Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 23:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d50dc2c01aac6349e0cccf40a18760f2.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d50dc2c01aac6349e0cccf40a18760f2.exe
-
Size
266KB
-
MD5
d50dc2c01aac6349e0cccf40a18760f2
-
SHA1
84664fd5abd994631b27967a5972c6af9a818b93
-
SHA256
31abd0bea69bb7fe3a58f5c04150f3c21f2701a0315453d52204d4dc572206e4
-
SHA512
0531ff6cde44e6a5351c651b391f3b69c57fe6d4acdc046f830350afab50c015ca63733bf8a30fc451b387a06004a10224bb2c29481e247e030ea7f09f901644
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMr:n3C9BRIG0asYFm71mPfkVB8dKwaWb
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral1/memory/2076-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/368-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-561-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-639-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-654-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-712-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-812-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-945-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 lrtfj.exe 1740 vlxvfrd.exe 2652 npbxx.exe 2856 jtphdl.exe 2596 ppbjtdx.exe 2508 rtfjf.exe 2672 xlhlxjd.exe 2380 bfpxjtf.exe 2792 jrjpxb.exe 268 hnnjfjj.exe 676 vlphvp.exe 1344 rllfrd.exe 368 xvlln.exe 1924 vrtbjl.exe 2312 xrnxl.exe 1824 vlhpxnj.exe 1708 jphvbvj.exe 1552 pbtjbp.exe 2628 blbjj.exe 2240 vthddt.exe 2264 phpnnhl.exe 2116 lfnvvn.exe 2912 rfhtvlj.exe 1684 bbjpvh.exe 1512 jpjtbt.exe 1476 llffrf.exe 1812 xbthrnh.exe 3052 ljbdf.exe 2828 xflvxt.exe 3044 xdbbjx.exe 852 blpjb.exe 2344 vfnlvx.exe 2144 xhpfd.exe 1904 xvdxh.exe 2080 lldjhn.exe 2456 lvdfr.exe 2516 htftxxp.exe 2572 rrtbhxh.exe 2536 prxdp.exe 2664 pfjbntx.exe 2424 jbdpb.exe 2032 nbxhtbd.exe 2908 ljbnhth.exe 2440 flprj.exe 472 lffft.exe 1372 dnfhrl.exe 1712 ttbvpll.exe 2296 vlntv.exe 368 tfldx.exe 1924 ltpdd.exe 1072 xhvpn.exe 2348 rblhpx.exe 1764 fprxd.exe 1520 txrrph.exe 1492 tnnttdb.exe 1632 djphdp.exe 2256 jvfltl.exe 2676 xvppxj.exe 1052 rfxln.exe 2620 nrfhfhh.exe 2912 pvdflbr.exe 1564 pxlxtd.exe 432 htnfj.exe 932 hjtbdfd.exe -
resource yara_rule behavioral1/memory/2076-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/368-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/472-422-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-444-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-496-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-511-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-561-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-639-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-654-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-704-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-712-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-727-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-812-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-834-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-849-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-878-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-908-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-937-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-945-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-1065-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-1165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-1194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2080 2076 d50dc2c01aac6349e0cccf40a18760f2.exe 28 PID 2076 wrote to memory of 2080 2076 