Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 01:14
Behavioral task
behavioral1
Sample
0b00471d05fbec8dd89515394b80f290.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0b00471d05fbec8dd89515394b80f290.exe
-
Size
285KB
-
MD5
0b00471d05fbec8dd89515394b80f290
-
SHA1
4aa9a985ace19b0d038111d1afde7b4234f0c54a
-
SHA256
6c41fdb38c34bf7a747ce56735724d39b0e49b359db808a41da4b08b7016e141
-
SHA512
980850f5a3daa22c203ed1e3af85e686843cee9198bf5d979b6af2684114019e145a413ee0ffa6fb8b3ab13ca2937efae0188952acdb65fa57879b671f0ef9fe
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZTyoImg:y4wFHoS3eFp3IDvSbh5nP+oImg
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/3000-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-105-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1232-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/900-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-337-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2108-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-379-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2976-380-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-408-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2180-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-470-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-565-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2408-573-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2228-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-588-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/900-615-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1296-651-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2444-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-685-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-684-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1048-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-808-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-860-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2512 llrdn.exe 2692 ffxvtjr.exe 2544 bxjvjrv.exe 2536 tbjtt.exe 2728 xhflpnd.exe 2484 btndv.exe 2100 jdrpn.exe 820 vbldxtr.exe 1352 pnbxh.exe 1720 rbjxh.exe 2812 dtxttdt.exe 2904 nxptxx.exe 1232 xdrhplp.exe 1960 nvxlpbd.exe 1824 pxhttvl.exe 2636 vphvvj.exe 2660 lxpvph.exe 1032 fhhrd.exe 1048 ttfhtrn.exe 2088 jfplbr.exe 2168 bvvfld.exe 1644 fhfjdjv.exe 2292 jnbxrd.exe 3064 fbhfd.exe 1136 dlljv.exe 1528 vbxbdf.exe 1360 drjphl.exe 1340 hnrrn.exe 1320 xhprfj.exe 2208 ltrvrv.exe 960 lddvx.exe 528 txnth.exe 588 nxnjvph.exe 900 pdvjv.exe 2988 lhfdn.exe 3000 dtxdpn.exe 1672 vhtpp.exe 2108 rrtfrj.exe 2700 vtjvnx.exe 2552 jfhtdxv.exe 2104 rhrxp.exe 2456 xhvnxr.exe 2496 htrtbhf.exe 2976 btfbjtn.exe 524 prthpl.exe 2400 xbhfl.exe 820 rlrlhl.exe 580 tjpfbdr.exe 1772 fjrndxf.exe 1720 ptdrdf.exe 2180 lfbhdft.exe 1936 fhdrdn.exe 2624 thtnvnj.exe 2628 pppfvnj.exe 1816 rpbfv.exe 1824 xhpxh.exe 2676 fftdt.exe 848 fdjpb.exe 1820 xdhtxnv.exe 1036 xlpxlh.exe 1048 bjlxp.exe 2288 xxlhjfb.exe 1844 rxdjdrx.exe 1648 ddrlv.exe -
