Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 20:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe
-
Size
213KB
-
MD5
270bf9fb320cfc6ef65e5266e2cf2474
-
SHA1
d11a9e1661afca4b1803272436b500c266c13f6b
-
SHA256
34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5
-
SHA512
4724997b647bd7a1cf75c58be0da4f5019af46878b3b004c1378ca3bb3474c9087b907b625958ffbfc11454b6c439d94d7232b47d84297a947374138f23a270b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABvc:n3C9BRIG0asYFm71m8+GdkB9EBE
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1244-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/1244-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1664-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2564-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2212-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1860-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1948-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1800-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1764-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2256-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/324-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2296-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1484-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3028-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1812-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1664 xrfxrrx.exe 2596 7tnhnn.exe 2564 jvdjd.exe 2568 1lffffl.exe 2548 htnhhh.exe 2504 vpdvd.exe 2464 lxffrfl.exe 2480 fxffrlr.exe 2252 btbhtt.exe 2484 vpvvv.exe 2744 7djjp.exe 1048 lxrxlff.exe 2212 rfrxxlr.exe 1860 nbhbbb.exe 1948 jdjjp.exe 380 9jvvv.exe 1800 xlxxfxx.exe 1764 lxllxxf.exe 2256 3nttbh.exe 324 vpvvv.exe 2296 pjpjv.exe 2796 9rxrrff.exe 1028 bbhhht.exe 1484 7hnhhb.exe 2900 1jvjj.exe 1608 pjvdp.exe 3028 xllllfr.exe 1020 7bhbhh.exe 2088 pdjdd.exe 876 dpddj.exe 1812 rrfxllr.exe 2924 dvjjp.exe 1664 xrfxfrf.exe 1600 bthntt.exe 2140 9nbhhn.exe 2616 vpvdd.exe 2556 bnbtbb.exe 2664 vjppp.exe 2988 pdjjv.exe 2424 dpvvv.exe 2340 7xrxffl.exe 2432 5rllrlr.exe 2584 nhhhhh.exe 1804 vpdpd.exe 2908 dpdvd.exe 2676 5rrlffl.exe 2484 fxrrrrx.exe 2476 hbntbn.exe 1048 htbbbh.exe 1756 pjvjd.exe 1128 7djdp.exe 2864 7xrllll.exe 1952 hthhnn.exe 380 5djjj.exe 288 3jpjj.exe 2280 rllxlrf.exe 1764 xlrxlfl.exe 2604 nhnnth.exe 2800 7hbbhh.exe 3012 pdjjj.exe 596 lxrllll.exe 1028 frfflfl.exe 304 tnnbhh.exe 1744 1bntnn.exe -
resource yara_rule behavioral1/memory/1244-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1244 wrote to memory of 1664 1244 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 28 PID 1244 wrote to memory of 1664 1244 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 28 PID 1244 wrote to memory of 1664 1244 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 28 PID 1244 wrote to memory of 1664 1244 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 28 PID 1664 wrote to memory of 2596 1664 xrfxrrx.exe 29 PID 1664 wrote to memory of 2596 1664 xrfxrrx.exe 29 PID 1664 wrote to memory of 2596 1664 xrfxrrx.exe 29 PID 1664 wrote to memory of 2596 1664 xrfxrrx.exe 29 PID 2596 wrote to memory of 2564 2596 7tnhnn.exe 30 PID 2596 wrote to memory of 2564 2596 7tnhnn.exe 30 PID 2596 wrote to memory of 2564 2596 7tnhnn.exe 30 PID 2596 wrote to memory of 2564 2596 7tnhnn.exe 30 PID 2564 wrote to