Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.95661b4505868d839663a5bf942a14c0.exe
Resource
win7-20231023-en
3 signatures
150 seconds
General
-
Target
NEAS.95661b4505868d839663a5bf942a14c0.exe
-
Size
396KB
-
MD5
95661b4505868d839663a5bf942a14c0
-
SHA1
edd5bdcbc5c32aed5a5fc66226127a81e2f4c8cc
-
SHA256
b4342ab14608c5990c566741431608e00b6dbe687a5705853db34ce7dfb3a298
-
SHA512
7a1a0e83375df7cae1fdb8839cac58db2d9ebe533a6eeb17149d7dcb88bb18ad06520be3f092e75fd560a98ca553bf020c750f374761486f5ac20ccf14cdb72f
-
SSDEEP
3072:vhOm2sI93UufdC67cidt251UrRE9TTF06dTCs0yZ+MEtCslqJ3:vcm7ImGddXdt251UriZF0KCsNZARqJ3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3704-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4280-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1508-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3096-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4080-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3856-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1044-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5072-139-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/884-134-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3028-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1984-198-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4816-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3848-207-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1380-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4488-226-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3096-241-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4464-244-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3424-247-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/232-250-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5036-256-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3860-265-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3556-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2620-331-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3352-378-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4328-404-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4316-413-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3520-467-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4112-474-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1600-611-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3148-771-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1988-826-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2276-743-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1884-724-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1120-512-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3440-477-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1460-433-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1092-356-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1632-303-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4424-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3812-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1448-290-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/664-253-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1080-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2568-179-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1896-168-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3436-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4924-116-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2424-114-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1512-103-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3204-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1836-93-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/636-86-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