjxptt.exe 91 PID 4700 wrote to memory of 1972 4700 hjxptt.exe 91 PID 4700 wrote to memory of 1972 4700 hjxptt.exe 91 PID 1972 wrote to memory of 4448 1972 fdnvdxh.exe 92 PID 1972 wrote to memory of 4448 1972 fdnvdxh.exe 92 PID 1972 wrote to memory of 4448 1972 fdnvdxh.exe 92 PID 4448 wrote to memory of 2056 4448 hplbp.exe 93 PID 4448 wrote to memory of 2056 4448 hplbp.exe 93 PID 4448 wrote to memory of 2056 4448 hplbp.exe 93 PID 2056 wrote to memory of 5032 2056 fvhdxx.exe 94 PID 2056 wrote to memory of 5032 2056 fvhdxx.exe 94 PID 2056 wrote to memory of 5032 2056 fvhdxx.exe 94 PID 5032 wrote to memory of 4636 5032 jjjprp.exe 95 PID 5032 wrote to memory of 4636 5032 jjjprp.exe 95 PID 5032 wrote to memory of 4636 5032 jjjprp.exe 95 PID 4636 wrote to memory of 3348 4636 vbdtlp.exe 96 PID 4636 wrote to memory of 3348 4636 vbdtlp.exe 96 PID 4636 wrote to memory of 3348 4636 vbdtlp.exe 96 PID 3348 wrote to memory of 1172 3348 prbbbpl.exe 97 PID 3348 wrote to memory of 1172 3348 prbbbpl.exe 97 PID 3348 wrote to memory of 1172 3348 prbbbpl.exe 97 PID 1172 wrote to memory of 3820 1172 fbjxrdl.exe 98 PID 1172 wrote to memory of 3820 1172 fbjxrdl.exe 98 PID 1172 wrote to memory of 3820 1172 fbjxrdl.exe 98 PID 3820 wrote to memory of 1888 3820 rhpvjnj.exe 99 PID 3820 wrote to memory of 1888 3820 rhpvjnj.exe 99 PID 3820 wrote to memory of 1888 3820 rhpvjnj.exe 99 PID 1888 wrote to memory of 4296 1888 pfdht.exe 100 PID 1888 wrote to memory of 4296 1888 pfdht.exe 100 PID 1888 wrote to memory of 4296 1888 pfdht.exe 100 PID 4296 wrote to memory of 912 4296 vlpvdfh.exe 101 PID 4296 wrote to memory of 912 4296 vlpvdfh.exe 101 PID 4296 wrote to memory of 912 4296 vlpvdfh.exe 101 PID 912 wrote to memory of 1508 912 tbjlbxx.exe 102 PID 912 wrote to memory of 1508 912 tbjlbxx.exe 102 PID 912 wrote to memory of 1508 912 tbjlbxx.exe 102 PID 1508 wrote to memory of 232 1508 bdfjxfj.exe 103 PID 1508 wrote to memory of 232 1508 bdfjxfj.exe 103 PID 1508 wrote to memory of 232 1508 bdfjxfj.exe 103 PID 232 wrote to memory of 3032 232 lpntvlp.exe 105 PID 232 wrote to memory of 3032 232 lpntvlp.exe 105 PID 232 wrote to memory of 3032 232 lpntvlp.exe 105 PID 3032 wrote to memory of 1292 3032 prvxrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7b943939f435b6d63c409c6a254a8a80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7b943939f435b6d63c409c6a254a8a80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\ppjftpr.exec:\ppjftpr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\pvxpfx.exec:\pvxpfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012
-
-
-