memory of 2568 2564 jvdjd.exe 31 PID 2564 wrote to memory of 2568 2564 jvdjd.exe 31 PID 2564 wrote to memory of 2568 2564 jvdjd.exe 31 PID 2564 wrote to memory of 2568 2564 jvdjd.exe 31 PID 2568 wrote to memory of 2548 2568 1lffffl.exe 32 PID 2568 wrote to memory of 2548 2568 1lffffl.exe 32 PID 2568 wrote to memory of 2548 2568 1lffffl.exe 32 PID 2568 wrote to memory of 2548 2568 1lffffl.exe 32 PID 2548 wrote to memory of 2504 2548 htnhhh.exe 33 PID 2548 wrote to memory of 2504 2548 htnhhh.exe 33 PID 2548 wrote to memory of 2504 2548 htnhhh.exe 33 PID 2548 wrote to memory of 2504 2548 htnhhh.exe 33 PID 2504 wrote to memory of 2464 2504 vpdvd.exe 34 PID 2504 wrote to memory of 2464 2504 vpdvd.exe 34 PID 2504 wrote to memory of 2464 2504 vpdvd.exe 34 PID 2504 wrote to memory of 2464 2504 vpdvd.exe 34 PID 2464 wrote to memory of 2480 2464 lxffrfl.exe 35 PID 2464 wrote to memory of 2480 2464 lxffrfl.exe 35 PID 2464 wrote to memory of 2480 2464 lxffrfl.exe 35 PID 2464 wrote to memory of 2480 2464 lxffrfl.exe 35 PID 2480 wrote to memory of 2252 2480 fxffrlr.exe 36 PID 2480 wrote to memory of 2252 2480 fxffrlr.exe 36 PID 2480 wrote to memory of 2252 2480 fxffrlr.exe 36 PID 2480 wrote to memory of 2252 2480 fxffrlr.exe 36 PID 2252 wrote to memory of 2484 2252 btbhtt.exe 37 PID 2252 wrote to memory of 2484 2252 btbhtt.exe 37 PID 2252 wrote to memory of 2484 2252 btbhtt.exe 37 PID 2252 wrote to memory of 2484 2252 btbhtt.exe 37 PID 2484 wrote to memory of 2744 2484 vpvvv.exe 38 PID 2484 wrote to memory of 2744 2484 vpvvv.exe 38 PID 2484 wrote to memory of 2744 2484 vpvvv.exe 38 PID 2484 wrote to memory of 2744 2484 vpvvv.exe 38 PID 2744 wrote to memory of 1048 2744 7djjp.exe 39 PID 2744 wrote to memory of 1048 2744 7djjp.exe 39 PID 2744 wrote to memory of 1048 2744 7djjp.exe 39 PID 2744 wrote to memory of 1048 2744 7djjp.exe 39 PID 1048 wrote to memory of 2212 1048 lxrxlff.exe 40 PID 1048 wrote to memory of 2212 1048 lxrxlff.exe 40 PID 1048 wrote to memory of 2212 1048 lxrxlff.exe 40 PID 1048 wrote to memory of 2212 1048 lxrxlff.exe 40 PID 2212 wrote to memory of 1860 2212 rfrxxlr.exe 41 PID 2212 wrote to memory of 1860 2212 rfrxxlr.exe 41 PID 2212 wrote to memory of 1860 2212 rfrxxlr.exe 41 PID 2212 wrote to memory of 1860 2212 rfrxxlr.exe 41 PID 1860 wrote to memory of 1948 1860 nbhbbb.exe 42 PID 1860 wrote to memory of 1948 1860 nbhbbb.exe 42 PID 1860 wrote to memory of 1948 1860 nbhbbb.exe 42 PID 1860 wrote to memory of 1948 1860 nbhbbb.exe 42 PID 1948 wrote to memory of 380 1948 jdjjp.exe 43 PID 1948 wrote to memory of 380 1948 jdjjp.exe 43 PID 1948 wrote to memory of 380 1948 jdjjp.exe 43 PID 1948 wrote to memory of 380 1948 jdjjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe"C:\Users\Admin\AppData\Local\Temp\34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\xrfxrrx.exec:\xrfxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\7tnhnn.exec:\7tnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jvdjd.exec:\jvdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1lffffl.exec:\1lffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\htnhhh.exec:\htnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vpdvd.exec:\vpdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lxffrfl.exec:\lxffrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\fxffrlr.exec:\fxffrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