Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
276b56bc68499a0f87e0abebdf89b490N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
276b56bc68499a0f87e0abebdf89b490N.exe
-
Size
484KB
-
MD5
276b56bc68499a0f87e0abebdf89b490
-
SHA1
47bc5156d6123cb1cff4ccd64890544ccb4952a3
-
SHA256
ed0861e403c3329f3071cf935abaecaaec5aa078a395314b9b52b6da3c6c4e5b
-
SHA512
710d61b520e40bb9071034da24761779e7ebbeb4c929210b5ff04140c4cdb0be87eb5a0727c0021fcd9b3a1a48ba040c83ec905ab4982d43022e4ca87b0d6742
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjp:q7Tc2NYHUrAwqzc/
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-79-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2752-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-290-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-498-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1360-740-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 tpflv.exe 2920 jbftbxv.exe 2432 hntbft.exe 2744 tlvvxx.exe 2816 bdrddx.exe 1700 hfjjhd.exe 2648 frjrnr.exe 2752 lrdbf.exe 2312 tdrtdrx.exe 2592 ttpbhf.exe 2336 bvvjh.exe 2992 jrjnh.exe 2872 rtvlrl.exe 2876 xfjfdrv.exe 2472 nvvvb.exe 396 jbdlv.exe 1376 bbnfp.exe 860 jxnpjhh.exe 2380 pdlbbl.exe 2440 dhlhhjh.exe 2264 xxjjvnp.exe 1092 xnhlbpd.exe 2504 xnvxrfd.exe 2208 lrrtf.exe 2196 pbpphn.exe 592 fjvtn.exe 1756 bdfrt.exe 2292 tnjxbnv.exe 776 jdfnh.exe 1496 pdpdfv.exe 2280 jhjfb.exe 2228 nrhvn.exe 2320 tfrbj.exe 1596 ftlrnhb.exe 2236 pbrjf.exe 2916 vpvvl.exe 2528 vpxxb.exe 2832 xvvnp.exe 2744 nvrnvjf.exe 2748 jxxdnpl.exe 2808 dptnxb.exe 2636 rnndj.exe 2728 bptnp.exe 2680 pltdb.exe 1576 dbvvb.exe 2580 lhhjdb.exe 2964 vjltt.exe 2980 jxdnd.exe 3020 ljlntp.exe 2880 vvbtpjh.exe 3048 ljpptpn.exe 2484 bttljvv.exe 2684 rxffx.exe 1144 lvvfjxd.exe 1824 nrjxl.exe 1332 bltlpx.exe 1608 vdxptr.exe 2460 xtrfjj.exe 2440 jjrtj.exe 540 rxfbd.exe 1484 brnpbpp.exe 1668 jhpvxpn.exe 1636 frnnfhx.exe 1296 lxxhbdn.exe -
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-79-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2752-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-830-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2524 2532 276b56bc68499a0f87e0abebdf89b490N.exe 29 PID 2532 wrote to memory of 2524 2532 276b56bc68499a0f87e0abebdf89b490N.exe 29 PID 2532 wrote to memory of 2524 2532 276b56bc68499a0f87e0abebdf89b490N.exe 29 PID 2532 wrote to memory of 2524 2532 276b56bc68499a0f87e0abebdf89b490N.exe 29 PID 2524 wrote to memory of 2920 2524 tpflv.exe 30 PID 2524 wrote to memory of 2920 2524 tpflv.exe 30 PID 2524 wrote to memory of 2920 2524 tpflv.exe 30 PID 2524 wrote to memory of 2920 2524 tpflv.exe 30 PID 2920 wrote to memory of 2432 2920 jbftbxv.exe 31 PID 2920 wrote to memory of 2432 2920 jbftbxv.exe 31 PID 2920 wrote to memory of 2432 2920 jbftbxv.exe 31 PID 2920 wrote to memory of 2432 2920 jbftbxv.exe 31 PID 2432 wrote to memory of 2744 2432 hntbft.exe 32 PID 2432 wrote to memory of 2744 2432 hntbft.exe 32 PID 2432 wrote to memory of 2744 2432 hntbft.exe 32 PID 2432 wrote to memory of 2744 2432 hntbft.exe 32 PID 2744 wrote to memory of 2816 2744 tlvvxx.exe 33 PID 2744 wrote to memory of 2816 2744 tlvvxx.exe 33 PID 2744 wrote to memory of 2816 2744 tlvvxx.exe 33 PID 2744 wrote to memory of 2816 2744 