Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 22:16
Behavioral task
behavioral1
Sample
NEAS.6bef9eaf6e09895fb04758f9588fa230.exe
Resource
win7-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.6bef9eaf6e09895fb04758f9588fa230.exe
-
Size
128KB
-
MD5
6bef9eaf6e09895fb04758f9588fa230
-
SHA1
742092675309e1136ab0a478374e980f1149f7f0
-
SHA256
6c4e4714d08fe26d884510eab9af2d272e0dff461eda329a1f0a72c947167a7b
-
SHA512
7d4fe46e1853cb14a4c96fb5e8aad0fa96bf4e7213be8fbfa608bb9159c20aa14d5cf3e74b851567ba7101f6740e955ff98e25fde6b01c348ebfd5c29d03d9ab
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa11zoOg7ITEF+dNJn:ccm4FmowdHoS5ddWccj8IF+d
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5036-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-1187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-1382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-1624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 bhbxtvv.exe 4008 ffhndlv.exe 1828 hxjxplj.exe 3160 jlbvjb.exe 3940 rvdlfh.exe 2400 ttfbjxd.exe 4232 flphbfl.exe 4384 dnvpt.exe 3528 nlxbhth.exe 2432 xtldvl.exe 1540 tbhplv.exe 2068 hffvvxl.exe 4308 nffvh.exe 744 pvtfr.exe 1900 dbvnntt.exe 2176 rlvpr.exe 4260 bltbx.exe 2892 rpbfl.exe 3256 rtjdphb.exe 3456 phxhv.exe 4576 rnfpdnp.exe 2860 rlptln.exe 2580 xnnxpt.exe 3580 bxdpr.exe 3644 hxrhxfh.exe 4472 rrfjnh.exe 4452 npjxhbd.exe 4892 ftvpll.exe 4876 pdxvj.exe 3172 vfprn.exe 2996 rfrjprp.exe 980 rrpbp.exe 1688 blvtfll.exe 3196 xfrhf.exe 5052 jxvrf.exe 4456 xtvltvh.exe 4396 xdplp.exe 3032 ftpnv.exe 1948 hfvrjhh.exe 4932 ndbfdf.exe 4176 bvjjb.exe 1840 tjfhx.exe 2360 jrblxl.exe 1336 plbbf.exe 1528 blfvj.exe 4200 hdpxfhp.exe 3740 vlnnp.exe 3448 rljlpl.exe 5044 hvdjdl.exe 232 vhpfjvf.exe 3556 jffnd.exe 4320 tbdxlv.exe 4072 tnhxhbj.exe 2060 ndfjj.exe 812 lhbpr.exe 2916 vprrv.exe 4160 vrjrb.exe 2024 vltdfnf.exe 3440 fdvhn.exe 4536 ntvnrj.exe 2572 prdxh.exe 1368 dxbrvhr.exe 1700 hnvxdt.exe 3164 dllfxl.exe -
resource yara_rule behavioral2/memory/3180-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d86-3.dat upx behavioral2/files/0x0008000000022d86-5.dat upx behavioral2/memory/5036-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d90-11.dat upx behavioral2/files/0x0007000000022d90-9.dat upx behavioral2/memory/3180-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4008-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d91-16.dat upx behavioral2/files/0x0007000000022d91-14.dat upx behavioral2/files/0x0007000000022d91-12.dat upx behavioral2/memory/1828-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d92-19.dat upx behavioral2/files/0x0007000000022d92-21.dat upx behavioral2/files/0x0007000000022d93-25.dat upx behavioral2/files/0x0007000000022d93-24.dat upx