Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 16:50
Behavioral task
behavioral1
Sample
NEAS.d50eb731e599017b82fba365b9c8ce90.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.d50eb731e599017b82fba365b9c8ce90.exe
-
Size
71KB
-
MD5
d50eb731e599017b82fba365b9c8ce90
-
SHA1
c45394f001886596e7d1aeb9002ab2dd176c0a22
-
SHA256
dbf545a4802a1573eb55168ef16c348d75321dd1aea27ae30eb3aef5d261b57b
-
SHA512
f7e2312f877e1586ab19815f2b8b8788ffc92b06c69ebb1992d0079c1836cb23bd2f1fbdf11a1631f668652a952bd2f65884e8fb18b9c2d8d35537a5444d6f76
-
SSDEEP
1536:DvQBeOGtrYS3srx93UBWfwC6Ggnouy8TLU8cxqEM/3qR+7JwB:DhOmTsF93UYfwC6GIoutpcxKfqR+qB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2884-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-959-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-1047-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-1545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2884 pddttv.exe 1380 tbnpjjr.exe 4584 rxxvj.exe 4316 fpxjpd.exe 900 dtnbnj.exe 4136 jlbln.exe 2992 bfhnblp.exe 3660 fnpnd.exe 3988 fbnpxvd.exe 1488 ltpdlpp.exe 4564 jbtdn.exe 4784 lhnnhht.exe 5116 tjfxpjp.exe 4980 dlrdj.exe 3484 bvlnxt.exe 3848 nnjdxd.exe 392 vxjhbj.exe 8 xhlntbx.exe 5072 fhtddf.exe 5016 rppbxvv.exe 4464 hrfhd.exe 996 dtbhb.exe 4660 trxnjb.exe 1644 tpjdb.exe 4868 rpffbv.exe 3904 ndlrn.exe 2952 pxdhd.exe 3408 ptjtf.exe 4536 vtvhbt.exe 620 hrpxv.exe 4024 hnjjlb.exe 1704 fnptf.exe 3440 pdntpr.exe 4020 xbflbtn.exe 1492 bfnrd.exe 5100 ntrhpx.exe 4544 dfxvl.exe 536 tpjfb.exe 4196 rljlh.exe 4224 tlftjb.exe 4284 htjvrxj.exe 2404 nnpdxxj.exe 5088 xrjpp.exe 5076 vrhdr.exe 4420 rddblj.exe 4292 lrdxlt.exe 1816 fjjth.exe 1548 pdhpt.exe 3720 fdjjnvv.exe 3628 rnlthf.exe 5104 hhxfb.exe 680 trttjv.exe 3480 ddlvnrb.exe 3880 xdprrhx.exe 4900 bxbhf.exe 2992 xdfxn.exe 1252 vfxvj.exe 2544 xttxbff.exe 2756 xxpvj.exe 676 xjbpx.exe 5032 rdxfxlj.exe 2160 jrfhph.exe 3608 brxhlx.exe 1368 rhrxdjp.exe -
resource yara_rule behavioral2/memory/4560-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d71-3.dat upx behavioral2/files/0x0008000000022d71-4.dat upx behavioral2/memory/2884-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4560-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d74-10.dat upx behavioral2/files/0x0008000000022d74-11.dat upx behavioral2/files/0x0007000000022d7a-12.dat upx behavioral2/files/0x0007000000022d7a-14.dat upx behavioral2/memory/1380-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d7a-16.dat upx behavioral2/files/0x0007000000022d7d-19.dat upx behavioral2/files/0x0007000000022d7d-21.dat upx behavioral2/memory/4584-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d87-24.dat