tlvvxx.exe 33 PID 2816 wrote to memory of 1700 2816 bdrddx.exe 34 PID 2816 wrote to memory of 1700 2816 bdrddx.exe 34 PID 2816 wrote to memory of 1700 2816 bdrddx.exe 34 PID 2816 wrote to memory of 1700 2816 bdrddx.exe 34 PID 1700 wrote to memory of 2648 1700 hfjjhd.exe 35 PID 1700 wrote to memory of 2648 1700 hfjjhd.exe 35 PID 1700 wrote to memory of 2648 1700 hfjjhd.exe 35 PID 1700 wrote to memory of 2648 1700 hfjjhd.exe 35 PID 2648 wrote to memory of 2752 2648 frjrnr.exe 36 PID 2648 wrote to memory of 2752 2648 frjrnr.exe 36 PID 2648 wrote to memory of 2752 2648 frjrnr.exe 36 PID 2648 wrote to memory of 2752 2648 frjrnr.exe 36 PID 2752 wrote to memory of 2312 2752 lrdbf.exe 37 PID 2752 wrote to memory of 2312 2752 lrdbf.exe 37 PID 2752 wrote to memory of 2312 2752 lrdbf.exe 37 PID 2752 wrote to memory of 2312 2752 lrdbf.exe 37 PID 2312 wrote to memory of 2592 2312 tdrtdrx.exe 38 PID 2312 wrote to memory of 2592 2312 tdrtdrx.exe 38 PID 2312 wrote to memory of 2592 2312 tdrtdrx.exe 38 PID 2312 wrote to memory of 2592 2312 tdrtdrx.exe 38 PID 2592 wrote to memory of 2336 2592 ttpbhf.exe 39 PID 2592 wrote to memory of 2336 2592 ttpbhf.exe 39 PID 2592 wrote to memory of 2336 2592 ttpbhf.exe 39 PID 2592 wrote to memory of 2336 2592 ttpbhf.exe 39 PID 2336 wrote to memory of 2992 2336 bvvjh.exe 40 PID 2336 wrote to memory of 2992 2336 bvvjh.exe 40 PID 2336 wrote to memory of 2992 2336 bvvjh.exe 40 PID 2336 wrote to memory of 2992 2336 bvvjh.exe 40 PID 2992 wrote to memory of 2872 2992 jrjnh.exe 41 PID 2992 wrote to memory of 2872 2992 jrjnh.exe 41 PID 2992 wrote to memory of 2872 2992 jrjnh.exe 41 PID 2992 wrote to memory of 2872 2992 jrjnh.exe 41 PID 2872 wrote to memory of 2876 2872 rtvlrl.exe 42 PID 2872 wrote to memory of 2876 2872 rtvlrl.exe 42 PID 2872 wrote to memory of 2876 2872 rtvlrl.exe 42 PID 2872 wrote to memory of 2876 2872 rtvlrl.exe 42 PID 2876 wrote to memory of 2472 2876 xfjfdrv.exe 43 PID 2876 wrote to memory of 2472 2876 xfjfdrv.exe 43 PID 2876 wrote to memory of 2472 2876 xfjfdrv.exe 43 PID 2876 wrote to memory of 2472 2876 xfjfdrv.exe 43 PID 2472 wrote to memory of 396 2472 nvvvb.exe 44 PID 2472 wrote to memory of 396 2472 nvvvb.exe 44 PID 2472 wrote to memory of 396 2472 nvvvb.exe 44 PID 2472 wrote to memory of 396 2472 nvvvb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\276b56bc68499a0f87e0abebdf89b490N.exe"C:\Users\Admin\AppData\Local\Temp\276b56bc68499a0f87e0abebdf89b490N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tpflv.exec:\tpflv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jbftbxv.exec:\jbftbxv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hntbft.exec:\hntbft.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tlvvxx.exec:\tlvvxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bdrddx.exec:\bdrddx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hfjjhd.exec:\hfjjhd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\frjrnr.exec:\frjrnr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lrdbf.exec:\lrdbf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\tdrtdrx.exec:\tdrtdrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ttpbhf.exec:\ttpbhf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bvvjh.exec:\bvvjh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\jrjnh.exec:\jrjnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rtvlrl.exec:\rtvlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xfjfdrv.exec:\xfjfdrv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nvvvb.exec:\nvvvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\jbdlv.exec:\jbdlv.exe17⤵
