Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 11:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba263b5510097e7131341ad4a1aa5770N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
ba263b5510097e7131341ad4a1aa5770N.exe
-
Size
411KB
-
MD5
ba263b5510097e7131341ad4a1aa5770
-
SHA1
ca5a3f86aaf15f34d052362923faa1416e9d4acc
-
SHA256
66a32ca5e5e746a11ffc4aceac32c26500d08a17ddb728ee864dd50267f72441
-
SHA512
a0916adac105cfc96a2fde7ad2f02ff176b0ff92069f59485e0801a3ef7cfc81468049949c31902fd09d9e56d52953d2cd3b9f39ae031b0814033740c673ccc2
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1BwcZN:Pcm7ImGddXtWrXD486jJq1BwcZN
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2444-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-254-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/1852-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-253-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/1032-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-297-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2300-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-406-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2716-426-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1480-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-455-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1088-462-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-461-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1088-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-488-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1372-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-524-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-588-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1956-607-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1068-736-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 jdrhlf.exe 2284 tddfn.exe 596 lbjjrlp.exe 3060 nhdll.exe 2736 tjlpj.exe 2532 xnhthp.exe 2828 ffhhtn.exe 2460 xvhtbr.exe 2568 ptbbnlp.exe 2156 dhrvjnt.exe 1788 djblxxx.exe 2624 hjdvj.exe 2864 vvrhffb.exe 1652 hbprfb.exe 1504 ttnnr.exe 2232 jlxvnv.exe 1396 nppdvlr.exe 1272 xjjjnl.exe 1632 txxfnfl.exe 1328 hhdllxd.exe 2336 dffbth.exe 2932 fjlbr.exe 1436 dbldnl.exe 1772 tfrbld.exe 1320 vhdfjl.exe 1852 rflxb.exe 2128 tjlffxr.exe 3052 nlnnb.exe 1032 ppvjp.exe 1324 ddjxndj.exe 3068 dxrtx.exe 1608 hffdf.exe 2964 nbddv.exe 2472 dfjlnbb.exe 2300 nlvpxpn.exe 1936 dnxxbn.exe 3044 prfvlp.exe 2800 brrxlxn.exe 1256 vldvll.exe 2760 xpvbbj.exe 2676 vdhplr.exe 2688 rxblpnb.exe 2548 dxpvdp.exe 2696 jlfdlxv.exe 2700 bfhblh.exe 2648 ndlbhb.exe 2568 dtblv.exe 2156 dbrld.exe 2844 jhjpf.exe 2716 xtjbr.exe 2856 rptrr.exe 1068 trrbdxl.exe 2408 vfvhtbv.exe 1480 ntxpbnj.exe 1992 dtdlvt.exe 1088 djxhdr.exe 2512 hltjhnx.exe 1684 hfjnffr.exe 2340 tpfllht.exe 1372 rjbhd.exe 2216 ldbljh.exe 2492 pdxrtxv.exe 2200 tlrhll.exe 1084 lltpndp.exe -
resource yara_rule behavioral1/memory/2444-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-297-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2472-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-436-0x0000000000250000-0x0000000000279000-memory.dmp upx behavioral1/memory/1480-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-455-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1088-462-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-524-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-533-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-540-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-622-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-656-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2688-669-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-719-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-736-0x0000000000220000-0x0000000000249000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1952 