3860-83-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2880-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3820-69-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4656-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2412-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3148-39-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2844-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2044-24-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1736-21-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3680-1021-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4224-1184-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4532-1642-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4280 dtldh.exe 1508 fbhhrft.exe 1736 xpffrrp.exe 2044 dbrhh.exe 2844 nhplv.exe 3148 nfhxp.exe 3096 rtfnx.exe 2412 rhphhhj.exe 4600 bdjvpt.exe 4080 rrvpjxl.exe 4656 lfflvn.exe 3820 ptjpvj.exe 2880 ttnfrx.exe 3860 vnjhxf.exe 636 vrldhx.exe 1836 tplxddx.exe 3204 jvxttbl.exe 1512 pdpbrp.exe 3856 pfddr.exe 2424 tptxfjv.exe 4924 pnrpbdd.exe 1044 hrlbhn.exe 5024 jfbpl.exe 884 prhlltd.exe 5072 xbtprvn.exe 4596 tnpdr.exe 1152 bfdfrnd.exe 3436 hjxrt.exe 5104 jhlbhp.exe 3852 ltthvn.exe 1896 nvbfnpf.exe 4860 tfdhtn.exe 2568 llptr.exe 1080 trfjh.exe 1276 pxlvdv.exe 3028 lljpt.exe 808 lthtnf.exe 860 xbljjlp.exe 1984 bbdpdnd.exe 468 ldvdptd.exe 4816 ffdjfdj.exe 3848 fpbvxrn.exe 1756 fvlvf.exe 1656 jhdhjb.exe 1380 jrbhnvt.exe 2972 pxtjvx.exe 4928 zmstage.exe 4488 fppfl.exe 3100 pfxdbh.exe 3352 nhtffx.exe 2844 nhplv.exe 3120 phfvjr.exe 3096 rtfnx.exe 4464 dpdhl.exe 3424 tljph.exe 232 brrfflv.exe 664 nxrxn.exe 5036 fnhxrj.exe 760 frvvxn.exe 456 xdhdx.exe 3860 frvtxhv.exe 5108 npltj.exe 3212 xxbxpdj.exe 3204 jvxttbl.exe -
resource yara_rule behavioral2/memory/3704-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4280-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1508-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3096-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4080-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3856-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1044-124-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5072-139-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/884-134-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2568-175-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3028-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1984-198-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4816-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3848-207-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1380-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4488-226-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3096-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4464-244-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3424-247-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/232-250-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5036-256-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3860-265-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3556-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2620-331-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3352-378-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4328-404-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4316-413-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3520-467-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4112-474-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1600-611-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/416-624-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/400-695-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1448-702-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3