- Executes dropped EXE
PID:396 -
\??\c:\bbnfp.exec:\bbnfp.exe18⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jxnpjhh.exec:\jxnpjhh.exe19⤵
- Executes dropped EXE
PID:860 -
\??\c:\pdlbbl.exec:\pdlbbl.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dhlhhjh.exec:\dhlhhjh.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxjjvnp.exec:\xxjjvnp.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xnhlbpd.exec:\xnhlbpd.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xnvxrfd.exec:\xnvxrfd.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lrrtf.exec:\lrrtf.exe25⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pbpphn.exec:\pbpphn.exe26⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fjvtn.exec:\fjvtn.exe27⤵
- Executes dropped EXE
PID:592 -
\??\c:\bdfrt.exec:\bdfrt.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnjxbnv.exec:\tnjxbnv.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jdfnh.exec:\jdfnh.exe30⤵
- Executes dropped EXE
PID:776 -
\??\c:\pdpdfv.exec:\pdpdfv.exe31⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jhjfb.exec:\jhjfb.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nrhvn.exec:\nrhvn.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tfrbj.exec:\tfrbj.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ftlrnhb.exec:\ftlrnhb.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pbrjf.exec:\pbrjf.exe36⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vpvvl.exec:\vpvvl.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vpxxb.exec:\vpxxb.exe38⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xvvnp.exec:\xvvnp.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nvrnvjf.exec:\nvrnvjf.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jxxdnpl.exec:\jxxdnpl.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dptnxb.exec:\dptnxb.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rnndj.exec:\rnndj.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bptnp.exec:\bptnp.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pltdb.exec:\pltdb.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dbvvb.exec:\dbvvb.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lhhjdb.exec:\lhhjdb.exe47⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vjltt.exec:\vjltt.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jxdnd.exec:\jxdnd.exe49⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ljlntp.exec:\ljlntp.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvbtpjh.exec:\vvbtpjh.exe51⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ljpptpn.exec:\ljpptpn.exe52⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bttljvv.exec:\bttljvv.exe53⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rxffx.exec:\rxffx.exe54⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lvvfjxd.exec:\lvvfjxd.exe55⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nrjxl.exec:\nrjxl.exe56⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bltlpx.exec:\bltlpx.exe57⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vdxptr.exec:\vdxptr.