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002c000000014b6d-18.dat upx behavioral1/memory/2692-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014909-10.dat upx behavioral1/memory/3000-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002c000000014c67-28.dat upx behavioral1/memory/2536-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015264-37.dat upx behavioral1/memory/2728-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015364-51.dat upx behavioral1/memory/2536-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000155d4-61.dat upx behavioral1/memory/2484-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cb9-69.dat upx behavioral1/memory/2484-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cf0-80.dat upx behavioral1/memory/820-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d01-88.dat upx behavioral1/memory/2100-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1352-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000014e3d-97.dat upx behavioral1/files/0x0006000000016d11-108.dat upx behavioral1/files/0x0006000000016d24-118.dat upx behavioral1/memory/2812-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-125.dat upx behavioral1/memory/1720-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d41-135.dat upx behavioral1/memory/1232-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4a-143.dat upx behavioral1/files/0x0006000000016d4f-151.dat upx behavioral1/files/0x0006000000016d55-159.dat upx behavioral1/memory/1032-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d84-170.dat upx behavioral1/memory/2660-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d89-178.dat upx behavioral1/memory/1032-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e56-189.dat upx behavioral1/memory/1048-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001704f-196.dat upx behavioral1/files/0x0006000000017090-203.dat upx behavioral1/memory/1644-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868c-214.dat upx behavioral1/files/0x0005000000018698-222.dat upx behavioral1/files/0x00050000000186a0-230.dat upx behavioral1/memory/1528-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ae2-239.dat upx behavioral1/files/0x0006000000018ae8-248.dat upx behavioral1/files/0x0006000000018b15-256.dat upx behavioral1/files/0x0006000000018b33-266.dat upx behavioral1/memory/1340-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1320-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b37-275.dat upx behavioral1/files/0x0006000000018b42-284.dat upx behavioral1/files/0x0006000000018b4a-291.dat upx behavioral1/memory/900-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-326-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2512 3000 0b00471d05fbec8dd89515394b80f290.exe 28 PID 3000 wrote to memory of 2512 3000 0b00471d05fbec8dd89515394b80f290.exe 28 PID 3000 wrote to memory of 2512 3000 0b00471d05fbec8dd89515394b80f290.exe 28 PID 3000 wrote to memory of 2512 3000 0b00471d05fbec8dd89515394b80f290.exe 28 PID 2512 wrote to memory of 2692 2512 llrdn.exe 29 PID 2512 wrote to memory of 2692 2512 llrdn.exe 29 PID 2512 wrote to memory of 2692 2512 llrdn.exe 29 PID 2512 wrote to memory of 2692 2512 llrdn.exe 29 PID 2692 wrote to memory of 2544 2692 ffxvtjr.exe 30 PID 2692 wrote to memory of 2544 2692 ffxvtjr.exe 30 PID 2692 wrote to memory of 2544 2692 ffxvtjr.exe 30 PID 2692 wrote to memory of 2544 2692 ffxvtjr.exe 30 PID 2544 wrote to memory of 2536 2544 bxjvjrv.exe 31 PID 2544 wrote to memory of 2536 2544 bxjvjrv.exe 31 PID 2544 wrote to memory of 2536 2544 bxjvjrv.exe 31 PID 2544 wrote to memory of 2536 2544 bxjvjrv.exe 