Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 20:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe
-
Size
64KB
-
MD5
c0a405767f65ac461d13b1056409085d
-
SHA1
3589b43f945bfc5f22c0c45056f1f6c7967b91ff
-
SHA256
31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd
-
SHA512
18e4898a15797019c6be046deb2f943411fb1b1a1d753a30eabdd0265ffa2a425b0cc3809373ace06050c82389a005eb8d9765b21ae688533754e9814d4851a8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvd3:ymb3NkkiQ3mdBjF0yMlk
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2008-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral1/memory/2008-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2008-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2216-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2876-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1896-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2392-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1240-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/560-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/948-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1920-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/944-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/588-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1128-222-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/584-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1808-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1268-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2216 vdpjvv.exe 2332 bdnff.exe 2876 tbtjrv.exe 1896 jphvtfp.exe 2568 htbfh.exe 2524 tpbjxb.exe 2484 vlvjnrf.exe 2412 xrntxfp.exe 2516 fndntx.exe 2392 fdvbr.exe 2856 fhdjhd.exe 1240 xdbffb.exe 560 rxhptnr.exe 948 nhprt.exe 1920 xlhvxj.exe 944 tnbfj.exe 1952 jjnrlb.exe 1472 bjdhvjv.exe 2440 jtllh.exe 588 ljnprv.exe 2740 lhdflhb.exe 1128 xfrtvrt.exe 2096 jxphn.exe 584 hlxvv.exe 1808 brfrb.exe 1552 dnjvfpf.exe 1016 fjvjjt.exe 1144 ndtbtp.exe 904 bhvbxlx.exe 1268 jhxdvb.exe 2904 ttdbhr.exe 2144 htdtrf.exe 804 hntrtrv.exe 2212 frprnb.exe 2308 jbtvvx.exe 2000 jtdlfh.exe 1612 jbbxdr.exe 2816 bhjbn.exe 2332 bdhfd.exe 2240 hlbfpjp.exe 1708 vfnjn.exe 2948 xpvpvh.exe 3004 xrbfn.exe 2604 jbbpdr.exe 2632 jjvjn.exe 2548 phfdpfd.exe 2676 rjtxd.exe 2376 jhbrx.exe 2436 jpxhnbt.exe 2428 htbjfl.exe 2848 bfnnx.exe 1908 fvbdnn.exe 760 lhtdrjn.exe 1432 vnlhb.exe 1592 tvnbpt.exe 1920 ftnjt.exe 520 ltljf.exe 632 nbvlx.exe 1528 jrtdjdf.exe 2684 djrtj.exe 592 pdhtddn.exe 588 nfnpb.exe 2708 nrjjpf.exe 2944 dffbbh.exe -
resource yara_rule behavioral1/memory/2008-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2216 2008 31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe 28 PID 2008 wrote to memory of 2216 2008 31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe 28 PID 2008 wrote to memory of 2216 2008 31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe 28 PID 2008 wrote to memory of 2216 2008 31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe 28 PID 2216 wrote to memory of 2332 2216 vdpjvv.exe 29 PID 2216 wrote to memory of 2332 2216 vdpjvv.exe 29 PID 2216 wrote to memory of 2332 2216 vdpjvv.exe 29 PID 2216 wrote to memory of 2332 2216 vdpjvv.exe 29 PID 2332 wrote to memory of 2876 2332 bdnff.exe 30 PID 2332 wrote to memory of 2876 2332 bdnff.exe 30 PID 2332 wrote to memory of 2876 2332 bdnff.exe 30 PID 2332 wrote to