Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 05:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe
-
Size
89KB
-
MD5
a874678270622ba291252aeed79ea092
-
SHA1
b8ecd50fcde5ef481682d7ce2a0848868815e254
-
SHA256
f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca
-
SHA512
4e0e7a5ae2a1f130ecfe2a2e4597b0eb3f8a6b86e0fbf3dcf6dc90b37664a0cab4e22d7feebda64ebe58275b21f7101a741ba7717cae417491239f4f49c14ec6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1grORPfr0k890CDVxU:ymb3NkkiQ3mdBjFoLk8Pk890CDVa
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral1/memory/2320-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2320-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2964-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/832-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2076-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/812-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2228-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2392-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2124-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2104-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2300 ppvpj.exe 2612 jpjjj.exe 2568 nhnntt.exe 2584 vdpjd.exe 2588 lffxlrr.exe 2420 7frxlrr.exe 2964 nbhhhh.exe 832 9thhbt.exe 2940 jjjjj.exe 2992 5vddd.exe 2680 lflflrf.exe 2712 thnntt.exe 2492 thnnnt.exe 2700 pjvdv.exe 2816 rrrrflx.exe 1532 7frrflr.exe 1744 btbbtt.exe 2076 nhnthn.exe 2888 jdvvd.exe 1668 7pddj.exe 812 rflllrf.exe 956 xrxfrrf.exe 2228 tnnnbb.exe 1808 tnhhhh.exe 2392 dvjvv.exe 2372 3frxlll.exe 3028 hbtthh.exe 1280 jpdvj.exe 2124 1jpjp.exe 2104 rflllll.exe 2320 hthttn.exe 1652 bnbbhh.exe 2300 vjvvd.exe 3060 jvpjj.exe 2732 xflrlll.exe 2548 rfllxxx.exe 2280 htbbbb.exe 2584 1jjjd.exe 1876 jvdvd.exe 2424 frlflfl.exe 2284 nbtbnh.exe 1932 5jdpv.exe 832 vjvvj.exe 2840 ffxrxxf.exe 2944 fxlrflr.exe 1696 bthbnb.exe 2668 hntntt.exe 1960 3ddjp.exe 868 5fxlrxf.exe 2764 rrflffr.exe 2700 frrrlff.exe 1528 bththh.exe 1568 bnbttt.exe 2304 vpdpv.exe 1984 5jdvp.exe 2212 xxfrxrl.exe 604 tbhnnh.exe 1424 7nhthn.exe 1580 9nbhhh.exe 2060 jjjdj.exe 1164 pdpdv.exe 856 rlxfrrf.exe 2084 1fxfrfr.exe 3032 nhhhhb.exe -
resource yara_rule behavioral1/memory/2320-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2300 2320 f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe 29 PID 2320 wrote to memory of 2300 2320 f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe 29 PID 2320 wrote to memory of 2300 2320 f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe 29 PID 2320 wrote to memory of 2300 2320 f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe 29 PID 2300 wrote to memory of 2612 2300 ppvpj.exe 30 PID 2300 wrote to memory of 2612 2300 ppvpj.exe 30 PID 2300 wrote to memory of 2612 2300 ppvpj.exe 30 PID 2300 wrote to memory of 2612 2300 ppvpj.exe 30 PID 2612 wrote to memory of 2568 2612 jpjjj.exe 31 PID 2612 wrote to memory of 2568 2612 jpjjj.exe 31 PID 2612 wrote to memory of 2568 2612 jpjjj.exe 31 PID 2612 wrote to memory of 2568 2612 jpjjj.exe 31 PID 2568 wrote to memory of 2584 2568 nhnntt.exe 32 PID 2568 wrote to memory of 2584 2568 nhnntt.exe 32 PID 2568 wrote to memory of 2584 2568 nhnntt.exe 32 PID 2568 wrote to memory of 2584 2568 nhnntt.exe 32 PID 2584 wrote to memory