behavioral2/memory/2400-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d94-30.dat upx behavioral2/files/0x0007000000022d95-38.dat upx behavioral2/memory/4232-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d97-42.dat upx behavioral2/memory/4232-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d97-43.dat upx behavioral2/files/0x0007000000022d98-47.dat upx behavioral2/files/0x0007000000022d98-48.dat upx behavioral2/files/0x0007000000022d95-37.dat upx behavioral2/files/0x0007000000022d94-32.dat upx behavioral2/memory/4384-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3528-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3160-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3940-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d99-53.dat upx behavioral2/memory/2432-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d99-55.dat upx behavioral2/files/0x0008000000022d8a-61.dat upx behavioral2/memory/1540-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2432-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d9a-65.dat upx behavioral2/files/0x0008000000022d8a-59.dat upx behavioral2/files/0x0007000000022d9a-66.dat upx behavioral2/memory/2068-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2068-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d9b-71.dat upx behavioral2/files/0x0007000000022d9b-72.dat upx behavioral2/files/0x0008000000022d9d-77.dat upx behavioral2/files/0x0008000000022d9d-78.dat upx behavioral2/files/0x0008000000022d9e-81.dat upx behavioral2/memory/744-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d9e-83.dat upx behavioral2/files/0x0007000000022d9f-88.dat upx behavioral2/memory/2176-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1900-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022da0-93.dat upx behavioral2/files/0x0008000000022da0-94.dat upx behavioral2/files/0x0007000000022d9f-86.dat upx behavioral2/files/0x0008000000022da1-98.dat upx behavioral2/files/0x0008000000022da1-99.dat upx behavioral2/memory/4260-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2892-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022da3-108.dat upx behavioral2/memory/3256-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3456-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022da3-109.dat upx behavioral2/files/0x0008000000022da2-105.