148-771-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4836-795-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1988-826-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2276-743-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1884-724-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1120-512-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3440-477-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1460-433-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1092-356-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1632-303-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4424-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3812-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1448-290-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/664-253-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1080-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2568-179-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1896-168-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3436-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4924-116-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2424-114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1512-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3204-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1836-93-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/636-86-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3860-83-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2880-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3820-69-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4656-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2412-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4600-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3148-39-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 4280 3704 xdtxxf.exe 21 PID 3704 wrote to memory of 4280 3704 xdtxxf.exe 21 PID 3704 wrote to memory of 4280 3704 xdtxxf.exe 21 PID 4280 wrote to memory of 1508 4280 dtldh.exe 296 PID 4280 wrote to memory of 1508 4280 dtldh.exe 296 PID 4280 wrote to memory of 1508 4280 dtldh.exe 296 PID 1508 wrote to memory of 1736 1508 fbhhrft.exe 22 PID 1508 wrote to memory of 1736 1508 fbhhrft.exe 22 PID 1508 wrote to memory of 1736 1508 fbhhrft.exe 22 PID 1736 wrote to memory of 2044 1736 xpffrrp.exe 23 PID 1736 wrote to memory of 2044 1736 xpffrrp.exe 23 PID 1736 wrote to memory of 2044 1736 xpffrrp.exe 23 PID 2044 wrote to memory of 2844 2044 dbrhh.exe 295 PID 2044 wrote to memory of 2844 2044 dbrhh.exe 295 PID 2044 wrote to memory of 2844 2044 dbrhh.exe 295 PID 2844 wrote to memory of 3148 2844 nhplv.exe 294 PID 2844 wrote to memory of 3148 2844 nhplv.exe 294 PID 2844 wrote to memory of 3148 2844 nhplv.exe 294 PID 3148 wrote to memory of 3096 3148 nfhxp.exe 178 PID 3148 wrote to memory of 3096 3148 nfhxp.exe 178 PID 3148 wrote to memory of 3096 3148 nfhxp.exe 178 PID 3096 wrote to memory of 2412 3096 rtfnx.exe 293 PID 3096 wrote to memory of 2412 3096 rtfnx.exe 293 PID 3096 wrote to memory of 2412 3096 rtfnx.exe 293 PID 2412 wrote to memory of 4600 2412 rhphhhj.exe 123 PID 2412 wrote to memory of 4600 2412 rhphhhj.exe 123 PID 2412 wrote to memory of 4600 2412 rhphhhj.exe 123 PID 4600 wrote to memory of 4080 4600 bdjvpt.exe 292 PID 4600 wrote to memory of 4080 4600 bdjvpt.exe 292 PID 4600 wrote to memory of 4080 4600 bdjvpt.exe 292 PID 4080 wrote to memory of 4656 4080 rrvpjxl.exe 26 PID 4080 wrote to memory of 4656 4080 rrvpjxl.exe 26 PID 4080 wrote to memory of 4656 4080 rrvpjxl.exe 26 PID 4656 wrote to memory of 3820 4656 lfflvn.exe 291 PID 4656 wrote to memory of 3820 4656 lfflvn.exe 291 PID 4656 wrote to memory of 3820 4656 lfflvn.exe 291 PID 3820 wrote to memory of 2880 3820 ptjpvj.exe 290 PID 3820 