Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe
-
Size
94KB
-
MD5
70b43b60e16400939b9b137c7cfb09b5
-
SHA1
80b1ebfb7a31e460001e3db91cfc8aa925ff015a
-
SHA256
93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9
-
SHA512
f94af7c94d4b2ba1c5d98445d3b17af7a5b6a7bee28a33f132ba3fb95c89bdd1a8f08baf3c409c6ca494235f775abf137979e54eb104ba767f854b64cac72344
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtQ:ymb3NkkiQ3mdBjFIWeFGyAsJAg2Q
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2808-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral1/memory/2808-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2808-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2080-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1856-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2312-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1920-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1312-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1168-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1156-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1656-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2280-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-227-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1068-281-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/872-308-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2084 lxtxxdh.exe 2080 btddrrh.exe 2896 vhbtf.exe 2536 prpxvp.exe 2560 rpxvhp.exe 2368 vlhhd.exe 2504 vfrxn.exe 2376 pvrjj.exe 1856 rpvpf.exe 2312 tfbhj.exe 1312 nhpljxb.exe 1920 hfhhrd.exe 1168 pplnr.exe 1156 vlhhh.exe 1656 bdpfhx.exe 2280 pxpdxhd.exe 1708 rdrpf.exe 1688 hfvtlfj.exe 2400 ntrfx.exe 2132 vhlhhh.exe 2244 dbpxhdp.exe 2708 dxpnh.exe 1636 lxtldhv.exe 1844 pnnlhb.exe 1988 rdpvd.exe 2512 bvvxx.exe 2208 jnbvbr.exe 1068 pdhrbj.exe 2124 fbhvb.exe 1752 njllh.exe 872 tnbbnrt.exe 1604 vtjxxd.exe 2920 nthrvx.exe 2632 blntbx.exe 1716 tpxhl.exe 2684 vbjvd.exe 2520 pvjdx.exe 2768 xpxnxl.exe 2896 jfptf.exe 2544 vthjdtf.exe 2456 btrnhv.exe 2448 bbpdlhb.exe 2380 rldlf.exe 2552 lntjddn.exe 2352 ddpntrn.exe 2376 vrbvdrj.exe 2944 hpnfddf.exe 1952 fbdxxv.exe 1092 fptbp.exe 572 pfppljl.exe 964 hnndnvd.exe 2176 tdtdthb.exe 1832 blptnpp.exe 1368 vxxljf.exe 1648 rjnjdl.exe 2284 pfvxxpl.exe 2140 vbxtbf.exe 1756 frjrjn.exe 2320 bptbf.exe 2652 rpxtn.exe 2792 pfdvbvh.exe 2668 lvxtl.exe 2244 pbpvjn.exe 2916 frvldjf.exe -
resource yara_rule behavioral1/memory/2808-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2084 2808 93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe 28 PID 2808 wrote to memory of 2084 2808 93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe 28 PID 2808 wrote to memory of 2084 2808 93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe 28 PID 2808 wrote to memory of 2084 2808 93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe 28 PID 2084 wrote to memory of 2080 2084 lxtxxdh.exe 29 PID 2084 wrote to memory of 2080 2084 lxtxxdh.exe 29 PID 2084 wrote to memory of 2080 2084 lxtxxdh.exe 29 PID 2084 wrote to memory of 2080 2084 lxtxxdh.exe 29 PID 2080 wrote to memory of 2896 2080 btddrrh.exe 30 PID 2080 wrote to memory of 2896 2080 btddrrh.exe 30 PID 2080 wrote to memory of 2896 2080 btddrrh.exe 30 PID 2080 wrote to memory of 2896 2080 btddrrh.exe 30 PID 2896 wrote to memory of 2536 2896 vhbtf.exe 31 PID 2896 wrote to memory of 2536 