Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a78961125ba475b29dcf408ce33cf38.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
5a78961125ba475b29dcf408ce33cf38.exe
-
Size
66KB
-
MD5
5a78961125ba475b29dcf408ce33cf38
-
SHA1
2eb6b3f980766baedc4f62a23efee7716e1edb76
-
SHA256
53ea18ee11da0d4c60509174a9c09f6eb93a2d634568758345538721883b6ba3
-
SHA512
c4dbab8c5dcc88eef5135b235ca663858cac2f222d8ab63b5e1fa2de861947c89bd0bb89758ed69655c5242447e4975cba87ff5a71b3e9587374c5782fe1e8b5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qjH4f:ymb3NkkiQ3mdBjFIj+qjH4f
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2348-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-518-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-558-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-580-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-637-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-653-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-668-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-698-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2444 vvdvd.exe 3068 vpddp.exe 2216 rxfllxr.exe 2624 3ppvv.exe 2712 xlrllfx.exe 2488 jdjjd.exe 2704 fxrfrrx.exe 2780 jddjp.exe 2552 xxrxfrr.exe 1796 jvddj.exe 320 hbhhnn.exe 1220 9jvvd.exe 1312 3jpvv.exe 1640 jdppv.exe 1184 tbnnhh.exe 1776 1nhhnn.exe 2996 5dvpd.exe 2032 pdppv.exe 2188 rrlxlrf.exe 552 fxrxxxf.exe 588 tnbbtb.exe 108 bbhhnt.exe 1968 hbthbb.exe 2300 nhnhtt.exe 1496 3lflrxx.exe 1628 5btbhh.exe 2260 hnbbnh.exe 1196 7btbnt.exe 1224 hbhbnh.exe 2900 3fflfrf.exe 688 btbtnt.exe 1808 nntbnn.exe 2412 5vpjv.exe 2208 nntbnn.exe 1992 hhbhnb.exe 1616 9nhhhh.exe 3068 fxrfrxf.exe 2708 ffxxflr.exe 2608 vpjdp.exe 2612 5bntbh.exe 2752 tnhnhn.exe 2680 9xxxrrx.exe 2704 xxrxlrf.exe 2500 vpvdp.exe 884 httbhn.exe 2980 rfxxllr.exe 2568 jjdpv.exe 1492 xrrxflx.exe 1568 7ntbnt.exe 1448 xrllxrx.exe 2700 ttbntt.exe 1172 5fxrxrx.exe 2992 nbhhtb.exe 2144 pjpdj.exe 2996 ddvdj.exe 1832 rllflrf.exe 1256 3nhhbt.exe 288 9jdjv.exe 1824 bthttt.exe 604 vvpdj.exe 1064 nthbbh.exe 1676 pjdvd.exe 1320 7tnntt.exe 1752 pvvpv.exe -
resource yara_rule behavioral1/memory/2348-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-410-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-426-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-444-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-458-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-518-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-580-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-610-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-637-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-636-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-653-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-652-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-668-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-683-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-698-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-713-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-757-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-772-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-830-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-845-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-875-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-890-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2444 2348 5a78961125ba475b29dcf408ce33cf38.exe 28 PID 2348 wrote to memory of 2444 2348 5a78961125ba475b29dcf408ce33cf38.exe 28 PID 2348 wrote to memory of 2444 2348 5a78961125ba475b29dcf408ce33cf38.exe 28 PID 2348 wrote to memory of 2444 2348 5a78961125ba475b29dcf408ce33cf38.exe 28 PID 2444 wrote to memory of 3068 2444 vvdvd.exe 29 PID 2444 