Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe
-
Size
186KB
-
MD5
38be3a5adb22dcd58d4ef375b1953947
-
SHA1
fa18c2f8b8e125bf1ad55172c2fdceaa87a77607
-
SHA256
a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700
-
SHA512
52ee0069b54a1bd644884e82ca01f4ae4b432bb12451b7b8f77ff6fcd8d53a537379b1cc0dd76fc82364ec90ce21b96298be5799d27816662034ded4b563c43e
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJJIBbS:PhOm2sI93UufdC67ciJTmEbS
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2784-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-63-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2572-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-140-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1672-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-182-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2096-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-236-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2076-244-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1856-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-266-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/816-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-351-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2708-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-364-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1228-446-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-452-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2524-390-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2448-384-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2524-343-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2524-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-336-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1520-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-269-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1936-459-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2244-268-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1420-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-476-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2496-482-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2692-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/2020-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2020-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2792-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2056-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1496-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1936-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1856-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/816-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2020-317-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-365-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1228-446-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-337-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-302-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1420-468-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2692-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2784 pvjbll.exe 2056 plrfr.exe 2636 hftdd.exe 2556 pjljb.exe 2792 rvrbn.exe 2644 rtbnn.exe 2572 rfldr.exe 2412 phdbvnf.exe 2876 vxbltd.exe 2384 tlpjx.exe 792 tnrbl.exe 1496 vvprr.exe 2688 lvbbnfd.exe 2760 fnrhn.exe 1936 pnlbtd.exe 1656 bbpdhf.exe 1420 nfbrv.exe 1672 nrpntvx.exe 2976 vdhvfpb.exe 1696 rvtbd.exe 2096 hrblt.exe 2116 fjlhr.exe 2244 jnfjlx.exe 620 hdjtdh.exe 2076 pfjdlvr.exe 2692 ffjlf.exe 1052 vvdjjtr.exe 1856 bpbhhrd.exe 1788 jblhxv.exe 2988 rpddv.exe 1620 vxfxnd.exe 816 brrrvvl.exe 1520 xfxvr.exe 2192 rptrfjl.exe 2020 bdvph.exe 1568 hpdjxbt.exe 2784 vjxvtv.exe 2524 xtjfd.exe 2620 jbfffx.exe 2516 fpjnxp.exe 2532 xhbvx.exe 2708 xlxfrrr.exe 2644 prvhf.exe 2448 fdndb.exe 2432 btvlt.exe 2404 drxpx.exe 2044 rlrtrv.exe 436 lrnplt.exe 1076 ttjbl.exe 792 txftfjd.exe 2500 hrhvdfj.exe 2656 lvdpnpx.exe 1100 jjjjfhv.exe 1228 bdpbpnl.exe 1936 xvvvr.exe 2468 pfvdvtb.exe 1420 jlxrnj.exe 2496 jrfvvp.exe 920 lbvfxph.exe 1748 htntvr.exe 2820 jnthf.exe 1552 hnrhp.exe 1848 ptxfxp.exe 2948 prvllb.exe -