31 PID 2536 wrote to memory of 2728 2536 tbjtt.exe 32 PID 2536 wrote to memory of 2728 2536 tbjtt.exe 32 PID 2536 wrote to memory of 2728 2536 tbjtt.exe 32 PID 2536 wrote to memory of 2728 2536 tbjtt.exe 32 PID 2728 wrote to memory of 2484 2728 xhflpnd.exe 33 PID 2728 wrote to memory of 2484 2728 xhflpnd.exe 33 PID 2728 wrote to memory of 2484 2728 xhflpnd.exe 33 PID 2728 wrote to memory of 2484 2728 xhflpnd.exe 33 PID 2484 wrote to memory of 2100 2484 btndv.exe 34 PID 2484 wrote to memory of 2100 2484 btndv.exe 34 PID 2484 wrote to memory of 2100 2484 btndv.exe 34 PID 2484 wrote to memory of 2100 2484 btndv.exe 34 PID 2100 wrote to memory of 820 2100 jdrpn.exe 35 PID 2100 wrote to memory of 820 2100 jdrpn.exe 35 PID 2100 wrote to memory of 820 2100 jdrpn.exe 35 PID 2100 wrote to memory of 820 2100 jdrpn.exe 35 PID 820 wrote to memory of 1352 820 vbldxtr.exe 36 PID 820 wrote to memory of 1352 820 vbldxtr.exe 36 PID 820 wrote to memory of 1352 820 vbldxtr.exe 36 PID 820 wrote to memory of 1352 820 vbldxtr.exe 36 PID 1352 wrote to memory of 1720 1352 pnbxh.exe 37 PID 1352 wrote to memory of 1720 1352 pnbxh.exe 37 PID 1352 wrote to memory of 1720 1352 pnbxh.exe 37 PID 1352 wrote to memory of 1720 1352 pnbxh.exe 37 PID 1720 wrote to memory of 2812 1720 rbjxh.exe 38 PID 1720 wrote to memory of 2812 1720 rbjxh.exe 38 PID 1720 wrote to memory of 2812 1720 rbjxh.exe 38 PID 1720 wrote to memory of 2812 1720 rbjxh.exe 38 PID 2812 wrote to memory of 2904 2812 dtxttdt.exe 39 PID 2812 wrote to memory of 2904 2812 dtxttdt.exe 39 PID 2812 wrote to memory of 2904 2812 dtxttdt.exe 39 PID 2812 wrote to memory of 2904 2812 dtxttdt.exe 39 PID 2904 wrote to memory of 1232 2904 nxptxx.exe 40 PID 2904 wrote to memory of 1232 2904 nxptxx.exe 40 PID 2904 wrote to memory of 1232 2904 nxptxx.exe 40 PID 2904 wrote to memory of 1232 2904 nxptxx.exe 40 PID 1232 wrote to memory of 1960 1232 xdrhplp.exe 41 PID 1232 wrote to memory of 1960 1232 xdrhplp.exe 41 PID 1232 wrote to memory of 1960 1232 xdrhplp.exe 41 PID 1232 wrote to memory of 1960 1232 xdrhplp.exe 41 PID 1960 wrote to memory of 1824 1960 nvxlpbd.exe 42 PID 1960 wrote to memory of 1824 1960 nvxlpbd.exe 42 PID 1960 wrote to memory of 1824 1960 nvxlpbd.exe 42 PID 1960 wrote to memory of 1824 1960 nvxlpbd.exe 42 PID 1824 wrote to memory of 2636 1824 pxhttvl.exe 43 PID 1824 wrote to memory of 2636 1824 pxhttvl.exe 43 PID 1824 wrote to memory of 2636 1824 pxhttvl.exe 43 PID 1824 wrote to memory of 2636 1824 pxhttvl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b00471d05fbec8dd89515394b80f290.exe"C:\Users\Admin\AppData\Local\Temp\0b00471d05fbec8dd89515394b80f290.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\llrdn.exec:\llrdn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\ffxvtjr.exec:\ffxvtjr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bxjvjrv.exec:\bxjvjrv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tbjtt.exec:\tbjtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xhflpnd.exec:\xhflpnd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\btndv.exec:\btndv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jdrpn.exec:\jdrpn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vbldxtr.exec:\vbldxtr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\pnbxh.exec:\pnbxh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