Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe
-
Size
391KB
-
MD5
cf0eb360c1aa2e54e46b230e0808d2b4
-
SHA1
ae873ff1b99738889f3a626590f649b83cb3bfc7
-
SHA256
ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a
-
SHA512
ca7c7dd86c6ead051b7c2e5dfc2628e4c66901d2fb784c4b7fdd8b9cd68790e6bc628754675796e4fcfffed5f9971401ead914f829335c4fe9c0b3093c83e567
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkobjcSbcY+CaQdaFOY4iGFYtRdu/W:n3C9ytvngQjZbz+xt4vFBu
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral1/memory/2508-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/520-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-515-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-559-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-660-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-691-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 45 IoCs
resource yara_rule behavioral1/memory/2508-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2820-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/928-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1200-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1200-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1276-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/928-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2356-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/808-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/520-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/520-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/808-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1992-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1488-308-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/880-317-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-343-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-357-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-365-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-396-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-439-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1072-447-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/776-515-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/956-559-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-610-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-660-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2656-669-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-691-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-729-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2820 hxnrnv.exe 2760 xlnvj.exe 2996 tvjvll.exe 2644 lrptn.exe 2776 hptfnth.exe 2448 pnxrb.exe 2424 jvhnrt.exe 1740 xvhnjdf.exe 928 xnddb.exe 1200 tprln.exe 2708 fpnffh.exe 2836 nfbffvf.exe 1276 dfljjbr.exe 1964 nbndd.exe 2368 dlnrj.exe 1992 blhpxfx.exe 2356 hhptrx.exe 1776 vhjjn.exe 1096 pxftxv.exe 808 tfvtbbb.exe 520 lrhpvjn.exe 2956 bblxfdn.exe 1804 pbnpp.exe 1308 lxxvptn.exe 2788 btpvnf.exe 2984 brbtxff.exe 1312 llphjf.exe 2280 xxplp.exe 2412 ntjxf.exe 1488 drlbnrd.exe 880 tvphjnx.exe 2828 plbdvp.exe 1620 nnrjnvx.exe 2684 bnbxltf.exe 2960 htllxnn.exe 2532 jnlprxp.exe 2636 xfhrx.exe 2460 njrdb.exe 2720 vjfvpn.exe 2540 vvfxv.exe 2488 tdnfbnj.exe 3052 xfhpxbn.exe 2856 pttnx.exe 928 djpplt.exe 2696 nvfjv.exe 1200 phttfj.exe 2712 hfxhxn.exe 1072 fpbhlv.exe 1972 pbblfv.exe 2336 vfljh.exe 1964 xbtrn.exe 2000 lnvjbrh.exe 1936 trjtbtx.exe 1896 lrhfv.exe 1908 rvxjnb.exe 2124 dvnjd.exe 776 jndvpjn.exe 2140 lrnfxh.exe 980 rjfpj.exe 2316 rfvxfjh.exe 3024 vlvxjlb.exe 1764 dnpvvv.exe 956 bffbjv.exe 1036 jlvrjb.exe -