\btbhtt.exec:\btbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vpvvv.exec:\vpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\7djjp.exec:\7djjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lxrxlff.exec:\lxrxlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\rfrxxlr.exec:\rfrxxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\nbhbbb.exec:\nbhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jdjjp.exec:\jdjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\9jvvv.exec:\9jvvv.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\xlxxfxx.exec:\xlxxfxx.exe18⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lxllxxf.exec:\lxllxxf.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3nttbh.exec:\3nttbh.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vpvvv.exec:\vpvvv.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\pjpjv.exec:\pjpjv.exe22⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9rxrrff.exec:\9rxrrff.exe23⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bbhhht.exec:\bbhhht.exe24⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7hnhhb.exec:\7hnhhb.exe25⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1jvjj.exec:\1jvjj.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pjvdp.exec:\pjvdp.exe27⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xllllfr.exec:\xllllfr.exe28⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7bhbhh.exec:\7bhbhh.exe29⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pdjdd.exec:\pdjdd.exe30⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dpddj.exec:\dpddj.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\rrfxllr.exec:\rrfxllr.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dvjjp.exec:\dvjjp.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xrfxfrf.exec:\xrfxfrf.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bthntt.exec:\bthntt.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9nbhhn.exec:\9nbhhn.exe36⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vpvdd.exec:\vpvdd.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bnbtbb.exec:\bnbtbb.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjppp.exec:\vjppp.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pdjjv.exec:\pdjjv.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dpvvv.exec:\dpvvv.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7xrxffl.exec:\7xrxffl.exe42⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5rllrlr.exec:\5rllrlr.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nhhhhh.exec:\nhhhhh.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vpdpd.exec:\vpdpd.exe45⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dpdvd.exec:\dpdvd.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5rrlffl.exec:\5rrlffl.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbntbn.exec:\hbntbn.exe49⤵
- Executes dropped EXE
PID:2476 -
\??\c:\htbbbh.exec:\htbbbh.exe50⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pjvjd.exec:\pjvjd.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7djdp.exec:\7djdp.exe52⤵
- Executes dropped EXE
PID:1128 -
\??\c:\7xrllll.exec:\7xrllll.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hthhnn.exec:\hthhnn.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5djjj.exec:\5djjj.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\3jpjj.exec:\3jpjj.exe56⤵
