Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe
-
Size
465KB
-
MD5
df69b73cafbd4cac5c473bbbbc0413d0
-
SHA1
2bdcc6773bb57beec4dfa57ead50dd6d81046b88
-
SHA256
ed08130b0f40bdbf5f5cfc7149484a4deccda8d309d0beddeaf321d748885def
-
SHA512
a261411c83581e683ea15a135b7d935ed0d9c4d74a2356d3a8ae13021b3b467856e9d5d71d1ab7700dd0ac1fff027e286dc1b577d75550a38cf0082161ce4a4a
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fa:Su326p0aroZt0C
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral2/memory/1428-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/500-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-397-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-461-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3840 tddnn.exe 1088 txddtbh.exe 2448 lfdpjr.exe 4412 rfdxtj.exe 4876 rpdbhp.exe 4480 fhdhnf.exe 2888 npxxbbt.exe 3328 nnrxt.exe 3828 tllphr.exe 4992 nndph.exe 4888 bndtj.exe 2988 hjnlp.exe 2232 djftllb.exe 3100 vdrdndr.exe 500 dbvlr.exe 4692 fdhtjr.exe 2276 bdrxt.exe 2796 jlnlh.exe 2004 fdppjrx.exe 4960 ptnhh.exe 4520 xdjdtbt.exe 3556 ltptp.exe 4528 jxhxbnt.exe 4952 tffhf.exe 644 lbxtxl.exe 824 rnhrrjd.exe 780 jlljdrp.exe 320 htlrtn.exe 4436 lnbdfj.exe 668 vvbft.exe 2936 jnrrn.exe 1852 fnbvhfj.exe 3924 vjljhp.exe 1800 fdhdrx.exe 2440 tfhhhtv.exe 4676 fjnddbx.exe 4860 jthffdh.exe 2508 pxxbbv.exe 4124 hvfhl.exe 3624 xjnfx.exe 820 hnpbbfb.exe 1724 hnffhvx.exe 8 vbntv.exe 888 bbltt.exe 4928 rxjdf.exe 1068 ljxbb.exe 3744 pxfljp.exe 2352 dlvjrt.exe 4512 dlltxxl.exe 2988 vdjdvj.exe 2248 fdddhx.exe 1948 bdbpd.exe 3100 blpfddv.exe 680 xfnbt.exe 4628 ttnjdpl.exe 4048 pnhrrdt.exe 4864 tndxhpn.exe 3764 lvpjbx.exe 4788 rnnxfnt.exe 4960 jdtfh.exe 4396 ldlfl.exe 2132 xjltvh.exe 1020 ptdjbb.exe 1836 jvnplv.exe -
resource yara_rule behavioral2/memory/1428-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/500-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-461-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-472-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 3840 1428 NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe 84 PID 1428 wrote to memory of 3840 1428 NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe 84 PID 1428 wrote to memory of 3840 1428 NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe 84 PID 3840 wrote to memory of 1088 3840 tddnn.exe 85 PID 3840 wrote to memory of 1088 3840 tddnn.exe 85 PID 3840 wrote to memory of 1088 3840 tddnn.exe 85 PID 1088 wrote to memory of 2448 1088 txddtbh.exe 86 PID 1088 wrote to memory of 2448 1088 txddtbh.exe 86 PID 1088 wrote to memory of 2448 1088 txddtbh.exe 86 PID 2448 wrote to memory of 4412 2448 lfdpjr.exe 87 PID 2448 wrote to memory of 4412 2448 lfdpjr.exe 87 PID 2448 wrote to memory of 4412 2448 lfdpjr.exe 87 PID 4412 wrote to memory of 4876 4412 rfdxtj.exe 88 PID 4412 wrote to memory