\rbjxh.exec:\rbjxh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\dtxttdt.exec:\dtxttdt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nxptxx.exec:\nxptxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\xdrhplp.exec:\xdrhplp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\nvxlpbd.exec:\nvxlpbd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\pxhttvl.exec:\pxhttvl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\vphvvj.exec:\vphvvj.exe17⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lxpvph.exec:\lxpvph.exe18⤵
- Executes dropped EXE
PID:2660 -
\??\c:\fhhrd.exec:\fhhrd.exe19⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ttfhtrn.exec:\ttfhtrn.exe20⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jfplbr.exec:\jfplbr.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bvvfld.exec:\bvvfld.exe22⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fhfjdjv.exec:\fhfjdjv.exe23⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jnbxrd.exec:\jnbxrd.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fbhfd.exec:\fbhfd.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dlljv.exec:\dlljv.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vbxbdf.exec:\vbxbdf.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\drjphl.exec:\drjphl.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hnrrn.exec:\hnrrn.exe29⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xhprfj.exec:\xhprfj.exe30⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ltrvrv.exec:\ltrvrv.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lddvx.exec:\lddvx.exe32⤵
- Executes dropped EXE
PID:960 -
\??\c:\txnth.exec:\txnth.exe33⤵
- Executes dropped EXE
PID:528 -
\??\c:\nxnjvph.exec:\nxnjvph.exe34⤵
- Executes dropped EXE
PID:588 -
\??\c:\pdvjv.exec:\pdvjv.exe35⤵
- Executes dropped EXE
PID:900 -
\??\c:\lhfdn.exec:\lhfdn.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dtxdpn.exec:\dtxdpn.exe37⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vhtpp.exec:\vhtpp.exe38⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rrtfrj.exec:\rrtfrj.exe39⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vtjvnx.exec:\vtjvnx.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jfhtdxv.exec:\jfhtdxv.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rhrxp.exec:\rhrxp.exe42⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xhvnxr.exec:\xhvnxr.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\htrtbhf.exec:\htrtbhf.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\btfbjtn.exec:\btfbjtn.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\prthpl.exec:\prthpl.exe46⤵
- Executes dropped EXE
PID:524 -
\??\c:\xbhfl.exec:\xbhfl.exe47⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rlrlhl.exec:\rlrlhl.exe48⤵
- Executes dropped EXE
PID:820 -
\??\c:\tjpfbdr.exec:\tjpfbdr.exe49⤵
- Executes dropped EXE
PID:580 -
\??\c:\fjrndxf.exec:\fjrndxf.exe50⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ptdrdf.exec:\ptdrdf.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfbhdft.exec:\lfbhdft.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fhdrdn.exec:\fhdrdn.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\thtnvnj.exec:\thtnvnj.exe54⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pppfvnj.exec:\pppfvnj.exe55⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rpbfv.exec:\rpbfv.exe56⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xhpxh.exec:\xhpxh.exe57⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fftdt.exec:\fftdt.exe58⤵
