Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 18:22
Behavioral task
behavioral1
Sample
b55ce0b48c766b699a73056303c17a04.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
b55ce0b48c766b699a73056303c17a04.exe
-
Size
143KB
-
MD5
b55ce0b48c766b699a73056303c17a04
-
SHA1
d1ccea5a0e76a2951b7fc08f2f790b71f13b566c
-
SHA256
d47231b1dc03614724c819f3fe052abec0f0e1661c6efaee26491342e166a549
-
SHA512
53df785601166fc08d139501bf2ae6f339b982f12a2f88ebbc84c1d570e5449ef7e6705f80cc764a8d1f69c40127030cc3d5c0adebc551fb60db644f5323fc7f
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBuItR8pLbtIBjOHCfOp2:9cm4FmowdHoS4BftapFApmp2
Malware Config
Signatures
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1784-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-99-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2412-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/748-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/528-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-168-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/916-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/528-188-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1284-196-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2288-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-287-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2004-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-301-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/820-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-328-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2936-336-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2600-350-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1668-351-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2552-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-358-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2456-365-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3044-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-373-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/2548-380-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2380-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-418-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/552-424-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2648-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-446-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/936-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-471-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2012-479-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1616-485-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1336-499-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1552-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-527-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2000-546-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 jtvblx.exe 2936 jrvhljl.exe 2672 frftvlp.exe 2524 vrnpfb.exe 2716 npjtjdh.exe 2604 blrtd.exe 2588 dnjjrb.exe 2412 nvlbpbb.exe 2868 xftlfjf.exe 2384 dhjdj.exe 268 blxfv.exe 1496 pjbpn.exe 2752 pfhpbtl.exe 528 phdtfn.exe 748 jxfvvvj.exe 2228 nlvptjt.exe 1700 xvftlb.exe 2684 xptxrl.exe 916 lrfln.exe 1512 ljpvl.exe 1284 lbnvfl.exe 2288 vtrhx.exe 1248 dfddntj.exe 2260 hxpfnv.exe 824 nlfhhtv.exe 1120 dxhpln.exe 1548 dhvlld.exe 1584 lxfnxp.exe 1792 tfnlvbh.exe 884 jxnxf.exe 1532 ltdrp.exe 1668 bpnvrlh.exe 2004 tbbtvd.exe 820 brhjl.exe 1992 xnvvb.exe 3036 vrbdvx.exe 1568 jphrfhr.exe 2996 jnvtxrn.exe 2936 btphd.exe 2552 pbfvf.exe 2600 lbfdtrl.exe 2456 rnlvlh.exe 2516 xrpbfxx.exe 3044 hppdp.exe 2548 hpbhhlj.exe 2868 nffjln.exe 2380 bfxlb.exe 1276 rrtbtlt.exe 2064 bxnfhxv.exe 1496 jbvlj.exe 552 hrjdftf.exe 1232 xjdvvxl.exe 2012 ftbhpf.exe 2648 nblvj.exe 1656 lftrprl.exe 1420 rfthv.exe 364 drftxrt.exe 936 tvnvrp.exe 2976 ftnvpj.exe 1616 tvnvj.exe 1572 vntrrnd.exe 1336 tdlbptx.exe 1552 hppxhnh.exe 2284 bpfdlrj.exe -