of 4876 4412 rfdxtj.exe 88 PID 4412 wrote to memory of 4876 4412 rfdxtj.exe 88 PID 4876 wrote to memory of 4480 4876 rpdbhp.exe 89 PID 4876 wrote to memory of 4480 4876 rpdbhp.exe 89 PID 4876 wrote to memory of 4480 4876 rpdbhp.exe 89 PID 4480 wrote to memory of 2888 4480 fhdhnf.exe 90 PID 4480 wrote to memory of 2888 4480 fhdhnf.exe 90 PID 4480 wrote to memory of 2888 4480 fhdhnf.exe 90 PID 2888 wrote to memory of 3328 2888 npxxbbt.exe 91 PID 2888 wrote to memory of 3328 2888 npxxbbt.exe 91 PID 2888 wrote to memory of 3328 2888 npxxbbt.exe 91 PID 3328 wrote to memory of 3828 3328 nnrxt.exe 92 PID 3328 wrote to memory of 3828 3328 nnrxt.exe 92 PID 3328 wrote to memory of 3828 3328 nnrxt.exe 92 PID 3828 wrote to memory of 4992 3828 tllphr.exe 93 PID 3828 wrote to memory of 4992 3828 tllphr.exe 93 PID 3828 wrote to memory of 4992 3828 tllphr.exe 93 PID 4992 wrote to memory of 4888 4992 nndph.exe 94 PID 4992 wrote to memory of 4888 4992 nndph.exe 94 PID 4992 wrote to memory of 4888 4992 nndph.exe 94 PID 4888 wrote to memory of 2988 4888 bndtj.exe 95 PID 4888 wrote to memory of 2988 4888 bndtj.exe 95 PID 4888 wrote to memory of 2988 4888 bndtj.exe 95 PID 2988 wrote to memory of 2232 2988 hjnlp.exe 97 PID 2988 wrote to memory of 2232 2988 hjnlp.exe 97 PID 2988 wrote to memory of 2232 2988 hjnlp.exe 97 PID 2232 wrote to memory of 3100 2232 djftllb.exe 96 PID 2232 wrote to memory of 3100 2232 djftllb.exe 96 PID 2232 wrote to memory of 3100 2232 djftllb.exe 96 PID 3100 wrote to memory of 500 3100 vdrdndr.exe 98 PID 3100 wrote to memory of 500 3100 vdrdndr.exe 98 PID 3100 wrote to memory of 500 3100 vdrdndr.exe 98 PID 500 wrote to memory of 4692 500 dbvlr.exe 99 PID 500 wrote to memory of 4692 500 dbvlr.exe 99 PID 500 wrote to memory of 4692 500 dbvlr.exe 99 PID 4692 wrote to memory of 2276 4692 fdhtjr.exe 100 PID 4692 wrote to memory of 2276 4692 fdhtjr.exe 100 PID 4692 wrote to memory of 2276 4692 fdhtjr.exe 100 PID 2276 wrote to memory of 2796 2276 bdrxt.exe 101 PID 2276 wrote to memory of 2796 2276 bdrxt.exe 101 PID 2276 wrote to memory of 2796 2276 bdrxt.exe 101 PID 2796 wrote to memory of 2004 2796 jlnlh.exe 102 PID 2796 wrote to memory of 2004 2796 jlnlh.exe 102 PID 2796 wrote to memory of 2004 2796 jlnlh.exe 102 PID 2004 wrote to memory of 4960 2004 fdppjrx.exe 103 PID 2004 wrote to memory of 4960 2004 fdppjrx.exe 103 PID 2004 wrote to memory of 4960 2004 fdppjrx.exe 103 PID 4960 wrote to memory of 4520 4960 ptnhh.exe 104 PID 4960 wrote to memory of 4520 4960 ptnhh.exe 104 PID 4960 wrote to memory of 4520 4960 ptnhh.exe 104 PID 4520 wrote to memory of 3556 4520 