resource yara_rule behavioral1/memory/2784-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-74-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2572-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-446-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-243-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2784 2020 a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe 28 PID 2020 wrote to memory of 2784 2020 a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe 28 PID 2020 wrote to memory of 2784 2020 a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe 28 PID 2020 wrote to memory of 2784 2020 a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe 28 PID 2784 wrote to memory of 2056 2784 pvjbll.exe 29 PID 2784 wrote to memory of 2056 2784 pvjbll.exe 29 PID 2784 wrote to memory of 2056 2784 pvjbll.exe 29 PID 2784 wrote to memory of 2056 2784 pvjbll.exe 29 PID 2056 wrote to memory of 2636 2056 plrfr.exe 30 PID 2056 wrote to memory of 2636 2056 plrfr.exe 30 PID 2056 wrote to memory of 2636 2056 plrfr.exe 30 PID 2056 wrote to memory of 2636 2056 plrfr.exe 30 PID 2636 wrote to memory of 2556 2636 hftdd.exe 31 PID 2636 wrote to memory of 2556 2636 hftdd.exe 31 PID 2636 wrote to memory of 2556 2636 hftdd.exe 31 PID 2636 wrote to memory of 2556 2636 hftdd.exe 31 PID 2556 wrote to memory of 2792 2556 pjljb.exe 32 PID 2556 wrote to memory of 2792 2556 pjljb.exe 32 PID 2556 wrote to memory of 2792 2556 pjljb.exe 32 PID 2556 wrote to memory of 2792 2556 pjljb.exe 32 PID 2792 wrote to memory of 2644 2792 rvrbn.exe 70 PID 2792 wrote to memory of 2644 2792 rvrbn.exe 70 PID 2792 wrote to memory of 2644 2792 rvrbn.exe 70 PID 2792 wrote to memory of 2644 2792 rvrbn.exe 70 PID 2644 wrote to memory of 2572 2644 rtbnn.exe 34 PID 2644 wrote to memory of 2572 2644 rtbnn.exe 34 PID 2644 wrote to memory of 2572 2644 rtbnn.exe 34 PID 2644 wrote to memory of 2572 2644 rtbnn.exe 34 PID 2572 wrote to memory of 2412 2572 rfldr.exe 35 PID 2572 wrote to memory of 2412 2572 rfldr.exe 35 PID 2572 wrote to memory of 2412 2572 rfldr.exe 35 PID 2572 wrote to memory of 2412 2572 rfldr.exe 35 PID 2412 wrote to memory of 2876 2412 phdbvnf.exe 36 PID 2412 wrote to memory of 2876 2412 phdbvnf.exe 36 PID 2412 wrote to memory of 2876 2412 phdbvnf.exe 36 PID 2412 wrote to memory of 2876 2412 phdbvnf.exe 36 PID 2876 wrote to memory of 2384 2876 vxbltd.exe 37 PID 2876 wrote to memory of 2384 2876 vxbltd.exe 37 PID 2876 wrote to memory of 2384 2876 vxbltd.exe 37 PID 2876 wrote to memory of 2384 2876 vxbltd.exe 37 PID 2384 wrote to memory of 792 2384 tlpjx.exe 77 PID 2384 wrote to memory of 792 2384 tlpjx.exe 77 PID 2384 wrote to memory of 792 2384 tlpjx.exe 77 PID 2384 wrote to memory of 792 2384 tlpjx.exe 77 PID 792 wrote to memory of 1496 792 tnrbl.exe 120 PID 792 wrote to memory of 1496 792 tnrbl.exe 120 PID 792 wrote to memory of 1496 792 tnrbl.exe 120 PID 792 wrote to memory of 1496 792 tnrbl.exe 120 PID 1496 wrote to memory of 2688 1496 vvprr.exe 121 PID 1496 wrote to memory of 2688 1496 vvprr.exe 121 PID 1496 wrote to memory of 2688 1496 vvprr.exe 121 PID 1496 wrote to memory of 2688 1496 vvprr.exe 121 PID 2688 wrote to memory of 2760 2688 lvbbnfd.exe 41 PID 2688 wrote to memory of 2760 2688 lvbbnfd.exe 41 PID 2688 wrote to memory of 2760 2688 lvbbnfd.exe 41 PID 2688 wrote to memory of 2760 2688 lvbbnfd.exe 41 PID 2760 wrote to memory of 1936 2760 fnrhn.exe 82 PID 2760 wrote to memory of 1936 2760 fnrhn.exe 82 PID 2760 wrote to memory of 1936 2760 fnrhn.exe 82 PID 2760 wrote to memory