resource yara_rule behavioral1/memory/1784-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012241-5.dat upx behavioral1/memory/2720-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0026000000015c3c-28.dat upx behavioral1/memory/2936-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d88-43.dat upx behavioral1/memory/2672-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cb9-35.dat upx behavioral1/files/0x000c000000015a2d-19.dat upx behavioral1/files/0x0007000000015db4-53.dat upx behavioral1/files/0x00080000000167db-62.dat upx behavioral1/memory/2716-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018ae2-71.dat upx behavioral1/memory/2868-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b33-97.dat upx behavioral1/files/0x0006000000018b15-88.dat upx behavioral1/memory/2384-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ae8-79.dat upx behavioral1/memory/1496-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/268-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-115.dat upx behavioral1/memory/2412-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b4a-123.dat upx behavioral1/memory/2752-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b37-106.dat upx behavioral1/memory/748-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0011000000015c52-131.dat upx behavioral1/files/0x0006000000018b6a-140.dat upx behavioral1/files/0x0006000000018b73-149.dat upx behavioral1/files/0x0006000000018b96-158.dat upx behavioral1/memory/2684-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ba2-166.dat upx behavioral1/files/0x0006000000018ba2-165.dat upx behavioral1/memory/916-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d06-177.dat upx behavioral1/files/0x0006000000018d06-176.dat upx behavioral1/files/0x00050000000192c9-185.dat upx behavioral1/files/0x00050000000192c9-184.dat upx behavioral1/memory/1284-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/528-188-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001931b-204.dat upx behavioral1/memory/2288-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192f4-194.dat upx behavioral1/files/0x0005000000019333-211.dat upx behavioral1/memory/2260-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019368-219.dat upx behavioral1/files/0x0005000000019377-229.dat upx behavioral1/files/0x000500000001939b-237.dat upx behavioral1/files/0x00050000000193b0-246.dat upx behavioral1/files/0x0005000000019410-253.dat upx behavioral1/memory/1584-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946b-262.dat upx behavioral1/files/0x0005000000019473-278.dat upx behavioral1/files/0x000500000001946f-270.dat upx behavioral1/memory/1668-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/824-290-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/820-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3036-314-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/2996-322-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1784 wrote to memory of 2720 1784 b55ce0b48c766b699a73056303c17a04.exe 28 PID 1784 wrote to memory of 2720 1784 b55ce0b48c766b699a73056303c17a04.exe 28 PID 1784 wrote to memory of 2720 1784 b55ce0b48c766b699a73056303c17a04.exe 28 PID 1784 wrote to memory of 2720 