of 2588 2584 vdpjd.exe 33 PID 2584 wrote to memory of 2588 2584 vdpjd.exe 33 PID 2584 wrote to memory of 2588 2584 vdpjd.exe 33 PID 2584 wrote to memory of 2588 2584 vdpjd.exe 33 PID 2588 wrote to memory of 2420 2588 lffxlrr.exe 34 PID 2588 wrote to memory of 2420 2588 lffxlrr.exe 34 PID 2588 wrote to memory of 2420 2588 lffxlrr.exe 34 PID 2588 wrote to memory of 2420 2588 lffxlrr.exe 34 PID 2420 wrote to memory of 2964 2420 7frxlrr.exe 35 PID 2420 wrote to memory of 2964 2420 7frxlrr.exe 35 PID 2420 wrote to memory of 2964 2420 7frxlrr.exe 35 PID 2420 wrote to memory of 2964 2420 7frxlrr.exe 35 PID 2964 wrote to memory of 832 2964 nbhhhh.exe 36 PID 2964 wrote to memory of 832 2964 nbhhhh.exe 36 PID 2964 wrote to memory of 832 2964 nbhhhh.exe 36 PID 2964 wrote to memory of 832 2964 nbhhhh.exe 36 PID 832 wrote to memory of 2940 832 9thhbt.exe 37 PID 832 wrote to memory of 2940 832 9thhbt.exe 37 PID 832 wrote to memory of 2940 832 9thhbt.exe 37 PID 832 wrote to memory of 2940 832 9thhbt.exe 37 PID 2940 wrote to memory of 2992 2940 jjjjj.exe 38 PID 2940 wrote to memory of 2992 2940 jjjjj.exe 38 PID 2940 wrote to memory of 2992 2940 jjjjj.exe 38 PID 2940 wrote to memory of 2992 2940 jjjjj.exe 38 PID 2992 wrote to memory of 2680 2992 5vddd.exe 39 PID 2992 wrote to memory of 2680 2992 5vddd.exe 39 PID 2992 wrote to memory of 2680 2992 5vddd.exe 39 PID 2992 wrote to memory of 2680 2992 5vddd.exe 39 PID 2680 wrote to memory of 2712 2680 lflflrf.exe 40 PID 2680 wrote to memory of 2712 2680 lflflrf.exe 40 PID 2680 wrote to memory of 2712 2680 lflflrf.exe 40 PID 2680 wrote to memory of 2712 2680 lflflrf.exe 40 PID 2712 wrote to memory of 2492 2712 thnntt.exe 41 PID 2712 wrote to memory of 2492 2712 thnntt.exe 41 PID 2712 wrote to memory of 2492 2712 thnntt.exe 41 PID 2712 wrote to memory of 2492 2712 thnntt.exe 41 PID 2492 wrote to memory of 2700 2492 thnnnt.exe 42 PID 2492 wrote to memory of 2700 2492 thnnnt.exe 42 PID 2492 wrote to memory of 2700 2492 thnnnt.exe 42 PID 2492 wrote to memory of 2700 2492 thnnnt.exe 42 PID 2700 wrote to memory of 2816 2700 pjvdv.exe 43 PID 2700 wrote to memory of 2816 2700 pjvdv.exe 43 PID 2700 wrote to memory of 2816 2700 pjvdv.exe 43 PID 2700 wrote to memory of 2816 2700 pjvdv.exe 43 PID 2816 wrote to memory of 1532 2816 rrrrflx.exe 44 PID 2816 wrote to memory of 1532 2816 rrrrflx.exe 44 PID 2816 wrote to memory of 1532 2816 rrrrflx.exe 44 PID 2816 wrote to memory of 1532 2816 rrrrflx.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe"C:\Users\Admin\AppData\Local\Temp\f3396a7dfafb31e88a07dd13faae1b79c77fc5da38db766dbb013428160cb0ca.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\ppvpj.exec:\ppvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jpjjj.exec:\jpjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nhnntt.exec:\nhnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vdpjd.exec:\vdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\lffxlrr.exec:\lffxlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7frxlrr.exec:\7frxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nbhhhh.exec:\nbhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\9thhbt.exec:\9thhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\jjjjj.exec:\jjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5vddd.exec:\5vddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lflflrf.exec:\lflflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\thnntt.exec:\thnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\thnnnt.exec:\thnnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\pjvdv.exec:\pjvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rrrrflx.exec:\rrrrflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7frrflr.exec:\7frrflr.exe17⤵