of 1936 2760 fnrhn.exe 82 PID 1936 wrote to memory of 1656 1936 pnlbtd.exe 43 PID 1936 wrote to memory of 1656 1936 pnlbtd.exe 43 PID 1936 wrote to memory of 1656 1936 pnlbtd.exe 43 PID 1936 wrote to memory of 1656 1936 pnlbtd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe"C:\Users\Admin\AppData\Local\Temp\a7bf533f1a90f5c4e34b6aa212b9fe9b3930a067e6286944a905dbed2196a700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\pvjbll.exec:\pvjbll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\plrfr.exec:\plrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\hftdd.exec:\hftdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pjljb.exec:\pjljb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rvrbn.exec:\rvrbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rtbnn.exec:\rtbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rfldr.exec:\rfldr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\phdbvnf.exec:\phdbvnf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vxbltd.exec:\vxbltd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tlpjx.exec:\tlpjx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\tnrbl.exec:\tnrbl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\vvprr.exec:\vvprr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\lvbbnfd.exec:\lvbbnfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fnrhn.exec:\fnrhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pnlbtd.exec:\pnlbtd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\bbpdhf.exec:\bbpdhf.exe17⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nfbrv.exec:\nfbrv.exe18⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nrpntvx.exec:\nrpntvx.exe19⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vdhvfpb.exec:\vdhvfpb.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rvtbd.exec:\rvtbd.exe21⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hrblt.exec:\hrblt.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fjlhr.exec:\fjlhr.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jnfjlx.exec:\jnfjlx.exe24⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hdjtdh.exec:\hdjtdh.exe25⤵
- Executes dropped EXE
PID:620 -
\??\c:\pfjdlvr.exec:\pfjdlvr.exe26⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ffjlf.exec:\ffjlf.exe27⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vvdjjtr.exec:\vvdjjtr.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bpbhhrd.exec:\bpbhhrd.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jblhxv.exec:\jblhxv.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rpddv.exec:\rpddv.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vxfxnd.exec:\vxfxnd.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\brrrvvl.exec:\brrrvvl.exe33⤵
- Executes dropped EXE
PID:816 -
\??\c:\xfxvr.exec:\xfxvr.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rptrfjl.exec:\rptrfjl.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bdvph.exec:\bdvph.exe36⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hpdjxbt.exec:\hpdjxbt.exe37⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vjxvtv.exec:\vjxvtv.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xtjfd.exec:\xtjfd.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jbfffx.exec:\jbfffx.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fpjnxp.exec:\fpjnxp.exe41⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xhbvx.exec:\xhbvx.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xlxfrrr.exec:\xlxfrrr.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\prvhf.exec:\prvhf.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fdndb.exec:\fdndb.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\btvlt.exec:\btvlt.exe46⤵
- Executes dropped EXE
PID:2432 -
\??\c:\drxpx.exec:\drxpx.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rlrtrv.exec:\rlrtrv.exe48⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lrnplt.exec:\lrnplt.exe49⤵