- Executes dropped EXE
PID:288 -
\??\c:\rllxlrf.exec:\rllxlrf.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xlrxlfl.exec:\xlrxlfl.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nhnnth.exec:\nhnnth.exe59⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7hbbhh.exec:\7hbbhh.exe60⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pdjjj.exec:\pdjjj.exe61⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lxrllll.exec:\lxrllll.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\frfflfl.exec:\frfflfl.exe63⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tnnbhh.exec:\tnnbhh.exe64⤵
- Executes dropped EXE
PID:304 -
\??\c:\1bntnn.exec:\1bntnn.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dppjp.exec:\dppjp.exe66⤵PID:1976
-
\??\c:\jdvvv.exec:\jdvvv.exe67⤵PID:1988
-
\??\c:\9rfffxf.exec:\9rfffxf.exe68⤵PID:3028
-
\??\c:\btbnnn.exec:\btbnnn.exe69⤵PID:1372
-
\??\c:\7thbht.exec:\7thbht.exe70⤵PID:612
-
\??\c:\pjppp.exec:\pjppp.exe71⤵PID:1516
-
\??\c:\1dpvv.exec:\1dpvv.exe72⤵PID:276
-
\??\c:\lxlxfxf.exec:\lxlxfxf.exe73⤵PID:1624
-
\??\c:\7htttn.exec:\7htttn.exe74⤵PID:2188
-
\??\c:\hthhnt.exec:\hthhnt.exe75⤵PID:1588
-
\??\c:\vvpvd.exec:\vvpvd.exe76⤵PID:1244
-
\??\c:\vddvv.exec:\vddvv.exe77⤵PID:3068
-
\??\c:\lxfrxxf.exec:\lxfrxxf.exe78⤵PID:2628
-
\??\c:\tnnhnb.exec:\tnnhnb.exe79⤵PID:2540
-
\??\c:\thbttn.exec:\thbttn.exe80⤵PID:2568
-
\??\c:\1jvpj.exec:\1jvpj.exe81⤵PID:2576
-
\??\c:\3pdpp.exec:\3pdpp.exe82⤵PID:2440
-
\??\c:\7xfxrlr.exec:\7xfxrlr.exe83⤵PID:2672
-
\??\c:\xrllrll.exec:\xrllrll.exe84⤵PID:2472
-
\??\c:\hbttbh.exec:\hbttbh.exe85⤵PID:2020
-
\??\c:\vpvvv.exec:\vpvvv.exe86⤵PID:1644
-
\??\c:\vpdjp.exec:\vpdjp.exe87⤵PID:2704
-
\??\c:\fxrxffl.exec:\fxrxffl.exe88⤵PID:2252
-
\??\c:\1xfflff.exec:\1xfflff.exe89⤵PID:2844
-
\??\c:\ntbtbt.exec:\ntbtbt.exe90⤵PID:2304
-
\??\c:\ttnhbh.exec:\ttnhbh.exe91⤵PID:2196
-
\??\c:\pjdjp.exec:\pjdjp.exe92⤵PID:2024
-
\??\c:\jvppp.exec:\jvppp.exe93⤵PID:1784
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe94⤵PID:2168
-
\??\c:\rllrrlr.exec:\rllrrlr.exe95⤵PID:2348
-
\??\c:\bthhnh.exec:\bthhnh.exe96⤵PID:1088
-
\??\c:\httbbb.exec:\httbbb.exe97⤵PID:1820
-
\??\c:\9dvvd.exec:\9dvvd.exe98⤵PID:536
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe99⤵PID:2292
-
\??\c:\xrxrxrf.exec:\xrxrxrf.exe100⤵PID:2148
-
\??\c:\1nthhh.exec:\1nthhh.exe101⤵PID:1720
-
\??\c:\nhtthb.exec:\nhtthb.exe102⤵PID:1104
-
\??\c:\9jjjd.exec:\9jjjd.exe103⤵PID:1108
-
\??\c:\dvvpv.exec:\dvvpv.exe104⤵PID:984
-
\??\c:\lxxllll.exec:\lxxllll.exe105⤵PID:1484
-
\??\c:\rxfflll.exec:\rxfflll.exe106⤵PID:304
-
\??\c:\hbttbt.exec:\hbttbt.exe107⤵PID:1956
-
\??\c:\hbbbbb.exec:\hbbbbb.exe108⤵PID:872
-
\??\c:\7jdpj.exec:\7jdpj.exe109⤵PID:1396
-
\??\c:\flrffff.exec:\flrffff.exe110⤵PID:1688
-
\??\c:\fxflrrr.exec:\fxflrrr.exe111⤵PID:2060
-
\??\c:\hbtttt.exec:\hbtttt.exe112⤵PID:612
-
\??\c:\7ttttb.exec:\7ttttb.exe113⤵PID:748
-
\??\c:\jvdpp.exec:\jvdpp.exe114⤵PID:1812
-
\??\c:\vvjdj.exec:\vvjdj.exe115⤵PID:1708
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe116⤵PID:1692
-
\??\c:\lxxrrrx.exec:\lxxrrrx.exe117⤵PID:2596
-
\??\c:\3bntbb.exec:\3bntbb.exe118⤵PID:2696
-
\??\c:\7nnbnh.exec:\7nnbnh.exe119⤵PID:3068
-
\??\c:\5pjjv.exec:\5pjjv.exe120⤵PID:2640
-
\??\c:\lxxxfxl.exec:\lxxxfxl.exe121⤵PID:2716
-
\??\c:\3frrxfl.exec:\3frrxfl.exe122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-