\??\c:\ndnfb.exec:\ndnfb.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\trfftdj.exec:\trfftdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\tlnvfln.exec:\tlnvfln.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\pjndxh.exec:\pjndxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\hjxptt.exec:\hjxptt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\fdnvdxh.exec:\fdnvdxh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\hplbp.exec:\hplbp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\fvhdxx.exec:\fvhdxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\jjjprp.exec:\jjjprp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vbdtlp.exec:\vbdtlp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\prbbbpl.exec:\prbbbpl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\fbjxrdl.exec:\fbjxrdl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\rhpvjnj.exec:\rhpvjnj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\pfdht.exec:\pfdht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\vlpvdfh.exec:\vlpvdfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\tbjlbxx.exec:\tbjlbxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\bdfjxfj.exec:\bdfjxfj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\lpntvlp.exec:\lpntvlp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\prvxrx.exec:\prvxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\xvpxp.exec:\xvpxp.exe1⤵
- Executes dropped EXE
PID:1292 -
\??\c:\dxrtrrv.exec:\dxrtrrv.exe2⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xvllf.exec:\xvllf.exe3⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ntjdpnp.exec:\ntjdpnp.exe4⤵
- Executes dropped EXE
PID:1300 -
\??\c:\fvjhp.exec:\fvjhp.exe5⤵
- Executes dropped EXE
PID:4044 -
\??\c:\jptht.exec:\jptht.exe6⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rpvlbj.exec:\rpvlbj.exe7⤵
- Executes dropped EXE
PID:3784 -
\??\c:\tlpln.exec:\tlpln.exe8⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hfbdhdn.exec:\hfbdhdn.exe9⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nvvfnl.exec:\nvvfnl.exe10⤵
- Executes dropped EXE
PID:1620 -
\??\c:\prlvt.exec:\prlvt.exe11⤵
- Executes dropped EXE
PID:1220 -
\??\c:\ljnthvn.exec:\ljnthvn.exe12⤵
- Executes dropped EXE
PID:3504 -
\??\c:\tjjpfld.exec:\tjjpfld.exe13⤵
- Executes dropped EXE
PID:60 -
\??\c:\vvbltr.exec:\vvbltr.exe14⤵
- Executes dropped EXE
PID:4744 -
\??\c:\txtnftl.exec:\txtnftl.exe15⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vdtfxvx.exec:\vdtfxvx.exe16⤵
- Executes dropped EXE
PID:4312 -
\??\c:\fldbn.exec:\fldbn.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\hjlpn.exec:\hjlpn.exe18⤵
- Executes dropped EXE
PID:3452 -