upx behavioral2/files/0x0007000000022d87-26.dat upx behavioral2/files/0x0007000000022d88-29.dat upx behavioral2/memory/900-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d88-31.dat upx behavioral2/memory/4136-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2992-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d8b-36.dat upx behavioral2/files/0x0007000000022d8b-35.dat upx behavioral2/files/0x0006000000022d9b-40.dat upx behavioral2/files/0x0006000000022d9b-42.dat upx behavioral2/memory/3660-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d9c-47.dat upx behavioral2/memory/3988-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d9c-45.dat upx behavioral2/files/0x0006000000022d9e-51.dat upx behavioral2/files/0x0006000000022d9f-58.dat upx behavioral2/memory/1488-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d9e-53.dat upx behavioral2/files/0x0006000000022d9f-59.dat upx behavioral2/files/0x0006000000022da0-64.dat upx behavioral2/memory/4564-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022da0-62.dat upx behavioral2/memory/5116-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022da1-69.dat upx behavioral2/files/0x0006000000022da1-68.dat upx behavioral2/files/0x0006000000022da2-74.dat upx behavioral2/files/0x0006000000022da2-75.dat upx behavioral2/files/0x0006000000022da3-79.dat upx behavioral2/memory/4980-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3484-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3484-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022da3-80.dat upx behavioral2/files/0x0006000000022da4-85.dat upx behavioral2/files/0x0006000000022da4-86.dat upx behavioral2/files/0x0006000000022da5-89.dat upx behavioral2/files/0x0006000000022da5-91.dat upx behavioral2/memory/3848-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022da7-94.dat upx behavioral2/files/0x0006000000022da7-96.dat upx behavioral2/memory/392-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022da8-99.dat upx behavioral2/files/0x0006000000022da8-101.dat upx behavioral2/memory/5016-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022da9-105.dat upx behavioral2/files/0x0006000000022dab-115.dat upx behavioral2/memory/996-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022dac-122.dat upx behavioral2/files/0x0006000000022dad-126.dat upx behavioral2/files/0x0006000000022dae-132.