xdjdtbt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.df69b73cafbd4cac5c473bbbbc0413d0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\tddnn.exec:\tddnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\txddtbh.exec:\txddtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\lfdpjr.exec:\lfdpjr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rfdxtj.exec:\rfdxtj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\rpdbhp.exec:\rpdbhp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\fhdhnf.exec:\fhdhnf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\npxxbbt.exec:\npxxbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nnrxt.exec:\nnrxt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\tllphr.exec:\tllphr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\nndph.exec:\nndph.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\bndtj.exec:\bndtj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\hjnlp.exec:\hjnlp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\djftllb.exec:\djftllb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\vdrdndr.exec:\vdrdndr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\dbvlr.exec:\dbvlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
\??\c:\fdhtjr.exec:\fdhtjr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bdrxt.exec:\bdrxt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jlnlh.exec:\jlnlh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\fdppjrx.exec:\fdppjrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\ptnhh.exec:\ptnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\xdjdtbt.exec:\xdjdtbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ltptp.exec:\ltptp.exe9⤵
- Executes dropped EXE
PID:3556 -
\??\c:\jxhxbnt.exec:\jxhxbnt.exe10⤵
- Executes dropped EXE
PID:4528 -
\??\c:\tffhf.exec:\tffhf.exe11⤵
- Executes dropped EXE
PID:4952 -
\??\c:\lbxtxl.exec:\lbxtxl.exe12⤵
- Executes dropped EXE
PID:644 -
\??\c:\rnhrrjd.exec:\rnhrrjd.exe13⤵
- Executes dropped EXE
PID:824 -
\??\c:\jlljdrp.exec:\jlljdrp.exe14⤵
- Executes dropped EXE
PID:780 -
\??\c:\htlrtn.exec:\htlrtn.exe15⤵
- Executes dropped EXE
PID:320 -
\??\c:\lnbdfj.exec:\lnbdfj.exe16⤵
- Executes dropped EXE
PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\vvbft.exec:\vvbft.exe1⤵
- Executes dropped EXE
PID:668 -
\??\c:\jnrrn.exec:\jnrrn.exe2⤵
- Executes dropped EXE
PID:2936 -
\??\c:\fnbvhfj.exec:\fnbvhfj.exe3⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vjljhp.exec:\vjljhp.exe4⤵
- Executes dropped EXE
PID:3924 -
\??\c:\fdhdrx.exec:\fdhdrx.exe5⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tfhhhtv.exec:\tfhhhtv.exe6⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fjnddbx.exec:\fjnddbx.exe7⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jthffdh.exec:\jthffdh.exe8⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pxxbbv.exec:\pxxbbv.exe9⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hvfhl.exec:\hvfhl.exe10⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xjnfx.exec:\xjnfx.exe11⤵
- Executes dropped EXE
