Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe
-
Size
286KB
-
MD5
b8ed05150c2acc7cd9502311a5afd1db
-
SHA1
80cb53289df483e6481985cf1dd25e55fd581d44
-
SHA256
507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1
-
SHA512
4671952efd651eb8a1d058185e139f9151af6dddac1d62048342543a4647d09f59ea4ffe95d4308018ea7fda5e578cdae0b331f88d8df64d18bbc37f1f237cc0
-
SSDEEP
3072:ThOm2sI93UufdC67cipfmCiiiXAQ5lpBoGYwNNhu0CzhKPf:Tcm7ImGddXlWrXF5lpKGYV0wh6f
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2620-11-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2884-25-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2592-30-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1952-6-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2516-53-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2660-57-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2660-59-0x00000000001B0000-0x00000000001DB000-memory.dmp family_blackmoon behavioral1/memory/2360-67-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2620-74-0x00000000003A0000-0x00000000003CB000-memory.dmp family_blackmoon behavioral1/memory/2792-77-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/648-111-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2532-115-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2168-126-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2168-131-0x00000000001B0000-0x00000000001DB000-memory.dmp family_blackmoon behavioral1/memory/1816-136-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2312-148-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2180-157-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2180-167-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1680-165-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1640-177-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2060-185-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/528-200-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1104-243-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1072-255-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1656-265-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2756-274-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2756-280-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/2296-283-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2296-292-0x00000000001B0000-0x00000000001DB000-memory.dmp family_blackmoon behavioral1/memory/2732-308-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/2732-309-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1212-316-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2924-332-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2732-339-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/2488-346-0x0000000000230000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/2380-365-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/964-411-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/964-417-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/648-425-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/944-431-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1456-439-0x00000000001B0000-0x00000000001DB000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral1/memory/2620-11-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2884-25-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2592-30-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1952-6-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2516-53-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2660-57-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2660-59-0x00000000001B0000-0x00000000001DB000-memory.dmp UPX behavioral1/memory/2360-67-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2792-77-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2792-84-0x0000000000220000-0x000000000024B000-memory.dmp