wrote to memory of 3068 2444 vvdvd.exe 29 PID 2444 wrote to memory of 3068 2444 vvdvd.exe 29 PID 2444 wrote to memory of 3068 2444 vvdvd.exe 29 PID 3068 wrote to memory of 2216 3068 vpddp.exe 30 PID 3068 wrote to memory of 2216 3068 vpddp.exe 30 PID 3068 wrote to memory of 2216 3068 vpddp.exe 30 PID 3068 wrote to memory of 2216 3068 vpddp.exe 30 PID 2216 wrote to memory of 2624 2216 rxfllxr.exe 31 PID 2216 wrote to memory of 2624 2216 rxfllxr.exe 31 PID 2216 wrote to memory of 2624 2216 rxfllxr.exe 31 PID 2216 wrote to memory of 2624 2216 rxfllxr.exe 31 PID 2624 wrote to memory of 2712 2624 3ppvv.exe 32 PID 2624 wrote to memory of 2712 2624 3ppvv.exe 32 PID 2624 wrote to memory of 2712 2624 3ppvv.exe 32 PID 2624 wrote to memory of 2712 2624 3ppvv.exe 32 PID 2712 wrote to memory of 2488 2712 xlrllfx.exe 33 PID 2712 wrote to memory of 2488 2712 xlrllfx.exe 33 PID 2712 wrote to memory of 2488 2712 xlrllfx.exe 33 PID 2712 wrote to memory of 2488 2712 xlrllfx.exe 33 PID 2488 wrote to memory of 2704 2488 jdjjd.exe 34 PID 2488 wrote to memory of 2704 2488 jdjjd.exe 34 PID 2488 wrote to memory of 2704 2488 jdjjd.exe 34 PID 2488 wrote to memory of 2704 2488 jdjjd.exe 34 PID 2704 wrote to memory of 2780 2704 fxrfrrx.exe 35 PID 2704 wrote to memory of 2780 2704 fxrfrrx.exe 35 PID 2704 wrote to memory of 2780 2704 fxrfrrx.exe 35 PID 2704 wrote to memory of 2780 2704 fxrfrrx.exe 35 PID 2780 wrote to memory of 2552 2780 jddjp.exe 36 PID 2780 wrote to memory of 2552 2780 jddjp.exe 36 PID 2780 wrote to memory of 2552 2780 jddjp.exe 36 PID 2780 wrote to memory of 2552 2780 jddjp.exe 36 PID 2552 wrote to memory of 1796 2552 xxrxfrr.exe 37 PID 2552 wrote to memory of 1796 2552 xxrxfrr.exe 37 PID 2552 wrote to memory of 1796 2552 xxrxfrr.exe 37 PID 2552 wrote to memory of 1796 2552 xxrxfrr.exe 37 PID 1796 wrote to memory of 320 1796 jvddj.exe 38 PID 1796 wrote to memory of 320 1796 jvddj.exe 38 PID 1796 wrote to memory of 320 1796 jvddj.exe 38 PID 1796 wrote to memory of 320 1796 jvddj.exe 38 PID 320 wrote to memory of 1220 320 hbhhnn.exe 39 PID 320 wrote to memory of 1220 320 hbhhnn.exe 39 PID 320 wrote to memory of 1220 320 hbhhnn.exe 39 PID 320 wrote to memory of 1220 320 hbhhnn.exe 39 PID 1220 wrote to memory of 1312 1220 9jvvd.exe 40 PID 1220 wrote to memory of 1312 1220 9jvvd.exe 40 PID 1220 wrote to memory of 1312 1220 9jvvd.exe 40 PID 1220 wrote to memory of 1312 1220 9jvvd.exe 40 PID 1312 wrote to memory of 1640 1312 3jpvv.exe 50 PID 1312 wrote to memory of 1640 1312 3jpvv.exe 50 PID 1312 wrote to memory of 1640 1312 3jpvv.exe 50 PID 1312 wrote to memory of 1640 1312 3jpvv.exe 50 PID 1640 wrote to memory of 1184 1640 jdppv.exe 41 PID 1640 wrote to memory of 1184 1640 jdppv.exe 41 PID 1640 wrote to memory of 1184 1640 jdppv.exe 41 PID 1640 wrote to memory of 1184 1640 jdppv.exe 41 PID 1184 wrote to memory of 1776 1184 tbnnhh.exe 42 PID 1184 wrote to memory of 1776 1184 tbnnhh.exe 42 PID 1184 wrote to memory of 1776 1184 tbnnhh.exe 42 PID 1184 wrote to memory of 1776 1184 tbnnhh.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a78961125ba475b29dcf408ce33cf38.exe"C:\Users\Admin\AppData\Local\Temp\5a78961125ba475b29dcf408ce33cf38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vvdvd.exec:\vvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vpddp.exec:\vpddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rxfllxr.exec:\rxfllxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\3ppvv.exec:\3ppvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xlrllfx.exec:\xlrllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jdjjd.exec:\jdjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jddjp.exec:\jddjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xxrxfrr.exec:\xxrxfrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jvddj.exec:\jvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\hbhhnn.exec:\hbhhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\9jvvd.exec:\9jvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\3jpvv.exec:\3jpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jdppv.exec:\jdppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\tbnnhh.exec:\tbnnhh.