Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 02:19
Behavioral task
behavioral1
Sample
a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe
-
Size
363KB
-
MD5
ad4f6b9ace9998795638cb8b347249f8
-
SHA1
6a847e8f4fe7d25a78e3281a5669154190775d9c
-
SHA256
a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468
-
SHA512
aa9b9a9b2cf468c0bd8e7b87c1b21871e4b0a78bc31fbdf1b0a950cd731554d9c737dfb4f4398e1cb7e6b3f90b912ca639624d8834102cf17f013389726f7558
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE81:/4wFHoSQuxy3rTXIM181
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2772-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-188-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/268-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-211-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1036-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1160-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-252-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1832-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/948-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-299-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2056-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-416-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1276-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1208-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-510-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1764-555-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1020-568-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/752-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-606-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-615-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1228-629-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/752-637-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-650-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2780-663-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-759-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-762-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-821-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/972-842-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1160-852-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1160-885-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 xrnxd.exe 2768 fvnpdx.exe 2516 ddbxj.exe 2532 hrlxft.exe 2640 lfnhxxd.exe 2632 rtpjbv.exe 2744 dflnjpn.exe 2560 nlfdnrt.exe 2444 tdtrh.exe 884 tjtrl.exe 1512 ntnnlvl.exe 2732 vxnrdtd.exe 2868 bvjbbhv.exe 2212 hprhffx.exe 1588 xvbdn.exe 2352 vnxtn.exe 1940 dvphtd.exe 2024 lvhljx.exe 3032 rrnpdjd.exe 2116 fhrhrvt.exe 2268 vnbtdf.exe 268 nltxrxr.exe 584 jplvjp.exe 1036 njttp.exe 1160 vxfplh.exe 1624 dtdrt.exe 604 vlrbvnh.exe 1832 xblhtl.exe 624 xxflj.exe 948 tlnph.exe 2188 ndtljl.exe 1000 bjllp.exe 2300 jxpflb.exe 1988 rhrdjp.exe 2056 fnttr.exe 2832 pnpjh.exe 2772 bvhlnhf.exe 2812 jffjxp.exe 2760 xdllbl.exe 2528 dfljtfb.exe 2672 hdpbnt.exe 2628 xjphfn.exe 2576 lhvhjjh.exe 2748 hdnxplj.exe 1772 ftbnf.exe 2588 xhfxrnf.exe 2500 vlffh.exe 2856 xhndvr.exe 2236 jvrfdfp.exe 2704 lnvrr.exe 1904 nldhjj.exe 2764 jrvfjx.exe 1276 vlhfvfh.exe 1516 jjbhfbp.exe 1208 jpvfnrf.exe 856 jrrpld.exe 2288 thlvhdl.exe 1996 hxjtjpr.exe 2356 vbhpx.exe 1836 dhpbt.exe 2284 rxtht.exe 328 xhhxlrh.exe 940 jrppjn.exe 268 tbfprp.exe -
resource yara_rule behavioral1/memory/2504-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016332-6.dat upx behavioral1/memory/2504-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2772-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00280000000167db-18.dat upx behavioral1/memory/2768-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0028000000016b5e-26.dat upx behavioral1/files/0x0008000000016c90-37.dat upx behavioral1/memory/2516-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ca9-45.dat upx behavioral1/files/0x0009000000016ccf-52.dat upx behavioral1/memory/2632-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016cd4-64.dat upx behavioral1/files/0x000700000001704f-72.dat upx behavioral1/memory/2560-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0010000000016c10-82.dat upx behavioral1/files/0x000500000001946f-92.dat upx behavioral1/memory/2444-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019485-100.dat