Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 02:04
Behavioral task
behavioral1
Sample
c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe
-
Size
424KB
-
MD5
b528fec4af832641128758aa11a969e7
-
SHA1
f9731ba919e3d015b7073db8a7a92541b67023f3
-
SHA256
c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33
-
SHA512
81832aa84caa02dbbc7965cbc52df3851d9faa5082385d816f90506cc12f81686c11ee76c88724273062453353f9ed79e0e5866bca5b8823cead81db64f7a21e
-
SSDEEP
12288:C4wFBh2F5BVzPSMh2F5BVzPSMh2F5BVzPS1:NL1ML1ML1m
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1648-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-43-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2672-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-152-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1788-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/388-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-243-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1252-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-817-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-919-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-1025-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2024-1304-0x0000000000320000-0x0000000000347000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2984 flxfrfr.exe 2632 dvddp.exe 2716 rxrxfxf.exe 2756 tttbnt.exe 2672 rlxfrrf.exe 2656 tnnbtt.exe 2484 ffxlrfl.exe 2412 hntnhb.exe 2968 fxxxrff.exe 2552 1hhtnb.exe 2796 9xrxxlf.exe 1284 nhbbhn.exe 2044 5ffrrxr.exe 2184 tnbnht.exe 2012 lxfxxlr.exe 1148 hhbnhb.exe 2176 llrfxff.exe 1788 ntnbbn.exe 2208 fxrxfrl.exe 2228 tthhtt.exe 1772 llxfxrl.exe 388 btnthh.exe 768 pjvjv.exe 408 xflflrl.exe 1220 lfrxffr.exe 1252 bbtbnt.exe 1296 llfrxfr.exe 2180 pdvvj.exe 2248 9xxflrl.exe 2068 dvjjd.exe 2448 7hbbhh.exe 1608 bbtntt.exe 2940 fxrxlrf.exe 2056 ntntbh.exe 1532 1pddp.exe 1044 llxflrl.exe 2692 lfxxfrf.exe 2688 ttntnt.exe 2724 5jpvd.exe 2876 xxrrflr.exe 2848 3tnnbb.exe 2544 dddvj.exe 2504 jjjdj.exe 2500 fxllrrx.exe 2548 nhtthh.exe 1584 dvpvj.exe 2972 7djpd.exe 1800 lffrfll.exe 2676 hbbhtt.exe 1928 jjvpj.exe 1272 ffrxffr.exe 2288 1rrrffl.exe 2420 hhtbnt.exe 2452 dvjpd.exe 2844 vvpdv.exe 1348 1rlrffr.exe 1032 bthhth.exe 1768 5jvdj.exe 2360 lfrxrlx.exe 2208 fxxlxfr.exe 760 hbtbhh.exe 1460 dvvjj.exe 676 ffxfllf.exe 2372 ttnbhn.exe -
resource yara_rule behavioral1/memory/1648-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000122ee-8.dat upx behavioral1/memory/1648-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0039000000013362-16.dat upx behavioral1/memory/2632-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000134f5-23.dat upx behavioral1/memory/2716-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000013a15-34.dat upx behavioral1/files/0x0008000000013a65-46.dat upx behavioral1/memory/2672-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000013a85-54.dat upx behavioral1/files/0x000a000000013b02-61.dat upx behavioral1/memory/2484-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001451d-72.dat upx behavioral1/files/0x0006000000014525-79.dat upx behavioral1/memory/2412-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000145c9-91.dat upx behavioral1/memory/2968-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000145d4-98.dat upx behavioral1/memory/2796-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000146a7-109.dat upx behavioral1/files/0x0006000000014730-116.dat upx behavioral1/memory/1284-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001474b-127.dat upx behavioral1/memory/2044-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2184-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001475f-134.dat upx behavioral1/files/0x003900000001340e-143.dat upx behavioral1/memory/2012-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000148af-156.dat upx behavioral1/files/0x0006000000014a29-163.dat upx behavioral1/files/0x0006000000014c0b-170.dat upx behavioral1/memory/1788-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014d0f-180.dat