d50dc2c01aac6349e0cccf40a18760f2.exe 28 PID 2076 wrote to memory of 2080 2076 d50dc2c01aac6349e0cccf40a18760f2.exe 28 PID 2076 wrote to memory of 2080 2076 d50dc2c01aac6349e0cccf40a18760f2.exe 28 PID 2080 wrote to memory of 1740 2080 lrtfj.exe 29 PID 2080 wrote to memory of 1740 2080 lrtfj.exe 29 PID 2080 wrote to memory of 1740 2080 lrtfj.exe 29 PID 2080 wrote to memory of 1740 2080 lrtfj.exe 29 PID 1740 wrote to memory of 2652 1740 vlxvfrd.exe 30 PID 1740 wrote to memory of 2652 1740 vlxvfrd.exe 30 PID 1740 wrote to memory of 2652 1740 vlxvfrd.exe 30 PID 1740 wrote to memory of 2652 1740 vlxvfrd.exe 30 PID 2652 wrote to memory of 2856 2652 npbxx.exe 31 PID 2652 wrote to memory of 2856 2652 npbxx.exe 31 PID 2652 wrote to memory of 2856 2652 npbxx.exe 31 PID 2652 wrote to memory of 2856 2652 npbxx.exe 31 PID 2856 wrote to memory of 2596 2856 jtphdl.exe 32 PID 2856 wrote to memory of 2596 2856 jtphdl.exe 32 PID 2856 wrote to memory of 2596 2856 jtphdl.exe 32 PID 2856 wrote to memory of 2596 2856 jtphdl.exe 32 PID 2596 wrote to memory of 2508 2596 ppbjtdx.exe 33 PID 2596 wrote to memory of 2508 2596 ppbjtdx.exe 33 PID 2596 wrote to memory of 2508 2596 ppbjtdx.exe 33 PID 2596 wrote to memory of 2508 2596 ppbjtdx.exe 33 PID 2508 wrote to memory of 2672 2508 rtfjf.exe 34 PID 2508 wrote to memory of 2672 2508 rtfjf.exe 34 PID 2508 wrote to memory of 2672 2508 rtfjf.exe 34 PID 2508 wrote to memory of 2672 2508 rtfjf.exe 34 PID 2672 wrote to memory of 2380 2672 xlhlxjd.exe 35 PID 2672 wrote to memory of 2380 2672 xlhlxjd.exe 35 PID 2672 wrote to memory of 2380 2672 xlhlxjd.exe 35 PID 2672 wrote to memory of 2380 2672 xlhlxjd.exe 35 PID 2380 wrote to memory of 2792 2380 bfpxjtf.exe 36 PID 2380 wrote to memory of 2792 2380 bfpxjtf.exe 36 PID 2380 wrote to memory of 2792 2380 bfpxjtf.exe 36 PID 2380 wrote to memory of 2792 2380 bfpxjtf.exe 36 PID 2792 wrote to memory of 268 2792 jrjpxb.exe 37 PID 2792 wrote to memory of 268 2792 jrjpxb.exe 37 PID 2792 wrote to memory of 268 2792 jrjpxb.exe 37 PID 2792 wrote to memory of 268 2792 jrjpxb.exe 37 PID 268 wrote to memory of 676 268 hnnjfjj.exe 38 PID 268 wrote to memory of 676 268 hnnjfjj.exe 38 PID 268 wrote to memory of 676 268 hnnjfjj.exe 38 PID 268 wrote to memory of 676 268 hnnjfjj.exe 38 PID 676 wrote to memory of 1344 676 vlphvp.exe 39 PID 676 wrote to memory of 1344 676 vlphvp.exe 39 PID 676 wrote to memory of 1344 676 vlphvp.exe 39 PID 676 wrote to memory of 1344 676 vlphvp.exe 39 PID 1344 wrote to memory of 368 1344 rllfrd.exe 40 PID 1344 wrote to memory of 368 1344 rllfrd.exe 40 PID 1344 wrote to memory of 368 1344 rllfrd.exe 40 PID 1344 wrote to memory of 368 1344 rllfrd.exe 40 PID 368 wrote to memory of 1924 368 xvlln.exe 41 PID 368 wrote to memory of 1924 368 xvlln.exe 41 PID 368 wrote to memory of 1924 368 xvlln.exe 41 PID 368 wrote to memory of 1924 368 xvlln.exe 41 PID 1924 wrote to memory of 2312 1924 vrtbjl.exe 42 PID 1924 wrote to memory of 2312 1924 vrtbjl.exe 42 PID 1924 wrote to memory of 2312 1924 vrtbjl.exe 42 PID 1924 wrote to memory of 2312 1924 vrtbjl.exe 42 PID 2312 wrote to memory of 1824 2312 xrnxl.exe 43 PID 2312 wrote to memory of 1824 2312 xrnxl.exe 43 PID 2312 wrote to memory of 1824 2312 xrnxl.exe 43 PID 2312 wrote to memory of 1824 2312 