memory of 2876 2332 bdnff.exe 30 PID 2876 wrote to memory of 1896 2876 tbtjrv.exe 31 PID 2876 wrote to memory of 1896 2876 tbtjrv.exe 31 PID 2876 wrote to memory of 1896 2876 tbtjrv.exe 31 PID 2876 wrote to memory of 1896 2876 tbtjrv.exe 31 PID 1896 wrote to memory of 2568 1896 jphvtfp.exe 32 PID 1896 wrote to memory of 2568 1896 jphvtfp.exe 32 PID 1896 wrote to memory of 2568 1896 jphvtfp.exe 32 PID 1896 wrote to memory of 2568 1896 jphvtfp.exe 32 PID 2568 wrote to memory of 2524 2568 htbfh.exe 33 PID 2568 wrote to memory of 2524 2568 htbfh.exe 33 PID 2568 wrote to memory of 2524 2568 htbfh.exe 33 PID 2568 wrote to memory of 2524 2568 htbfh.exe 33 PID 2524 wrote to memory of 2484 2524 tpbjxb.exe 34 PID 2524 wrote to memory of 2484 2524 tpbjxb.exe 34 PID 2524 wrote to memory of 2484 2524 tpbjxb.exe 34 PID 2524 wrote to memory of 2484 2524 tpbjxb.exe 34 PID 2484 wrote to memory of 2412 2484 vlvjnrf.exe 35 PID 2484 wrote to memory of 2412 2484 vlvjnrf.exe 35 PID 2484 wrote to memory of 2412 2484 vlvjnrf.exe 35 PID 2484 wrote to memory of 2412 2484 vlvjnrf.exe 35 PID 2412 wrote to memory of 2516 2412 xrntxfp.exe 36 PID 2412 wrote to memory of 2516 2412 xrntxfp.exe 36 PID 2412 wrote to memory of 2516 2412 xrntxfp.exe 36 PID 2412 wrote to memory of 2516 2412 xrntxfp.exe 36 PID 2516 wrote to memory of 2392 2516 fndntx.exe 37 PID 2516 wrote to memory of 2392 2516 fndntx.exe 37 PID 2516 wrote to memory of 2392 2516 fndntx.exe 37 PID 2516 wrote to memory of 2392 2516 fndntx.exe 37 PID 2392 wrote to memory of 2856 2392 fdvbr.exe 38 PID 2392 wrote to memory of 2856 2392 fdvbr.exe 38 PID 2392 wrote to memory of 2856 2392 fdvbr.exe 38 PID 2392 wrote to memory of 2856 2392 fdvbr.exe 38 PID 2856 wrote to memory of 1240 2856 fhdjhd.exe 39 PID 2856 wrote to memory of 1240 2856 fhdjhd.exe 39 PID 2856 wrote to memory of 1240 2856 fhdjhd.exe 39 PID 2856 wrote to memory of 1240 2856 fhdjhd.exe 39 PID 1240 wrote to memory of 560 1240 xdbffb.exe 40 PID 1240 wrote to memory of 560 1240 xdbffb.exe 40 PID 1240 wrote to memory of 560 1240 xdbffb.exe 40 PID 1240 wrote to memory of 560 1240 xdbffb.exe 40 PID 560 wrote to memory of 948 560 rxhptnr.exe 41 PID 560 wrote to memory of 948 560 rxhptnr.exe 41 PID 560 wrote to memory of 948 560 rxhptnr.exe 41 PID 560 wrote to memory of 948 560 rxhptnr.exe 41 PID 948 wrote to memory of 1920 948 nhprt.exe 42 PID 948 wrote to memory of 1920 948 nhprt.exe 42 PID 948 wrote to memory of 1920 948 nhprt.exe 42 PID 948 wrote to memory of 1920 948 nhprt.exe 42 PID 1920 wrote to memory of 944 1920 xlhvxj.exe 43 PID 1920 wrote to memory of 944 1920 xlhvxj.exe 43 PID 1920 wrote to memory of 944 1920 xlhvxj.exe 43 PID 1920 wrote to memory of 944 1920 xlhvxj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe"C:\Users\Admin\AppData\Local\Temp\31be798e08549c560b2eeea1eefea1dd787ddb40a834dcc8b57ea911ee9bd6bd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vdpjvv.exec:\vdpjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\bdnff.exec:\bdnff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\tbtjrv.exec:\tbtjrv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jphvtfp.exec:\jphvtfp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\htbfh.exec:\htbfh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tpbjxb.exec:\tpbjxb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vlvjnrf.exec:\vlvjnrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