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 5036 3180 NEAS.6bef9eaf6e09895fb04758f9588fa230.exe 84 PID 3180 wrote to memory of 5036 3180 NEAS.6bef9eaf6e09895fb04758f9588fa230.exe 84 PID 3180 wrote to memory of 5036 3180 NEAS.6bef9eaf6e09895fb04758f9588fa230.exe 84 PID 5036 wrote to memory of 4008 5036 bhbxtvv.exe 85 PID 5036 wrote to memory of 4008 5036 bhbxtvv.exe 85 PID 5036 wrote to memory of 4008 5036 bhbxtvv.exe 85 PID 4008 wrote to memory of 1828 4008 ffhndlv.exe 86 PID 4008 wrote to memory of 1828 4008 ffhndlv.exe 86 PID 4008 wrote to memory of 1828 4008 ffhndlv.exe 86 PID 1828 wrote to memory of 3160 1828 hxjxplj.exe 87 PID 1828 wrote to memory of 3160 1828 hxjxplj.exe 87 PID 1828 wrote to memory of 3160 1828 hxjxplj.exe 87 PID 3160 wrote to memory of 3940 3160 jlbvjb.exe 88 PID 3160 wrote to memory of 3940 3160 jlbvjb.exe 88 PID 3160 wrote to memory of 3940 3160 jlbvjb.exe 88 PID 3940 wrote to memory of 2400 3940 rvdlfh.exe 89 PID 3940 wrote to memory of 2400 3940 rvdlfh.exe 89 PID 3940 wrote to memory of 2400 3940 rvdlfh.exe 89 PID 2400 wrote to memory of 4232 2400 ttfbjxd.exe 90 PID 2400 wrote to memory of 4232 2400 ttfbjxd.exe 90 PID 2400 wrote to memory of 4232 2400 ttfbjxd.exe 90 PID 4232 wrote to memory of 4384 4232 flphbfl.exe 91 PID 4232 wrote to memory of 4384 4232 flphbfl.exe 91 PID 4232 wrote to memory of 4384 4232 flphbfl.exe 91 PID 4384 wrote to memory of 3528 4384 dnvpt.exe 92 PID 4384 wrote to memory of 3528 4384 dnvpt.exe 92 PID 4384 wrote to memory of 3528 4384 dnvpt.exe 92 PID 3528 wrote to memory of 2432 3528 nlxbhth.exe 93 PID 3528 wrote to memory of 2432 3528 nlxbhth.exe 93 PID 3528 wrote to memory of 2432 3528 nlxbhth.exe 93 PID 2432 wrote to memory of 1540 2432 xtldvl.exe 94 PID 2432 wrote to memory of 1540 2432 xtldvl.exe 94 PID 2432 wrote to memory of 1540 2432 xtldvl.exe 94 PID 1540 wrote to memory of 2068 1540 tbhplv.exe 95 PID 1540 wrote to memory of 2068 1540 tbhplv.exe 95 PID 1540 wrote to memory of 2068 1540 tbhplv.exe 95 PID 2068 wrote to memory of 4308 2068 hffvvxl.exe 96 PID 2068 wrote to memory of 4308 2068 hffvvxl.exe 96 PID 2068 wrote to memory of 4308 2068 hffvvxl.exe 96 PID 4308 wrote to memory of 744 4308 nffvh.exe 97 PID 4308 wrote to memory of 744 4308 nffvh.exe 97 PID 4308 wrote to memory of 744 4308 nffvh.exe 97 PID 744 wrote to memory of 1900 744 pvtfr.exe 98 PID 744 wrote to memory of 1900 744 pvtfr.exe 98 PID 744 wrote to memory of 1900 744 pvtfr.exe 98 PID 1900 wrote to memory of 2176 1900 dbvnntt.exe 99 PID 1900 wrote to memory of 2176 1900 dbvnntt.exe 99 PID 1900 wrote to memory of 2176 1900 dbvnntt.exe 99 PID 2176 wrote to memory of 4260 2176 rlvpr.exe 100 PID 2176 wrote to memory of 4260 2176 rlvpr.exe 100 PID 2176 wrote to memory of 4260 2176 rlvpr.exe 100 PID 4260 wrote to memory of 2892 4260 bltbx.exe 101 PID 4260 wrote to memory of 2892 4260 bltbx.exe 101 PID 4260 wrote to memory of 2892 4260 bltbx.exe 101 PID 2892 wrote to memory of 3256 2892 rpbfl.exe 102 PID 2892 wrote to memory of 3256 2892 rpbfl.exe 102 PID 2892 wrote to memory of 3256 2892 rpbfl.exe 102 PID 3256 wrote to