resource yara_rule behavioral1/memory/2508-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/520-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/520-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-439-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-559-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-610-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-660-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-669-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-691-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-729-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2820 2508 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 28 PID 2508 wrote to memory of 2820 2508 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 28 PID 2508 wrote to memory of 2820 2508 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 28 PID 2508 wrote to memory of 2820 2508 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 28 PID 2820 wrote to memory of 2760 2820 hxnrnv.exe 29 PID 2820 wrote to memory of 2760 2820 hxnrnv.exe 29 PID 2820 wrote to memory of 2760 2820 hxnrnv.exe 29 PID 2820 wrote to memory of 2760 2820 hxnrnv.exe 29 PID 2760 wrote to memory of 2996 2760 xlnvj.exe 30 PID 2760 wrote to memory of 2996 2760 xlnvj.exe 30 PID 2760 wrote to memory of 2996 2760 xlnvj.exe 30 PID 2760 wrote to memory of 2996 2760 xlnvj.exe 30 PID 2996 wrote to memory of 2644 2996 tvjvll.exe 31 PID 2996 wrote to memory of 2644 2996 tvjvll.exe 31 PID 2996 wrote to memory of 2644 2996 tvjvll.exe 31 PID 2996 wrote to memory of 2644 2996 tvjvll.exe 31 PID 2644 wrote to memory of 2776 2644 lrptn.exe 32 PID 2644 wrote to memory of 2776 2644 lrptn.exe 32 PID 2644 wrote to memory of 2776 2644 lrptn.exe 32 PID 2644 wrote to memory of 2776 2644 lrptn.exe 32 PID 2776 wrote to memory of 2448 2776 hptfnth.exe 33 PID 2776 wrote to memory of 2448 2776 hptfnth.exe 33 PID 2776 wrote to memory of 2448 2776 hptfnth.exe 33 PID 2776 wrote to memory of 2448 2776 hptfnth.exe 33 PID 2448 wrote to memory of 2424 2448 pnxrb.exe 34 PID 2448 wrote to memory of 2424 2448 pnxrb.exe 34 PID 2448 wrote to memory of 2424 2448 pnxrb.exe 34 PID 2448 wrote to memory of 2424 2448 pnxrb.exe 34 PID 2424 wrote to memory of 1740 2424 jvhnrt.exe 35 PID 2424 wrote to memory of 1740 2424 jvhnrt.exe 35 PID 2424 wrote to memory of 1740 2424 jvhnrt.exe 35 PID 2424 wrote to memory of 1740 2424 jvhnrt.exe 35 PID 1740 wrote to memory of 928 1740 xvhnjdf.exe 36 PID 1740 wrote to memory of 928 1740 xvhnjdf.exe 36 PID 1740 wrote to memory of 928 1740 xvhnjdf.exe 36 PID 1740 wrote to memory of 928 1740 xvhnjdf.exe 36 PID 928 wrote to memory of 1200 928 xnddb.exe 37 PID 928 wrote to memory of 1200 928 xnddb.exe 37 PID 928 wrote to memory of 1200 928 xnddb.exe 37 PID 928 wrote to memory of 1200 928 xnddb.exe 37 PID 1200 wrote to memory of 2708 1200 tprln.exe 38 PID 1200 wrote to memory of 2708 1200 tprln.exe 38 PID 1200 wrote to memory of 2708 1200 tprln.exe 38 PID 1200 wrote to memory of 2708 1200 tprln.exe 38 PID 2708 wrote to memory of 2836 2708 fpnffh.exe 39 PID 2708 wrote to memory of 2836 2708 fpnffh.exe 39 PID 2708 wrote to memory of 2836 2708 fpnffh.exe 39 PID 2708 wrote to memory of 2836 2708 fpnffh.exe 39 PID 2836 wrote to memory of 1276 2836 nfbffvf.exe 40 PID 2836 wrote to memory of 1276 2836 nfbffvf.exe 40 PID 2836 wrote to memory of 1276 2836 nfbffvf.exe 40 PID 2836 wrote to memory of 1276 2836 nfbffvf.exe 40 PID 1276 wrote to memory of 1964 1276 dfljjbr.exe 41 PID 1276 wrote to memory of 1964 1276 dfljjbr.exe 41 PID 1276 wrote to memory of 1964 1276 dfljjbr.exe 41 PID 1276 wrote to memory of 1964 1276 dfljjbr.exe 41 PID 1964 wrote to memory of 2368 1964 nbndd.exe 42 PID 1964 wrote to memory of 2368 1964 nbndd.exe 42 PID 1964 wrote to memory of 2368 1964 nbndd.exe 42 PID 1964 wrote to memory of 2368 1964 nbndd.exe 42 PID 2368 wrote to memory of 1992 2368 dlnrj.exe 43 PID 2368 wrote to memory of 