UPX behavioral1/memory/648-111-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2532-115-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2168-126-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1816-136-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2312-148-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2180-157-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1680-165-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1640-177-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2060-185-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/528-200-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1104-237-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1104-243-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1072-255-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1656-265-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2756-274-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2296-283-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1212-316-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2924-332-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2380-365-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/964-411-0x0000000000400000-0x000000000042B000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2620 pfbrjb.exe 2884 pxtjx.exe 2592 vbnxflp.exe 2480 rljhd.exe 2516 jxljt.exe 2660 xnlxp.exe 2360 rhldnt.exe 2792 dhfplh.exe 1512 lbdvt.exe 2340 xpllpxr.exe 648 fnrdt.exe 2532 bpdnrbf.exe 2168 fhxbtpt.exe 1816 nbdtp.exe 2312 jbbflvj.exe 2180 jlrbnjx.exe 1680 dndpd.exe 1640 bvtblrn.exe 2060 rnlpj.exe 528 lbljtd.exe 712 tnprvx.exe 604 hnhnj.exe 272 httxlrh.exe 3064 dtdxlx.exe 1104 xpndj.exe 1636 frvnlb.exe 1072 bllrx.exe 1656 ljxhhh.exe 2756 xbrbjd.exe 2296 tbphdx.exe 2948 bxxvt.exe 2732 lrvxrbf.exe 2720 bbhdn.exe 1212 brrrr.exe 1708 dxfxpdv.exe 2924 dbbld.exe 2488 dlvrnlt.exe 2364 rdjdp.exe 2616 tfxbdjx.exe 2712 prrrt.exe 2380 blnnx.exe 2520 xvtlb.exe 2420 vfthhj.exe 1784 bnrbnxd.exe 2432 bbddttl.exe 572 dlphv.exe 1996 phfvpvj.exe 964 jfvlrl.exe 648 hbrxdpv.exe 944 ndldjx.exe 1456 vrltbn.exe 1976 trxhlh.exe 2208 hvfbfr.exe 1772 ppftlt.exe 2216 pldpxn.exe 1728 rpdrbjd.exe 1616 ljjrd.exe 1776 rdlbr.exe 1988 rlrjd.exe 336 vjnfhv.exe 684 pvdhpfl.exe 2724 fplrx.exe 2980 lhdhdrx.exe 272 jrlxxj.exe -
resource yara_rule behavioral1/memory/2620-11-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2884-25-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2592-30-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1952-6-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2516-53-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2660-57-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2660-59-0x00000000001B0000-0x00000000001DB000-memory.dmp upx behavioral1/memory/2360-67-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2792-77-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/648-111-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2532-115-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2168-126-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1816-136-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1816-146-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/2312-148-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2180-157-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1680-165-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1640-177-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2060-185-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/528-200-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1104-237-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1104-243-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1072-255-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1656-265-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2756-274-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2296-283-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1212-316-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2924-332-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2380-365-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/964-411-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2620 