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 2884 4560 NEAS.d50eb731e599017b82fba365b9c8ce90.exe 85 PID 4560 wrote to memory of 2884 4560 NEAS.d50eb731e599017b82fba365b9c8ce90.exe 85 PID 4560 wrote to memory of 2884 4560 NEAS.d50eb731e599017b82fba365b9c8ce90.exe 85 PID 2884 wrote to memory of 1380 2884 pddttv.exe 84 PID 2884 wrote to memory of 1380 2884 pddttv.exe 84 PID 2884 wrote to memory of 1380 2884 pddttv.exe 84 PID 1380 wrote to memory of 4584 1380 tbnpjjr.exe 86 PID 1380 wrote to memory of 4584 1380 tbnpjjr.exe 86 PID 1380 wrote to memory of 4584 1380 tbnpjjr.exe 86 PID 4584 wrote to memory of 4316 4584 rxxvj.exe 87 PID 4584 wrote to memory of 4316 4584 rxxvj.exe 87 PID 4584 wrote to memory of 4316 4584 rxxvj.exe 87 PID 4316 wrote to memory of 900 4316 fpxjpd.exe 88 PID 4316 wrote to memory of 900 4316 fpxjpd.exe 88 PID 4316 wrote to memory of 900 4316 fpxjpd.exe 88 PID 900 wrote to memory of 4136 900 dtnbnj.exe 89 PID 900 wrote to memory of 4136 900 dtnbnj.exe 89 PID 900 wrote to memory of 4136 900 dtnbnj.exe 89 PID 4136 wrote to memory of 2992 4136 jlbln.exe 90 PID 4136 wrote to memory of 2992 4136 jlbln.exe 90 PID 4136 wrote to memory of 2992 4136 jlbln.exe 90 PID 2992 wrote to memory of 3660 2992 bfhnblp.exe 91 PID 2992 wrote to memory of 3660 2992 bfhnblp.exe 91 PID 2992 wrote to memory of 3660 2992 bfhnblp.exe 91 PID 3660 wrote to memory of 3988 3660 fnpnd.exe 92 PID 3660 wrote to memory of 3988 3660 fnpnd.exe 92 PID 3660 wrote to memory of 3988 3660 fnpnd.exe 92 PID 3988 wrote to memory of 1488 3988 fbnpxvd.exe 93 PID 3988 wrote to memory of 1488 3988 fbnpxvd.exe 93 PID 3988 wrote to memory of 1488 3988 fbnpxvd.exe 93 PID 1488 wrote to memory of 4564 1488 ltpdlpp.exe 94 PID 1488 wrote to memory of 4564 1488 ltpdlpp.exe 94 PID 1488 wrote to memory of 4564 1488 ltpdlpp.exe 94 PID 4564 wrote to memory of 4784 4564 jbtdn.exe 95 PID 4564 wrote to memory of 4784 4564 jbtdn.exe 95 PID 4564 wrote to memory of 4784 4564 jbtdn.exe 95 PID 4784 wrote to memory of 5116 4784 lhnnhht.exe 96 PID 4784 wrote to memory of 5116 4784 lhnnhht.exe 96 PID 4784 wrote to memory of 5116 4784 lhnnhht.exe 96 PID 5116 wrote to memory of 4980 5116 tjfxpjp.exe 97 PID 5116 wrote to memory of 4980 5116 tjfxpjp.exe 97 PID 5116 wrote to memory of 4980 5116 tjfxpjp.exe 97 PID 4980 wrote to memory of 3484 4980 dlrdj.exe 98 PID 4980 wrote to memory of 3484 4980 dlrdj.exe 98 PID 4980 wrote to memory of 3484 4980 dlrdj.exe 98 PID 3484 wrote to memory of 3848 3484 bvlnxt.exe 99 PID 3484 wrote to memory of 3848 3484 bvlnxt.exe 99 PID 3484 wrote to memory of 3848 3484 bvlnxt.exe 99 PID 3848 wrote to memory of 392 3848 nnjdxd.exe 100 PID 3848 wrote to memory of 392 3848 nnjdxd.exe 100 PID 3848 wrote to memory of 392 3848 nnjdxd.exe 100 PID 392 wrote to memory of 8 392 vxjhbj.exe 101 PID 392 wrote to memory of 8 392 vxjhbj.exe 101 PID 392 wrote to