- Executes dropped EXE
PID:1532 -
\??\c:\btbbtt.exec:\btbbtt.exe18⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nhnthn.exec:\nhnthn.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdvvd.exec:\jdvvd.exe20⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7pddj.exec:\7pddj.exe21⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rflllrf.exec:\rflllrf.exe22⤵
- Executes dropped EXE
PID:812 -
\??\c:\xrxfrrf.exec:\xrxfrrf.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\tnnnbb.exec:\tnnnbb.exe24⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tnhhhh.exec:\tnhhhh.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dvjvv.exec:\dvjvv.exe26⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3frxlll.exec:\3frxlll.exe27⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hbtthh.exec:\hbtthh.exe28⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jpdvj.exec:\jpdvj.exe29⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1jpjp.exec:\1jpjp.exe30⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rflllll.exec:\rflllll.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hthttn.exec:\hthttn.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bnbbhh.exec:\bnbbhh.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vjvvd.exec:\vjvvd.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jvpjj.exec:\jvpjj.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xflrlll.exec:\xflrlll.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rfllxxx.exec:\rfllxxx.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\htbbbb.exec:\htbbbb.exe38⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1jjjd.exec:\1jjjd.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jvdvd.exec:\jvdvd.exe40⤵
- Executes dropped EXE
PID:1876 -
\??\c:\frlflfl.exec:\frlflfl.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nbtbnh.exec:\nbtbnh.exe42⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5jdpv.exec:\5jdpv.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vjvvj.exec:\vjvvj.exe44⤵
- Executes dropped EXE
PID:832 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fxlrflr.exec:\fxlrflr.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bthbnb.exec:\bthbnb.exe47⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hntntt.exec:\hntntt.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3ddjp.exec:\3ddjp.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5fxlrxf.exec:\5fxlrxf.exe50⤵
- Executes dropped EXE
PID:868 -
\??\c:\rrflffr.exec:\rrflffr.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\frrrlff.exec:\frrrlff.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bththh.exec:\bththh.exe53⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bnbttt.exec:\bnbttt.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpdpv.exec:\vpdpv.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5jdvp.exec:\5jdvp.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxfrxrl.exec:\xxfrxrl.exe57⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbhnnh.exec:\tbhnnh.exe58⤵