upx behavioral1/files/0x00050000000194a4-110.dat upx behavioral1/memory/1512-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000194d6-117.dat upx behavioral1/files/0x00040000000194d8-126.dat upx behavioral1/memory/2212-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000194dc-135.dat upx behavioral1/memory/1588-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e8-145.dat upx behavioral1/memory/1940-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ea-152.dat upx behavioral1/files/0x00050000000194ee-162.dat upx behavioral1/memory/2024-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-171.dat upx behavioral1/memory/3032-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f2-180.dat upx behavioral1/files/0x00050000000194f4-190.dat upx behavioral1/memory/2116-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950c-198.dat upx behavioral1/files/0x0005000000019521-206.dat upx behavioral1/memory/268-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019547-218.dat upx behavioral1/memory/1036-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019570-225.dat upx behavioral1/memory/1036-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1160-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001959c-236.dat upx behavioral1/memory/1624-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001959e-243.dat upx behavioral1/memory/604-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a2-254.dat upx behavioral1/memory/604-251-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/1832-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a4-263.dat upx behavioral1/memory/624-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a6-274.dat upx behavioral1/memory/948-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-283.dat upx behavioral1/files/0x00050000000195a8-291.dat upx behavioral1/memory/2832-321-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2772 2504 a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe 28 PID 2504 wrote to memory of 2772 2504 a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe 28 PID 2504 wrote to memory of 2772 2504 a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe 28 PID 2504 wrote to memory of 2772 2504 a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe 28 PID 2772 wrote to memory of 2768 2772 xrnxd.exe 29 PID 2772 wrote to memory of 2768 2772 xrnxd.exe 29 PID 2772 wrote to memory of 2768 2772 xrnxd.exe 29 PID 2772 wrote to memory of 2768 2772 xrnxd.exe 29 PID 2768 wrote to memory of 2516 2768 fvnpdx.exe 30 PID 2768 wrote to memory of 2516 2768 fvnpdx.exe 30 PID 2768 wrote to memory of 2516 2768 fvnpdx.exe 30 PID 2768 wrote to memory of 2516 2768 fvnpdx.exe 30 PID 2516 wrote to memory of 2532 2516 ddbxj.exe 31 PID 2516 wrote to memory of 2532 2516 ddbxj.exe 31 PID 2516 wrote to memory of 2532 2516 ddbxj.exe 31 PID 2516 wrote to memory of 2532 2516 ddbxj.exe 31 PID 2532 wrote to memory of 2640 2532 hrlxft.exe 32 PID 2532 wrote to memory of 2640 2532 hrlxft.exe 32 PID 2532 wrote to memory of 2640 2532 hrlxft.exe 32 PID 2532 wrote to memory of 2640 2532 hrlxft.exe 32 PID 2640 wrote to memory of 2632 2640 lfnhxxd.exe 33 PID 2640 wrote to memory of 2632 2640 lfnhxxd.exe 33 PID 2640 wrote to memory of 2632 2640 lfnhxxd.exe 33 PID 2640 wrote to memory of 2632 2640 lfnhxxd.exe 33 PID 2632 wrote to memory of 2744 2632 rtpjbv.exe 34 PID 2632 wrote to memory of 2744 2632 rtpjbv.exe 34 PID 2632 wrote to memory of 2744 2632 rtpjbv.exe 34 PID 2632 wrote to memory of 2744 2632 rtpjbv.exe 34 PID 2744 wrote to memory of 2560 2744 dflnjpn.exe 35 PID 2744 wrote to memory of 2560 2744 dflnjpn.exe 35 PID 2744 wrote to memory of 2560 2744 dflnjpn.exe 35 PID 2744 wrote to memory of 2560 2744 dflnjpn.exe 35 PID 2560 wrote to memory of 2444 2560 nlfdnrt.exe 36 PID 2560 wrote to memory of 2444 2560 nlfdnrt.exe 36 PID 2560 wrote to memory of 2444 2560 nlfdnrt.exe 36 PID 2560 wrote to memory of 2444 2560 nlfdnrt.exe 36 PID 2444 wrote to memory of 884 2444 tdtrh.exe 37 PID 2444 wrote to memory of 884 2444 tdtrh.exe 37 PID 2444 wrote to memory of 884 2444 tdtrh.exe 37 PID 2444 wrote to memory of 884 2444 tdtrh.exe 37 PID 884 wrote to memory of 1512 884 tjtrl.exe 38 PID 884 wrote to memory of 1512 884 tjtrl.exe 38 PID 884 wrote to memory of 1512 884 tjtrl.exe 