\??\c:\tdtvjxf.exec:\tdtvjxf.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xnftlfv.exec:\xnftlfv.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\jhlhhdl.exec:\jhlhhdl.exe21⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dllxjf.exec:\dllxjf.exe22⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vndff.exec:\vndff.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\djvdbl.exec:\djvdbl.exe24⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxffxh.exec:\fxffxh.exe25⤵
- Executes dropped EXE
PID:3200 -
\??\c:\xhfhb.exec:\xhfhb.exe26⤵
- Executes dropped EXE
PID:3576 -
\??\c:\rtfvrbt.exec:\rtfvrbt.exe27⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xrdnff.exec:\xrdnff.exe28⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nbhvt.exec:\nbhvt.exe29⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jjjpt.exec:\jjjpt.exe30⤵
- Executes dropped EXE
PID:4792 -
\??\c:\lnhnfvj.exec:\lnhnfvj.exe31⤵
- Executes dropped EXE
PID:5032 -
\??\c:\brpfxbt.exec:\brpfxbt.exe32⤵
- Executes dropped EXE
PID:3400 -
\??\c:\tdfdptd.exec:\tdfdptd.exe33⤵
- Executes dropped EXE
PID:4128 -
\??\c:\hptvrx.exec:\hptvrx.exe34⤵
- Executes dropped EXE
PID:2240 -
\??\c:\flrtr.exec:\flrtr.exe35⤵
- Executes dropped EXE
PID:456 -
\??\c:\xdbvtfb.exec:\xdbvtfb.exe36⤵
- Executes dropped EXE
PID:3820 -
\??\c:\pbtlplf.exec:\pbtlplf.exe37⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jlxpl.exec:\jlxpl.exe38⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xvnff.exec:\xvnff.exe39⤵
- Executes dropped EXE
PID:4496 -
\??\c:\vxrpvv.exec:\vxrpvv.exe40⤵
- Executes dropped EXE
PID:4076 -
\??\c:\bftxl.exec:\bftxl.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pdnplr.exec:\pdnplr.exe42⤵
- Executes dropped EXE
PID:892 -
\??\c:\bhnnt.exec:\bhnnt.exe43⤵
- Executes dropped EXE
PID:4812 -
\??\c:\bfbdfl.exec:\bfbdfl.exe44⤵PID:532
-
\??\c:\hxdxf.exec:\hxdxf.exe45⤵PID:2416
-
\??\c:\nhtjt.exec:\nhtjt.exe46⤵PID:804
-
\??\c:\phtnl.exec:\phtnl.exe47⤵PID:4524
-
\??\c:\tlhjx.exec:\tlhjx.exe48⤵PID:1300
-
\??\c:\dbpvp.exec:\dbpvp.exe49⤵PID:1412
-
\??\c:\lvlrn.exec:\lvlrn.exe50⤵PID:4916
-
\??\c:\vbtdb.exec:\vbtdb.exe51⤵PID:516
-
\??\c:\xjbfhtr.exec:\xjbfhtr.exe52⤵PID:4708
-
\??\c:\hrfjprf.exec:\hrfjprf.exe53⤵PID:2100
-
\??\c:\btvxj.exec:\btvxj.exe54⤵PID:1092
-
\??\c:\pjbvjl.exec:\pjbvjl.exe55⤵PID:4160
-
\??\c:\xhjdvxn.exec:\xhjdvxn.exe56⤵PID:3592
-
\??\c:\jlnxrnr.exec:\jlnxrnr.exe57⤵PID:4088
-
\??\c:\lxlnnr.exec:\lxlnnr.exe58⤵PID:2068
-
\??\c:\fhdtlnp.exec:\fhdtlnp.exe59⤵PID:2588
-
\??\c:\xppnxfj.exec:\xppnxfj.exe60⤵PID:4328
-
\??\c:\vhrpdb.exec:\vhrpdb.exe61⤵PID:3104
-
\??\c:\tfvnpx.exec:\tfvnpx.exe62⤵PID:1596
-
\??\c:\vldtrfr.exec:\vldtrfr.exe63⤵PID:4360
-