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\1nhhnn.exec:\1nhhnn.exe2⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5dvpd.exec:\5dvpd.exe3⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pdppv.exec:\pdppv.exe4⤵
- Executes dropped EXE
PID:2032
-
-
-
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe1⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe2⤵
- Executes dropped EXE
PID:552 -
\??\c:\tnbbtb.exec:\tnbbtb.exe3⤵
- Executes dropped EXE
PID:588 -
\??\c:\bbhhnt.exec:\bbhhnt.exe4⤵
- Executes dropped EXE
PID:108 -
\??\c:\hbthbb.exec:\hbthbb.exe5⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nhnhtt.exec:\nhnhtt.exe6⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3lflrxx.exec:\3lflrxx.exe7⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5btbhh.exec:\5btbhh.exe8⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hnbbnh.exec:\hnbbnh.exe9⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7btbnt.exec:\7btbnt.exe10⤵
- Executes dropped EXE
PID:1196 -
\??\c:\hbhbnh.exec:\hbhbnh.exe11⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3fflfrf.exec:\3fflfrf.exe12⤵
- Executes dropped EXE
PID:2900 -
\??\c:\btbtnt.exec:\btbtnt.exe13⤵
- Executes dropped EXE
PID:688 -
\??\c:\nntbnn.exec:\nntbnn.exe14⤵
- Executes dropped EXE
PID:1808 -
\??\c:\5vpjv.exec:\5vpjv.exe15⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nntbnn.exec:\nntbnn.exe16⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hhbhnb.exec:\hhbhnb.exe17⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9nhhhh.exec:\9nhhhh.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe19⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ffxxflr.exec:\ffxxflr.exe20⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vpjdp.exec:\vpjdp.exe21⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5bntbh.exec:\5bntbh.exe22⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnhnhn.exec:\tnhnhn.exe23⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9xxxrrx.exec:\9xxxrrx.exe24⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe25⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vpvdp.exec:\vpvdp.exe26⤵
- Executes dropped EXE
PID:2500 -
\??\c:\httbhn.exec:\httbhn.exe27⤵
- Executes dropped EXE
PID:884 -
\??\c:\rfxxllr.exec:\rfxxllr.exe28⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jjdpv.exec:\jjdpv.exe29⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrrxflx.exec:\xrrxflx.exe30⤵
- Executes dropped EXE
PID:1492 -
\??\c:\7ntbnt.exec:\7ntbnt.exe31⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xrllxrx.exec:\xrllxrx.exe32⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ttbntt.exec:\ttbntt.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5fxrxrx.exec:\5fxrxrx.exe34⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nbhhtb.exec:\nbhhtb.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pjpdj.exec:\pjpdj.exe36⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ddvdj.exec:\ddvdj.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rllflrf.exec:\rllflrf.exe38⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3nhhbt.exec:\3nhhbt.exe39⤵
- Executes dropped EXE
PID:1256 -
\??\c:\9jdjv.exec:\9jdjv.exe40⤵
- Executes dropped EXE
PID:288 -
\??\c:\bthttt.exec:\bthttt.exe41⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvpdj.exec:\vvpdj.exe42⤵
- Executes dropped EXE