memory of 3456 3256 rtjdphb.exe 103 PID 3256 wrote to memory of 3456 3256 rtjdphb.exe 103 PID 3256 wrote to memory of 3456 3256 rtjdphb.exe 103 PID 3456 wrote to memory of 4576 3456 phxhv.exe 104 PID 3456 wrote to memory of 4576 3456 phxhv.exe 104 PID 3456 wrote to memory of 4576 3456 phxhv.exe 104 PID 4576 wrote to memory of 2860 4576 rnfpdnp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6bef9eaf6e09895fb04758f9588fa230.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6bef9eaf6e09895fb04758f9588fa230.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\bhbxtvv.exec:\bhbxtvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\ffhndlv.exec:\ffhndlv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\hxjxplj.exec:\hxjxplj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\jlbvjb.exec:\jlbvjb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\rvdlfh.exec:\rvdlfh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\ttfbjxd.exec:\ttfbjxd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\flphbfl.exec:\flphbfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\dnvpt.exec:\dnvpt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\nlxbhth.exec:\nlxbhth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\xtldvl.exec:\xtldvl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tbhplv.exec:\tbhplv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\hffvvxl.exec:\hffvvxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\nffvh.exec:\nffvh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\pvtfr.exec:\pvtfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\dbvnntt.exec:\dbvnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\rlvpr.exec:\rlvpr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\bltbx.exec:\bltbx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\rpbfl.exec:\rpbfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rtjdphb.exec:\rtjdphb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\phxhv.exec:\phxhv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\rnfpdnp.exec:\rnfpdnp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rlptln.exec:\rlptln.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xnnxpt.exec:\xnnxpt.exe24⤵
- Executes dropped EXE
PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\hxxlbh.exec:\hxxlbh.exe8⤵PID:4476
-
-
-
-
-
-
-
-
\??\c:\bxdpr.exec:\bxdpr.exe1⤵
- Executes dropped EXE
PID:3580 -
\??\c:\hxrhxfh.exec:\hxrhxfh.exe2⤵
- Executes dropped EXE
PID:3644 -
\??\c:\rrfjnh.exec:\rrfjnh.exe3⤵
- Executes dropped EXE
PID:4472 -
\??\c:\npjxhbd.exec:\npjxhbd.exe4⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ftvpll.exec:\ftvpll.exe5⤵
- Executes dropped EXE
PID:4892 -
\??\c:\pdxvj.exec:\pdxvj.exe6⤵
- Executes dropped EXE
