Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe
-
Size
73KB
-
MD5
1cc97735b4ce3a0152cd4f12224df765
-
SHA1
a2f83b798fc7a58c42371fee7151753a11a8befb
-
SHA256
abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109
-
SHA512
1ea66915c0daa299229da5f09f64b8ace53f36d5fa18ef4f2be788169ceb52fa2e583dad948d0f2039a1698f7a4ddab4a8865365ea569236694ce0202c5ac31a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPV790v:ymb3NkkiQ3mdBjFIfvTfCD+HlQgv
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-9-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/528-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 36 IoCs
resource yara_rule behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2936-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2936-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2936-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2844-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/552-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/552-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/552-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2284-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2640-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/756-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1812-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2104-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1724-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/528-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3036-230-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1100-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1364-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2276-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-311-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3020 hnrnxrd.exe 2936 vlrhltb.exe 2684 xhjtrv.exe 2708 pbfhf.exe 2616 hnhxpj.exe 2480 lrbdh.exe 2844 nblprtp.exe 552 jtdtbjf.exe 2284 lrjxp.exe 924 dhdxnj.exe 2640 bhxft.exe 756 xjlxdd.exe 1812 vbtddx.exe 840 bbpnfv.exe 2104 tvphpj.exe 1724 vrtjfj.exe 1572 jhdltv.exe 2000 djrpvl.exe 2288 bjpvlpj.exe 2792 nnlfbj.exe 528 lxrjjr.exe 3036 ntxvrl.exe 2028 bbpbpj.exe 1100 blpnvj.exe 1364 hpxff.exe 1500 xtjvrv.exe 2784 rhbvvl.exe 948 hdbjnnt.exe 2276 jljtrhr.exe 1564 pvpbvxf.exe 2292 pvpxhhf.exe 1596 rbtdxx.exe 1308 rtpflh.exe 2508 vnxrf.exe 112 dfbtn.exe 2032 htvlhvr.exe 2688 btbvnnx.exe 2548 pvjxvnd.exe 2540 btbdthn.exe 2772 vbppp.exe 2692 thxjv.exe 2732 thpfjvx.exe 2236 xpbbjrh.exe 2860 pfhjh.exe 2852 vbrfbfj.exe 2404 fpjtjxh.exe 552 jnxrfr.exe 280 fbjrdr.exe 2412 rbjbbnj.exe 1132 lrhhdrj.exe 1036 jbbnjhb.exe 1944 hdxllnx.exe 2376 nhdtjp.exe 1848 ljvdhv.exe 2180 ttjbb.exe 1496 hnxbbhr.exe 1316 xxvnlhj.exe 1624 tdhdd.exe 2464 fnfhtlp.exe 2800 nfnxhp.exe 3000 xndvlhf.exe 1412 jnrrn.exe 320 thprrlx.exe 3036 fvvrbj.exe -
resource yara_rule behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-311-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 3020 1284 abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe 28 PID 1284 wrote to memory of 3020 1284 abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe 28 PID 1284 wrote to memory of 3020 1284 abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe 28 PID 1284 wrote to memory of 3020 1284 abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe 28 PID 3020 wrote to memory of 2936 3020 hnrnxrd.exe 29 PID 3020 wrote to memory of 2936 3020 hnrnxrd.exe 29 PID 3020 wrote to memory of 2936 