xrnxl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d50dc2c01aac6349e0cccf40a18760f2.exe"C:\Users\Admin\AppData\Local\Temp\d50dc2c01aac6349e0cccf40a18760f2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\lrtfj.exec:\lrtfj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vlxvfrd.exec:\vlxvfrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\npbxx.exec:\npbxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jtphdl.exec:\jtphdl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ppbjtdx.exec:\ppbjtdx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rtfjf.exec:\rtfjf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xlhlxjd.exec:\xlhlxjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bfpxjtf.exec:\bfpxjtf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\jrjpxb.exec:\jrjpxb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hnnjfjj.exec:\hnnjfjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\vlphvp.exec:\vlphvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\rllfrd.exec:\rllfrd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xvlln.exec:\xvlln.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\vrtbjl.exec:\vrtbjl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\xrnxl.exec:\xrnxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vlhpxnj.exec:\vlhpxnj.exe17⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jphvbvj.exec:\jphvbvj.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pbtjbp.exec:\pbtjbp.exe19⤵
- Executes dropped EXE
PID:1552 -
\??\c:\blbjj.exec:\blbjj.exe20⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vthddt.exec:\vthddt.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\phpnnhl.exec:\phpnnhl.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lfnvvn.exec:\lfnvvn.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rfhtvlj.exec:\rfhtvlj.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bbjpvh.exec:\bbjpvh.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jpjtbt.exec:\jpjtbt.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\llffrf.exec:\llffrf.exe27⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xbthrnh.exec:\xbthrnh.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ljbdf.exec:\ljbdf.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xflvxt.exec:\xflvxt.exe30⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xdbbjx.exec:\xdbbjx.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\blpjb.exec:\blpjb.exe32⤵
- Executes dropped EXE
PID:852 -
\??\c:\vfnlvx.exec:\vfnlvx.exe33⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xhpfd.exec:\xhpfd.exe34⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xvdxh.exec:\xvdxh.exe35⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lldjhn.exec:\lldjhn.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lvdfr.exec:\lvdfr.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\htftxxp.exec:\htftxxp.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rrtbhxh.exec:\rrtbhxh.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\prxdp.exec:\prxdp.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pfjbntx.exec:\pfjbntx.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jbdpb.exec:\jbdpb.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nbxhtbd.exec:\nbxhtbd.exe43⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ljbnhth.exec:\ljbnhth.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\flprj.exec:\flprj.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lffft.exec:\lffft.exe46⤵
- Executes dropped EXE
PID:472 -
\??\c:\dnfhrl.exec:\dnfhrl.exe47⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ttbvpll.exec:\ttbvpll.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vlntv.exec:\vlntv.exe49⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tfldx.exec:\tfldx.exe50⤵
- Executes dropped EXE
PID:368 -