memory of 8 392 vxjhbj.exe 101 PID 8 wrote to memory of 5072 8 xhlntbx.exe 102 PID 8 wrote to memory of 5072 8 xhlntbx.exe 102 PID 8 wrote to memory of 5072 8 xhlntbx.exe 102 PID 5072 wrote to memory of 5016 5072 fhtddf.exe 103 PID 5072 wrote to memory of 5016 5072 fhtddf.exe 103 PID 5072 wrote to memory of 5016 5072 fhtddf.exe 103 PID 5016 wrote to memory of 4464 5016 rppbxvv.exe 104 PID 5016 wrote to memory of 4464 5016 rppbxvv.exe 104 PID 5016 wrote to memory of 4464 5016 rppbxvv.exe 104 PID 4464 wrote to memory of 996 4464 hrfhd.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d50eb731e599017b82fba365b9c8ce90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d50eb731e599017b82fba365b9c8ce90.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\pddttv.exec:\pddttv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884
-
-
\??\c:\tbnpjjr.exec:\tbnpjjr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\rxxvj.exec:\rxxvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\fpxjpd.exec:\fpxjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\dtnbnj.exec:\dtnbnj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\jlbln.exec:\jlbln.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\bfhnblp.exec:\bfhnblp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fnpnd.exec:\fnpnd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\fbnpxvd.exec:\fbnpxvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\ltpdlpp.exec:\ltpdlpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jbtdn.exec:\jbtdn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\lhnnhht.exec:\lhnnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\tjfxpjp.exec:\tjfxpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\dlrdj.exec:\dlrdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\bvlnxt.exec:\bvlnxt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\nnjdxd.exec:\nnjdxd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\vxjhbj.exec:\vxjhbj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\xhlntbx.exec:\xhlntbx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\fhtddf.exec:\fhtddf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\rppbxvv.exec:\rppbxvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\hrfhd.exec:\hrfhd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\dtbhb.exec:\dtbhb.exe21⤵
- Executes dropped EXE
PID:996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\ptxhh.exec:\ptxhh.exe9⤵PID:3160
-
\??\c:\xpxtbd.exec:\xpxtbd.exe10⤵PID:1580
-
\??\c:\pfnxn.exec:\pfnxn.exe11⤵PID:2960
-
\??\c:\hnjddf.exec:\hnjddf.exe12⤵PID:2756
-
\??\c:\hnlxv.exec:\hnlxv.exe13⤵PID:4784
-