3020 hnrnxrd.exe 29 PID 3020 wrote to memory of 2936 3020 hnrnxrd.exe 29 PID 2936 wrote to memory of 2684 2936 vlrhltb.exe 30 PID 2936 wrote to memory of 2684 2936 vlrhltb.exe 30 PID 2936 wrote to memory of 2684 2936 vlrhltb.exe 30 PID 2936 wrote to memory of 2684 2936 vlrhltb.exe 30 PID 2684 wrote to memory of 2708 2684 xhjtrv.exe 31 PID 2684 wrote to memory of 2708 2684 xhjtrv.exe 31 PID 2684 wrote to memory of 2708 2684 xhjtrv.exe 31 PID 2684 wrote to memory of 2708 2684 xhjtrv.exe 31 PID 2708 wrote to memory of 2616 2708 pbfhf.exe 32 PID 2708 wrote to memory of 2616 2708 pbfhf.exe 32 PID 2708 wrote to memory of 2616 2708 pbfhf.exe 32 PID 2708 wrote to memory of 2616 2708 pbfhf.exe 32 PID 2616 wrote to memory of 2480 2616 hnhxpj.exe 33 PID 2616 wrote to memory of 2480 2616 hnhxpj.exe 33 PID 2616 wrote to memory of 2480 2616 hnhxpj.exe 33 PID 2616 wrote to memory of 2480 2616 hnhxpj.exe 33 PID 2480 wrote to memory of 2844 2480 lrbdh.exe 34 PID 2480 wrote to memory of 2844 2480 lrbdh.exe 34 PID 2480 wrote to memory of 2844 2480 lrbdh.exe 34 PID 2480 wrote to memory of 2844 2480 lrbdh.exe 34 PID 2844 wrote to memory of 552 2844 nblprtp.exe 35 PID 2844 wrote to memory of 552 2844 nblprtp.exe 35 PID 2844 wrote to memory of 552 2844 nblprtp.exe 35 PID 2844 wrote to memory of 552 2844 nblprtp.exe 35 PID 552 wrote to memory of 2284 552 jtdtbjf.exe 36 PID 552 wrote to memory of 2284 552 jtdtbjf.exe 36 PID 552 wrote to memory of 2284 552 jtdtbjf.exe 36 PID 552 wrote to memory of 2284 552 jtdtbjf.exe 36 PID 2284 wrote to memory of 924 2284 lrjxp.exe 37 PID 2284 wrote to memory of 924 2284 lrjxp.exe 37 PID 2284 wrote to memory of 924 2284 lrjxp.exe 37 PID 2284 wrote to memory of 924 2284 lrjxp.exe 37 PID 924 wrote to memory of 2640 924 dhdxnj.exe 38 PID 924 wrote to memory of 2640 924 dhdxnj.exe 38 PID 924 wrote to memory of 2640 924 dhdxnj.exe 38 PID 924 wrote to memory of 2640 924 dhdxnj.exe 38 PID 2640 wrote to memory of 756 2640 bhxft.exe 39 PID 2640 wrote to memory of 756 2640 bhxft.exe 39 PID 2640 wrote to memory of 756 2640 bhxft.exe 39 PID 2640 wrote to memory of 756 2640 bhxft.exe 39 PID 756 wrote to memory of 1812 756 xjlxdd.exe 40 PID 756 wrote to memory of 1812 756 xjlxdd.exe 40 PID 756 wrote to memory of 1812 756 xjlxdd.exe 40 PID 756 wrote to memory of 1812 756 xjlxdd.exe 40 PID 1812 wrote to memory of 840 1812 vbtddx.exe 41 PID 1812 wrote to memory of 840 1812 vbtddx.exe 41 PID 1812 wrote to memory of 840 1812 vbtddx.exe 41 PID 1812 wrote to memory of 840 1812 vbtddx.exe 41 PID 840 wrote to memory of 2104 840 bbpnfv.exe 42 PID 840 wrote to memory of 2104 840 bbpnfv.exe 42 PID 840 wrote to memory of 2104 840 bbpnfv.exe 42 PID 840 wrote to memory of 2104 840 bbpnfv.exe 42 PID 2104 wrote to memory of 1724 2104 tvphpj.exe 43 PID 2104 wrote to memory of 1724 2104 tvphpj.exe 43 PID 2104 wrote to memory of 1724 2104 tvphpj.exe 43 PID 2104 wrote to memory of 1724 2104 tvphpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe"C:\Users\Admin\AppData\Local\Temp\abd35364d342750bfcd6f9b9522723c94dffe088fa5ac48a7d469030d62c6109.