1952 507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe 28 PID 1952 wrote to memory of 2620 1952 507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe 28 PID 1952 wrote to memory of 2620 1952 507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe 28 PID 1952 wrote to memory of 2620 1952 507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe 28 PID 2620 wrote to memory of 2884 2620 pfbrjb.exe 29 PID 2620 wrote to memory of 2884 2620 pfbrjb.exe 29 PID 2620 wrote to memory of 2884 2620 pfbrjb.exe 29 PID 2620 wrote to memory of 2884 2620 pfbrjb.exe 29 PID 2884 wrote to memory of 2592 2884 pxtjx.exe 30 PID 2884 wrote to memory of 2592 2884 pxtjx.exe 30 PID 2884 wrote to memory of 2592 2884 pxtjx.exe 30 PID 2884 wrote to memory of 2592 2884 pxtjx.exe 30 PID 2592 wrote to memory of 2480 2592 vbnxflp.exe 31 PID 2592 wrote to memory of 2480 2592 vbnxflp.exe 31 PID 2592 wrote to memory of 2480 2592 vbnxflp.exe 31 PID 2592 wrote to memory of 2480 2592 vbnxflp.exe 31 PID 2480 wrote to memory of 2516 2480 rljhd.exe 32 PID 2480 wrote to memory of 2516 2480 rljhd.exe 32 PID 2480 wrote to memory of 2516 2480 rljhd.exe 32 PID 2480 wrote to memory of 2516 2480 rljhd.exe 32 PID 2516 wrote to memory of 2660 2516 jxljt.exe 33 PID 2516 wrote to memory of 2660 2516 jxljt.exe 33 PID 2516 wrote to memory of 2660 2516 jxljt.exe 33 PID 2516 wrote to memory of 2660 2516 jxljt.exe 33 PID 2660 wrote to memory of 2360 2660 xnlxp.exe 34 PID 2660 wrote to memory of 2360 2660 xnlxp.exe 34 PID 2660 wrote to memory of 2360 2660 xnlxp.exe 34 PID 2660 wrote to memory of 2360 2660 xnlxp.exe 34 PID 2360 wrote to memory of 2792 2360 rhldnt.exe 35 PID 2360 wrote to memory of 2792 2360 rhldnt.exe 35 PID 2360 wrote to memory of 2792 2360 rhldnt.exe 35 PID 2360 wrote to memory of 2792 2360 rhldnt.exe 35 PID 2792 wrote to memory of 1512 2792 dhfplh.exe 36 PID 2792 wrote to memory of 1512 2792 dhfplh.exe 36 PID 2792 wrote to memory of 1512 2792 dhfplh.exe 36 PID 2792 wrote to memory of 1512 2792 dhfplh.exe 36 PID 1512 wrote to memory of 2340 1512 lbdvt.exe 37 PID 1512 wrote to memory of 2340 1512 lbdvt.exe 37 PID 1512 wrote to memory of 2340 1512 lbdvt.exe 37 PID 1512 wrote to memory of 2340 1512 lbdvt.exe 37 PID 2340 wrote to memory of 648 2340 xpllpxr.exe 38 PID 2340 wrote to memory of 648 2340 xpllpxr.exe 38 PID 2340 wrote to memory of 648 2340 xpllpxr.exe 38 PID 2340 wrote to memory of 648 2340 xpllpxr.exe 38 PID 648 wrote to memory of 2532 648 fnrdt.exe 39 PID 648 wrote to memory of 2532 648 fnrdt.exe 39 PID 648 wrote to memory of 2532 648 fnrdt.exe 39 PID 648 wrote to memory of 2532 648 fnrdt.exe 39 PID 2532 wrote to memory of 2168 2532 bpdnrbf.exe 40 PID 2532 wrote to memory of 2168 2532 bpdnrbf.exe 40 PID 2532 wrote to memory of 2168 2532 bpdnrbf.exe 40 PID 2532 wrote to memory of 2168 2532 bpdnrbf.exe 40 PID 2168 wrote to memory of 1816 2168 fhxbtpt.exe 41 PID 2168 wrote to memory of 1816 2168 fhxbtpt.exe 41 PID 2168 wrote to memory of 1816 2168 fhxbtpt.exe 41 PID 2168 wrote to memory of 1816 2168 fhxbtpt.exe 41 PID 1816 wrote to memory of 2312 1816 nbdtp.exe 42 PID 1816 wrote to memory of 2312 1816 nbdtp.exe 42 PID 1816 wrote to memory of 2312 1816 nbdtp.exe 42 PID 1816 wrote to memory of 2312 1816 nbdtp.exe 42 PID 2312 wrote to memory of 2180 2312 jbbflvj.exe 43 PID 2312 wrote