upx behavioral1/files/0x0006000000014fac-190.dat upx behavioral1/files/0x0006000000015077-198.dat upx behavioral1/memory/768-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000150aa-208.dat upx behavioral1/memory/388-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001523e-215.dat upx behavioral1/files/0x000600000001543a-225.dat upx behavioral1/files/0x00060000000155e8-233.dat upx behavioral1/memory/1252-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1252-242-0x00000000001C0000-0x00000000001E7000-memory.dmp upx behavioral1/memory/1252-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1296-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015a15-246.dat upx behavioral1/files/0x0006000000015b37-254.dat upx behavioral1/files/0x0006000000015b72-263.dat upx behavioral1/files/0x0006000000015bb5-271.dat upx behavioral1/memory/2068-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c91-282.dat upx behavioral1/files/0x0006000000015c9b-289.dat upx behavioral1/memory/1532-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-363-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-388-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2984 1648 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 28 PID 1648 wrote to memory of 2984 1648 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 28 PID 1648 wrote to memory of 2984 1648 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 28 PID 1648 wrote to memory of 2984 1648 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 28 PID 2984 wrote to memory of 2632 2984 flxfrfr.exe 29 PID 2984 wrote to memory of 2632 2984 flxfrfr.exe 29 PID 2984 wrote to memory of 2632 2984 flxfrfr.exe 29 PID 2984 wrote to memory of 2632 2984 flxfrfr.exe 29 PID 2632 wrote to memory of 2716 2632 dvddp.exe 30 PID 2632 wrote to memory of 2716 2632 dvddp.exe 30 PID 2632 wrote to memory of 2716 2632 dvddp.exe 30 PID 2632 wrote to memory of 2716 2632 dvddp.exe 30 PID 2716 wrote to memory of 2756 2716 rxrxfxf.exe 31 PID 2716 wrote to memory of 2756 2716 rxrxfxf.exe 31 PID 2716 wrote to memory of 2756 2716 rxrxfxf.exe 31 PID 2716 wrote to memory of 2756 2716 rxrxfxf.exe 31 PID 2756 wrote to memory of 2672 2756 tttbnt.exe 32 PID 2756 wrote to memory of 2672 2756 tttbnt.exe 32 PID 2756 wrote to memory of 2672 2756 tttbnt.exe 32 PID 2756 wrote to memory of 2672 2756 tttbnt.exe 32 PID 2672 wrote to memory of 2656 2672 rlxfrrf.exe 33 PID 2672 wrote to memory of 2656 2672 rlxfrrf.exe 33 PID 2672 wrote to memory of 2656 2672 rlxfrrf.exe 33 PID 2672 wrote to memory of 2656 2672 rlxfrrf.exe 33 PID 2656 wrote to memory of 2484 2656 tnnbtt.exe 34 PID 2656 wrote to memory of 2484 2656 tnnbtt.exe 34 PID 2656 wrote to memory of 2484 2656 tnnbtt.exe 34 PID 2656 wrote to memory of 2484 2656 tnnbtt.exe 34 PID 2484 wrote to memory of 2412 2484 ffxlrfl.exe 35 PID 2484 wrote to memory of 2412 2484 ffxlrfl.exe 35 PID 2484 wrote to memory of 2412 2484 ffxlrfl.exe 35 PID 2484 wrote to memory of 2412 2484 ffxlrfl.exe 35 PID 2412 wrote to memory of 2968 2412 hntnhb.exe 36 PID 2412 wrote to memory of 2968 2412 hntnhb.exe 36 PID 2412 wrote to memory of 2968 2412 hntnhb.exe 36 PID 2412 wrote to memory of 2968 2412 hntnhb.exe 36 PID 2968 wrote to memory of 2552 2968 fxxxrff.exe 37 PID 2968 wrote to memory of 2552 2968 fxxxrff.exe 37 PID 2968 wrote to memory of 2552 2968 fxxxrff.exe 37 PID 2968 wrote to memory of 2552 2968 fxxxrff.exe 37 PID 2552 wrote to memory of 2796 2552 1hhtnb.exe 38 PID 2552 wrote to memory of 2796 2552 1hhtnb.exe 38 PID 2552 wrote to memory of 2796 2552 1hhtnb.exe 38 PID 2552 wrote to memory of 2796 2552 1hhtnb.exe 38 PID 2796 wrote to memory of 1284 2796 9xrxxlf.exe 39 PID 2796 wrote to memory of 1284 2796 9xrxxlf.exe 39 PID 2796 wrote to memory of 1284 2796 9xrxxlf.exe 39 PID 2796 wrote to memory of 1284 2796 9xrxxlf.exe 39 PID 1284 wrote to memory of 2044 1284 nhbbhn.exe 40 PID 1284 wrote to memory of 2044 1284 nhbbhn.exe 40 PID 1284 wrote to memory of 