1784 b55ce0b48c766b699a73056303c17a04.exe 28 PID 2720 wrote to memory of 2936 2720 jtvblx.exe 29 PID 2720 wrote to memory of 2936 2720 jtvblx.exe 29 PID 2720 wrote to memory of 2936 2720 jtvblx.exe 29 PID 2720 wrote to memory of 2936 2720 jtvblx.exe 29 PID 2936 wrote to memory of 2672 2936 jrvhljl.exe 30 PID 2936 wrote to memory of 2672 2936 jrvhljl.exe 30 PID 2936 wrote to memory of 2672 2936 jrvhljl.exe 30 PID 2936 wrote to memory of 2672 2936 jrvhljl.exe 30 PID 2672 wrote to memory of 2524 2672 frftvlp.exe 31 PID 2672 wrote to memory of 2524 2672 frftvlp.exe 31 PID 2672 wrote to memory of 2524 2672 frftvlp.exe 31 PID 2672 wrote to memory of 2524 2672 frftvlp.exe 31 PID 2524 wrote to memory of 2716 2524 vrnpfb.exe 32 PID 2524 wrote to memory of 2716 2524 vrnpfb.exe 32 PID 2524 wrote to memory of 2716 2524 vrnpfb.exe 32 PID 2524 wrote to memory of 2716 2524 vrnpfb.exe 32 PID 2716 wrote to memory of 2604 2716 npjtjdh.exe 33 PID 2716 wrote to memory of 2604 2716 npjtjdh.exe 33 PID 2716 wrote to memory of 2604 2716 npjtjdh.exe 33 PID 2716 wrote to memory of 2604 2716 npjtjdh.exe 33 PID 2604 wrote to memory of 2588 2604 blrtd.exe 34 PID 2604 wrote to memory of 2588 2604 blrtd.exe 34 PID 2604 wrote to memory of 2588 2604 blrtd.exe 34 PID 2604 wrote to memory of 2588 2604 blrtd.exe 34 PID 2588 wrote to memory of 2412 2588 dnjjrb.exe 35 PID 2588 wrote to memory of 2412 2588 dnjjrb.exe 35 PID 2588 wrote to memory of 2412 2588 dnjjrb.exe 35 PID 2588 wrote to memory of 2412 2588 dnjjrb.exe 35 PID 2412 wrote to memory of 2868 2412 nvlbpbb.exe 73 PID 2412 wrote to memory of 2868 2412 nvlbpbb.exe 73 PID 2412 wrote to memory of 2868 2412 nvlbpbb.exe 73 PID 2412 wrote to memory of 2868 2412 nvlbpbb.exe 73 PID 2868 wrote to memory of 2384 2868 xftlfjf.exe 37 PID 2868 wrote to memory of 2384 2868 xftlfjf.exe 37 PID 2868 wrote to memory of 2384 2868 xftlfjf.exe 37 PID 2868 wrote to memory of 2384 2868 xftlfjf.exe 37 PID 2384 wrote to memory of 268 2384 dhjdj.exe 38 PID 2384 wrote to memory of 268 2384 dhjdj.exe 38 PID 2384 wrote to memory of 268 2384 dhjdj.exe 38 PID 2384 wrote to memory of 268 2384 dhjdj.exe 38 PID 268 wrote to memory of 1496 268 blxfv.exe 77 PID 268 wrote to memory of 1496 268 blxfv.exe 77 PID 268 wrote to memory of 1496 268 blxfv.exe 77 PID 268 wrote to memory of 1496 268 blxfv.exe 77 PID 1496 wrote to memory of 2752 1496 pjbpn.exe 40 PID 1496 wrote to memory of 2752 1496 pjbpn.exe 40 PID 1496 wrote to memory of 2752 1496 pjbpn.exe 40 PID 1496 wrote to memory of 2752 1496 pjbpn.exe 40 PID 2752 wrote to memory of 528 2752 pfhpbtl.exe 41 PID 2752 wrote to memory of 528 2752 pfhpbtl.exe 41 PID 2752 wrote to memory of 528 2752 pfhpbtl.exe 41 PID 2752 wrote to memory of 528 2752 pfhpbtl.exe 41 PID 528 wrote to memory of 748 528 phdtfn.exe 42 PID 528 wrote to memory of 748 528 phdtfn.exe 42 PID 528 wrote to memory of 748 528 phdtfn.exe 42 PID 528 wrote to memory of 748 528 phdtfn.exe 42 PID 748 wrote to memory of 2228 748 jxfvvvj.exe 43 PID 748 wrote to memory of 2228 748 jxfvvvj.exe 43 PID 748 wrote to memory of 2228 748 jxfvvvj.exe 43 PID 748 wrote to memory of 2228 748 jxfvvvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b55ce0b48c766b699a73056303c17a04.exe"C:\Users\Admin\AppData\Local\Temp\b55ce0b48c766b699a73056303c17a04.