\??\c:\xhhxd.exec:\xhhxd.exe14⤵PID:984
-
\??\c:\rlljbd.exec:\rlljbd.exe15⤵PID:1240
-
\??\c:\rdplbfr.exec:\rdplbfr.exe16⤵PID:2108
-
\??\c:\xddhbhv.exec:\xddhbhv.exe17⤵PID:180
-
\??\c:\vljtnht.exec:\vljtnht.exe18⤵PID:4548
-
\??\c:\pdtjhf.exec:\pdtjhf.exe19⤵PID:1656
-
\??\c:\pdpfxb.exec:\pdpfxb.exe20⤵PID:3484
-
\??\c:\pdvnv.exec:\pdvnv.exe21⤵PID:2724
-
\??\c:\rbtdxxd.exec:\rbtdxxd.exe22⤵PID:212
-
\??\c:\xxrbppj.exec:\xxrbppj.exe23⤵PID:4124
-
\??\c:\thxhbv.exec:\thxhbv.exe24⤵PID:1760
-
\??\c:\xpvxh.exec:\xpvxh.exe25⤵PID:3780
-
\??\c:\xxpdb.exec:\xxpdb.exe26⤵PID:2136
-
\??\c:\xhdjff.exec:\xhdjff.exe27⤵PID:3148
-
\??\c:\bffddp.exec:\bffddp.exe28⤵PID:416
-
\??\c:\ffrfj.exec:\ffrfj.exe29⤵PID:2268
-
\??\c:\vftdp.exec:\vftdp.exe30⤵PID:1412
-
\??\c:\xjfrllj.exec:\xjfrllj.exe31⤵PID:3076
-
\??\c:\bbtlhl.exec:\bbtlhl.exe32⤵PID:3908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\tpjdb.exec:\tpjdb.exe1⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rpffbv.exec:\rpffbv.exe2⤵
- Executes dropped EXE
PID:4868
-
-
\??\c:\ptjtf.exec:\ptjtf.exe1⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vtvhbt.exec:\vtvhbt.exe2⤵
- Executes dropped EXE
PID:4536
-
-
\??\c:\hnjjlb.exec:\hnjjlb.exe1⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fnptf.exec:\fnptf.exe2⤵
- Executes dropped EXE
PID:1704
-
-
\??\c:\xbflbtn.exec:\xbflbtn.exe1⤵
- Executes dropped EXE
PID:4020 -
\??\c:\bfnrd.exec:\bfnrd.exe2⤵
- Executes dropped EXE
PID:1492
-
-
\??\c:\dfxvl.exec:\dfxvl.exe1⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tpjfb.exec:\tpjfb.exe2⤵
- Executes dropped EXE
PID:536
-
-
\??\c:\ntrhpx.exec:\ntrhpx.exe1⤵
- Executes dropped EXE
PID:5100
-
\??\c:\rljlh.exec:\rljlh.exe1⤵
- Executes dropped EXE
PID:4196 -
\??\c:\tlftjb.exec:\tlftjb.exe2⤵
- Executes dropped EXE
PID:4224
-
-
\??\c:\htjvrxj.exec:\htjvrxj.exe1⤵
- Executes dropped EXE
PID:4284 -
\??\c:\nnpdxxj.exec:\nnpdxxj.exe2⤵
- Executes dropped EXE
PID:2404
-
-
\??\c:\rddblj.exec:\rddblj.exe1⤵
- Executes dropped EXE
PID:4420 -
\??\c:\lrdxlt.exec:\lrdxlt.exe2⤵
- Executes dropped EXE
PID:4292 -
\??\c:\fjjth.exec:\fjjth.exe3⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pdhpt.exec:\pdhpt.exe4⤵
- Executes dropped EXE
PID:1548 -
\??\c:\fdjjnvv.exec:\fdjjnvv.exe5⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xjbldfl.exec:\xjbldfl.exe6⤵PID:3628
-
\??\c:\hhxfb.exec:\hhxfb.exe7⤵
- Executes dropped EXE
PID:5104 -
\??\c:\trttjv.exec:\trttjv.exe8⤵
- Executes dropped EXE
PID:680 -
\??\c:\ddlvnrb.exec:\ddlvnrb.exe9⤵
- Executes dropped EXE
PID:3480 -
\??\c:\xdprrhx.exec:\xdprrhx.exe10⤵
- Executes dropped EXE
PID:3880 -
\??\c:\hlbdd.exec:\hlbdd.exe11⤵PID:4900