PID:4876
-
-
-
-
-
-
\??\c:\vfprn.exec:\vfprn.exe1⤵
- Executes dropped EXE
PID:3172 -
\??\c:\rfrjprp.exec:\rfrjprp.exe2⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rrpbp.exec:\rrpbp.exe3⤵
- Executes dropped EXE
PID:980 -
\??\c:\blvtfll.exec:\blvtfll.exe4⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xfrhf.exec:\xfrhf.exe5⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jxvrf.exec:\jxvrf.exe6⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xtvltvh.exec:\xtvltvh.exe7⤵
- Executes dropped EXE
PID:4456 -
\??\c:\xdplp.exec:\xdplp.exe8⤵
- Executes dropped EXE
PID:4396 -
\??\c:\ftpnv.exec:\ftpnv.exe9⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hfvrjhh.exec:\hfvrjhh.exe10⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ndbfdf.exec:\ndbfdf.exe11⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bvjjb.exec:\bvjjb.exe12⤵
- Executes dropped EXE
PID:4176 -
\??\c:\tjfhx.exec:\tjfhx.exe13⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jrblxl.exec:\jrblxl.exe14⤵
- Executes dropped EXE
PID:2360 -
\??\c:\plbbf.exec:\plbbf.exe15⤵
- Executes dropped EXE
PID:1336 -
\??\c:\blfvj.exec:\blfvj.exe16⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hdpxfhp.exec:\hdpxfhp.exe17⤵
- Executes dropped EXE
PID:4200 -
\??\c:\vlnnp.exec:\vlnnp.exe18⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rljlpl.exec:\rljlpl.exe19⤵
- Executes dropped EXE
PID:3448 -
\??\c:\hvdjdl.exec:\hvdjdl.exe20⤵
- Executes dropped EXE
PID:5044 -
\??\c:\vhpfjvf.exec:\vhpfjvf.exe21⤵
- Executes dropped EXE
PID:232 -
\??\c:\jffnd.exec:\jffnd.exe22⤵
- Executes dropped EXE
PID:3556 -
\??\c:\tbdxlv.exec:\tbdxlv.exe23⤵
- Executes dropped EXE
PID:4320 -
\??\c:\tnhxhbj.exec:\tnhxhbj.exe24⤵
- Executes dropped EXE
PID:4072 -
\??\c:\ndfjj.exec:\ndfjj.exe25⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lhbpr.exec:\lhbpr.exe26⤵
- Executes dropped EXE
PID:812 -
\??\c:\vprrv.exec:\vprrv.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vrjrb.exec:\vrjrb.exe28⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vltdfnf.exec:\vltdfnf.exe29⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fdvhn.exec:\fdvhn.exe30⤵
- Executes dropped EXE
PID:3440 -
\??\c:\ntvnrj.exec:\ntvnrj.exe31⤵
- Executes dropped EXE
PID:4536 -
\??\c:\prdxh.exec:\prdxh.exe32⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dxbrvhr.exec:\dxbrvhr.exe33⤵
- Executes dropped EXE
PID:1368 -
\??\c:\hnvxdt.exec:\hnvxdt.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dllfxl.exec:\dllfxl.exe35⤵
- Executes dropped EXE
PID:3164
-
-
\??\c:\ttnvrjf.exec:\ttnvrjf.exe35⤵PID:3508
-
\??\c:\pxjnt.exec:\pxjnt.exe36⤵PID:4328
-
-
-
-
\??\c:\lpnjpln.exec:\lpnjpln.exe34⤵PID:4196
-
-
-
-
-
-
-
-
-
-