38 PID 884 wrote to memory of 1512 884 tjtrl.exe 38 PID 1512 wrote to memory of 2732 1512 ntnnlvl.exe 39 PID 1512 wrote to memory of 2732 1512 ntnnlvl.exe 39 PID 1512 wrote to memory of 2732 1512 ntnnlvl.exe 39 PID 1512 wrote to memory of 2732 1512 ntnnlvl.exe 39 PID 2732 wrote to memory of 2868 2732 vxnrdtd.exe 40 PID 2732 wrote to memory of 2868 2732 vxnrdtd.exe 40 PID 2732 wrote to memory of 2868 2732 vxnrdtd.exe 40 PID 2732 wrote to memory of 2868 2732 vxnrdtd.exe 40 PID 2868 wrote to memory of 2212 2868 bvjbbhv.exe 41 PID 2868 wrote to memory of 2212 2868 bvjbbhv.exe 41 PID 2868 wrote to memory of 2212 2868 bvjbbhv.exe 41 PID 2868 wrote to memory of 2212 2868 bvjbbhv.exe 41 PID 2212 wrote to memory of 1588 2212 hprhffx.exe 42 PID 2212 wrote to memory of 1588 2212 hprhffx.exe 42 PID 2212 wrote to memory of 1588 2212 hprhffx.exe 42 PID 2212 wrote to memory of 1588 2212 hprhffx.exe 42 PID 1588 wrote to memory of 2352 1588 xvbdn.exe 43 PID 1588 wrote to memory of 2352 1588 xvbdn.exe 43 PID 1588 wrote to memory of 2352 1588 xvbdn.exe 43 PID 1588 wrote to memory of 2352 1588 xvbdn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe"C:\Users\Admin\AppData\Local\Temp\a5cd8159bd049e1717fea530136cbb8ab8eae8bb6358bd281e448cb21e41d468.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xrnxd.exec:\xrnxd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\fvnpdx.exec:\fvnpdx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ddbxj.exec:\ddbxj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\hrlxft.exec:\hrlxft.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lfnhxxd.exec:\lfnhxxd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rtpjbv.exec:\rtpjbv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dflnjpn.exec:\dflnjpn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\nlfdnrt.exec:\nlfdnrt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\tdtrh.exec:\tdtrh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\tjtrl.exec:\tjtrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\ntnnlvl.exec:\ntnnlvl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vxnrdtd.exec:\vxnrdtd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bvjbbhv.exec:\bvjbbhv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\hprhffx.exec:\hprhffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xvbdn.exec:\xvbdn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\vnxtn.exec:\vnxtn.exe17⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvphtd.exec:\dvphtd.exe18⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lvhljx.exec:\lvhljx.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rrnpdjd.exec:\rrnpdjd.exe20⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fhrhrvt.exec:\fhrhrvt.exe21⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vnbtdf.exec:\vnbtdf.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nltxrxr.exec:\nltxrxr.exe23⤵
- Executes dropped EXE
PID:268 -
\??\c:\jplvjp.exec:\jplvjp.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\njttp.exec:\njttp.exe25⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vxfplh.exec:\vxfplh.exe26⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dtdrt.exec:\dtdrt.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vlrbvnh.exec:\vlrbvnh.exe28⤵
- Executes dropped EXE
PID:604 -
\??\c:\xblhtl.exec:\xblhtl.exe29⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xxflj.exec:\xxflj.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\tlnph.exec:\tlnph.exe31⤵
- Executes dropped EXE
PID:948 -
\??\c:\ndtljl.exec:\ndtljl.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bjllp.exec:\bjllp.exe33⤵
- Executes dropped EXE
PID:1000 -
\??\c:\jxpflb.exec:\jxpflb.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rhrdjp.exec:\rhrdjp.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\fnttr.exec:\fnttr.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pnpjh.exec:\pnpjh.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bvhlnhf.exec:\bvhlnhf.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jffjxp.exec:\jffjxp.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xdllbl.exec:\xdllbl.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dfljtfb.exec:\dfljtfb.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hdpbnt.exec:\hdpbnt.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xjphfn.exec:\xjphfn.