2896 vhbtf.exe 31 PID 2896 wrote to memory of 2536 2896 vhbtf.exe 31 PID 2896 wrote to memory of 2536 2896 vhbtf.exe 31 PID 2536 wrote to memory of 2560 2536 prpxvp.exe 32 PID 2536 wrote to memory of 2560 2536 prpxvp.exe 32 PID 2536 wrote to memory of 2560 2536 prpxvp.exe 32 PID 2536 wrote to memory of 2560 2536 prpxvp.exe 32 PID 2560 wrote to memory of 2368 2560 rpxvhp.exe 33 PID 2560 wrote to memory of 2368 2560 rpxvhp.exe 33 PID 2560 wrote to memory of 2368 2560 rpxvhp.exe 33 PID 2560 wrote to memory of 2368 2560 rpxvhp.exe 33 PID 2368 wrote to memory of 2504 2368 vlhhd.exe 34 PID 2368 wrote to memory of 2504 2368 vlhhd.exe 34 PID 2368 wrote to memory of 2504 2368 vlhhd.exe 34 PID 2368 wrote to memory of 2504 2368 vlhhd.exe 34 PID 2504 wrote to memory of 2376 2504 vfrxn.exe 35 PID 2504 wrote to memory of 2376 2504 vfrxn.exe 35 PID 2504 wrote to memory of 2376 2504 vfrxn.exe 35 PID 2504 wrote to memory of 2376 2504 vfrxn.exe 35 PID 2376 wrote to memory of 1856 2376 pvrjj.exe 36 PID 2376 wrote to memory of 1856 2376 pvrjj.exe 36 PID 2376 wrote to memory of 1856 2376 pvrjj.exe 36 PID 2376 wrote to memory of 1856 2376 pvrjj.exe 36 PID 1856 wrote to memory of 2312 1856 rpvpf.exe 37 PID 1856 wrote to memory of 2312 1856 rpvpf.exe 37 PID 1856 wrote to memory of 2312 1856 rpvpf.exe 37 PID 1856 wrote to memory of 2312 1856 rpvpf.exe 37 PID 2312 wrote to memory of 1312 2312 tfbhj.exe 38 PID 2312 wrote to memory of 1312 2312 tfbhj.exe 38 PID 2312 wrote to memory of 1312 2312 tfbhj.exe 38 PID 2312 wrote to memory of 1312 2312 tfbhj.exe 38 PID 1312 wrote to memory of 1920 1312 nhpljxb.exe 39 PID 1312 wrote to memory of 1920 1312 nhpljxb.exe 39 PID 1312 wrote to memory of 1920 1312 nhpljxb.exe 39 PID 1312 wrote to memory of 1920 1312 nhpljxb.exe 39 PID 1920 wrote to memory of 1168 1920 hfhhrd.exe 40 PID 1920 wrote to memory of 1168 1920 hfhhrd.exe 40 PID 1920 wrote to memory of 1168 1920 hfhhrd.exe 40 PID 1920 wrote to memory of 1168 1920 hfhhrd.exe 40 PID 1168 wrote to memory of 1156 1168 pplnr.exe 41 PID 1168 wrote to memory of 1156 1168 pplnr.exe 41 PID 1168 wrote to memory of 1156 1168 pplnr.exe 41 PID 1168 wrote to memory of 1156 1168 pplnr.exe 41 PID 1156 wrote to memory of 1656 1156 vlhhh.exe 42 PID 1156 wrote to memory of 1656 1156 vlhhh.exe 42 PID 1156 wrote to memory of 1656 1156 vlhhh.exe 42 PID 1156 wrote to memory of 1656 1156 vlhhh.exe 42 PID 1656 wrote to memory of 2280 1656 bdpfhx.exe 43 PID 1656 wrote to memory of 2280 1656 bdpfhx.exe 43 PID 1656 wrote to memory of 2280 1656 bdpfhx.exe 43 PID 1656 wrote to memory of 2280 1656 bdpfhx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe"C:\Users\Admin\AppData\Local\Temp\93487076b45f16fa3ddaa2a81793b0c1d85bcacb7a0d3b70d55555e7fba466f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\lxtxxdh.exec:\lxtxxdh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\btddrrh.exec:\btddrrh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vhbtf.exec:\vhbtf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\prpxvp.exec:\prpxvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rpxvhp.exec:\rpxvhp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\vlhhd.exec:\vlhhd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vfrxn.exec:\vfrxn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pvrjj.exec:\pvrjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\rpvpf.exec:\rpvpf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\tfbhj.exec:\tfbhj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\nhpljxb.exec:\nhpljxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\hfhhrd.exec:\hfhhrd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\pplnr.exec:\pplnr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\vlhhh.exec:\vlhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bdpfhx.exec:\bdpfhx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\pxpdxhd.exec:\pxpdxhd.exe17⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rdrpf.exec:\rdrpf.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hfvtlfj.exec:\hfvtlfj.exe19⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ntrfx.exec:\ntrfx.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vhlhhh.exec:\vhlhhh.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dbpxhdp.exec:\dbpxhdp.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dxpnh.exec:\dxpnh.exe23⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lxtldhv.exec:\lxtldhv.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pnnlhb.exec:\pnnlhb.exe25⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rdpvd.exec:\rdpvd.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bvvxx.exec:\bvvxx.exe27⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jnbvbr.exec:\jnbvbr.exe28⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pdhrbj.exec:\pdhrbj.exe29⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fbhvb.exec:\fbhvb.exe30⤵
- Executes dropped EXE
PID:2124 -
\??\c:\njllh.exec:\njllh.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnbbnrt.exec:\tnbbnrt.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\vtjxxd.exec:\vtjxxd.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nthrvx.exec:\nthrvx.exe34⤵
- Executes dropped EXE
PID:2920 -
\??\c:\blntbx.exec:\blntbx.exe35⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tpxhl.exec:\tpxhl.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vbjvd.exec:\vbjvd.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pvjdx.exec:\pvjdx.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xpxnxl.exec:\xpxnxl.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jfptf.exec:\jfptf.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vthjdtf.exec:\vthjdtf.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\btrnhv.exec:\btrnhv.exe42⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bbpdlhb.exec:\bbpdlhb.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rldlf.exec:\rldlf.exe44⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lntjddn.exec:\lntjddn.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ddpntrn.exec:\ddpntrn.exe46⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vrbvdrj.exec:\vrbvdrj.exe47⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hpnfddf.exec:\hpnfddf.exe48⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fbdxxv.exec:\fbdxxv.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\fptbp.exec:\fptbp.exe50⤵
- Executes dropped EXE
PID:1092 -
\??\c:\pfppljl.exec:\pfppljl.exe51⤵
- Executes dropped EXE
PID:572 -
\??\c:\hnndnvd.exec:\hnndnvd.exe52⤵
- Executes dropped EXE
PID:964 -