2444 ba263b5510097e7131341ad4a1aa5770N.exe 28 PID 2444 wrote to memory of 1952 2444 ba263b5510097e7131341ad4a1aa5770N.exe 28 PID 2444 wrote to memory of 1952 2444 ba263b5510097e7131341ad4a1aa5770N.exe 28 PID 2444 wrote to memory of 1952 2444 ba263b5510097e7131341ad4a1aa5770N.exe 28 PID 1952 wrote to memory of 2284 1952 jdrhlf.exe 29 PID 1952 wrote to memory of 2284 1952 jdrhlf.exe 29 PID 1952 wrote to memory of 2284 1952 jdrhlf.exe 29 PID 1952 wrote to memory of 2284 1952 jdrhlf.exe 29 PID 2284 wrote to memory of 596 2284 tddfn.exe 30 PID 2284 wrote to memory of 596 2284 tddfn.exe 30 PID 2284 wrote to memory of 596 2284 tddfn.exe 30 PID 2284 wrote to memory of 596 2284 tddfn.exe 30 PID 596 wrote to memory of 3060 596 lbjjrlp.exe 31 PID 596 wrote to memory of 3060 596 lbjjrlp.exe 31 PID 596 wrote to memory of 3060 596 lbjjrlp.exe 31 PID 596 wrote to memory of 3060 596 lbjjrlp.exe 31 PID 3060 wrote to memory of 2736 3060 nhdll.exe 32 PID 3060 wrote to memory of 2736 3060 nhdll.exe 32 PID 3060 wrote to memory of 2736 3060 nhdll.exe 32 PID 3060 wrote to memory of 2736 3060 nhdll.exe 32 PID 2736 wrote to memory of 2532 2736 tjlpj.exe 33 PID 2736 wrote to memory of 2532 2736 tjlpj.exe 33 PID 2736 wrote to memory of 2532 2736 tjlpj.exe 33 PID 2736 wrote to memory of 2532 2736 tjlpj.exe 33 PID 2532 wrote to memory of 2828 2532 xnhthp.exe 34 PID 2532 wrote to memory of 2828 2532 xnhthp.exe 34 PID 2532 wrote to memory of 2828 2532 xnhthp.exe 34 PID 2532 wrote to memory of 2828 2532 xnhthp.exe 34 PID 2828 wrote to memory of 2460 2828 ffhhtn.exe 35 PID 2828 wrote to memory of 2460 2828 ffhhtn.exe 35 PID 2828 wrote to memory of 2460 2828 ffhhtn.exe 35 PID 2828 wrote to memory of 2460 2828 ffhhtn.exe 35 PID 2460 wrote to memory of 2568 2460 xvhtbr.exe 36 PID 2460 wrote to memory of 2568 2460 xvhtbr.exe 36 PID 2460 wrote to memory of 2568 2460 xvhtbr.exe 36 PID 2460 wrote to memory of 2568 2460 xvhtbr.exe 36 PID 2568 wrote to memory of 2156 2568 ptbbnlp.exe 37 PID 2568 wrote to memory of 2156 2568 ptbbnlp.exe 37 PID 2568 wrote to memory of 2156 2568 ptbbnlp.exe 37 PID 2568 wrote to memory of 2156 2568 ptbbnlp.exe 37 PID 2156 wrote to memory of 1788 2156 dhrvjnt.exe 38 PID 2156 wrote to memory of 1788 2156 dhrvjnt.exe 38 PID 2156 wrote to memory of 1788 2156 dhrvjnt.exe 38 PID 2156 wrote to memory of 1788 2156 dhrvjnt.exe 38 PID 1788 wrote to memory of 2624 1788 djblxxx.exe 39 PID 1788 wrote to memory of 2624 1788 djblxxx.exe 39 PID 1788 wrote to memory of 2624 1788 djblxxx.exe 39 PID 1788 wrote to memory of 2624 1788 djblxxx.exe 39 PID 2624 wrote to memory of 2864 2624 hjdvj.exe 40 PID 2624 wrote to memory of 2864 2624 hjdvj.exe 40 PID 2624 wrote to memory of 2864 2624 hjdvj.exe 40 PID 2624 wrote to memory of 2864 2624 hjdvj.exe 40 PID 2864 wrote to memory of 1652 2864 vvrhffb.exe 41 PID 2864 wrote to memory of 1652 2864 vvrhffb.exe 41 PID 2864 wrote to memory of 1652 2864 vvrhffb.exe 41 PID 2864 wrote to memory of 1652 2864 vvrhffb.exe 41 PID 1652 wrote to memory of 1504 1652 hbprfb.exe 42 PID 1652 wrote to memory of 1504 1652 hbprfb.exe 42 PID 1652 wrote to memory of 1504 1652 hbprfb.exe 42 PID 1652 wrote to memory of 1504 1652 hbprfb.exe 42 PID 1504 wrote to memory of 2232 1504 ttnnr.exe 43 PID 1504 wrote to memory of 2232 1504 ttnnr.exe 43 PID 1504 wrote to memory of 2232 1504 ttnnr.exe 43 PID 1504 wrote to memory of 2232 1504 