\xrntxfp.exec:\xrntxfp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\fndntx.exec:\fndntx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\fdvbr.exec:\fdvbr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\fhdjhd.exec:\fhdjhd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xdbffb.exec:\xdbffb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\rxhptnr.exec:\rxhptnr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\nhprt.exec:\nhprt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\xlhvxj.exec:\xlhvxj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\tnbfj.exec:\tnbfj.exe17⤵
- Executes dropped EXE
PID:944 -
\??\c:\jjnrlb.exec:\jjnrlb.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bjdhvjv.exec:\bjdhvjv.exe19⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jtllh.exec:\jtllh.exe20⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ljnprv.exec:\ljnprv.exe21⤵
- Executes dropped EXE
PID:588 -
\??\c:\lhdflhb.exec:\lhdflhb.exe22⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xfrtvrt.exec:\xfrtvrt.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jxphn.exec:\jxphn.exe24⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hlxvv.exec:\hlxvv.exe25⤵
- Executes dropped EXE
PID:584 -
\??\c:\brfrb.exec:\brfrb.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dnjvfpf.exec:\dnjvfpf.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fjvjjt.exec:\fjvjjt.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ndtbtp.exec:\ndtbtp.exe29⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bhvbxlx.exec:\bhvbxlx.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\jhxdvb.exec:\jhxdvb.exe31⤵
- Executes dropped EXE
PID:1268 -
\??\c:\ttdbhr.exec:\ttdbhr.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\htdtrf.exec:\htdtrf.exe33⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hntrtrv.exec:\hntrtrv.exe34⤵
- Executes dropped EXE
PID:804 -
\??\c:\frprnb.exec:\frprnb.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jbtvvx.exec:\jbtvvx.exe36⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jtdlfh.exec:\jtdlfh.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jbbxdr.exec:\jbbxdr.exe38⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bhjbn.exec:\bhjbn.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bdhfd.exec:\bdhfd.exe40⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hlbfpjp.exec:\hlbfpjp.exe41⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vfnjn.exec:\vfnjn.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xpvpvh.exec:\xpvpvh.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrbfn.exec:\xrbfn.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jbbpdr.exec:\jbbpdr.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjvjn.exec:\jjvjn.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\phfdpfd.exec:\phfdpfd.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rjtxd.exec:\rjtxd.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jhbrx.exec:\jhbrx.exe49⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jpxhnbt.exec:\jpxhnbt.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\htbjfl.exec:\htbjfl.exe51⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bfnnx.exec:\bfnnx.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fvbdnn.exec:\fvbdnn.exe53⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lhtdrjn.exec:\lhtdrjn.exe54⤵