2044 1284 nhbbhn.exe 40 PID 1284 wrote to memory of 2044 1284 nhbbhn.exe 40 PID 2044 wrote to memory of 2184 2044 5ffrrxr.exe 41 PID 2044 wrote to memory of 2184 2044 5ffrrxr.exe 41 PID 2044 wrote to memory of 2184 2044 5ffrrxr.exe 41 PID 2044 wrote to memory of 2184 2044 5ffrrxr.exe 41 PID 2184 wrote to memory of 2012 2184 tnbnht.exe 42 PID 2184 wrote to memory of 2012 2184 tnbnht.exe 42 PID 2184 wrote to memory of 2012 2184 tnbnht.exe 42 PID 2184 wrote to memory of 2012 2184 tnbnht.exe 42 PID 2012 wrote to memory of 1148 2012 lxfxxlr.exe 43 PID 2012 wrote to memory of 1148 2012 lxfxxlr.exe 43 PID 2012 wrote to memory of 1148 2012 lxfxxlr.exe 43 PID 2012 wrote to memory of 1148 2012 lxfxxlr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe"C:\Users\Admin\AppData\Local\Temp\c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\flxfrfr.exec:\flxfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\dvddp.exec:\dvddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rxrxfxf.exec:\rxrxfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\tttbnt.exec:\tttbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tnnbtt.exec:\tnnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ffxlrfl.exec:\ffxlrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\hntnhb.exec:\hntnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\fxxxrff.exec:\fxxxrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1hhtnb.exec:\1hhtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\9xrxxlf.exec:\9xrxxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nhbbhn.exec:\nhbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\5ffrrxr.exec:\5ffrrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\tnbnht.exec:\tnbnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\lxfxxlr.exec:\lxfxxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hhbnhb.exec:\hhbnhb.exe17⤵
- Executes dropped EXE
PID:1148 -
\??\c:\llrfxff.exec:\llrfxff.exe18⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ntnbbn.exec:\ntnbbn.exe19⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxrxfrl.exec:\fxrxfrl.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\tthhtt.exec:\tthhtt.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\llxfxrl.exec:\llxfxrl.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\btnthh.exec:\btnthh.exe23⤵
- Executes dropped EXE
PID:388 -
\??\c:\pjvjv.exec:\pjvjv.exe24⤵
- Executes dropped EXE
PID:768 -
\??\c:\xflflrl.exec:\xflflrl.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\lfrxffr.exec:\lfrxffr.exe26⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bbtbnt.exec:\bbtbnt.exe27⤵
- Executes dropped EXE
PID:1252 -
\??\c:\llfrxfr.exec:\llfrxfr.exe28⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pdvvj.exec:\pdvvj.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9xxflrl.exec:\9xxflrl.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvjjd.exec:\dvjjd.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7hbbhh.exec:\7hbbhh.exe32⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbtntt.exec:\bbtntt.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe34⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ntntbh.exec:\ntntbh.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1pddp.exec:\1pddp.exe36⤵
- Executes dropped EXE
PID:1532 -
\??\c:\llxflrl.exec:\llxflrl.exe37⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lfxxfrf.exec:\lfxxfrf.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ttntnt.exec:\ttntnt.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5jpvd.exec:\5jpvd.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxrrflr.exec:\xxrrflr.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3tnnbb.exec:\3tnnbb.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dddvj.exec:\dddvj.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jjjdj.exec:\jjjdj.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fxllrrx.exec:\fxllrrx.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhtthh.exec:\nhtthh.