PID:3624 -
\??\c:\hnpbbfb.exec:\hnpbbfb.exe12⤵
- Executes dropped EXE
PID:820 -
\??\c:\hnffhvx.exec:\hnffhvx.exe13⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vbntv.exec:\vbntv.exe14⤵
- Executes dropped EXE
PID:8 -
\??\c:\bbltt.exec:\bbltt.exe15⤵
- Executes dropped EXE
PID:888 -
\??\c:\rxjdf.exec:\rxjdf.exe16⤵
- Executes dropped EXE
PID:4928 -
\??\c:\ljxbb.exec:\ljxbb.exe17⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pxfljp.exec:\pxfljp.exe18⤵
- Executes dropped EXE
PID:3744 -
\??\c:\dlvjrt.exec:\dlvjrt.exe19⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dlltxxl.exec:\dlltxxl.exe20⤵
- Executes dropped EXE
PID:4512 -
\??\c:\vdjdvj.exec:\vdjdvj.exe21⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fdddhx.exec:\fdddhx.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bdbpd.exec:\bdbpd.exe23⤵
- Executes dropped EXE
PID:1948 -
\??\c:\blpfddv.exec:\blpfddv.exe24⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xfnbt.exec:\xfnbt.exe25⤵
- Executes dropped EXE
PID:680 -
\??\c:\ttnjdpl.exec:\ttnjdpl.exe26⤵
- Executes dropped EXE
PID:4628 -
\??\c:\pnhrrdt.exec:\pnhrrdt.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tndxhpn.exec:\tndxhpn.exe28⤵
- Executes dropped EXE
PID:4864 -
\??\c:\lvpjbx.exec:\lvpjbx.exe29⤵
- Executes dropped EXE
PID:3764 -
\??\c:\rnnxfnt.exec:\rnnxfnt.exe30⤵
- Executes dropped EXE
PID:4788 -
\??\c:\jdtfh.exec:\jdtfh.exe31⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ldlfl.exec:\ldlfl.exe32⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xjltvh.exec:\xjltvh.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ptdjbb.exec:\ptdjbb.exe34⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jvnplv.exec:\jvnplv.exe35⤵
- Executes dropped EXE
PID:1836 -
\??\c:\hrdhpxb.exec:\hrdhpxb.exe36⤵PID:4952
-
\??\c:\pvxdnp.exec:\pvxdnp.exe37⤵PID:1696
-
\??\c:\jrjnt.exec:\jrjnt.exe38⤵PID:2128
-
\??\c:\xrtlt.exec:\xrtlt.exe39⤵PID:824
-
\??\c:\bnrnd.exec:\bnrnd.exe40⤵PID:776
-
\??\c:\nbhxnt.exec:\nbhxnt.exe41⤵PID:320
-
\??\c:\hhllj.exec:\hhllj.exe42⤵PID:2928
-
\??\c:\xhhdf.exec:\xhhdf.exe43⤵PID:2600
-
\??\c:\jffnh.exec:\jffnh.exe44⤵PID:3380
-
\??\c:\jjnlh.exec:\jjnlh.exe45⤵PID:4984
-
\??\c:\ntdhlh.exec:\ntdhlh.exe46⤵PID:2496
-
\??\c:\httppvh.exec:\httppvh.exe47⤵PID:2856
-
\??\c:\pnbbv.exec:\pnbbv.exe48⤵PID:3508
-
\??\c:\bxhhx.exec:\bxhhx.exe49⤵PID:3824
-
\??\c:\ljhrpxj.exec:\ljhrpxj.exe50⤵PID:1152
-
\??\c:\xnlltb.exec:\xnlltb.exe51⤵PID:4020
-
\??\c:\pfpvt.exec:\pfpvt.exe52⤵PID:1572
-
\??\c:\vvhfxp.exec:\vvhfxp.exe53⤵PID:1652
-
\??\c:\lpjpnrd.exec:\lpjpnrd.exe54⤵PID:2284
-
\??\c:\tjthd.exec:\tjthd.exe55⤵PID:3628
-
\??\c:\xnrpj.exec:\xnrpj.exe56⤵PID:1200
-
\??\c:\dlfnndh.exec:\dlfnndh.exe57⤵PID:1080
-
\??\c:\plvrxlr.exec:\plvrxlr.exe58⤵PID:3180
-
\??\c:\nlxxtf.exec:\nlxxtf.exe59⤵PID:3328
-
\??\c:\fnrdd.exec:\fnrdd.exe60⤵PID:4928