-
\??\c:\xdfxn.exec:\xdfxn.exe12⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vfxvj.exec:\vfxvj.exe13⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xttxbff.exec:\xttxbff.exe14⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xxpvj.exec:\xxpvj.exe15⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xjbpx.exec:\xjbpx.exe16⤵
- Executes dropped EXE
PID:676 -
\??\c:\rdxfxlj.exec:\rdxfxlj.exe17⤵
- Executes dropped EXE
PID:5032 -
\??\c:\jrfhph.exec:\jrfhph.exe18⤵
- Executes dropped EXE
PID:2160 -
\??\c:\brxhlx.exec:\brxhlx.exe19⤵
- Executes dropped EXE
PID:3608 -
\??\c:\rhrxdjp.exec:\rhrxdjp.exe20⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ltrdjjx.exec:\ltrdjjx.exe21⤵PID:4736
-
\??\c:\hlndfp.exec:\hlndfp.exe22⤵PID:3484
-
\??\c:\bjnjbd.exec:\bjnjbd.exe23⤵PID:2388
-
\??\c:\dvhppd.exec:\dvhppd.exe24⤵PID:3960
-
\??\c:\xtlfdlv.exec:\xtlfdlv.exe25⤵PID:8
-
\??\c:\pntvtn.exec:\pntvtn.exe26⤵PID:3828
-
\??\c:\rjlrdp.exec:\rjlrdp.exe27⤵PID:452
-
\??\c:\jjnrr.exec:\jjnrr.exe28⤵PID:1440
-
\??\c:\vttjh.exec:\vttjh.exe29⤵PID:3068
-
\??\c:\xdbpbb.exec:\xdbpbb.exe30⤵PID:4660
-
\??\c:\xflrd.exec:\xflrd.exe31⤵PID:3192
-
\??\c:\jxbbnr.exec:\jxbbnr.exe32⤵PID:2916
-
\??\c:\dhhrbr.exec:\dhhrbr.exe33⤵PID:2460
-
\??\c:\pltnjtp.exec:\pltnjtp.exe34⤵PID:4536
-
\??\c:\dvdtnjl.exec:\dvdtnjl.exe35⤵PID:4032
-
\??\c:\xrpjpvd.exec:\xrpjpvd.exe36⤵PID:4024
-
\??\c:\xdhvrfj.exec:\xdhvrfj.exe37⤵PID:1704
-
\??\c:\tttvjl.exec:\tttvjl.exe38⤵PID:3440
-
\??\c:\tblhb.exec:\tblhb.exe39⤵PID:944
-
\??\c:\jdjbpt.exec:\jdjbpt.exe40⤵PID:844
-
\??\c:\phhtpl.exec:\phhtpl.exe41⤵PID:4896
-
\??\c:\nrrdtfn.exec:\nrrdtfn.exe42⤵PID:2060
-
\??\c:\vnnlx.exec:\vnnlx.exe43⤵PID:1584
-
\??\c:\ldddbhp.exec:\ldddbhp.exe44⤵PID:4288
-
\??\c:\xrntjx.exec:\xrntjx.exe45⤵PID:1844
-
\??\c:\xxhrd.exec:\xxhrd.exe46⤵PID:4832
-
\??\c:\bbphl.exec:\bbphl.exe47⤵PID:4240
-
\??\c:\ldvbl.exec:\ldvbl.exe48⤵PID:2424
-
\??\c:\tjlxxt.exec:\tjlxxt.exe49⤵PID:5044
-
\??\c:\rbjfd.exec:\rbjfd.exe50⤵PID:1808
-
\??\c:\vtbhflt.exec:\vtbhflt.exe51⤵PID:4716
-
\??\c:\xfprj.exec:\xfprj.exe52⤵PID:2896
-
\??\c:\rnlthf.exec:\rnlthf.exe53⤵
- Executes dropped EXE
PID:3628 -
\??\c:\pfxxlh.exec:\pfxxlh.exe54⤵PID:2152
-
\??\c:\xbpdx.exec:\xbpdx.exe55⤵PID:220
-
\??\c:\lltrb.exec:\lltrb.exe56⤵PID:1116
-
\??\c:\hpllt.exec:\hpllt.exe57⤵PID:2904
-
\??\c:\bxbhf.exec:\bxbhf.exe58⤵
- Executes dropped EXE
PID:4900 -
\??\c:\vrhblht.exec:\vrhblht.exe59⤵PID:3660
-
\??\c:\nthnff.exec:\nthnff.exe60⤵PID:436
-
\??\c:\bnxfr.exec:\bnxfr.exe61⤵PID:1488
-
\??\c:\lbfjx.exec:\lbfjx.exe62⤵PID:5048
-
\??\c:\tlfxn.exec:\tlfxn.exe63⤵PID:64
-
\??\c:\djnhp.exec:\djnhp.exe64⤵PID:4812
-