- Executes dropped EXE
PID:604 -
\??\c:\7nhthn.exec:\7nhthn.exe59⤵
- Executes dropped EXE
PID:1424 -
\??\c:\9nbhhh.exec:\9nbhhh.exe60⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jjjdj.exec:\jjjdj.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pdpdv.exec:\pdpdv.exe62⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\1fxfrfr.exec:\1fxfrfr.exe64⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhhhhb.exec:\nhhhhb.exe65⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7nbhnn.exec:\7nbhnn.exe66⤵PID:1680
-
\??\c:\3vvpd.exec:\3vvpd.exe67⤵PID:1892
-
\??\c:\dpddv.exec:\dpddv.exe68⤵PID:2204
-
\??\c:\5jppd.exec:\5jppd.exe69⤵PID:912
-
\??\c:\3fxlrlr.exec:\3fxlrlr.exe70⤵PID:2124
-
\??\c:\frfrxfl.exec:\frfrxfl.exe71⤵PID:3056
-
\??\c:\3ttttt.exec:\3ttttt.exe72⤵PID:2140
-
\??\c:\bhtthh.exec:\bhtthh.exe73⤵PID:1524
-
\??\c:\1htbbh.exec:\1htbbh.exe74⤵PID:1540
-
\??\c:\3ddjj.exec:\3ddjj.exe75⤵PID:2572
-
\??\c:\jdpdp.exec:\jdpdp.exe76⤵PID:2612
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe77⤵PID:2540
-
\??\c:\xxxlrrr.exec:\xxxlrrr.exe78⤵PID:2740
-
\??\c:\bttttt.exec:\bttttt.exe79⤵PID:1940
-
\??\c:\9hbbbt.exec:\9hbbbt.exe80⤵PID:2696
-
\??\c:\jdvjv.exec:\jdvjv.exe81⤵PID:2536
-
\??\c:\dpdvv.exec:\dpdvv.exe82⤵PID:2112
-
\??\c:\1rrfrfl.exec:\1rrfrfl.exe83⤵PID:2960
-
\??\c:\flrrlfl.exec:\flrrlfl.exe84⤵PID:3008
-
\??\c:\bbnhhh.exec:\bbnhhh.exe85⤵PID:2996
-
\??\c:\hbntbb.exec:\hbntbb.exe86⤵PID:2080
-
\??\c:\3hntbb.exec:\3hntbb.exe87⤵PID:2992
-
\??\c:\pvjvd.exec:\pvjvd.exe88⤵PID:2680
-
\??\c:\dpddp.exec:\dpddp.exe89⤵PID:2484
-
\??\c:\lrxrffr.exec:\lrxrffr.exe90⤵PID:2792
-
\??\c:\7lfrxfx.exec:\7lfrxfx.exe91⤵PID:852
-
\??\c:\5nhntt.exec:\5nhntt.exe92⤵PID:500
-
\??\c:\nhnntt.exec:\nhnntt.exe93⤵PID:1564
-
\??\c:\pjvpp.exec:\pjvpp.exe94⤵PID:1920
-
\??\c:\vjppd.exec:\vjppd.exe95⤵PID:1472
-
\??\c:\dppjv.exec:\dppjv.exe96⤵PID:2188
-
\??\c:\5rxrlff.exec:\5rxrlff.exe97⤵PID:2076
-
\??\c:\3llrxrf.exec:\3llrxrf.exe98⤵PID:608
-
\??\c:\hbnbnt.exec:\hbnbnt.exe99⤵PID:488
-
\??\c:\tnhbtt.exec:\tnhbtt.exe100⤵PID:804
-
\??\c:\jdpdj.exec:\jdpdj.exe101⤵PID:1684
-
\??\c:\7pjpd.exec:\7pjpd.exe102⤵PID:2296
-
\??\c:\llxxrxf.exec:\llxxrxf.exe103⤵PID:2228
-
\??\c:\nhbbbb.exec:\nhbbbb.exe104⤵PID:276
-
\??\c:\hbnnth.exec:\hbnnth.exe105⤵PID:1632
-
\??\c:\dvjpp.exec:\dvjpp.exe106⤵PID:2248
-
\??\c:\vjppp.exec:\vjppp.exe107⤵PID:2852
-
\??\c:\htttnn.exec:\htttnn.exe108⤵PID:3028
-
\??\c:\5tbnbh.exec:\5tbnbh.exe109⤵PID:1776
-
\??\c:\djdpd.exec:\djdpd.exe110⤵PID:2708
-
\??\c:\7pppd.exec:\7pppd.exe111⤵PID:1900
-
\??\c:\fxlllxf.exec:\fxlllxf.exe112⤵PID:2516
-
\??\c:\9xrrflr.exec:\9xrrflr.exe113⤵PID:1548
-
\??\c:\httttt.exec:\httttt.exe114⤵PID:2128
-
\??\c:\bttbnn.exec:\bttbnn.exe115⤵PID:1540
-
\??\c:\pppdv.exec:\pppdv.exe116⤵PID:2656
-
\??\c:\vdddd.exec:\vdddd.exe117⤵PID:2732
-
\??\c:\3flrffl.exec:\3flrffl.exe118⤵PID:2540
-
\??\c:\xxxflff.exec:\xxxflff.exe119⤵PID:2560
-
\??\c:\ntnbhb.exec:\ntnbhb.exe120⤵PID:2468
-
\??\c:\nhttnn.exec:\nhttnn.exe121⤵PID:2476
-
\??\c:\5vdjj.exec:\5vdjj.exe122⤵PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-