to memory of 2180 2312 jbbflvj.exe 43 PID 2312 wrote to memory of 2180 2312 jbbflvj.exe 43 PID 2312 wrote to memory of 2180 2312 jbbflvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe"C:\Users\Admin\AppData\Local\Temp\507703086a714cd398fddd365702e2cd369e0781b7af82bfbaec57b3d970fab1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pfbrjb.exec:\pfbrjb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\pxtjx.exec:\pxtjx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vbnxflp.exec:\vbnxflp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rljhd.exec:\rljhd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jxljt.exec:\jxljt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xnlxp.exec:\xnlxp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\rhldnt.exec:\rhldnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\dhfplh.exec:\dhfplh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lbdvt.exec:\lbdvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\xpllpxr.exec:\xpllpxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fnrdt.exec:\fnrdt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\bpdnrbf.exec:\bpdnrbf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\fhxbtpt.exec:\fhxbtpt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nbdtp.exec:\nbdtp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jbbflvj.exec:\jbbflvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\jlrbnjx.exec:\jlrbnjx.exe17⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dndpd.exec:\dndpd.exe18⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bvtblrn.exec:\bvtblrn.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rnlpj.exec:\rnlpj.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lbljtd.exec:\lbljtd.exe21⤵
- Executes dropped EXE
PID:528 -
\??\c:\tnprvx.exec:\tnprvx.exe22⤵
- Executes dropped EXE
PID:712 -
\??\c:\hnhnj.exec:\hnhnj.exe23⤵
- Executes dropped EXE
PID:604 -
\??\c:\httxlrh.exec:\httxlrh.exe24⤵
- Executes dropped EXE
PID:272 -
\??\c:\dtdxlx.exec:\dtdxlx.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xpndj.exec:\xpndj.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\frvnlb.exec:\frvnlb.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bllrx.exec:\bllrx.exe28⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ljxhhh.exec:\ljxhhh.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xbrbjd.exec:\xbrbjd.exe30⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tbphdx.exec:\tbphdx.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bxxvt.exec:\bxxvt.exe32⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lrvxrbf.exec:\lrvxrbf.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bbhdn.exec:\bbhdn.exe34⤵
- Executes dropped EXE
PID:2720 -
\??\c:\brrrr.exec:\brrrr.exe35⤵
- Executes dropped EXE
PID:1212 -
\??\c:\dxfxpdv.exec:\dxfxpdv.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dbbld.exec:\dbbld.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dlvrnlt.exec:\dlvrnlt.exe38⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rdjdp.exec:\rdjdp.exe39⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tfxbdjx.exec:\tfxbdjx.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\prrrt.exec:\prrrt.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\blnnx.exec:\blnnx.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xvtlb.exec:\xvtlb.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vfthhj.exec:\vfthhj.exe44⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bnrbnxd.exec:\bnrbnxd.exe45⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bbddttl.exec:\bbddttl.exe46⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dlphv.exec:\dlphv.exe47⤵
- Executes dropped EXE
PID:572 -
\??\c:\phfvpvj.exec:\phfvpvj.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jfvlrl.exec:\jfvlrl.exe49⤵