wrote to memory of 2880 3820 ptjpvj.exe 290 PID 3820 wrote to memory of 2880 3820 ptjpvj.exe 290 PID 2880 wrote to memory of 3860 2880 ttnfrx.exe 253 PID 2880 wrote to memory of 3860 2880 ttnfrx.exe 253 PID 2880 wrote to memory of 3860 2880 ttnfrx.exe 253 PID 3860 wrote to memory of 636 3860 vnjhxf.exe 289 PID 3860 wrote to memory of 636 3860 vnjhxf.exe 289 PID 3860 wrote to memory of 636 3860 vnjhxf.exe 289 PID 636 wrote to memory of 1836 636 vrldhx.exe 288 PID 636 wrote to memory of 1836 636 vrldhx.exe 288 PID 636 wrote to memory of 1836 636 vrldhx.exe 288 PID 1836 wrote to memory of 3204 1836 tplxddx.exe 48 PID 1836 wrote to memory of 3204 1836 tplxddx.exe 48 PID 1836 wrote to memory of 3204 1836 tplxddx.exe 48 PID 3204 wrote to memory of 1512 3204 jvxttbl.exe 287 PID 3204 wrote to memory of 1512 3204 jvxttbl.exe 287 PID 3204 wrote to memory of 1512 3204 jvxttbl.exe 287 PID 1512 wrote to memory of 3856 1512 pdpbrp.exe 286 PID 1512 wrote to memory of 3856 1512 pdpbrp.exe 286 PID 1512 wrote to memory of 3856 1512 pdpbrp.exe 286 PID 3856 wrote to memory of 2424 3856 pfddr.exe 29 PID 3856 wrote to memory of 2424 3856 pfddr.exe 29 PID 3856 wrote to memory of 2424 3856 pfddr.exe 29 PID 2424 wrote to memory of 4924 2424 tptxfjv.exe 285 PID 2424 wrote to memory of 4924 2424 tptxfjv.exe 285 PID 2424 wrote to memory of 4924 2424 tptxfjv.exe 285 PID 4924 wrote to memory of 1044 4924 pnrpbdd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.95661b4505868d839663a5bf942a14c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.95661b4505868d839663a5bf942a14c0.exe"1⤵PID:3704
-
\??\c:\dtldh.exec:\dtldh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\fbhhrft.exec:\fbhhrft.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508
-
-
-
\??\c:\xpffrrp.exec:\xpffrrp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\dbrhh.exec:\dbrhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nhplv.exec:\nhplv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844
-
-
-
\??\c:\jptjfp.exec:\jptjfp.exe1⤵PID:3096
-
\??\c:\hpnlxbd.exec:\hpnlxbd.exe1⤵PID:4600
-
\??\c:\bhthhxt.exec:\bhthhxt.exe2⤵PID:2784
-
\??\c:\dbpbxjx.exec:\dbpbxjx.exe3⤵PID:1980
-
-
\??\c:\xvpdx.exec:\xvpdx.exe3⤵PID:4260
-
\??\c:\jtfbd.exec:\jtfbd.exe4⤵PID:1804
-
\??\c:\xdhdx.exec:\xdhdx.exe5⤵
- Executes dropped EXE
PID:456 -
\??\c:\ndhpbp.exec:\ndhpbp.exe6⤵PID:3932
-
\??\c:\blhpb.exec:\blhpb.exe7⤵PID:4544
-
\??\c:\jrbntpl.exec:\jrbntpl.exe8⤵PID:2828
-
\??\c:\brnrbx.exec:\brnrbx.exe9⤵PID:3880
-
\??\c:\tvjvl.exec:\tvjvl.exe10⤵PID:4628
-
\??\c:\bvflnn.exec:\bvflnn.exe11⤵PID:2456
-
\??\c:\npltj.exec:\npltj.exe12⤵
- Executes dropped EXE
PID:5108 -
\??\c:\vtvnf.exec:\vtvnf.exe13⤵PID:3172
-
\??\c:\jjtlhb.exec:\jjtlhb.exe14⤵PID:3208
-
\??\c:\dblxnrp.exec:\dblxnrp.exe15⤵PID:1588
-
\??\c:\dtvbhf.exec:\dtvbhf.exe16⤵PID:1104
-
\??\c:\hrrrnjt.exec:\hrrrnjt.exe17⤵PID:4568
-
\??\c:\prrlbvd.exec:\prrlbvd.exe18⤵PID:2336
-
\??\c:\rpfldf.exec:\rpfldf.exe19⤵PID:1568
-
\??\c:\bxlbrh.exec:\bxlbrh.exe20⤵PID:4832
-
\??\c:\plxhr.exec:\plxhr.exe21⤵PID:5080
-
\??\c:\pfvdftf.exec:\pfvdftf.exe22⤵PID:4064
-
\??\c:\tjdnj.exec:\tjdnj.exe23⤵PID:1212
-
\??\c:\trfjh.exec:\trfjh.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jhdflxp.exec:\jhdflxp.exe25⤵PID:1244
-
\??\c:\lppnx.exec:\lppnx.exe26⤵PID:3520
-
\??\c:\bhbhf.exec:\bhbhf.exe27⤵PID:3920
-
\??\c:\jjxlhnj.exec:\jjxlhnj.exe28⤵PID:3524
-
\??\c:\xrdpj.exec:\xrdpj.exe29⤵PID:4044
-
\??\c:\phrdj.exec:\phrdj.exe30⤵PID:3904
-
\??\c:\jptbbp.exec:\jptbbp.exe31⤵PID:3608
-
\??\c:\pvfff.exec:\pvfff.exe32⤵PID:4092
-
\??\c:\nlltvfv.exec:\nlltvfv.exe33⤵PID:4908
-
\??\c:\nbdphl.exec:\nbdphl.exe34⤵PID:2176
-
\??\c:\bdxxxr.exec:\bdxxxr.exe35⤵PID:1872
-
\??\c:\ltxxhhh.exec:\ltxxhhh.exe36⤵PID:1964
-
\??\c:\bxxprl.exec:\bxxprl.exe37⤵PID:4228
-
\??\c:\xfppl.exec:\xfppl.exe38⤵PID:3728