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lhvhjjh.exec:\lhvhjjh.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hdnxplj.exec:\hdnxplj.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ftbnf.exec:\ftbnf.exe46⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xhfxrnf.exec:\xhfxrnf.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vlffh.exec:\vlffh.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xhndvr.exec:\xhndvr.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jvrfdfp.exec:\jvrfdfp.exe50⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lnvrr.exec:\lnvrr.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nldhjj.exec:\nldhjj.exe52⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jrvfjx.exec:\jrvfjx.exe53⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vlhfvfh.exec:\vlhfvfh.exe54⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jjbhfbp.exec:\jjbhfbp.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jpvfnrf.exec:\jpvfnrf.exe56⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jrrpld.exec:\jrrpld.exe57⤵
- Executes dropped EXE
PID:856 -
\??\c:\thlvhdl.exec:\thlvhdl.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hxjtjpr.exec:\hxjtjpr.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vbhpx.exec:\vbhpx.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dhpbt.exec:\dhpbt.exe61⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rxtht.exec:\rxtht.exe62⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xhhxlrh.exec:\xhhxlrh.exe63⤵
- Executes dropped EXE
PID:328 -
\??\c:\jrppjn.exec:\jrppjn.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\tbfprp.exec:\tbfprp.exe65⤵
- Executes dropped EXE
PID:268 -
\??\c:\xnpfrlx.exec:\xnpfrlx.exe66⤵PID:1748
-
\??\c:\pdxnhb.exec:\pdxnhb.exe67⤵PID:2944
-
\??\c:\tjxdxn.exec:\tjxdxn.exe68⤵PID:1724
-
\??\c:\blrvhd.exec:\blrvhd.exe69⤵PID:1720
-
\??\c:\nllhtdl.exec:\nllhtdl.exe70⤵PID:648
-
\??\c:\lbdnnp.exec:\lbdnnp.exe71⤵PID:1764
-
\??\c:\dhxtt.exec:\dhxtt.exe72⤵PID:2788
-
\??\c:\hjdxlj.exec:\hjdxlj.exe73⤵PID:1020
-
\??\c:\hbptrbn.exec:\hbptrbn.exe74⤵PID:624
-
\??\c:\vhrbbf.exec:\vhrbbf.exe75⤵PID:1568
-
\??\c:\xlnprf.exec:\xlnprf.exe76⤵PID:2168
-
\??\c:\bvvpx.exec:\bvvpx.exe77⤵PID:2188
-
\??\c:\jxvpxpj.exec:\jxvpxpj.exe78⤵PID:2100
-
\??\c:\ptxddxl.exec:\ptxddxl.exe79⤵PID:752
-
\??\c:\pjjpdf.exec:\pjjpdf.exe80⤵PID:1760
-
\??\c:\tjpnl.exec:\tjpnl.exe81⤵PID:2828
-
\??\c:\njltlpx.exec:\njltlpx.exe82⤵PID:1228
-
\??\c:\vhlhxjf.exec:\vhlhxjf.exe83⤵PID:2684
-
\??\c:\rhxvj.exec:\rhxvj.exe84⤵PID:2896
-
\??\c:\rjbptpt.exec:\rjbptpt.exe85⤵PID:2812
-
\??\c:\xbrhp.exec:\xbrhp.exe86⤵PID:2768
-
\??\c:\lnjhdd.exec:\lnjhdd.exe87⤵PID:2780
-
\??\c:\bplvx.exec:\bplvx.exe88⤵PID:2720
-
\??\c:\vhnnxj.exec:\vhnnxj.exe89⤵PID:2660
-
\??\c:\rjvpbnx.exec:\rjvpbnx.exe90⤵PID:2752
-
\??\c:\fhppxxp.exec:\fhppxxp.exe91⤵PID:2460
-
\??\c:\txblhbr.exec:\txblhbr.exe92⤵PID:2592
-
\??\c:\rrdnpb.exec:\rrdnpb.exe93⤵PID:2468
-
\??\c:\dprvjbb.exec:\dprvjbb.exe94⤵PID:2544
-
\??\c:\fffptl.exec:\fffptl.exe95⤵PID:1120
-
\??\c:\jrflljl.exec:\jrflljl.exe96⤵PID:1928
-
\??\c:\vphhf.exec:\vphhf.exe97⤵PID:1512
-
\??\c:\nxldhfd.exec:\nxldhfd.exe98⤵PID:2616
-
\??\c:\fvpbpv.exec:\fvpbpv.exe99⤵PID:1072
-
\??\c:\nvvfptn.exec:\nvvfptn.exe100⤵PID:1672
-
\??\c:\dvbvl.exec:\dvbvl.exe101⤵PID:1972
-
\??\c:\drvlxhh.exec:\drvlxhh.exe102⤵PID:1588
-
\??\c:\bvvhhbh.exec:\bvvhhbh.exe103⤵PID:2008
-
\??\c:\fnhln.exec:\fnhln.exe104⤵PID:2020
-
\??\c:\btvhbl.exec:\btvhbl.exe105⤵PID:2288
-
\??\c:\thrpbb.exec:\thrpbb.exe106⤵PID:1924
-
\??\c:\prptx.exec:\prptx.exe107⤵PID:2356
-
\??\c:\tjlhxj.exec:\tjlhxj.exe108⤵PID:3032
-
\??\c:\rxhvx.exec:\rxhvx.exe109⤵PID:588
-
\??\c:\tdfrl.exec:\tdfrl.exe110⤵PID:2796
-
\??\c:\bnnrxn.exec:\bnnrxn.exe111⤵PID:1384
-
\??\c:\fhddbd.exec:\fhddbd.exe112⤵PID:520
-
\??\c:\vlljx.exec:\vlljx.exe113⤵PID:1748
-
\??\c:\ffnfx.exec:\ffnfx.exe114⤵PID:1544
-
\??\c:\rrbvn.exec:\rrbvn.exe115⤵PID:972
-
\??\c:\nxhlrvb.exec:\nxhlrvb.exe116⤵PID:1160
-
\??\c:\bxjjj.exec:\bxjjj.exe117⤵PID:836
-
\??\c:\bnlvr.exec:\bnlvr.exe118⤵PID:1092
-
\??\c:\xttvrbj.exec:\xttvrbj.exe119⤵PID:1424
-
\??\c:\nlbjbnh.exec:\nlbjbnh.exe120⤵PID:1020
-
\??\c:\dfnfbt.exec:\dfnfbt.exe121⤵PID:624
-
\??\c:\ffhrh.exec:\ffhrh.exe122⤵PID:1568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-