1992 2368 dlnrj.exe 43 PID 2368 wrote to memory of 1992 2368 dlnrj.exe 43 PID 2368 wrote to memory of 1992 2368 dlnrj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe"C:\Users\Admin\AppData\Local\Temp\ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\hxnrnv.exec:\hxnrnv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xlnvj.exec:\xlnvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tvjvll.exec:\tvjvll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lrptn.exec:\lrptn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\hptfnth.exec:\hptfnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\pnxrb.exec:\pnxrb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jvhnrt.exec:\jvhnrt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xvhnjdf.exec:\xvhnjdf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\xnddb.exec:\xnddb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\tprln.exec:\tprln.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\fpnffh.exec:\fpnffh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nfbffvf.exec:\nfbffvf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dfljjbr.exec:\dfljjbr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\nbndd.exec:\nbndd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\dlnrj.exec:\dlnrj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\blhpxfx.exec:\blhpxfx.exe17⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hhptrx.exec:\hhptrx.exe18⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vhjjn.exec:\vhjjn.exe19⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pxftxv.exec:\pxftxv.exe20⤵
- Executes dropped EXE
PID:1096 -
\??\c:\tfvtbbb.exec:\tfvtbbb.exe21⤵
- Executes dropped EXE
PID:808 -
\??\c:\lrhpvjn.exec:\lrhpvjn.exe22⤵
- Executes dropped EXE
PID:520 -
\??\c:\bblxfdn.exec:\bblxfdn.exe23⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pbnpp.exec:\pbnpp.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lxxvptn.exec:\lxxvptn.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\btpvnf.exec:\btpvnf.exe26⤵
- Executes dropped EXE
PID:2788 -
\??\c:\brbtxff.exec:\brbtxff.exe27⤵
- Executes dropped EXE
PID:2984 -
\??\c:\llphjf.exec:\llphjf.exe28⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xxplp.exec:\xxplp.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ntjxf.exec:\ntjxf.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\drlbnrd.exec:\drlbnrd.exe31⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tvphjnx.exec:\tvphjnx.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\plbdvp.exec:\plbdvp.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nnrjnvx.exec:\nnrjnvx.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bnbxltf.exec:\bnbxltf.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\htllxnn.exec:\htllxnn.exe36⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jnlprxp.exec:\jnlprxp.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xfhrx.exec:\xfhrx.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\njrdb.exec:\njrdb.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vjfvpn.exec:\vjfvpn.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vvfxv.exec:\vvfxv.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tdnfbnj.exec:\tdnfbnj.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xfhpxbn.exec:\xfhpxbn.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pttnx.exec:\pttnx.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\djpplt.exec:\djpplt.exe45⤵
- Executes dropped EXE
PID:928 -