-
\??\c:\hltlpjx.exec:\hltlpjx.exe61⤵PID:1068
-
\??\c:\npprb.exec:\npprb.exe62⤵PID:3016
-
\??\c:\tnbjlx.exec:\tnbjlx.exe63⤵PID:1432
-
\??\c:\drvvrjj.exec:\drvvrjj.exe64⤵PID:1416
-
\??\c:\bttxnt.exec:\bttxnt.exe65⤵PID:1656
-
\??\c:\tfptj.exec:\tfptj.exe66⤵PID:2136
-
\??\c:\nnlbndn.exec:\nnlbndn.exe67⤵PID:4496
-
\??\c:\hjvfbxv.exec:\hjvfbxv.exe68⤵PID:3224
-
\??\c:\njrvn.exec:\njrvn.exe69⤵PID:2372
-
\??\c:\jlprrbd.exec:\jlprrbd.exe70⤵PID:1488
-
\??\c:\vtfvnlj.exec:\vtfvnlj.exe71⤵PID:4156
-
\??\c:\pthxrrb.exec:\pthxrrb.exe72⤵PID:3500
-
\??\c:\xrlxrdp.exec:\xrlxrdp.exe73⤵PID:1444
-
\??\c:\htdrfrh.exec:\htdrfrh.exe74⤵PID:1168
-
\??\c:\nbtvv.exec:\nbtvv.exe75⤵PID:4520
-
\??\c:\jltndnx.exec:\jltndnx.exe76⤵PID:3556
-
\??\c:\hdhjxh.exec:\hdhjxh.exe77⤵PID:972
-
\??\c:\tpxth.exec:\tpxth.exe78⤵PID:1908
-
\??\c:\thrrd.exec:\thrrd.exe79⤵PID:3616
-
\??\c:\ljfptbb.exec:\ljfptbb.exe80⤵PID:2384
-
\??\c:\pdtltvd.exec:\pdtltvd.exe81⤵PID:2404
-
\??\c:\dfthnd.exec:\dfthnd.exe82⤵PID:4432
-
\??\c:\lrfvdxn.exec:\lrfvdxn.exe83⤵PID:2576
-
\??\c:\rtjdldj.exec:\rtjdldj.exe84⤵PID:1624
-
\??\c:\rhplfrt.exec:\rhplfrt.exe85⤵PID:1540
-
\??\c:\bphbl.exec:\bphbl.exe86⤵PID:2340
-
\??\c:\trbxt.exec:\trbxt.exe87⤵PID:668
-
\??\c:\jvtdjv.exec:\jvtdjv.exe88⤵PID:392
-
\??\c:\ftxxl.exec:\ftxxl.exe89⤵PID:3712
-
\??\c:\bjvhnhn.exec:\bjvhnhn.exe90⤵PID:1800
-
\??\c:\rvlxxl.exec:\rvlxxl.exe91⤵PID:2868
-
\??\c:\xftdbnl.exec:\xftdbnl.exe92⤵PID:2356
-
\??\c:\hdjvr.exec:\hdjvr.exe93⤵PID:412
-
\??\c:\tvbftrd.exec:\tvbftrd.exe94⤵PID:1440
-
\??\c:\rttrn.exec:\rttrn.exe95⤵PID:2180
-
\??\c:\dxlrp.exec:\dxlrp.exe96⤵PID:976
-
\??\c:\pblbnv.exec:\pblbnv.exe97⤵PID:4688
-
\??\c:\xlfvnn.exec:\xlfvnn.exe98⤵PID:3628
-
\??\c:\lnhnpp.exec:\lnhnpp.exe99⤵PID:3860
-
\??\c:\dhhxvl.exec:\dhhxvl.exe100⤵PID:3560
-
\??\c:\ndvvltt.exec:\ndvvltt.exe101⤵PID:3760
-
\??\c:\bttrvr.exec:\bttrvr.exe102⤵PID:2692
-
\??\c:\vlxvxll.exec:\vlxvxll.exe103⤵PID:4012
-
\??\c:\nnxvptb.exec:\nnxvptb.exe104⤵PID:2316
-
\??\c:\vbpht.exec:\vbpht.exe105⤵PID:1804
-
\??\c:\lhbbhf.exec:\lhbbhf.exe106⤵PID:3800
-
\??\c:\rthdt.exec:\rthdt.exe107⤵PID:4220
-
\??\c:\jphhvn.exec:\jphhvn.exe108⤵PID:3976
-
\??\c:\hntfdfl.exec:\hntfdfl.exe109⤵PID:680
-
\??\c:\nlfhlb.exec:\nlfhlb.exe110⤵PID:4104
-
\??\c:\ndftvhx.exec:\ndftvhx.exe111⤵PID:2372
-
\??\c:\lltvdl.exec:\lltvdl.exe112⤵PID:4244
-
\??\c:\hpvdd.exec:\hpvdd.exe113⤵PID:4788
-
\??\c:\ptbtftt.exec:\ptbtftt.exe114⤵PID:1336
-
\??\c:\rdxvtt.exec:\rdxvtt.exe115⤵PID:956
-
\??\c:\prlhbjx.exec:\prlhbjx.exe116⤵PID:2884
-
\??\c:\xjrbp.exec:\xjrbp.exe117⤵PID:2492
-
\??\c:\bfftxx.exec:\bfftxx.exe118⤵PID:3536
-
\??\c:\ttxbpdp.exec:\ttxbpdp.exe119⤵PID:3112
-
\??\c:\tvbfbdt.exec:\tvbfbdt.exe120⤵PID:3184
-
\??\c:\npnhtxr.exec:\npnhtxr.exe121⤵PID:3604
-
\??\c:\lnpjlb.exec:\lnpjlb.exe122⤵PID:320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-