- Executes dropped EXE
PID:964 -
\??\c:\hbrxdpv.exec:\hbrxdpv.exe50⤵
- Executes dropped EXE
PID:648 -
\??\c:\ndldjx.exec:\ndldjx.exe51⤵
- Executes dropped EXE
PID:944 -
\??\c:\vrltbn.exec:\vrltbn.exe52⤵
- Executes dropped EXE
PID:1456 -
\??\c:\trxhlh.exec:\trxhlh.exe53⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hvfbfr.exec:\hvfbfr.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ppftlt.exec:\ppftlt.exe55⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pldpxn.exec:\pldpxn.exe56⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rpdrbjd.exec:\rpdrbjd.exe57⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ljjrd.exec:\ljjrd.exe58⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rdlbr.exec:\rdlbr.exe59⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rlrjd.exec:\rlrjd.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjnfhv.exec:\vjnfhv.exe61⤵
- Executes dropped EXE
PID:336 -
\??\c:\pvdhpfl.exec:\pvdhpfl.exe62⤵
- Executes dropped EXE
PID:684 -
\??\c:\fplrx.exec:\fplrx.exe63⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lhdhdrx.exec:\lhdhdrx.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jrlxxj.exec:\jrlxxj.exe65⤵
- Executes dropped EXE
PID:272 -
\??\c:\tbxfbn.exec:\tbxfbn.exe66⤵PID:1856
-
\??\c:\bbfbt.exec:\bbfbt.exe67⤵PID:836
-
\??\c:\hbtxjlj.exec:\hbtxjlj.exe68⤵PID:984
-
\??\c:\bjfxt.exec:\bjfxt.exe69⤵PID:1568
-
\??\c:\ltxfndt.exec:\ltxfndt.exe70⤵PID:2956
-
\??\c:\rjpfdtb.exec:\rjpfdtb.exe71⤵PID:1668
-
\??\c:\ldtjltt.exec:\ldtjltt.exe72⤵PID:1272
-
\??\c:\pdhxfxn.exec:\pdhxfxn.exe73⤵PID:2092
-
\??\c:\vbvxhv.exec:\vbvxhv.exe74⤵PID:2892
-
\??\c:\drhthbx.exec:\drhthbx.exe75⤵PID:2008
-
\??\c:\bhthbnp.exec:\bhthbnp.exe76⤵PID:2324
-
\??\c:\fvtdd.exec:\fvtdd.exe77⤵PID:852
-
\??\c:\jxbdpn.exec:\jxbdpn.exe78⤵PID:2448
-
\??\c:\lnxtlnb.exec:\lnxtlnb.exe79⤵PID:2220
-
\??\c:\lndbpbr.exec:\lndbpbr.exe80⤵PID:2808
-
\??\c:\dtpppv.exec:\dtpppv.exe81⤵PID:2512
-
\??\c:\ljhnrl.exec:\ljhnrl.exe82⤵PID:2600
-
\??\c:\jnrlrn.exec:\jnrlrn.exe83⤵PID:2464
-
\??\c:\rhxrt.exec:\rhxrt.exe84⤵PID:2364
-
\??\c:\tltbhtl.exec:\tltbhtl.exe85⤵PID:2516
-
\??\c:\htpdl.exec:\htpdl.exe86⤵PID:2368
-
\??\c:\pjtrrr.exec:\pjtrrr.exe87⤵PID:2380
-
\??\c:\bvtvt.exec:\bvtvt.exe88⤵PID:2544
-
\??\c:\vlrbdn.exec:\vlrbdn.exe89⤵PID:2420
-
\??\c:\txjvdhf.exec:\txjvdhf.exe90⤵PID:1784
-
\??\c:\drbxdp.exec:\drbxdp.exe91⤵PID:940
-
\??\c:\jxbxxrn.exec:\jxbxxrn.exe92⤵PID:2336
-
\??\c:\xbljj.exec:\xbljj.exe93⤵PID:2648
-
\??\c:\jlpxnt.exec:\jlpxnt.exe94⤵PID:964
-
\??\c:\lrvtt.exec:\lrvtt.exe95⤵PID:648
-
\??\c:\drxdx.exec:\drxdx.exe96⤵PID:1836
-
\??\c:\tdlnxx.exec:\tdlnxx.exe97⤵PID:1076
-
\??\c:\lrlldp.exec:\lrlldp.exe98⤵PID:1832
-
\??\c:\bbhvb.exec:\bbhvb.exe99⤵PID:1964
-
\??\c:\vxjlfn.exec:\vxjlfn.exe100⤵PID:2180
-
\??\c:\bpldll.exec:\bpldll.exe101⤵PID:2228
-
\??\c:\thpnnjv.exec:\thpnnjv.exe102⤵PID:1588
-
\??\c:\xpptnnb.exec:\xpptnnb.exe103⤵PID:2260
-
\??\c:\xvvntf.exec:\xvvntf.exe104⤵PID:1552
-
\??\c:\jxxrdxd.exec:\jxxrdxd.exe105⤵PID:2292
-
\??\c:\dbbllt.exec:\dbbllt.exe106⤵PID:2916
-
\??\c:\xvxjhnp.exec:\xvxjhnp.exe107⤵PID:2920
-
\??\c:\bfrdtbl.exec:\bfrdtbl.exe108⤵PID:604
-
\??\c:\plxrhx.exec:\plxrhx.exe109⤵PID:2964
-
\??\c:\bdndxl.exec:\bdndxl.exe110⤵PID:3056
-
\??\c:\nrdlrjr.exec:\nrdlrjr.exe111⤵PID:1564
-
\??\c:\hllbrjn.exec:\hllbrjn.exe112⤵PID:2740
-
\??\c:\ftfrb.exec:\ftfrb.exe113⤵PID:2140
-
\??\c:\tbdndlh.exec:\tbdndlh.exe114⤵PID:1844
-
\??\c:\thxnljt.exec:\thxnljt.exe115⤵PID:1328
-
\??\c:\hjfjh.exec:\hjfjh.exe116⤵PID:1072
-
\??\c:\vjvpldr.exec:\vjvpldr.exe117⤵PID:1764
-
\??\c:\thdvjvh.exec:\thdvjvh.exe118⤵PID:2748
-
\??\c:\tjvxht.exec:\tjvxht.exe119⤵PID:2852
-
\??\c:\dprdn.exec:\dprdn.exe120⤵PID:2248
-
\??\c:\tppttbr.exec:\tppttbr.exe121⤵PID:2732
-
\??\c:\rdptpbr.exec:\rdptpbr.exe122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-