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvpvj.exec:\dvpvj.exe47⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7djpd.exec:\7djpd.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lffrfll.exec:\lffrfll.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hbbhtt.exec:\hbbhtt.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jjvpj.exec:\jjvpj.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ffrxffr.exec:\ffrxffr.exe52⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1rrrffl.exec:\1rrrffl.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hhtbnt.exec:\hhtbnt.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dvjpd.exec:\dvjpd.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vvpdv.exec:\vvpdv.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1rlrffr.exec:\1rlrffr.exe57⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bthhth.exec:\bthhth.exe58⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5jvdj.exec:\5jvdj.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lfrxrlx.exec:\lfrxrlx.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hbtbhh.exec:\hbtbhh.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\dvvjj.exec:\dvvjj.exe63⤵
- Executes dropped EXE
PID:1460 -
\??\c:\ffxfllf.exec:\ffxfllf.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\ttnbhn.exec:\ttnbhn.exe65⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpddd.exec:\vpddd.exe66⤵PID:768
-
\??\c:\7xxlxxr.exec:\7xxlxxr.exe67⤵PID:1180
-
\??\c:\nhttnn.exec:\nhttnn.exe68⤵PID:1956
-
\??\c:\hbtthn.exec:\hbtthn.exe69⤵PID:1220
-
\??\c:\jvppv.exec:\jvppv.exe70⤵PID:1604
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe71⤵PID:1960
-
\??\c:\nbbhbb.exec:\nbbhbb.exe72⤵PID:1296
-
\??\c:\vppvp.exec:\vppvp.exe73⤵PID:3020
-
\??\c:\pjjdv.exec:\pjjdv.exe74⤵PID:2996
-
\??\c:\5frxlrx.exec:\5frxlrx.exe75⤵PID:1500
-
\??\c:\bnhnbb.exec:\bnhnbb.exe76⤵PID:2068
-
\??\c:\dddvv.exec:\dddvv.exe77⤵PID:848
-
\??\c:\lllfllr.exec:\lllfllr.exe78⤵PID:884
-
\??\c:\llflrxf.exec:\llflrxf.exe79⤵PID:3000
-
\??\c:\7nhntb.exec:\7nhntb.exe80⤵PID:1528
-
\??\c:\pjjpd.exec:\pjjpd.exe81⤵PID:2352
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe82⤵PID:2984
-
\??\c:\xfflflx.exec:\xfflflx.exe83⤵PID:2704
-
\??\c:\nnhthn.exec:\nnhthn.exe84⤵PID:2700
-
\??\c:\jjdvd.exec:\jjdvd.exe85⤵PID:2224
-
\??\c:\djvdv.exec:\djvdv.exe86⤵PID:2624
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe87⤵PID:2876
-
\??\c:\1nbhth.exec:\1nbhth.exe88⤵PID:2156
-
\??\c:\jppjj.exec:\jppjj.exe89⤵PID:2728
-
\??\c:\pjvdp.exec:\pjvdp.exe90⤵PID:2504
-
\??\c:\rllxflx.exec:\rllxflx.exe91⤵PID:2484
-
\??\c:\bthtnt.exec:\bthtnt.exe92⤵PID:2548
-
\??\c:\tnhbnn.exec:\tnhbnn.exe93⤵PID:2032
-
\??\c:\ppjdj.exec:\ppjdj.exe94⤵PID:2968
-
\??\c:\5xllrxl.exec:\5xllrxl.exe95⤵PID:2736
-
\??\c:\nnhntt.exec:\nnhntt.exe96⤵PID:1912
-
\??\c:\tbthtt.exec:\tbthtt.exe97⤵PID:1244
-
\??\c:\3jdjp.exec:\3jdjp.exe98⤵PID:1676
-
\??\c:\5lffxrf.exec:\5lffxrf.exe99⤵PID:1844
-
\??\c:\5fflrfx.exec:\5fflrfx.exe100⤵PID:2184
-
\??\c:\nbbbtt.exec:\nbbbtt.exe101⤵PID:1856
-
\??\c:\vvpdj.exec:\vvpdj.exe102⤵PID:1884
-
\??\c:\1xlllff.exec:\1xlllff.exe103⤵PID:352
-
\??\c:\fxrxffr.exec:\fxrxffr.exe104⤵PID:1784
-
\??\c:\nnttnt.exec:\nnttnt.exe105⤵PID:2188
-
\??\c:\3vjjj.exec:\3vjjj.exe106⤵PID:1548
-
\??\c:\dppvj.exec:\dppvj.exe107⤵PID:2976
-
\??\c:\fxlfffl.exec:\fxlfffl.exe108⤵PID:2468
-
\??\c:\9tntnt.exec:\9tntnt.exe109⤵PID:1772
-
\??\c:\tnhhtb.exec:\tnhhtb.exe110⤵PID:2280
-
\??\c:\jpdvd.exec:\jpdvd.exe111⤵PID:2464
-
\??\c:\lfrlfxl.exec:\lfrlfxl.exe112⤵PID:3052
-
\??\c:\nnntbh.exec:\nnntbh.exe113⤵PID:2080
-
\??\c:\9pvpd.exec:\9pvpd.exe114⤵PID:1180
-
\??\c:\ddvdj.exec:\ddvdj.exe115⤵PID:1468
-
\??\c:\lfffrrf.exec:\lfffrrf.exe116⤵PID:1252
-
\??\c:\ttnhbh.exec:\ttnhbh.exe117⤵PID:1504
-
\??\c:\dpvvp.exec:\dpvvp.exe118⤵PID:852
-
\??\c:\xrffrrf.exec:\xrffrrf.exe119⤵PID:284
-
\??\c:\7hhhtb.exec:\7hhhtb.exe120⤵PID:3020
-
\??\c:\pvjpv.exec:\pvjpv.exe121⤵PID:2432
-
\??\c:\dvppd.exec:\dvppd.exe122⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-