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jtvblx.exec:\jtvblx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jrvhljl.exec:\jrvhljl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\frftvlp.exec:\frftvlp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vrnpfb.exec:\vrnpfb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\npjtjdh.exec:\npjtjdh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\blrtd.exec:\blrtd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dnjjrb.exec:\dnjjrb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nvlbpbb.exec:\nvlbpbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xftlfjf.exec:\xftlfjf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dhjdj.exec:\dhjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\blxfv.exec:\blxfv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\pjbpn.exec:\pjbpn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\pfhpbtl.exec:\pfhpbtl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\phdtfn.exec:\phdtfn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\jxfvvvj.exec:\jxfvvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\nlvptjt.exec:\nlvptjt.exe17⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xvftlb.exec:\xvftlb.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xptxrl.exec:\xptxrl.exe19⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lrfln.exec:\lrfln.exe20⤵
- Executes dropped EXE
PID:916 -
\??\c:\ljpvl.exec:\ljpvl.exe21⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lbnvfl.exec:\lbnvfl.exe22⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vtrhx.exec:\vtrhx.exe23⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dfddntj.exec:\dfddntj.exe24⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hxpfnv.exec:\hxpfnv.exe25⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nlfhhtv.exec:\nlfhhtv.exe26⤵
- Executes dropped EXE
PID:824 -
\??\c:\dxhpln.exec:\dxhpln.exe27⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dhvlld.exec:\dhvlld.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lxfnxp.exec:\lxfnxp.exe29⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tfnlvbh.exec:\tfnlvbh.exe30⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jxnxf.exec:\jxnxf.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\ltdrp.exec:\ltdrp.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bpnvrlh.exec:\bpnvrlh.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tbbtvd.exec:\tbbtvd.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\brhjl.exec:\brhjl.exe35⤵
- Executes dropped EXE
PID:820 -
\??\c:\xnvvb.exec:\xnvvb.exe36⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vrbdvx.exec:\vrbdvx.exe37⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jphrfhr.exec:\jphrfhr.exe38⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jnvtxrn.exec:\jnvtxrn.exe39⤵
- Executes dropped EXE
PID:2996 -
\??\c:\btphd.exec:\btphd.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pbfvf.exec:\pbfvf.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lbfdtrl.exec:\lbfdtrl.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rnlvlh.exec:\rnlvlh.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrpbfxx.exec:\xrpbfxx.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hppdp.exec:\hppdp.exe45⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hpbhhlj.exec:\hpbhhlj.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nffjln.exec:\nffjln.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bfxlb.exec:\bfxlb.exe48⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rrtbtlt.exec:\rrtbtlt.exe49⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bxnfhxv.exec:\bxnfhxv.exe50⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jbvlj.exec:\jbvlj.exe51⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hrjdftf.exec:\hrjdftf.exe52⤵
- Executes dropped EXE
PID:552 -