\??\c:\lpnvnp.exec:\lpnvnp.exe65⤵PID:3084
-
\??\c:\pjthvxx.exec:\pjthvxx.exe66⤵PID:4444
-
\??\c:\lprpfd.exec:\lprpfd.exe67⤵PID:560
-
\??\c:\vhvxtvf.exec:\vhvxtvf.exe68⤵PID:1788
-
\??\c:\phtvxb.exec:\phtvxb.exe69⤵PID:3588
-
\??\c:\dpnnvtl.exec:\dpnnvtl.exe70⤵PID:3116
-
\??\c:\plpjth.exec:\plpjth.exe71⤵PID:1804
-
\??\c:\hnrdd.exec:\hnrdd.exe72⤵PID:2188
-
\??\c:\jvtllp.exec:\jvtllp.exe73⤵PID:4888
-
\??\c:\dvxxlff.exec:\dvxxlff.exe74⤵PID:2492
-
\??\c:\djvll.exec:\djvll.exe75⤵PID:3704
-
\??\c:\xdljdnr.exec:\xdljdnr.exe76⤵PID:1680
-
\??\c:\dxhnf.exec:\dxhnf.exe77⤵PID:3068
-
\??\c:\bhvtfjv.exec:\bhvtfjv.exe78⤵PID:60
-
\??\c:\ttlvbfp.exec:\ttlvbfp.exe79⤵PID:4660
-
\??\c:\ttnhhd.exec:\ttnhhd.exe80⤵PID:4892
-
\??\c:\ttvvllj.exec:\ttvvllj.exe81⤵PID:2916
-
\??\c:\nlnlbd.exec:\nlnlbd.exe82⤵PID:3280
-
\??\c:\bhnntn.exec:\bhnntn.exe83⤵PID:1352
-
\??\c:\hvvntbl.exec:\hvvntbl.exe84⤵PID:1960
-
\??\c:\pnfnf.exec:\pnfnf.exe85⤵PID:4984
-
\??\c:\rphtt.exec:\rphtt.exe86⤵PID:944
-
\??\c:\xhrdf.exec:\xhrdf.exe87⤵PID:4544
-
\??\c:\fdtfv.exec:\fdtfv.exe88⤵PID:5040
-
\??\c:\tvlbffh.exec:\tvlbffh.exe89⤵PID:4964
-
\??\c:\jrvfhft.exec:\jrvfhft.exe90⤵PID:4572
-
\??\c:\htptvn.exec:\htptvn.exe91⤵PID:4516
-
\??\c:\hrphn.exec:\hrphn.exe92⤵PID:4368
-
\??\c:\jtflpfv.exec:\jtflpfv.exe93⤵PID:4336
-
\??\c:\btrjlr.exec:\btrjlr.exe94⤵PID:4560
-
\??\c:\nnhrlnp.exec:\nnhrlnp.exe95⤵PID:3548
-
\??\c:\plxxv.exec:\plxxv.exe96⤵PID:2336
-
\??\c:\rfpnxn.exec:\rfpnxn.exe97⤵PID:1808
-
\??\c:\vvvdlj.exec:\vvvdlj.exe98⤵PID:2156
-
\??\c:\ftbnxjd.exec:\ftbnxjd.exe99⤵PID:900
-
\??\c:\ntrpvxn.exec:\ntrpvxn.exe100⤵PID:3628
-
\??\c:\nfrfd.exec:\nfrfd.exe101⤵PID:1212
-
\??\c:\thvpdxt.exec:\thvpdxt.exe102⤵PID:2648
-
\??\c:\jdplb.exec:\jdplb.exe103⤵PID:2508
-
\??\c:\hxhvf.exec:\hxhvf.exe104⤵PID:3868
-
\??\c:\jtbbj.exec:\jtbbj.exe105⤵PID:208
-
\??\c:\jvbfdpp.exec:\jvbfdpp.exe106⤵PID:436
-
\??\c:\thbfdpd.exec:\thbfdpd.exe107⤵PID:1488
-
\??\c:\dxnvdn.exec:\dxnvdn.exe108⤵PID:4784
-
\??\c:\nrxdtrd.exec:\nrxdtrd.exe109⤵PID:3284
-
\??\c:\rxhtf.exec:\rxhtf.exe110⤵PID:2160
-
\??\c:\lhnjv.exec:\lhnjv.exe111⤵PID:1656
-
\??\c:\rptptt.exec:\rptptt.exe112⤵PID:2776
-
\??\c:\fndfl.exec:\fndfl.exe113⤵PID:2468
-
\??\c:\prttxd.exec:\prttxd.exe114⤵PID:2268
-
\??\c:\lfdhxvd.exec:\lfdhxvd.exe115⤵PID:3588
-
\??\c:\ttvfxrl.exec:\ttvfxrl.exe116⤵PID:3960
-
\??\c:\ltpddfl.exec:\ltpddfl.exe117⤵PID:5016
-
\??\c:\jplhj.exec:\jplhj.exe118⤵PID:2188
-
\??\c:\lrnxb.exec:\lrnxb.exe119⤵PID:4888
-
\??\c:\fvdpdt.exec:\fvdpdt.exe120⤵PID:4404
-
\??\c:\rtpdtlj.exec:\rtpdtlj.exe121⤵PID:1644
-
\??\c:\hxnxbpv.exec:\hxnxbpv.exe122⤵PID:4868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-