-
\??\c:\dbpvx.exec:\dbpvx.exe39⤵PID:3680
-
\??\c:\pllhjpp.exec:\pllhjpp.exe40⤵PID:1748
-
\??\c:\bbdtvf.exec:\bbdtvf.exe41⤵PID:2268
-
\??\c:\lxdvdx.exec:\lxdvdx.exe42⤵PID:2052
-
\??\c:\jhhvhdh.exec:\jhhvhdh.exe43⤵PID:5004
-
\??\c:\nljhjp.exec:\nljhjp.exe44⤵PID:1992
-
\??\c:\fjtbh.exec:\fjtbh.exe45⤵PID:3500
-
\??\c:\xndbbd.exec:\xndbbd.exe46⤵PID:4316
-
\??\c:\vpfjhv.exec:\vpfjhv.exe47⤵PID:4560
-
\??\c:\lvbfh.exec:\lvbfh.exe48⤵PID:1056
-
\??\c:\dxbttvb.exec:\dxbttvb.exe49⤵PID:3388
-
\??\c:\frvtxhv.exec:\frvtxhv.exe50⤵
- Executes dropped EXE
PID:3860 -
\??\c:\nfpbp.exec:\nfpbp.exe51⤵PID:3936
-
\??\c:\vfjfb.exec:\vfjfb.exe52⤵PID:4636
-
\??\c:\rtnvd.exec:\rtnvd.exe53⤵PID:1512
-
\??\c:\rhrrxtf.exec:\rhrrxtf.exe54⤵PID:1044
-
\??\c:\btflv.exec:\btflv.exe55⤵PID:3192
-
\??\c:\bxjpbp.exec:\bxjpbp.exe56⤵PID:4924
-
\??\c:\hlpjhr.exec:\hlpjhr.exe57⤵PID:3208
-
\??\c:\prtrr.exec:\prtrr.exe58⤵PID:4684
-
\??\c:\xtxdd.exec:\xtxdd.exe59⤵PID:1448
-
\??\c:\djvlvxh.exec:\djvlvxh.exe60⤵PID:4568
-
\??\c:\vbpbp.exec:\vbpbp.exe61⤵PID:548
-
\??\c:\jhbpxx.exec:\jhbpxx.exe62⤵PID:2144
-
\??\c:\rpvrx.exec:\rpvrx.exe63⤵PID:880
-
\??\c:\jthbr.exec:\jthbr.exe64⤵PID:1428
-
\??\c:\pdtttj.exec:\pdtttj.exe65⤵PID:2424
-
\??\c:\lxllv.exec:\lxllv.exe66⤵PID:2164
-
\??\c:\lrttj.exec:\lrttj.exe67⤵PID:1280
-
\??\c:\xxvrr.exec:\xxvrr.exe68⤵PID:4832
-
\??\c:\btfbddt.exec:\btfbddt.exe69⤵PID:1788
-
\??\c:\jpjbnfn.exec:\jpjbnfn.exe70⤵PID:2960
-
\??\c:\lphdrnr.exec:\lphdrnr.exe71⤵PID:2568
-
\??\c:\tpttdd.exec:\tpttdd.exe72⤵PID:1080
-
\??\c:\lftdrt.exec:\lftdrt.exe73⤵PID:1244
-
\??\c:\jdhnb.exec:\jdhnb.exe74⤵PID:3520
-
\??\c:\tlxpjn.exec:\tlxpjn.exe75⤵PID:3920
-
\??\c:\bjrnht.exec:\bjrnht.exe76⤵PID:4076
-
\??\c:\drdtnrt.exec:\drdtnrt.exe77⤵PID:1744
-
\??\c:\blfjrr.exec:\blfjrr.exe78⤵PID:2972
-
\??\c:\nllplb.exec:\nllplb.exe79⤵PID:220
-
\??\c:\xhdphln.exec:\xhdphln.exe80⤵PID:4092
-
\??\c:\vhbpltf.exec:\vhbpltf.exe81⤵PID:2044
-
\??\c:\vlhxxnf.exec:\vlhxxnf.exe82⤵PID:2176
-
\??\c:\vlvpx.exec:\vlvpx.exe83⤵PID:3808
-
\??\c:\pnlxbd.exec:\pnlxbd.exe84⤵PID:3352
-
\??\c:\rvhnhpp.exec:\rvhnhpp.exe85⤵PID:3252
-
\??\c:\fjpxbh.exec:\fjpxbh.exe86⤵PID:3424
-
\??\c:\nldvh.exec:\nldvh.exe87⤵PID:3892
-
\??\c:\hxbjp.exec:\hxbjp.exe88⤵PID:1372
-
\??\c:\vtxlhrb.exec:\vtxlhrb.exe89⤵PID:232
-
\??\c:\dtllt.exec:\dtllt.exe90⤵PID:5036
-
\??\c:\ldhtvxh.exec:\ldhtvxh.exe91⤵PID:664
-
\??\c:\pvfdxp.exec:\pvfdxp.exe92⤵PID:3320
-
\??\c:\bndlp.exec:\bndlp.exe93⤵PID:4224
-
\??\c:\ljrvdx.exec:\ljrvdx.exe94⤵PID:4328
-
\??\c:\hlfvfxl.exec:\hlfvfxl.exe95⤵PID:4972
-
\??\c:\xtfdtxl.exec:\xtfdtxl.exe96⤵PID:4544
-
\??\c:\hlxnnvx.exec:\hlxnnvx.exe97⤵PID:532
-
\??\c:\trpxxt.exec:\trpxxt.exe98⤵PID:2828
-
\??\c:\htrjrnd.exec:\htrjrnd.exe99⤵PID:4152
-
\??\c:\bpfprtt.exec:\bpfprtt.exe100⤵PID:3908
-
\??\c:\bpvfhrl.exec:\bpvfhrl.exe101⤵PID:4884
-
\??\c:\hltfb.exec:\hltfb.exe102⤵PID:4800
-
\??\c:\ldrbj.exec:\ldrbj.exe103⤵PID:3172
-
\??\c:\tntnvnt.exec:\tntnvnt.exe104⤵PID:3020
-
\??\c:\bpddlf.exec:\bpddlf.exe105⤵PID:1588
-
\??\c:\rtbddjn.exec:\rtbddjn.exe106⤵PID:1104
-
\??\c:\tvpxn.exec:\tvpxn.exe107⤵PID:1988
-
\??\c:\lxpftf.exec:\lxpftf.exe108⤵PID:2336
-
\??\c:\nhvbvvv.exec:\nhvbvvv.exe109⤵PID:3048
-
\??\c:\dvntrdj.exec:\dvntrdj.exe110⤵PID:4496
-
\??\c:\dpdphd.exec:\dpdphd.exe111⤵PID:208
-
\??\c:\tjtpnxp.exec:\tjtpnxp.exe112⤵PID:2848
-
\??\c:\xxphdp.exec:\xxphdp.exe113⤵PID:924
-
\??\c:\hlxfljt.exec:\hlxfljt.exe114⤵PID:3504
-
\??\c:\bxbpdbj.exec:\bxbpdbj.exe115⤵PID:2964
-
\??\c:\lrlpnpd.exec:\lrlpnpd.exe116⤵PID:5080
-
\??\c:\brrvhr.exec:\brrvhr.exe117⤵PID:4268
-
\??\c:\jfvrp.exec:\jfvrp.exe118⤵PID:1884
-
\??\c:\frnvn.exec:\frnvn.exe119⤵PID:2360
-
\??\c:\lnddrh.exec:\lnddrh.exe120⤵PID:1080
-
\??\c:\jjhxrrp.exec:\jjhxrrp.exe121⤵PID:4380
-
\??\c:\pbpfblv.exec:\pbpfblv.exe122⤵PID:4044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-