\??\c:\nvfjv.exec:\nvfjv.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\phttfj.exec:\phttfj.exe47⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hfxhxn.exec:\hfxhxn.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fpbhlv.exec:\fpbhlv.exe49⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pbblfv.exec:\pbblfv.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vfljh.exec:\vfljh.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xbtrn.exec:\xbtrn.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lnvjbrh.exec:\lnvjbrh.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\trjtbtx.exec:\trjtbtx.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lrhfv.exec:\lrhfv.exe55⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rvxjnb.exec:\rvxjnb.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvnjd.exec:\dvnjd.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jndvpjn.exec:\jndvpjn.exe58⤵
- Executes dropped EXE
PID:776 -
\??\c:\lrnfxh.exec:\lrnfxh.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rjfpj.exec:\rjfpj.exe60⤵
- Executes dropped EXE
PID:980 -
\??\c:\rfvxfjh.exec:\rfvxfjh.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vlvxjlb.exec:\vlvxjlb.exe62⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dnpvvv.exec:\dnpvvv.exe63⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bffbjv.exec:\bffbjv.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\jlvrjb.exec:\jlvrjb.exe65⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tdpxr.exec:\tdpxr.exe66⤵PID:868
-
\??\c:\jptfj.exec:\jptfj.exe67⤵PID:3020
-
\??\c:\frddltt.exec:\frddltt.exe68⤵PID:1260
-
\??\c:\vpnvdr.exec:\vpnvdr.exe69⤵PID:2928
-
\??\c:\rjrrtj.exec:\rjrrtj.exe70⤵PID:2184
-
\??\c:\frnbbb.exec:\frnbbb.exe71⤵PID:2264
-
\??\c:\xxxbnhj.exec:\xxxbnhj.exe72⤵PID:2400
-
\??\c:\tnvjlvd.exec:\tnvjlvd.exe73⤵PID:1676
-
\??\c:\vrvdtp.exec:\vrvdtp.exe74⤵PID:1488
-
\??\c:\rtnjl.exec:\rtnjl.exe75⤵PID:2840
-
\??\c:\nptbrbv.exec:\nptbrbv.exe76⤵PID:1784
-
\??\c:\jvfnv.exec:\jvfnv.exe77⤵PID:1616
-
\??\c:\rjvrvnn.exec:\rjvrvnn.exe78⤵PID:2552
-
\??\c:\bbhprjp.exec:\bbhprjp.exe79⤵PID:2656
-
\??\c:\lffjrnv.exec:\lffjrnv.exe80⤵PID:2640
-
\??\c:\lvnpf.exec:\lvnpf.exe81⤵PID:2620
-
\??\c:\rjbjtb.exec:\rjbjtb.exe82⤵PID:2224
-
\??\c:\xxltxp.exec:\xxltxp.exe83⤵PID:2720
-
\??\c:\jlplxn.exec:\jlplxn.exe84⤵PID:2864
-
\??\c:\lblxpf.exec:\lblxpf.exe85⤵PID:2588
-
\??\c:\lpxhr.exec:\lpxhr.exe86⤵PID:2408
-
\??\c:\hlrjr.exec:\hlrjr.exe87⤵PID:2856
-
\??\c:\dvdtnjp.exec:\dvdtnjp.exe88⤵PID:2404
-
\??\c:\htdpvv.exec:\htdpvv.exe89⤵PID:2328
-
\??\c:\nvbbpv.exec:\nvbbpv.exe90⤵PID:2764
-
\??\c:\fvjhd.exec:\fvjhd.exe91⤵PID:2836
-
\??\c:\pvpvd.exec:\pvpvd.exe92⤵PID:1140
-
\??\c:\dnnpvj.exec:\dnnpvj.exe93⤵PID:2032
-
\??\c:\nvvdtv.exec:\nvvdtv.exe94⤵PID:856
-
\??\c:\djfhvdx.exec:\djfhvdx.exe95⤵PID:2364
-
\??\c:\dprbxpf.exec:\dprbxpf.exe96⤵PID:1920
-
\??\c:\tnhbvnl.exec:\tnhbvnl.exe97⤵PID:2348
-
\??\c:\dbvvfj.exec:\dbvvfj.exe98⤵PID:1908
-
\??\c:\jttlbx.exec:\jttlbx.exe99⤵PID:2804
-
\??\c:\xfxxtn.exec:\xfxxtn.exe100⤵PID:584
-
\??\c:\nxxvhp.exec:\nxxvhp.exe101⤵PID:2952
-
\??\c:\jhnhpdr.exec:\jhnhpdr.exe102⤵PID:1160
-
\??\c:\bfthlh.exec:\bfthlh.exe103⤵PID:2044
-
\??\c:\dvhndb.exec:\dvhndb.exe104⤵PID:648
-
\??\c:\rhtnt.exec:\rhtnt.exe105⤵PID:2132
-
\??\c:\tblxlrj.exec:\tblxlrj.exe106⤵PID:1428
-
\??\c:\jtdrh.exec:\jtdrh.exe107⤵PID:108
-
\??\c:\lbxbfl.exec:\lbxbfl.exe108⤵PID:2168
-
\??\c:\xlbxnd.exec:\xlbxnd.exe109⤵PID:2968
-
\??\c:\hnbttjb.exec:\hnbttjb.exe110⤵PID:1180
-
\??\c:\bfjlvfl.exec:\bfjlvfl.exe111⤵PID:2060
-
\??\c:\ttpbj.exec:\ttpbj.exe112⤵PID:1000
-
\??\c:\vrfrbvx.exec:\vrfrbvx.exe113⤵PID:2096
-
\??\c:\tbjlx.exec:\tbjlx.exe114⤵PID:1080
-
\??\c:\hjdfhxp.exec:\hjdfhxp.exe115⤵PID:2816
-
\??\c:\jvvlxrb.exec:\jvvlxrb.exe116⤵PID:2812
-
\??\c:\nrdvf.exec:\nrdvf.exe117⤵PID:3068
-
\??\c:\xnvjbth.exec:\xnvjbth.exe118⤵PID:2780
-
\??\c:\dhnbn.exec:\dhnbn.exe119⤵PID:2936
-
\??\c:\rrvdb.exec:\rrvdb.exe120⤵PID:2736
-
\??\c:\bfxxpd.exec:\bfxxpd.exe121⤵PID:1888
-
\??\c:\nprbldj.exec:\nprbldj.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-