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\hnrnxrd.exec:\hnrnxrd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vlrhltb.exec:\vlrhltb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xhjtrv.exec:\xhjtrv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pbfhf.exec:\pbfhf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hnhxpj.exec:\hnhxpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\lrbdh.exec:\lrbdh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nblprtp.exec:\nblprtp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jtdtbjf.exec:\jtdtbjf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\lrjxp.exec:\lrjxp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dhdxnj.exec:\dhdxnj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\bhxft.exec:\bhxft.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xjlxdd.exec:\xjlxdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vbtddx.exec:\vbtddx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bbpnfv.exec:\bbpnfv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\tvphpj.exec:\tvphpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\vrtjfj.exec:\vrtjfj.exe17⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jhdltv.exec:\jhdltv.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\djrpvl.exec:\djrpvl.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bjpvlpj.exec:\bjpvlpj.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nnlfbj.exec:\nnlfbj.exe21⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lxrjjr.exec:\lxrjjr.exe22⤵
- Executes dropped EXE
PID:528 -
\??\c:\ntxvrl.exec:\ntxvrl.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bbpbpj.exec:\bbpbpj.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\blpnvj.exec:\blpnvj.exe25⤵
- Executes dropped EXE
PID:1100 -
\??\c:\hpxff.exec:\hpxff.exe26⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xtjvrv.exec:\xtjvrv.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rhbvvl.exec:\rhbvvl.exe28⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hdbjnnt.exec:\hdbjnnt.exe29⤵
- Executes dropped EXE
PID:948 -
\??\c:\jljtrhr.exec:\jljtrhr.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pvpbvxf.exec:\pvpbvxf.exe31⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pvpxhhf.exec:\pvpxhhf.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rbtdxx.exec:\rbtdxx.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rtpflh.exec:\rtpflh.exe34⤵
- Executes dropped EXE
PID:1308 -
\??\c:\vnxrf.exec:\vnxrf.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dfbtn.exec:\dfbtn.exe36⤵
- Executes dropped EXE
PID:112 -
\??\c:\htvlhvr.exec:\htvlhvr.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\btbvnnx.exec:\btbvnnx.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pvjxvnd.exec:\pvjxvnd.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\btbdthn.exec:\btbdthn.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vbppp.exec:\vbppp.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\thxjv.exec:\thxjv.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thpfjvx.exec:\thpfjvx.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xpbbjrh.exec:\xpbbjrh.exe44⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pfhjh.exec:\pfhjh.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vbrfbfj.exec:\vbrfbfj.exe46⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fpjtjxh.exec:\fpjtjxh.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jnxrfr.exec:\jnxrfr.exe48⤵
- Executes dropped EXE
PID:552 -
\??\c:\fbjrdr.exec:\fbjrdr.exe49⤵
- Executes dropped EXE
PID:280 -