\??\c:\tdtdthb.exec:\tdtdthb.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\blptnpp.exec:\blptnpp.exe54⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vxxljf.exec:\vxxljf.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rjnjdl.exec:\rjnjdl.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pfvxxpl.exec:\pfvxxpl.exe57⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vbxtbf.exec:\vbxtbf.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\frjrjn.exec:\frjrjn.exe59⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bptbf.exec:\bptbf.exe60⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rpxtn.exec:\rpxtn.exe61⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pfdvbvh.exec:\pfdvbvh.exe62⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lvxtl.exec:\lvxtl.exe63⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pbpvjn.exec:\pbpvjn.exe64⤵
- Executes dropped EXE
PID:2244 -
\??\c:\frvldjf.exec:\frvldjf.exe65⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xpbhx.exec:\xpbhx.exe66⤵PID:1816
-
\??\c:\rdlnhh.exec:\rdlnhh.exe67⤵PID:1564
-
\??\c:\jrxbhnp.exec:\jrxbhnp.exe68⤵PID:1160
-
\??\c:\bdjpf.exec:\bdjpf.exe69⤵PID:1548
-
\??\c:\dtjpr.exec:\dtjpr.exe70⤵PID:1968
-
\??\c:\jpphp.exec:\jpphp.exe71⤵PID:840
-
\??\c:\ljrfj.exec:\ljrfj.exe72⤵PID:1668
-
\??\c:\fnxlh.exec:\fnxlh.exe73⤵PID:1088
-
\??\c:\tfptl.exec:\tfptl.exe74⤵PID:2072
-
\??\c:\ltxvh.exec:\ltxvh.exe75⤵PID:1536
-
\??\c:\ldhxpxv.exec:\ldhxpxv.exe76⤵PID:872
-
\??\c:\hphhjpl.exec:\hphhjpl.exe77⤵PID:2092
-
\??\c:\trbfdv.exec:\trbfdv.exe78⤵PID:1216
-
\??\c:\hbjrbll.exec:\hbjrbll.exe79⤵PID:2216
-
\??\c:\xlxxr.exec:\xlxxr.exe80⤵PID:1692
-
\??\c:\bbdfj.exec:\bbdfj.exe81⤵PID:3016
-
\??\c:\rfpvv.exec:\rfpvv.exe82⤵PID:3056
-
\??\c:\brrnrdt.exec:\brrnrdt.exe83⤵PID:2572
-
\??\c:\xhdjh.exec:\xhdjh.exe84⤵PID:2620
-
\??\c:\vdbvhf.exec:\vdbvhf.exe85⤵PID:2696
-
\??\c:\tdhrfp.exec:\tdhrfp.exe86⤵PID:2640
-
\??\c:\lvxlf.exec:\lvxlf.exe87⤵PID:2548
-
\??\c:\tjhtjhv.exec:\tjhtjhv.exe88⤵PID:2332
-
\??\c:\jlrfx.exec:\jlrfx.exe89⤵PID:2496
-
\??\c:\xrlxlth.exec:\xrlxlth.exe90⤵PID:2388
-
\??\c:\jfhlxv.exec:\jfhlxv.exe91⤵PID:2100
-
\??\c:\hvbtvfb.exec:\hvbtvfb.exe92⤵PID:2776
-
\??\c:\rfbjlp.exec:\rfbjlp.exe93⤵PID:2812
-
\??\c:\vtrtrl.exec:\vtrtrl.exe94⤵PID:2312
-
\??\c:\jthrxnj.exec:\jthrxnj.exe95⤵PID:1996
-
\??\c:\xxxjxrd.exec:\xxxjxrd.exe96⤵PID:2032
-
\??\c:\hlxlxlp.exec:\hlxlxlp.exe97⤵PID:2004
-
\??\c:\pjrhrbl.exec:\pjrhrbl.exe98⤵PID:2008
-
\??\c:\tjrhxnj.exec:\tjrhxnj.exe99⤵PID:1940
-
\??\c:\xxlfx.exec:\xxlfx.exe100⤵PID:1632
-
\??\c:\rxprx.exec:\rxprx.exe101⤵PID:2284
-
\??\c:\fpvjrbt.exec:\fpvjrbt.exe102⤵PID:1708
-
\??\c:\ddtbbh.exec:\ddtbbh.exe103⤵PID:1756
-
\??\c:\htdpl.exec:\htdpl.exe104⤵PID:1596
-
\??\c:\vvdxr.exec:\vvdxr.exe105⤵PID:2428
-
\??\c:\xxfdnf.exec:\xxfdnf.exe106⤵PID:1184
-
\??\c:\vlbbvht.exec:\vlbbvht.exe107⤵PID:2796
-
\??\c:\vxdrd.exec:\vxdrd.exe108⤵PID:2712
-
\??\c:\hjpjflx.exec:\hjpjflx.exe109⤵PID:632
-
\??\c:\fjtnrvh.exec:\fjtnrvh.exe110⤵PID:2912
-
\??\c:\dddpj.exec:\dddpj.exe111⤵PID:1288
-
\??\c:\nlnhxv.exec:\nlnhxv.exe112⤵PID:2596
-
\??\c:\ddtldph.exec:\ddtldph.exe113⤵PID:1160
-
\??\c:\xndrh.exec:\xndrh.exe114⤵PID:1548
-
\??\c:\dpfbhhf.exec:\dpfbhhf.exe115⤵PID:1968
-
\??\c:\rnvpd.exec:\rnvpd.exe116⤵PID:1676
-
\??\c:\pvxfrh.exec:\pvxfrh.exe117⤵PID:1668
-
\??\c:\xdplvxj.exec:\xdplvxj.exe118⤵PID:2824
-
\??\c:\xhpbptp.exec:\xhpbptp.exe119⤵PID:2688
-
\??\c:\rhdbjpp.exec:\rhdbjpp.exe120⤵PID:1164
-
\??\c:\tddlpfp.exec:\tddlpfp.exe121⤵PID:1696
-
\??\c:\lrdbb.exec:\lrdbb.exe122⤵PID:1504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-