- Executes dropped EXE
PID:760 -
\??\c:\vnlhb.exec:\vnlhb.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tvnbpt.exec:\tvnbpt.exe56⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ftnjt.exec:\ftnjt.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ltljf.exec:\ltljf.exe58⤵
- Executes dropped EXE
PID:520 -
\??\c:\nbvlx.exec:\nbvlx.exe59⤵
- Executes dropped EXE
PID:632 -
\??\c:\jrtdjdf.exec:\jrtdjdf.exe60⤵
- Executes dropped EXE
PID:1528 -
\??\c:\djrtj.exec:\djrtj.exe61⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdhtddn.exec:\pdhtddn.exe62⤵
- Executes dropped EXE
PID:592 -
\??\c:\nfnpb.exec:\nfnpb.exe63⤵
- Executes dropped EXE
PID:588 -
\??\c:\nrjjpf.exec:\nrjjpf.exe64⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dffbbh.exec:\dffbbh.exe65⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bxfbxv.exec:\bxfbxv.exe66⤵PID:2264
-
\??\c:\jpnxftn.exec:\jpnxftn.exe67⤵PID:1224
-
\??\c:\tnpptf.exec:\tnpptf.exe68⤵PID:1116
-
\??\c:\lrrprrr.exec:\lrrprrr.exe69⤵PID:1624
-
\??\c:\xbvrxfd.exec:\xbvrxfd.exe70⤵PID:1700
-
\??\c:\rflfh.exec:\rflfh.exe71⤵PID:2016
-
\??\c:\jnvppj.exec:\jnvppj.exe72⤵PID:108
-
\??\c:\pxjlj.exec:\pxjlj.exe73⤵PID:2992
-
\??\c:\ftbjhn.exec:\ftbjhn.exe74⤵PID:2936
-
\??\c:\ndvxvj.exec:\ndvxvj.exe75⤵PID:2076
-
\??\c:\lrdxhpt.exec:\lrdxhpt.exe76⤵PID:2156
-
\??\c:\fnjhd.exec:\fnjhd.exe77⤵PID:880
-
\??\c:\bjtxjvl.exec:\bjtxjvl.exe78⤵PID:2100
-
\??\c:\rftnf.exec:\rftnf.exe79⤵PID:2228
-
\??\c:\rplrrj.exec:\rplrrj.exe80⤵PID:1884
-
\??\c:\rtdpddn.exec:\rtdpddn.exe81⤵PID:1608
-
\??\c:\hjvfd.exec:\hjvfd.exe82⤵PID:940
-
\??\c:\vlbhjt.exec:\vlbhjt.exe83⤵PID:1676
-
\??\c:\lpdfvx.exec:\lpdfvx.exe84⤵PID:1744
-
\??\c:\nfjdp.exec:\nfjdp.exe85⤵PID:2032
-
\??\c:\npdft.exec:\npdft.exe86⤵PID:2912
-
\??\c:\xnfdjxh.exec:\xnfdjxh.exe87⤵PID:2584
-
\??\c:\bdbdj.exec:\bdbdj.exe88⤵PID:2508
-
\??\c:\rddrbhv.exec:\rddrbhv.exe89⤵PID:2636
-
\??\c:\xdrnbft.exec:\xdrnbft.exe90⤵PID:2772
-
\??\c:\jdblrbp.exec:\jdblrbp.exe91⤵PID:2400
-
\??\c:\djrxhd.exec:\djrxhd.exe92⤵PID:2492
-
\??\c:\drhnr.exec:\drhnr.exe93⤵PID:2408
-
\??\c:\jnfjxt.exec:\jnfjxt.exe94⤵PID:2396
-
\??\c:\rtxtp.exec:\rtxtp.exe95⤵PID:1904
-
\??\c:\nnddxhf.exec:\nnddxhf.exe96⤵PID:1668
-
\??\c:\pfvdbvf.exec:\pfvdbvf.exe97⤵PID:2036
-
\??\c:\nxvdp.exec:\nxvdp.exe98⤵PID:560
-
\??\c:\ndnrldh.exec:\ndnrldh.exe99⤵PID:948
-
\??\c:\pjbbvpf.exec:\pjbbvpf.exe100⤵PID:2024
-
\??\c:\vlrdfxr.exec:\vlrdfxr.exe101⤵PID:1588
-
\??\c:\brnxb.exec:\brnxb.exe102⤵PID:1212
-
\??\c:\fhrtjnh.exec:\fhrtjnh.exe103⤵PID:1384
-
\??\c:\dvtxxp.exec:\dvtxxp.exe104⤵PID:460
-
\??\c:\ddnxxv.exec:\ddnxxv.exe105⤵PID:2364
-
\??\c:\dbfpx.exec:\dbfpx.exe106⤵PID:2440
-
\??\c:\pdjvx.exec:\pdjvx.exe107⤵PID:2748
-
\??\c:\jpbvjdp.exec:\jpbvjdp.exe108⤵PID:2128
-
\??\c:\xpxrxhh.exec:\xpxrxhh.exe109⤵PID:2616
-
\??\c:\jlnxprf.exec:\jlnxprf.exe110⤵PID:1060
-
\??\c:\ldhpjr.exec:\ldhpjr.exe111⤵PID:2352
-
\??\c:\fxlbjrr.exec:\fxlbjrr.exe112⤵PID:836
-
\??\c:\nlvhpd.exec:\nlvhpd.exe113⤵PID:1556
-
\??\c:\vbddxj.exec:\vbddxj.exe114⤵PID:1012
-
\??\c:\brvtntr.exec:\brvtntr.exe115⤵PID:1136
-
\??\c:\bfnxtnj.exec:\bfnxtnj.exe116⤵PID:276
-
\??\c:\xjvdt.exec:\xjvdt.exe117⤵PID:1144
-
\??\c:\njvpfnx.exec:\njvpfnx.exe118⤵PID:904
-
\??\c:\tdljj.exec:\tdljj.exe119⤵PID:2680
-
\??\c:\xnldlp.exec:\xnldlp.exe120⤵PID:2140
-
\??\c:\dbflldf.exec:\dbflldf.exe121⤵PID:876
-
\??\c:\tvrthv.exec:\tvrthv.exe122⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-