\??\c:\jdxttb.exec:\jdxttb.exe64⤵PID:2304
-
\??\c:\lndpb.exec:\lndpb.exe65⤵PID:1284
-
\??\c:\nrfxhhv.exec:\nrfxhhv.exe66⤵PID:3420
-
\??\c:\vvpxbj.exec:\vvpxbj.exe67⤵PID:2772
-
\??\c:\jhpldnv.exec:\jhpldnv.exe68⤵PID:2296
-
\??\c:\vhppxd.exec:\vhppxd.exe69⤵PID:3200
-
\??\c:\xbdbn.exec:\xbdbn.exe70⤵PID:4676
-
\??\c:\xltnxxd.exec:\xltnxxd.exe71⤵PID:2216
-
\??\c:\lpplltf.exec:\lpplltf.exe72⤵PID:2392
-
\??\c:\jndtd.exec:\jndtd.exe73⤵PID:4004
-
\??\c:\rbdbdl.exec:\rbdbdl.exe74⤵PID:4636
-
\??\c:\frfjvrb.exec:\frfjvrb.exe75⤵PID:3896
-
\??\c:\fpbvr.exec:\fpbvr.exe76⤵PID:2212
-
\??\c:\vhtxpbn.exec:\vhtxpbn.exe77⤵PID:2240
-
\??\c:\vnthxj.exec:\vnthxj.exe78⤵PID:4324
-
\??\c:\fvfvpfn.exec:\fvfvpfn.exe79⤵PID:4492
-
\??\c:\pnlrtp.exec:\pnlrtp.exe80⤵PID:3696
-
\??\c:\lpvvt.exec:\lpvvt.exe81⤵PID:2144
-
\??\c:\tdxln.exec:\tdxln.exe82⤵PID:4756
-
\??\c:\rfptffd.exec:\rfptffd.exe83⤵PID:468
-
\??\c:\fbltlnn.exec:\fbltlnn.exe84⤵PID:4280
-
\??\c:\rhxrfv.exec:\rhxrfv.exe85⤵PID:2016
-
\??\c:\pnjfnjf.exec:\pnjfnjf.exe86⤵PID:4936
-
\??\c:\bbpxbdh.exec:\bbpxbdh.exe87⤵PID:2956
-
\??\c:\tvpxbvx.exec:\tvpxbvx.exe88⤵PID:2540
-
\??\c:\nnpplh.exec:\nnpplh.exe89⤵PID:5020
-
\??\c:\ttnpjdv.exec:\ttnpjdv.exe90⤵PID:1892
-
\??\c:\txxdf.exec:\txxdf.exe91⤵PID:3184
-
\??\c:\pxpptr.exec:\pxpptr.exe92⤵PID:4028
-
\??\c:\vlbhn.exec:\vlbhn.exe93⤵PID:4944
-
\??\c:\lvpjbp.exec:\lvpjbp.exe94⤵PID:1880
-
\??\c:\rdjrv.exec:\rdjrv.exe95⤵PID:4160
-
\??\c:\ptfhv.exec:\ptfhv.exe96⤵PID:1484
-
\??\c:\vxldpxh.exec:\vxldpxh.exe97⤵PID:1836
-
\??\c:\jtrhv.exec:\jtrhv.exe98⤵PID:2356
-
\??\c:\bjlplf.exec:\bjlplf.exe99⤵PID:2588
-
\??\c:\ltxjdfn.exec:\ltxjdfn.exe100⤵PID:3608
-
\??\c:\xppll.exec:\xppll.exe101⤵PID:3104
-
\??\c:\jnjxp.exec:\jnjxp.exe102⤵PID:1428
-
\??\c:\pdbpjdf.exec:\pdbpjdf.exe103⤵PID:2232
-
\??\c:\ldxdvl.exec:\ldxdvl.exe104⤵PID:1748
-
\??\c:\dhjrl.exec:\dhjrl.exe105⤵PID:1168
-
\??\c:\vbpbpxj.exec:\vbpbpxj.exe106⤵PID:4852
-
\??\c:\nrfrlv.exec:\nrfrlv.exe107⤵PID:4232
-
\??\c:\fxthf.exec:\fxthf.exe108⤵PID:4700
-
\??\c:\bdtdnpl.exec:\bdtdnpl.exe109⤵PID:3576
-
\??\c:\fhbfnpv.exec:\fhbfnpv.exe110⤵PID:3200
-
\??\c:\xjntj.exec:\xjntj.exe111⤵PID:2276
-
\??\c:\vfprf.exec:\vfprf.exe112⤵PID:1280
-
\??\c:\xfnlfp.exec:\xfnlfp.exe113⤵PID:5028
-
\??\c:\lxjth.exec:\lxjth.exe114⤵PID:4948
-
\??\c:\phxnr.exec:\phxnr.exe115⤵PID:3348
-
\??\c:\phhxxh.exec:\phhxxh.exe116⤵PID:4408
-
\??\c:\trjpvl.exec:\trjpvl.exe117⤵PID:2240
-
\??\c:\tjxtpdl.exec:\tjxtpdl.exe118⤵PID:912
-
\??\c:\jnlhpjh.exec:\jnlhpjh.exe119⤵PID:4236
-
\??\c:\nhjdt.exec:\nhjdt.exe120⤵PID:2880
-
\??\c:\tfnnvnp.exec:\tfnnvnp.exe121⤵PID:3068
-
\??\c:\tbvfxj.exec:\tbvfxj.exe122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-