\??\c:\rbjbbnj.exec:\rbjbbnj.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lrhhdrj.exec:\lrhhdrj.exe51⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jbbnjhb.exec:\jbbnjhb.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hdxllnx.exec:\hdxllnx.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhdtjp.exec:\nhdtjp.exe54⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ljvdhv.exec:\ljvdhv.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ttjbb.exec:\ttjbb.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hnxbbhr.exec:\hnxbbhr.exe57⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xxvnlhj.exec:\xxvnlhj.exe58⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tdhdd.exec:\tdhdd.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fnfhtlp.exec:\fnfhtlp.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nfnxhp.exec:\nfnxhp.exe61⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xndvlhf.exec:\xndvlhf.exe62⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jnrrn.exec:\jnrrn.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\thprrlx.exec:\thprrlx.exe64⤵
- Executes dropped EXE
PID:320 -
\??\c:\fvvrbj.exec:\fvvrbj.exe65⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nvjprjj.exec:\nvjprjj.exe66⤵PID:2028
-
\??\c:\ddjtj.exec:\ddjtj.exe67⤵PID:968
-
\??\c:\vlldrfx.exec:\vlldrfx.exe68⤵PID:1772
-
\??\c:\nbtrbnr.exec:\nbtrbnr.exe69⤵PID:1776
-
\??\c:\bvfbbx.exec:\bvfbbx.exe70⤵PID:844
-
\??\c:\pnhxrxb.exec:\pnhxrxb.exe71⤵PID:616
-
\??\c:\rrbbrr.exec:\rrbbrr.exe72⤵PID:2176
-
\??\c:\nvbxp.exec:\nvbxp.exe73⤵PID:1752
-
\??\c:\ljhdpfl.exec:\ljhdpfl.exe74⤵PID:2192
-
\??\c:\xffrx.exec:\xffrx.exe75⤵PID:1940
-
\??\c:\rjnbbv.exec:\rjnbbv.exe76⤵PID:1912
-
\??\c:\ldfrf.exec:\ldfrf.exe77⤵PID:2312
-
\??\c:\frdxvfr.exec:\frdxvfr.exe78⤵PID:1284
-
\??\c:\rdjxbbr.exec:\rdjxbbr.exe79⤵PID:2564
-
\??\c:\xvvbn.exec:\xvvbn.exe80⤵PID:2972
-
\??\c:\bpvlbl.exec:\bpvlbl.exe81⤵PID:2856
-
\??\c:\ndrvj.exec:\ndrvj.exe82⤵PID:2556
-
\??\c:\thrbhxj.exec:\thrbhxj.exe83⤵PID:2552
-
\??\c:\nnlfnjd.exec:\nnlfnjd.exe84⤵PID:2584
-
\??\c:\ptxdfh.exec:\ptxdfh.exe85⤵PID:2524
-
\??\c:\xbffn.exec:\xbffn.exe86⤵PID:2756
-
\??\c:\vhbnh.exec:\vhbnh.exe87⤵PID:2052
-
\??\c:\bfbfp.exec:\bfbfp.exe88⤵PID:2736
-
\??\c:\tpljxph.exec:\tpljxph.exe89⤵PID:2424
-
\??\c:\tjfrvpx.exec:\tjfrvpx.exe90⤵PID:2352
-
\??\c:\jxtnh.exec:\jxtnh.exe91⤵PID:572
-
\??\c:\lxvjj.exec:\lxvjj.exe92⤵PID:1860
-
\??\c:\bfthbdp.exec:\bfthbdp.exe93⤵PID:904
-
\??\c:\ltjfbvb.exec:\ltjfbvb.exe94⤵PID:2400
-
\??\c:\jxntpjl.exec:\jxntpjl.exe95⤵PID:2412
-
\??\c:\pphndpv.exec:\pphndpv.exe96⤵PID:2628
-
\??\c:\rjlfhjh.exec:\rjlfhjh.exe97⤵PID:1820
-
\??\c:\phlfflp.exec:\phlfflp.exe98⤵PID:644
-
\??\c:\bffxj.exec:\bffxj.exe99⤵PID:840
-
\??\c:\dphhnl.exec:\dphhnl.exe100⤵PID:2064
-
\??\c:\lhlvndb.exec:\lhlvndb.exe101⤵PID:2180
-
\??\c:\vjtptjr.exec:\vjtptjr.exe102⤵PID:1496
-
\??\c:\xfllfn.exec:\xfllfn.exe103⤵PID:3028
-
\??\c:\rxvhxtb.exec:\rxvhxtb.exe104⤵PID:1624
-
\??\c:\xhhlfv.exec:\xhhlfv.exe105⤵PID:2464
-
\??\c:\pxvfhj.exec:\pxvfhj.exe106⤵PID:2800
-
\??\c:\vvxdh.exec:\vvxdh.exe107⤵PID:3000
-
\??\c:\bhnnfhp.exec:\bhnnfhp.exe108⤵PID:1412
-
\??\c:\brtxv.exec:\brtxv.exe109⤵PID:2072
-
\??\c:\lbvnxv.exec:\lbvnxv.exe110⤵PID:3036
-
\??\c:\jlntr.exec:\jlntr.exe111⤵PID:2028
-
\??\c:\pxnvf.exec:\pxnvf.exe112⤵PID:968
-
\??\c:\jxxtn.exec:\jxxtn.exe113⤵PID:1648
-
\??\c:\fhxddv.exec:\fhxddv.exe114⤵PID:1776
-
\??\c:\npjjthd.exec:\npjjthd.exe115⤵PID:2976
-
\??\c:\pfbhh.exec:\pfbhh.exe116⤵PID:1244
-
\??\c:\xnvvl.exec:\xnvvl.exe117⤵PID:2176
-
\??\c:\pjnpfbp.exec:\pjnpfbp.exe118⤵PID:1752
-
\??\c:\jjltt.exec:\jjltt.exe119⤵PID:876
-
\??\c:\nxddd.exec:\nxddd.exe120⤵PID:1940
-
\??\c:\jpnjpx.exec:\jpnjpx.exe121⤵PID:2744
-
\??\c:\hbjhr.exec:\hbjhr.exe122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-