\??\c:\ltpdd.exec:\ltpdd.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xhvpn.exec:\xhvpn.exe52⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rblhpx.exec:\rblhpx.exe53⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fprxd.exec:\fprxd.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\txrrph.exec:\txrrph.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\tnnttdb.exec:\tnnttdb.exe56⤵
- Executes dropped EXE
PID:1492 -
\??\c:\djphdp.exec:\djphdp.exe57⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jvfltl.exec:\jvfltl.exe58⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xvppxj.exec:\xvppxj.exe59⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rfxln.exec:\rfxln.exe60⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nrfhfhh.exec:\nrfhfhh.exe61⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pvdflbr.exec:\pvdflbr.exe62⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pxlxtd.exec:\pxlxtd.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\htnfj.exec:\htnfj.exe64⤵
- Executes dropped EXE
PID:432 -
\??\c:\hjtbdfd.exec:\hjtbdfd.exe65⤵
- Executes dropped EXE
PID:932 -
\??\c:\dfbdhf.exec:\dfbdhf.exe66⤵PID:1656
-
\??\c:\pfjtpb.exec:\pfjtpb.exe67⤵PID:1468
-
\??\c:\tnrjtnl.exec:\tnrjtnl.exe68⤵PID:2892
-
\??\c:\rplph.exec:\rplph.exe69⤵PID:2756
-
\??\c:\hlrbdlh.exec:\hlrbdlh.exe70⤵PID:3020
-
\??\c:\xhfdv.exec:\xhfdv.exe71⤵PID:1940
-
\??\c:\lpxxlx.exec:\lpxxlx.exe72⤵PID:1156
-
\??\c:\fnpbfbb.exec:\fnpbfbb.exe73⤵PID:1728
-
\??\c:\xhlfdxv.exec:\xhlfdxv.exe74⤵PID:2696
-
\??\c:\jxbxnt.exec:\jxbxnt.exe75⤵PID:1164
-
\??\c:\nvxvnvx.exec:\nvxvnvx.exe76⤵PID:2144
-
\??\c:\rpjvtd.exec:\rpjvtd.exe77⤵PID:2564
-
\??\c:\bhjfxtj.exec:\bhjfxtj.exe78⤵PID:2900
-
\??\c:\xnplj.exec:\xnplj.exe79⤵PID:2956
-
\??\c:\vhrrrrp.exec:\vhrrrrp.exe80⤵PID:2948
-
\??\c:\llbdvh.exec:\llbdvh.exe81⤵PID:2504
-
\??\c:\tphrj.exec:\tphrj.exe82⤵PID:2500
-
\??\c:\lbjlj.exec:\lbjlj.exe83⤵PID:2648
-
\??\c:\tfldnx.exec:\tfldnx.exe84⤵PID:2396
-
\??\c:\plrxph.exec:\plrxph.exe85⤵PID:2816
-
\??\c:\jxljrh.exec:\jxljrh.exe86⤵PID:2160
-
\??\c:\vlxpbl.exec:\vlxpbl.exe87⤵PID:2168
-
\??\c:\ljfdd.exec:\ljfdd.exe88⤵PID:2784
-
\??\c:\dfblb.exec:\dfblb.exe89⤵PID:472
-
\??\c:\nphntd.exec:\nphntd.exe90⤵PID:1372
-
\??\c:\jdfhxt.exec:\jdfhxt.exe91⤵PID:2496
-
\??\c:\nbhhvd.exec:\nbhhvd.exe92⤵PID:1748
-
\??\c:\jhvhjb.exec:\jhvhjb.exe93⤵PID:1080
-
\??\c:\pxjhd.exec:\pxjhd.exe94⤵PID:2004
-
\??\c:\dbvfdt.exec:\dbvfdt.exe95⤵PID:2220
-
\??\c:\xrbbpf.exec:\xrbbpf.exe96⤵PID:1568
-
\??\c:\jllhhp.exec:\jllhhp.exe97⤵PID:1616
-
\??\c:\jvhxnv.exec:\jvhxnv.exe98⤵PID:2436
-
\??\c:\vblnrnl.exec:\vblnrnl.exe99⤵PID:1956
-
\??\c:\nnjxr.exec:\nnjxr.exe100⤵PID:2808
-
\??\c:\vdtlhnj.exec:\vdtlhnj.exe101⤵PID:1452
-
\??\c:\txlbfp.exec:\txlbfp.exe102⤵PID:2104
-
\??\c:\jxptdp.exec:\jxptdp.exe103⤵PID:2736
-
\??\c:\rfnbnt.exec:\rfnbnt.exe104⤵PID:364
-
\??\c:\ndhttjj.exec:\ndhttjj.exe105⤵PID:1028
-
\??\c:\flnlrd.exec:\flnlrd.exe106⤵PID:2904
-
\??\c:\jbnxnp.exec:\jbnxnp.exe107⤵PID:2108
-
\??\c:\thhthdr.exec:\thhthdr.exe108⤵PID:640
-
\??\c:\hrdxl.exec:\hrdxl.exe109⤵PID:940
-
\??\c:\rvnbl.exec:\rvnbl.exe110⤵PID:3052
-
\??\c:\xfpnflt.exec:\xfpnflt.exe111⤵PID:2892
-
\??\c:\pttjrv.exec:\pttjrv.exe112⤵PID:856
-
\??\c:\tjdrl.exec:\tjdrl.exe113⤵PID:2944
-
\??\c:\vprhb.exec:\vprhb.exe114⤵PID:1580
-
\??\c:\dblfll.exec:\dblfll.exe115⤵PID:1728
-
\??\c:\fvjtr.exec:\fvjtr.exe116⤵PID:1720
-
\??\c:\pxxpddl.exec:\pxxpddl.exe117⤵PID:1448
-
\??\c:\lpttvt.exec:\lpttvt.exe118⤵PID:2468
-
\??\c:\tnnxfb.exec:\tnnxfb.exe119⤵PID:1292
-
\??\c:\lftdt.exec:\lftdt.exe120⤵PID:2900
-
\??\c:\xpjvjpl.exec:\xpjvjpl.exe121⤵PID:2588
-
\??\c:\fbppt.exec:\fbppt.exe122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-