\??\c:\jvtljfp.exec:\jvtljfp.exe26⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\jnrvl.exec:\jnrvl.exe1⤵PID:228
-
\??\c:\jtlfjxj.exec:\jtlfjxj.exe2⤵PID:1628
-
\??\c:\fjnjdv.exec:\fjnjdv.exe3⤵PID:2628
-
\??\c:\nbvjrx.exec:\nbvjrx.exe4⤵PID:4304
-
\??\c:\tlxfpp.exec:\tlxfpp.exe5⤵PID:1296
-
\??\c:\rfdhb.exec:\rfdhb.exe6⤵PID:4676
-
\??\c:\tfpplt.exec:\tfpplt.exe7⤵PID:208
-
\??\c:\hhndx.exec:\hhndx.exe8⤵PID:1252
-
\??\c:\rxphnhl.exec:\rxphnhl.exe9⤵PID:2544
-
\??\c:\nttxj.exec:\nttxj.exe10⤵PID:3876
-
\??\c:\ttfrdjj.exec:\ttfrdjj.exe11⤵PID:776
-
\??\c:\bjbpld.exec:\bjbpld.exe12⤵PID:2244
-
\??\c:\rbjffrf.exec:\rbjffrf.exe13⤵PID:2232
-
\??\c:\hjbhphn.exec:\hjbhphn.exe14⤵PID:2228
-
\??\c:\pjhvdr.exec:\pjhvdr.exe15⤵PID:3272
-
\??\c:\fxxxnhn.exec:\fxxxnhn.exe16⤵PID:3132
-
\??\c:\hrrlf.exec:\hrrlf.exe17⤵PID:3288
-
\??\c:\xhdlnj.exec:\xhdlnj.exe18⤵PID:4388
-
\??\c:\tvdhbdl.exec:\tvdhbdl.exe19⤵PID:3572
-
\??\c:\ldtdrf.exec:\ldtdrf.exe20⤵PID:3328
-
\??\c:\txrfhd.exec:\txrfhd.exe21⤵PID:4848
-
\??\c:\bbxjp.exec:\bbxjp.exe22⤵PID:4300
-
\??\c:\nrbph.exec:\nrbph.exe23⤵PID:2996
-
\??\c:\trbdvd.exec:\trbdvd.exe24⤵PID:1224
-
\??\c:\hhlhbjr.exec:\hhlhbjr.exe25⤵PID:1848
-
\??\c:\bfjvln.exec:\bfjvln.exe26⤵PID:3800
-
\??\c:\hrjhd.exec:\hrjhd.exe27⤵PID:1704
-
\??\c:\tbhjh.exec:\tbhjh.exe28⤵PID:4360
-
\??\c:\xrjhp.exec:\xrjhp.exe29⤵PID:5068
-
\??\c:\xjprn.exec:\xjprn.exe30⤵PID:4736
-
\??\c:\fdddn.exec:\fdddn.exe31⤵PID:4004
-
\??\c:\vjvbf.exec:\vjvbf.exe32⤵PID:4408
-
\??\c:\pthvdhr.exec:\pthvdhr.exe33⤵PID:1616
-
\??\c:\nttvhr.exec:\nttvhr.exe34⤵PID:4468
-
\??\c:\ddhvl.exec:\ddhvl.exe35⤵PID:3848
-
\??\c:\nbntrlx.exec:\nbntrlx.exe36⤵PID:4244
-
\??\c:\pplvj.exec:\pplvj.exe37⤵PID:3740
-
\??\c:\llvxn.exec:\llvxn.exe38⤵PID:4364
-
\??\c:\lbbxtnh.exec:\lbbxtnh.exe39⤵PID:4596
-
\??\c:\tfptp.exec:\tfptp.exe40⤵PID:3392
-
\??\c:\fdhlv.exec:\fdhlv.exe41⤵PID:3556
-
\??\c:\xptvf.exec:\xptvf.exe42⤵PID:3664
-
\??\c:\npddl.exec:\npddl.exe43⤵PID:4072
-
\??\c:\pvbnr.exec:\pvbnr.exe44⤵PID:4648
-
\??\c:\xjpjn.exec:\xjpjn.exe45⤵PID:4940
-
\??\c:\bjfpnh.exec:\bjfpnh.exe46⤵PID:4160
-
\??\c:\tnxjt.exec:\tnxjt.exe47⤵PID:3528
-
\??\c:\tnpjftt.exec:\tnpjftt.exe48⤵PID:2252
-
\??\c:\jrjrp.exec:\jrjrp.exe49⤵PID:3588
-
\??\c:\xnnbxjp.exec:\xnnbxjp.exe50⤵PID:2832
-
\??\c:\lvxvxp.exec:\lvxvxp.exe51⤵PID:4308
-
\??\c:\nttdxvj.exec:\nttdxvj.exe52⤵PID:964
-
\??\c:\pjxxttb.exec:\pjxxttb.exe53⤵PID:4868
-
\??\c:\hxfhvpv.exec:\hxfhvpv.exe54⤵PID:744
-
\??\c:\rlxxdd.exec:\rlxxdd.exe55⤵PID:1744
-
\??\c:\rtxxn.exec:\rtxxn.exe56⤵PID:1624
-
\??\c:\lvtxjx.exec:\lvtxjx.exe57⤵PID:3256
-
\??\c:\xlxxv.exec:\xlxxv.exe58⤵PID:4676
-
\??\c:\hxffh.exec:\hxffh.exe59⤵PID:3508
-
\??\c:\ldbnbl.exec:\ldbnbl.exe60⤵PID:208
-
\??\c:\lvffl.exec:\lvffl.exe61⤵PID:2384
-
\??\c:\rxxhh.exec:\rxxhh.exe62⤵PID:4904