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xtrfjj.exec:\xtrfjj.exe59⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjrtj.exec:\jjrtj.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rxfbd.exec:\rxfbd.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\brnpbpp.exec:\brnpbpp.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jhpvxpn.exec:\jhpvxpn.exe63⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frnnfhx.exec:\frnnfhx.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lxxhbdn.exec:\lxxhbdn.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dfrhplx.exec:\dfrhplx.exe66⤵PID:1540
-
\??\c:\jppbj.exec:\jppbj.exe67⤵PID:1208
-
\??\c:\pxjtdrn.exec:\pxjtdrn.exe68⤵PID:1752
-
\??\c:\dtjhfl.exec:\dtjhfl.exe69⤵PID:2420
-
\??\c:\nbxvjpf.exec:\nbxvjpf.exe70⤵PID:936
-
\??\c:\jbnjnbh.exec:\jbnjnbh.exe71⤵PID:584
-
\??\c:\xhxjjv.exec:\xhxjjv.exe72⤵PID:2444
-
\??\c:\nhvfjn.exec:\nhvfjn.exe73⤵PID:1012
-
\??\c:\hxlbp.exec:\hxlbp.exe74⤵PID:1312
-
\??\c:\xbxhhhd.exec:\xbxhhhd.exe75⤵PID:1732
-
\??\c:\ldplj.exec:\ldplj.exe76⤵PID:1120
-
\??\c:\tlrvhn.exec:\tlrvhn.exe77⤵PID:1600
-
\??\c:\djxfpjv.exec:\djxfpjv.exe78⤵PID:2104
-
\??\c:\phtbvnt.exec:\phtbvnt.exe79⤵PID:2164
-
\??\c:\lnbxj.exec:\lnbxj.exe80⤵PID:2456
-
\??\c:\jtjxj.exec:\jtjxj.exe81⤵PID:2412
-
\??\c:\brpvd.exec:\brpvd.exe82⤵PID:2888
-
\??\c:\ntbnp.exec:\ntbnp.exe83⤵PID:2732
-
\??\c:\xfxtjv.exec:\xfxtjv.exe84⤵PID:3068
-
\??\c:\pnhffbb.exec:\pnhffbb.exe85⤵PID:952
-
\??\c:\dprjxx.exec:\dprjxx.exe86⤵PID:2808
-
\??\c:\jhxdp.exec:\jhxdp.exe87⤵PID:2636
-
\??\c:\vjdjbx.exec:\vjdjbx.exe88⤵PID:964
-
\??\c:\pflfrf.exec:\pflfrf.exe89⤵PID:2056
-
\??\c:\nlnbdj.exec:\nlnbdj.exe90⤵PID:2364
-
\??\c:\vtjxv.exec:\vtjxv.exe91⤵PID:2924
-
\??\c:\xdfhftd.exec:\xdfhftd.exe92⤵PID:2976
-
\??\c:\nrrbhrj.exec:\nrrbhrj.exe93⤵PID:2968
-
\??\c:\hllft.exec:\hllft.exe94⤵PID:3008
-
\??\c:\fjjbd.exec:\fjjbd.exe95⤵PID:2852
-
\??\c:\nphdt.exec:\nphdt.exe96⤵PID:2956
-
\??\c:\vnnpdjr.exec:\vnnpdjr.exe97⤵PID:1248
-
\??\c:\jlhtf.exec:\jlhtf.exe98⤵PID:1360
-
\??\c:\pfhltp.exec:\pfhltp.exe99⤵PID:1632
-
\??\c:\dbbffvn.exec:\dbbffvn.exe100⤵PID:2324
-
\??\c:\prbprvp.exec:\prbprvp.exe101⤵PID:2464
-
\??\c:\bhtpprb.exec:\bhtpprb.exe102⤵PID:2216
-
\??\c:\hhhptfh.exec:\hhhptfh.exe103⤵PID:2584
-
\??\c:\djxjjj.exec:\djxjjj.exe104⤵PID:1412
-
\??\c:\njbbfb.exec:\njbbfb.exe105⤵PID:2152
-
\??\c:\njfndnf.exec:\njfndnf.exe106⤵PID:2288
-
\??\c:\ptnbllf.exec:\ptnbllf.exe107⤵PID:1616
-
\??\c:\vjvndp.exec:\vjvndp.exe108⤵PID:1668
-
\??\c:\hrvvrt.exec:\hrvvrt.exe109⤵PID:1380
-
\??\c:\txbnd.exec:\txbnd.exe110⤵PID:1296
-
\??\c:\hxfnf.exec:\hxfnf.exe111⤵PID:1684
-
\??\c:\rfpbp.exec:\rfpbp.exe112⤵PID:1208
-
\??\c:\xhnvnr.exec:\xhnvnr.exe113⤵PID:2044
-
\??\c:\pxbtr.exec:\pxbtr.exe114⤵PID:2420
-
\??\c:\ndnfrld.exec:\ndnfrld.exe115⤵PID:3056
-
\??\c:\fvldn.exec:\fvldn.exe116⤵PID:2452
-
\??\c:\jbrvtd.exec:\jbrvtd.exe117⤵PID:816
-
\??\c:\dthlh.exec:\dthlh.exe118⤵PID:2280
-
\??\c:\jnbxx.exec:\jnbxx.exe119⤵PID:2180
-
\??\c:\pnpnjhr.exec:\pnpnjhr.exe120⤵PID:1072
-
\??\c:\rjffdn.exec:\rjffdn.exe121⤵PID:1768
-
\??\c:\xltfrbf.exec:\xltfrbf.exe122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-