- Executes dropped EXE
PID:436 -
\??\c:\ttjbl.exec:\ttjbl.exe50⤵
- Executes dropped EXE
PID:1076 -
\??\c:\txftfjd.exec:\txftfjd.exe51⤵
- Executes dropped EXE
PID:792 -
\??\c:\hrhvdfj.exec:\hrhvdfj.exe52⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lvdpnpx.exec:\lvdpnpx.exe53⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jjjjfhv.exec:\jjjjfhv.exe54⤵
- Executes dropped EXE
PID:1100 -
\??\c:\bdpbpnl.exec:\bdpbpnl.exe55⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xvvvr.exec:\xvvvr.exe56⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pfvdvtb.exec:\pfvdvtb.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jlxrnj.exec:\jlxrnj.exe58⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jrfvvp.exec:\jrfvvp.exe59⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lbvfxph.exec:\lbvfxph.exe60⤵
- Executes dropped EXE
PID:920 -
\??\c:\htntvr.exec:\htntvr.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jnthf.exec:\jnthf.exe62⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hnrhp.exec:\hnrhp.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ptxfxp.exec:\ptxfxp.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\prvllb.exec:\prvllb.exe65⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rljvrd.exec:\rljvrd.exe66⤵PID:1092
-
\??\c:\xxhxr.exec:\xxhxr.exe67⤵PID:2256
-
\??\c:\jfnrbd.exec:\jfnrbd.exe68⤵PID:1556
-
\??\c:\fppjr.exec:\fppjr.exe69⤵PID:960
-
\??\c:\tlfdtv.exec:\tlfdtv.exe70⤵PID:2328
-
\??\c:\xlfdll.exec:\xlfdll.exe71⤵PID:644
-
\??\c:\vrnfx.exec:\vrnfx.exe72⤵PID:1788
-
\??\c:\jhnxrv.exec:\jhnxrv.exe73⤵PID:3000
-
\??\c:\tlxrdpb.exec:\tlxrdpb.exe74⤵PID:1756
-
\??\c:\hjrxdld.exec:\hjrxdld.exe75⤵PID:1468
-
\??\c:\lndvl.exec:\lndvl.exe76⤵PID:816
-
\??\c:\prxxnbr.exec:\prxxnbr.exe77⤵PID:2180
-
\??\c:\ljpjl.exec:\ljpjl.exe78⤵PID:1988
-
\??\c:\pfxppl.exec:\pfxppl.exe79⤵PID:2940
-
\??\c:\jrvvdb.exec:\jrvvdb.exe80⤵PID:876
-
\??\c:\xjxxf.exec:\xjxxf.exe81⤵PID:2504
-
\??\c:\jhjphd.exec:\jhjphd.exe82⤵PID:2612
-
\??\c:\tbnffdj.exec:\tbnffdj.exe83⤵PID:2560
-
\??\c:\flldjv.exec:\flldjv.exe84⤵PID:2616
-
\??\c:\lfljtd.exec:\lfljtd.exe85⤵PID:2748
-
\??\c:\vnjplx.exec:\vnjplx.exe86⤵PID:2112
-
\??\c:\bfrxx.exec:\bfrxx.exe87⤵PID:2900
-
\??\c:\tdhxthf.exec:\tdhxthf.exe88⤵PID:2464
-
\??\c:\fvlpffj.exec:\fvlpffj.exe89⤵PID:1276
-
\??\c:\vbnfrj.exec:\vbnfrj.exe90⤵PID:1940
-
\??\c:\xnvjxp.exec:\xnvjxp.exe91⤵PID:760
-
\??\c:\pldjt.exec:\pldjt.exe92⤵PID:1500
-
\??\c:\jjbvddt.exec:\jjbvddt.exe93⤵PID:1632
-
\??\c:\nvdbfdr.exec:\nvdbfdr.exe94⤵PID:1496
-
\??\c:\jrrnjr.exec:\jrrnjr.exe95⤵PID:2688
-
\??\c:\fvfrj.exec:\fvfrj.exe96⤵PID:924
-
\??\c:\vvrtjf.exec:\vvrtjf.exe97⤵PID:2488
-
\??\c:\jhlvb.exec:\jhlvb.exe98⤵PID:2236
-
\??\c:\vbptxn.exec:\vbptxn.exe99⤵PID:1844
-
\??\c:\pfbftfn.exec:\pfbftfn.exe100⤵PID:2136
-
\??\c:\fjrnpp.exec:\fjrnpp.exe101⤵PID:1936
-
\??\c:\rxfjjxd.exec:\rxfjjxd.exe102⤵PID:1572
-
\??\c:\rlfhxdd.exec:\rlfhxdd.exe103⤵PID:2268
-
\??\c:\dpdrrj.exec:\dpdrrj.exe104⤵PID:1284
-
\??\c:\fxxnbfb.exec:\fxxnbfb.exe105⤵PID:2824
-
\??\c:\nllfp.exec:\nllfp.exe106⤵PID:2104
-
\??\c:\bbtxd.exec:\bbtxd.exe107⤵PID:2296
-
\??\c:\bxfrbnv.exec:\bxfrbnv.exe108⤵PID:1308
-
\??\c:\xvtvxhn.exec:\xvtvxhn.exe109⤵PID:2244
-
\??\c:\rnvjbrx.exec:\rnvjbrx.exe110⤵PID:852
-
\??\c:\ntvtl.exec:\ntvtl.exe111⤵PID:1680
-
\??\c:\drhvxj.exec:\drhvxj.exe112⤵PID:1140
-
\??\c:\bppdt.exec:\bppdt.exe113⤵PID:1184
-
\??\c:\ldpdn.exec:\ldpdn.exe114⤵PID:1832
-
\??\c:\fpnpn.exec:\fpnpn.exe115⤵PID:668
-
\??\c:\dttfrf.exec:\dttfrf.exe116⤵PID:2352
-
\??\c:\hrrjdfr.exec:\hrrjdfr.exe117⤵PID:1788
-
\??\c:\vpxvxb.exec:\vpxvxb.exe118⤵PID:2176
-
\??\c:\lftjj.exec:\lftjj.exe119⤵PID:2092
-
\??\c:\tvfbhp.exec:\tvfbhp.exe120⤵PID:2232
-
\??\c:\pbnrpp.exec:\pbnrpp.exe121⤵PID:1984
-
\??\c:\prhrlx.exec:\prhrlx.exe122⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-