-
\??\c:\lxpppdb.exec:\lxpppdb.exe63⤵PID:4212
-
\??\c:\tdtnvf.exec:\tdtnvf.exe64⤵PID:4832
-
\??\c:\dnjtdl.exec:\dnjtdl.exe65⤵PID:3208
-
\??\c:\lnvlv.exec:\lnvlv.exe66⤵PID:4500
-
\??\c:\hrltplp.exec:\hrltplp.exe67⤵PID:3272
-
\??\c:\jnxnbhf.exec:\jnxnbhf.exe68⤵PID:180
-
\??\c:\fdxvn.exec:\fdxvn.exe69⤵PID:2032
-
\??\c:\xptxb.exec:\xptxb.exe70⤵PID:4460
-
\??\c:\ffthl.exec:\ffthl.exe71⤵PID:3844
-
\??\c:\ftpthd.exec:\ftpthd.exe72⤵PID:3452
-
\??\c:\rpbptvx.exec:\rpbptvx.exe73⤵PID:3044
-
\??\c:\nnhtxhx.exec:\nnhtxhx.exe74⤵PID:4144
-
\??\c:\hjfff.exec:\hjfff.exe75⤵PID:3540
-
\??\c:\fnfhph.exec:\fnfhph.exe76⤵PID:4232
-
\??\c:\lnxvhl.exec:\lnxvhl.exe77⤵PID:5076
-
\??\c:\jrpdnj.exec:\jrpdnj.exe78⤵PID:3020
-
\??\c:\xjxfll.exec:\xjxfll.exe79⤵PID:4396
-
\??\c:\xtflxxb.exec:\xtflxxb.exe80⤵PID:3232
-
\??\c:\tvpjf.exec:\tvpjf.exe81⤵PID:1948
-
\??\c:\fthltvd.exec:\fthltvd.exe82⤵PID:4736
-
\??\c:\nhpbn.exec:\nhpbn.exe83⤵PID:4768
-
\??\c:\dxrjfxl.exec:\dxrjfxl.exe84⤵PID:872
-
\??\c:\xbpddtt.exec:\xbpddtt.exe85⤵PID:4284
-
\??\c:\bxhvn.exec:\bxhvn.exe86⤵PID:2756
-
\??\c:\ldjhxvb.exec:\ldjhxvb.exe87⤵PID:4328
-
\??\c:\hxppnv.exec:\hxppnv.exe88⤵PID:4244
-
\??\c:\xntxfbb.exec:\xntxfbb.exe89⤵PID:1828
-
\??\c:\bdtltr.exec:\bdtltr.exe90⤵PID:348
-
\??\c:\hrvld.exec:\hrvld.exe91⤵PID:3720
-
\??\c:\hffhxb.exec:\hffhxb.exe92⤵PID:3392
-
\??\c:\phlptp.exec:\phlptp.exe93⤵PID:3872
-
\??\c:\lxbdpb.exec:\lxbdpb.exe94⤵PID:2912
-
\??\c:\txxvjrx.exec:\txxvjrx.exe95⤵PID:4040
-
\??\c:\pnnrvf.exec:\pnnrvf.exe96⤵PID:4476
-
\??\c:\fblhr.exec:\fblhr.exe97⤵PID:2024
-
\??\c:\jbltfvf.exec:\jbltfvf.exe98⤵PID:4968
-
\??\c:\fhnrnjr.exec:\fhnrnjr.exe99⤵PID:4536
-
\??\c:\dffrdf.exec:\dffrdf.exe100⤵PID:224
-
\??\c:\bxxxb.exec:\bxxxb.exe101⤵PID:1580
-
\??\c:\rvhlff.exec:\rvhlff.exe102⤵PID:2832
-
\??\c:\hpvxnnx.exec:\hpvxnnx.exe103⤵PID:1900
-
\??\c:\jvxrd.exec:\jvxrd.exe104⤵PID:228
-
\??\c:\fplljhf.exec:\fplljhf.exe105⤵PID:1468
-
\??\c:\bvtvjj.exec:\bvtvjj.exe106⤵PID:744
-
\??\c:\lbrtj.exec:\lbrtj.exe107⤵PID:3488
-
\??\c:\nlpjnfj.exec:\nlpjnfj.exe108⤵PID:4840
-
\??\c:\lphdvjn.exec:\lphdvjn.exe109⤵PID:1252
-
\??\c:\vpfntr.exec:\vpfntr.exe110⤵PID:4584
-
\??\c:\htrjxt.exec:\htrjxt.exe111⤵PID:2428
-
\??\c:\fxtxtb.exec:\fxtxtb.exe112⤵PID:3876
-
\??\c:\fftnnh.exec:\fftnnh.exe113⤵PID:3580
-
\??\c:\fdtjj.exec:\fdtjj.exe114⤵PID:776
-
\??\c:\hvxdd.exec:\hvxdd.exe115⤵PID:1988
-
\??\c:\rvbntbb.exec:\rvbntbb.exe116⤵PID:3208
-
\??\c:\bpnfrj.exec:\bpnfrj.exe117⤵PID:4452
-
\??\c:\xrtfvx.exec:\xrtfvx.exe118⤵PID:3460
-
\??\c:\bxfhv.exec:\bxfhv.exe119⤵PID:5080
-
\??\c:\pvrfp.exec:\pvrfp.exe120⤵PID:4440
-
\??\c:\tnxnlnd.exec:\tnxnlnd.exe121⤵PID:1448
-
\??\c:\vxlpxv.exec:\vxlpxv.exe122⤵PID:3172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-