PID:604 -
\??\c:\nthbbh.exec:\nthbbh.exe43⤵
- Executes dropped EXE
PID:1064 -
\??\c:\pjdvd.exec:\pjdvd.exe44⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7tnntt.exec:\7tnntt.exe45⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pvvpv.exec:\pvvpv.exe46⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vjppv.exec:\vjppv.exe47⤵PID:1436
-
\??\c:\hbhbnn.exec:\hbhbnn.exe48⤵PID:1792
-
\??\c:\1vjjp.exec:\1vjjp.exe49⤵PID:1148
-
\??\c:\rlffflx.exec:\rlffflx.exe50⤵PID:956
-
\??\c:\1hthnn.exec:\1hthnn.exe51⤵PID:2184
-
\??\c:\xxxrxrf.exec:\xxxrxrf.exe52⤵PID:2464
-
\??\c:\hhthbn.exec:\hhthbn.exe53⤵PID:1460
-
\??\c:\dvjpv.exec:\dvjpv.exe54⤵PID:888
-
\??\c:\bbthtt.exec:\bbthtt.exe55⤵PID:932
-
\??\c:\1btthb.exec:\1btthb.exe56⤵PID:1844
-
\??\c:\7vvdj.exec:\7vvdj.exe57⤵PID:1088
-
\??\c:\tnbnbb.exec:\tnbnbb.exe58⤵PID:2208
-
\??\c:\ppddv.exec:\ppddv.exe59⤵PID:1700
-
\??\c:\xxlxlrx.exec:\xxlxlrx.exe60⤵PID:2176
-
\??\c:\bbhthn.exec:\bbhthn.exe61⤵PID:2436
-
\??\c:\fxxlxlx.exec:\fxxlxlx.exe62⤵PID:2636
-
\??\c:\9bnbhb.exec:\9bnbhb.exe63⤵PID:2732
-
\??\c:\3fflxxl.exec:\3fflxxl.exe64⤵PID:2224
-
\??\c:\ttnhnb.exec:\ttnhnb.exe65⤵PID:2476
-
\??\c:\vjvdv.exec:\vjvdv.exe66⤵PID:2544
-
\??\c:\xxrfflr.exec:\xxrfflr.exe67⤵PID:2528
-
\??\c:\tnbhtn.exec:\tnbhtn.exe68⤵PID:2068
-
\??\c:\9rfxlrx.exec:\9rfxlrx.exe69⤵PID:1980
-
\??\c:\nhbtbh.exec:\nhbtbh.exe70⤵PID:2980
-
\??\c:\dvjdp.exec:\dvjdp.exe71⤵PID:1288
-
\??\c:\hbhhbh.exec:\hbhhbh.exe72⤵PID:1492
-
\??\c:\jjvdj.exec:\jjvdj.exe73⤵PID:1704
-
\??\c:\hhbnth.exec:\hhbnth.exe74⤵PID:2192
-
\??\c:\jdjvp.exec:\jdjvp.exe75⤵PID:2308
-
\??\c:\rllrrxl.exec:\rllrrxl.exe76⤵PID:3000
-
\??\c:\7tnhtb.exec:\7tnhtb.exe77⤵PID:3012
-
\??\c:\lfrxffr.exec:\lfrxffr.exe78⤵PID:1984
-
\??\c:\hhntbb.exec:\hhntbb.exe79⤵PID:2140
-
\??\c:\dvvdp.exec:\dvvdp.exe80⤵PID:2332
-
\??\c:\lfflrfr.exec:\lfflrfr.exe81⤵PID:668
-
\??\c:\3jpvp.exec:\3jpvp.exe82⤵PID:2124
-
\??\c:\xxflrxf.exec:\xxflrxf.exe83⤵PID:588
-
\??\c:\hbhhtt.exec:\hbhhtt.exe84⤵PID:1756
-
\??\c:\7jjpp.exec:\7jjpp.exe85⤵PID:1336
-
\??\c:\5frxrfr.exec:\5frxrfr.exe86⤵PID:1708
-
\??\c:\pdpdj.exec:\pdpdj.exe87⤵PID:948
-
\??\c:\1rlxflr.exec:\1rlxflr.exe88⤵PID:1548
-
\??\c:\hhhbnt.exec:\hhhbnt.exe89⤵PID:1748
-
\??\c:\ddjvj.exec:\ddjvj.exe90⤵PID:768
-
\??\c:\fxrxxff.exec:\fxrxxff.exe91⤵PID:2360
-
\??\c:\pjvdd.exec:\pjvdd.exe92⤵PID:1196
-
\??\c:\xrlllrf.exec:\xrlllrf.exe93⤵PID:2084
-
\??\c:\vjjvj.exec:\vjjvj.exe94⤵PID:1800
-
\??\c:\lxrllxf.exec:\lxrllxf.exe95⤵PID:2552
-
\??\c:\7pjpv.exec:\7pjpv.exe96⤵PID:2388
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe97⤵PID:2028
-
\??\c:\bnthbh.exec:\bnthbh.exe98⤵PID:2408
-
\??\c:\nnhntb.exec:\nnhntb.exe99⤵PID:2080
-
\??\c:\rlxlllr.exec:\rlxlllr.exe100⤵PID:1620
-
\??\c:\9tntth.exec:\9tntth.exe101⤵PID:3020
-
\??\c:\dpddp.exec:\dpddp.exe102⤵PID:2716
-
\??\c:\htbthh.exec:\htbthh.exe103⤵PID:2708
-
\??\c:\pddjv.exec:\pddjv.exe104⤵PID:2608
-
\??\c:\llrlrxf.exec:\llrlrxf.exe105⤵PID:2636
-
\??\c:\7bthhh.exec:\7bthhh.exe106⤵PID:2616
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe107⤵PID:2480
-
\??\c:\nnnthh.exec:\nnnthh.exe108⤵PID:2780
-
\??\c:\dvvpj.exec:\dvvpj.exe109⤵PID:2632
-
\??\c:\9rffllf.exec:\9rffllf.exe110⤵PID:1796
-
\??\c:\5bttnn.exec:\5bttnn.exe111⤵PID:2816
-
\??\c:\9rfxxfl.exec:\9rfxxfl.exe112⤵PID:1372
-
\??\c:\tbbbtb.exec:\tbbbtb.exe113⤵PID:1220
-
\??\c:\xxrfllx.exec:\xxrfllx.exe114⤵PID:2568
-
\??\c:\vdjvp.exec:\vdjvp.exe115⤵PID:2036
-
\??\c:\lfxflxl.exec:\lfxflxl.exe116⤵PID:1312
-
\??\c:\hthhtt.exec:\hthhtt.exe117⤵PID:2700
-
\??\c:\fflxlxl.exec:\fflxlxl.exe118⤵PID:3008
-
\??\c:\3hnntt.exec:\3hnntt.exe119⤵PID:2268
-
\??\c:\vvjdj.exec:\vvjdj.exe120⤵PID:2092
-
\??\c:\1xfflll.exec:\1xfflll.exe121⤵PID:2576
-
\??\c:\3vjpj.exec:\3vjpj.exe122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-