- Executes dropped EXE
PID:2676 -
\??\c:\fdjpb.exec:\fdjpb.exe59⤵
- Executes dropped EXE
PID:848 -
\??\c:\xdhtxnv.exec:\xdhtxnv.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xlpxlh.exec:\xlpxlh.exe61⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bjlxp.exec:\bjlxp.exe62⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xxlhjfb.exec:\xxlhjfb.exe63⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rxdjdrx.exec:\rxdjdrx.exe64⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ddrlv.exec:\ddrlv.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rjdhd.exec:\rjdhd.exe66⤵PID:2128
-
\??\c:\xlxdnl.exec:\xlxdnl.exe67⤵PID:992
-
\??\c:\xrvpfdn.exec:\xrvpfdn.exe68⤵PID:2884
-
\??\c:\dhvltpj.exec:\dhvltpj.exe69⤵PID:1056
-
\??\c:\vxlhhl.exec:\vxlhhl.exe70⤵PID:1140
-
\??\c:\jhpdn.exec:\jhpdn.exe71⤵PID:1604
-
\??\c:\vhxvd.exec:\vhxvd.exe72⤵PID:1748
-
\??\c:\hpnnppv.exec:\hpnnppv.exe73⤵PID:2900
-
\??\c:\xntdh.exec:\xntdh.exe74⤵PID:2408
-
\??\c:\prhphrh.exec:\prhphrh.exe75⤵PID:2228
-
\??\c:\hrxhjrn.exec:\hrxhjrn.exe76⤵PID:1692
-
\??\c:\xtfhdf.exec:\xtfhdf.exe77⤵PID:2252
-
\??\c:\hhbvpbt.exec:\hhbvpbt.exe78⤵PID:1304
-
\??\c:\btbjnxx.exec:\btbjnxx.exe79⤵PID:904
-
\??\c:\ffvvxf.exec:\ffvvxf.exe80⤵PID:1952
-
\??\c:\lndtnv.exec:\lndtnv.exe81⤵PID:900
-
\??\c:\dpvnjdr.exec:\dpvnjdr.exe82⤵PID:1544
-
\??\c:\prbbr.exec:\prbbr.exe83⤵PID:2528
-
\??\c:\lndph.exec:\lndph.exe84⤵PID:2364
-
\??\c:\hlxhpx.exec:\hlxhpx.exe85⤵PID:1672
-
\??\c:\dnbfp.exec:\dnbfp.exe86⤵PID:1296
-
\??\c:\vdfphvt.exec:\vdfphvt.exe87⤵PID:2580
-
\??\c:\xbjvnt.exec:\xbjvnt.exe88⤵PID:2848
-
\??\c:\pvnnx.exec:\pvnnx.exe89⤵PID:2276
-
\??\c:\hpdjhnj.exec:\hpdjhnj.exe90⤵PID:2444
-
\??\c:\ltdht.exec:\ltdht.exe91⤵PID:2496
-
\??\c:\fxrtltf.exec:\fxrtltf.exe92⤵PID:2484
-
\??\c:\hhrjtjf.exec:\hhrjtjf.exe93⤵PID:524
-
\??\c:\jftrjn.exec:\jftrjn.exe94⤵PID:2400
-
\??\c:\xpnppx.exec:\xpnppx.exe95⤵PID:1708
-
\??\c:\ntjvlr.exec:\ntjvlr.exe96⤵PID:1800
-
\??\c:\ddldlv.exec:\ddldlv.exe97⤵PID:1384
-
\??\c:\nddlvd.exec:\nddlvd.exe98⤵PID:1652
-
\??\c:\rxbpjf.exec:\rxbpjf.exe99⤵PID:2076
-
\??\c:\xjbrf.exec:\xjbrf.exe100⤵PID:2632
-
\??\c:\ldlft.exec:\ldlft.exe101⤵PID:1456
-
\??\c:\fvtbj.exec:\fvtbj.exe102⤵PID:2020
-
\??\c:\hdpdddn.exec:\hdpdddn.exe103⤵PID:2012
-
\??\c:\nvdrndn.exec:\nvdrndn.exe104⤵PID:1428
-
\??\c:\xvhhn.exec:\xvhhn.exe105⤵PID:2652
-
\??\c:\vjpxtb.exec:\vjpxtb.exe106⤵PID:1840
-
\??\c:\fndhx.exec:\fndhx.exe107⤵PID:1588
-
\??\c:\vbvlxtb.exec:\vbvlxtb.exe108⤵PID:1812
-
\??\c:\hrbvrl.exec:\hrbvrl.exe109⤵PID:2260
-
\??\c:\ttthphn.exec:\ttthphn.exe110⤵PID:1048
-
\??\c:\dvfdpxj.exec:\dvfdpxj.exe111⤵PID:1300
-
\??\c:\rfnpvj.exec:\rfnpvj.exe112⤵PID:2316
-
\??\c:\ntxpx.exec:\ntxpx.exe113⤵PID:1476
-
\??\c:\npjrp.exec:\npjrp.exe114⤵PID:432
-
\??\c:\hlfdx.exec:\hlfdx.exe115⤵PID:1912
-
\??\c:\fnxhdf.exec:\fnxhdf.exe116⤵PID:700
-
\??\c:\dhlvhl.exec:\dhlvhl.exe117⤵PID:1504
-
\??\c:\jjbfvt.exec:\jjbfvt.exe118⤵PID:1988
-
\??\c:\vhxrrn.exec:\vhxrrn.exe119⤵PID:1156
-
\??\c:\thhvj.exec:\thhvj.exe120⤵PID:1272
-
\??\c:\jdfpnpx.exec:\jdfpnpx.exe121⤵PID:2408
-
\??\c:\jtnfhdr.exec:\jtnfhdr.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-