ttnnr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba263b5510097e7131341ad4a1aa5770N.exe"C:\Users\Admin\AppData\Local\Temp\ba263b5510097e7131341ad4a1aa5770N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jdrhlf.exec:\jdrhlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\tddfn.exec:\tddfn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\lbjjrlp.exec:\lbjjrlp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\nhdll.exec:\nhdll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tjlpj.exec:\tjlpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xnhthp.exec:\xnhthp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ffhhtn.exec:\ffhhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xvhtbr.exec:\xvhtbr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\ptbbnlp.exec:\ptbbnlp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\dhrvjnt.exec:\dhrvjnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\djblxxx.exec:\djblxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\hjdvj.exec:\hjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vvrhffb.exec:\vvrhffb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hbprfb.exec:\hbprfb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\ttnnr.exec:\ttnnr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\jlxvnv.exec:\jlxvnv.exe17⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nppdvlr.exec:\nppdvlr.exe18⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xjjjnl.exec:\xjjjnl.exe19⤵
- Executes dropped EXE
PID:1272 -
\??\c:\txxfnfl.exec:\txxfnfl.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhdllxd.exec:\hhdllxd.exe21⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dffbth.exec:\dffbth.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fjlbr.exec:\fjlbr.exe23⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dbldnl.exec:\dbldnl.exe24⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tfrbld.exec:\tfrbld.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vhdfjl.exec:\vhdfjl.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rflxb.exec:\rflxb.exe27⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tjlffxr.exec:\tjlffxr.exe28⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nlnnb.exec:\nlnnb.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppvjp.exec:\ppvjp.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ddjxndj.exec:\ddjxndj.exe31⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dxrtx.exec:\dxrtx.exe32⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hffdf.exec:\hffdf.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nbddv.exec:\nbddv.exe34⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dfjlnbb.exec:\dfjlnbb.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nlvpxpn.exec:\nlvpxpn.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dnxxbn.exec:\dnxxbn.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\prfvlp.exec:\prfvlp.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\brrxlxn.exec:\brrxlxn.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vldvll.exec:\vldvll.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xpvbbj.exec:\xpvbbj.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vdhplr.exec:\vdhplr.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rxblpnb.exec:\rxblpnb.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dxpvdp.exec:\dxpvdp.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jlfdlxv.exec:\jlfdlxv.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bfhblh.exec:\bfhblh.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ndlbhb.exec:\ndlbhb.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dtblv.exec:\dtblv.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dbrld.exec:\dbrld.exe49⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jhjpf.exec:\jhjpf.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xtjbr.exec:\xtjbr.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rptrr.exec:\rptrr.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\trrbdxl.exec:\trrbdxl.exe53⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vfvhtbv.exec:\vfvhtbv.exe54⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ntxpbnj.exec:\ntxpbnj.exe55⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dtdlvt.exec:\dtdlvt.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\djxhdr.exec:\djxhdr.exe57⤵