\??\c:\xjdvvxl.exec:\xjdvvxl.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ftbhpf.exec:\ftbhpf.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nblvj.exec:\nblvj.exe55⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lftrprl.exec:\lftrprl.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rfthv.exec:\rfthv.exe57⤵
- Executes dropped EXE
PID:1420 -
\??\c:\drftxrt.exec:\drftxrt.exe58⤵
- Executes dropped EXE
PID:364 -
\??\c:\tvnvrp.exec:\tvnvrp.exe59⤵
- Executes dropped EXE
PID:936 -
\??\c:\ftnvpj.exec:\ftnvpj.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tvnvj.exec:\tvnvj.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vntrrnd.exec:\vntrrnd.exe62⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tdlbptx.exec:\tdlbptx.exe63⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hppxhnh.exec:\hppxhnh.exe64⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bpfdlrj.exec:\bpfdlrj.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xbrxxv.exec:\xbrxxv.exe66⤵PID:1248
-
\??\c:\vlpfhvd.exec:\vlpfhvd.exe67⤵PID:1304
-
\??\c:\lnrbhr.exec:\lnrbhr.exe68⤵PID:2948
-
\??\c:\dppfdpl.exec:\dppfdpl.exe69⤵PID:1120
-
\??\c:\rtdtlv.exec:\rtdtlv.exe70⤵PID:2000
-
\??\c:\vlhnrvf.exec:\vlhnrvf.exe71⤵PID:1768
-
\??\c:\vtxbd.exec:\vtxbd.exe72⤵PID:1772
-
\??\c:\xxnnxrr.exec:\xxnnxrr.exe73⤵PID:2124
-
\??\c:\fljdxvb.exec:\fljdxvb.exe74⤵PID:1428
-
\??\c:\pxftn.exec:\pxftn.exe75⤵PID:1468
-
\??\c:\blvfbx.exec:\blvfbx.exe76⤵PID:1628
-
\??\c:\vrdnd.exec:\vrdnd.exe77⤵PID:2176
-
\??\c:\jdvrljj.exec:\jdvrljj.exe78⤵PID:2232
-
\??\c:\hbvllf.exec:\hbvllf.exe79⤵PID:1384
-
\??\c:\hpbdtbt.exec:\hpbdtbt.exe80⤵PID:536
-
\??\c:\nrxhvnb.exec:\nrxhvnb.exe81⤵PID:2904
-
\??\c:\thnftd.exec:\thnftd.exe82⤵PID:2200
-
\??\c:\vblffr.exec:\vblffr.exe83⤵PID:2704
-
\??\c:\lbvdvh.exec:\lbvdvh.exe84⤵PID:2544
-
\??\c:\hpdfphx.exec:\hpdfphx.exe85⤵PID:2612
-
\??\c:\xnppb.exec:\xnppb.exe86⤵PID:2600
-
\??\c:\vppbll.exec:\vppbll.exe87⤵PID:2512
-
\??\c:\ntnjf.exec:\ntnjf.exe88⤵PID:2428
-
\??\c:\rpfhv.exec:\rpfhv.exe89⤵PID:2452
-
\??\c:\dpfjprn.exec:\dpfjprn.exe90⤵PID:2036
-
\??\c:\jjbhnpb.exec:\jjbhnpb.exe91⤵PID:2636
-
\??\c:\dfplnjx.exec:\dfplnjx.exe92⤵PID:2324
-
\??\c:\thldr.exec:\thldr.exe93⤵PID:2740
-
\??\c:\frffptn.exec:\frffptn.exe94⤵PID:2992
-
\??\c:\fdxfl.exec:\fdxfl.exe95⤵PID:2732
-
\??\c:\htbflxd.exec:\htbflxd.exe96⤵PID:552
-
\??\c:\ndbvvbv.exec:\ndbvvbv.exe97⤵PID:1460
-
\??\c:\lnpplf.exec:\lnpplf.exe98⤵PID:1968
-
\??\c:\xvttflf.exec:\xvttflf.exe99⤵PID:2012
-
\??\c:\bvxtlhp.exec:\bvxtlhp.exe100⤵PID:2236
-
\??\c:\htntn.exec:\htntn.exe101⤵PID:2884
-
\??\c:\ndhhvlh.exec:\ndhhvlh.exe102⤵PID:1836
-
\??\c:\rlhxb.exec:\rlhxb.exe103⤵PID:1664
-
\??\c:\tjxtnnh.exec:\tjxtnnh.exe104⤵PID:1576
-
\??\c:\ndnhxpl.exec:\ndnhxpl.exe105⤵PID:1444
-
\??\c:\jdhtvdf.exec:\jdhtvdf.exe106⤵PID:1612
-
\??\c:\hfbbhvj.exec:\hfbbhvj.exe107⤵PID:1900
-
\??\c:\nxjlxrp.exec:\nxjlxrp.exe108⤵PID:2156
-
\??\c:\hlrnl.exec:\hlrnl.exe109⤵PID:3048
-
\??\c:\jphxf.exec:\jphxf.exe110⤵PID:2256
-
\??\c:\ftfrpfx.exec:\ftfrpfx.exe111⤵PID:1812
-
\??\c:\jdvxtnr.exec:\jdvxtnr.exe112⤵PID:1248
-
\??\c:\jvvrnvn.exec:\jvvrnvn.exe113⤵PID:3020
-
\??\c:\ntxtr.exec:\ntxtr.exe114⤵PID:1140
-
\??\c:\fhfnln.exec:\fhfnln.exe115⤵PID:1124
-
\??\c:\pfrhnvl.exec:\pfrhnvl.exe116⤵PID:596
-
\??\c:\vbphhj.exec:\vbphhj.exe117⤵PID:960
-
\??\c:\fbhjnx.exec:\fbhjnx.exe118⤵PID:2980
-
\??\c:\tldhjp.exec:\tldhjp.exe119⤵PID:1532
-
\??\c:\jvnvfr.exec:\jvnvfr.exe120⤵PID:1668
-
\??\c:\xlvjld.exec:\xlvjld.exe121⤵PID:1340
-
\??\c:\hbbbvrp.exec:\hbbbvrp.exe122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-