- Executes dropped EXE
PID:1088 -
\??\c:\hltjhnx.exec:\hltjhnx.exe58⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hfjnffr.exec:\hfjnffr.exe59⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tpfllht.exec:\tpfllht.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rjbhd.exec:\rjbhd.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ldbljh.exec:\ldbljh.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pdxrtxv.exec:\pdxrtxv.exe63⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tlrhll.exec:\tlrhll.exe64⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lltpndp.exec:\lltpndp.exe65⤵
- Executes dropped EXE
PID:1084 -
\??\c:\txlbn.exec:\txlbn.exe66⤵PID:2084
-
\??\c:\dlrrf.exec:\dlrrf.exe67⤵PID:1804
-
\??\c:\dpxtj.exec:\dpxtj.exe68⤵PID:1100
-
\??\c:\bpfrdvb.exec:\bpfrdvb.exe69⤵PID:1200
-
\??\c:\hdlll.exec:\hdlll.exe70⤵PID:1736
-
\??\c:\ljlrj.exec:\ljlrj.exe71⤵PID:272
-
\??\c:\nblhrdb.exec:\nblhrdb.exe72⤵PID:1040
-
\??\c:\rvhth.exec:\rvhth.exe73⤵PID:2204
-
\??\c:\ttdpfrr.exec:\ttdpfrr.exe74⤵PID:3028
-
\??\c:\rtfvpt.exec:\rtfvpt.exe75⤵PID:3048
-
\??\c:\ddxjfl.exec:\ddxjfl.exe76⤵PID:2432
-
\??\c:\fjltx.exec:\fjltx.exe77⤵PID:1956
-
\??\c:\ddvfbhl.exec:\ddvfbhl.exe78⤵PID:2484
-
\??\c:\pjlxl.exec:\pjlxl.exe79⤵PID:1948
-
\??\c:\lpjrxt.exec:\lpjrxt.exe80⤵PID:2284
-
\??\c:\jbrrx.exec:\jbrrx.exe81⤵PID:1936
-
\??\c:\brllxpt.exec:\brllxpt.exe82⤵PID:3044
-
\??\c:\nddrbt.exec:\nddrbt.exe83⤵PID:2800
-
\??\c:\drntpv.exec:\drntpv.exe84⤵PID:1256
-
\??\c:\drxjlfb.exec:\drxjlfb.exe85⤵PID:2788
-
\??\c:\nbdndn.exec:\nbdndn.exe86⤵PID:1036
-
\??\c:\flflxx.exec:\flflxx.exe87⤵PID:2688
-
\??\c:\jlrtlv.exec:\jlrtlv.exe88⤵PID:2640
-
\??\c:\nftjhph.exec:\nftjhph.exe89⤵PID:2540
-
\??\c:\dfptxp.exec:\dfptxp.exe90⤵PID:2544
-
\??\c:\tnfphv.exec:\tnfphv.exe91⤵PID:1892
-
\??\c:\rtvth.exec:\rtvth.exe92⤵PID:1884
-
\??\c:\nthnlb.exec:\nthnlb.exe93⤵PID:2220
-
\??\c:\xdbbf.exec:\xdbbf.exe94⤵PID:2844
-
\??\c:\rndvddl.exec:\rndvddl.exe95⤵PID:2716
-
\??\c:\fnltn.exec:\fnltn.exe96⤵PID:2856
-
\??\c:\ltftfd.exec:\ltftfd.exe97⤵PID:1068
-
\??\c:\hjtfvp.exec:\hjtfvp.exe98⤵PID:1964
-
\??\c:\blvhfh.exec:\blvhfh.exe99⤵PID:1612
-
\??\c:\jltpph.exec:\jltpph.exe100⤵PID:1496
-
\??\c:\rbdfb.exec:\rbdfb.exe101⤵PID:2852
-
\??\c:\rrvxt.exec:\rrvxt.exe102⤵PID:2060
-
\??\c:\ddjtjjx.exec:\ddjtjjx.exe103⤵PID:1692
-
\??\c:\dpthnp.exec:\dpthnp.exe104⤵PID:1776
-
\??\c:\hhjbht.exec:\hhjbht.exe105⤵PID:1372
-
\??\c:\ffnpp.exec:\ffnpp.exe106⤵PID:2940
-
\??\c:\pbnhpr.exec:\pbnhpr.exe107⤵PID:2928
-
\??\c:\dntrbr.exec:\dntrbr.exe108⤵PID:1332
-
\??\c:\rfxnhnj.exec:\rfxnhnj.exe109⤵PID:1436
-
\??\c:\ldnprn.exec:\ldnprn.exe110⤵PID:2180
-
\??\c:\bpnxrvp.exec:\bpnxrvp.exe111⤵PID:2424
-
\??\c:\nvpbvrh.exec:\nvpbvrh.exe112⤵PID:2096
-
\??\c:\xvbpvf.exec:\xvbpvf.exe113⤵PID:236
-
\??\c:\vprttlx.exec:\vprttlx.exe114⤵PID:2496
-
\??\c:\xbdrnfx.exec:\xbdrnfx.exe115⤵PID:1760
-
\??\c:\jrbtxt.exec:\jrbtxt.exe116⤵PID:924
-
\??\c:\rxrpl.exec:\rxrpl.exe117⤵PID:1040
-
\??\c:\xbfbbfn.exec:\xbfbbfn.exe118⤵PID:2204
-
\??\c:\fbfdh.exec:\fbfdh.exe119⤵PID:3028
-
\??\c:\nffnd.exec:\nffnd.exe120⤵PID:768
-
\??\c:\hnxxx.exec:\hnxxx.exe121⤵PID:888
-
\??\c:\drfld.exec:\drfld.exe122⤵PID:2964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-