Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe
-
Size
58KB
-
MD5
6d7b7eaf67d4b8f294d18165bc1036ad
-
SHA1
697c1e3ccbf398651e8964907b9aebeed3c0c873
-
SHA256
354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973
-
SHA512
1e7df61febd0a52c141af462909c468744197ea9064581a9af52eaaf4ee36503d5687e6d958fc03505c3e36d9b4db1c35c2f9b69d1206a6e72c99e66fc3c25df
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L5:ymb3NkkiQ3mdBjFI99
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2192-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral1/memory/2192-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1036-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2844-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/292-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2176-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2092-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/580-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1868-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1000-274-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1732-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2468 tththb.exe 1036 dvjjj.exe 2588 5jddj.exe 2512 lfrxlfl.exe 2420 hbnbtt.exe 2440 ppjvv.exe 2400 pjjvd.exe 2444 5lxxffl.exe 776 hnhtnb.exe 2632 ttnnnt.exe 2724 3jdpj.exe 2844 dvddd.exe 292 xxlrrrf.exe 468 7rrxfrf.exe 2176 hbnthh.exe 2160 1nhbnt.exe 2036 jvdvd.exe 2900 lfrlxfl.exe 1952 rfxxrxf.exe 1712 bbtbhn.exe 2092 dvjpv.exe 580 5pjpp.exe 528 1rflrfl.exe 2348 xrffrll.exe 3016 bthhtn.exe 1868 hthbnt.exe 2112 9ppdj.exe 1000 dvdvj.exe 2768 fxllxfr.exe 2976 nhbthn.exe 1732 3tnnbh.exe 2688 1vvjj.exe 2468 5frlrrx.exe 1664 xfrxrxx.exe 2532 hbtbnn.exe 2536 3hbbnn.exe 2600 pjppj.exe 2512 jjvdv.exe 2548 rfffrfr.exe 2560 frfxflr.exe 2440 7lfrfrl.exe 2404 htnhnn.exe 2936 7pjvj.exe 1064 rffxlfl.exe 2620 lflrflx.exe 2632 7nnnbb.exe 812 bbhnhn.exe 1748 djjdp.exe 2844 5jdjp.exe 292 1lrrxxf.exe 860 xrxrfxl.exe 1268 3hbhhh.exe 2012 bhtttb.exe 2000 pjjjd.exe 2888 vjppv.exe 2244 9lfrrrx.exe 2896 fxrxflr.exe 1744 tnbhnt.exe 792 nnbtbb.exe 2092 ddvjj.exe 656 jpdvd.exe 1144 rfrlrxf.exe 1696 fxfxxlx.exe 704 hbhbbb.exe -
resource yara_rule behavioral1/memory/2192-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2468 2192 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 29 PID 2192 wrote to memory of 2468 2192 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 29 PID 2192 wrote to memory of 2468 2192 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 29 PID 2192 wrote to memory of 2468 2192 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 29 PID 2468 wrote to memory of 1036 2468 tththb.exe 30 PID 2468 wrote to memory of 1036 2468 tththb.exe 30 PID 2468 wrote to memory of 1036 2468 tththb.exe 30 PID 2468 wrote to memory of 1036 2468 tththb.exe 30 PID 1036 wrote to memory of 2588 1036 dvjjj.exe 31 PID 1036 wrote to memory of 2588 1036 dvjjj.exe 31 PID 1036 wrote to memory of 2588 1036 dvjjj.exe 31 PID 1036 wrote to memory of 2588 1036 dvjjj.exe 31 PID 2588 wrote to memory of 2512 2588 5jddj.exe 32 PID 2588 wrote to memory of 2512 2588 5jddj.exe 32 PID 2588 wrote to memory of 2512 2588 5jddj.exe 32 PID 2588 wrote to memory of 2512 2588 5jddj.exe 32 PID 2512 wrote to memory of 2420 2512 lfrxlfl.exe 33 PID 2512 wrote to memory of 2420 2512 lfrxlfl.exe 33 PID 2512 wrote to memory of 2420 2512 lfrxlfl.exe 33 PID 2512 wrote to memory of 2420 2512 lfrxlfl.exe 33 PID 2420 wrote to memory of 2440 2420 hbnbtt.exe 34 PID 2420 wrote to memory of 2440 2420 hbnbtt.exe 34 PID 2420 wrote to memory of 2440 2420 hbnbtt.exe 34 PID 2420 wrote to memory of 2440 2420 hbnbtt.exe 34 PID 2440 wrote to memory of 2400 2440 ppjvv.exe 35 PID 2440 wrote to memory of 2400 2440 ppjvv.exe 35 PID 2440 wrote to memory of 2400 2440 ppjvv.exe 35 PID 2440 wrote to memory of 2400 2440 ppjvv.exe 35 PID 2400 wrote to memory of 2444 2400 pjjvd.exe 36 PID 2400 wrote to memory of 2444 2400 pjjvd.exe 36 PID 2400 wrote to memory of 2444 2400 pjjvd.exe 36 PID 2400 wrote to memory of 2444 2400 pjjvd.exe 36 PID 2444 wrote to memory of 776 2444 5lxxffl.exe 37 PID 2444 wrote to memory of 776 2444 5lxxffl.exe 37 PID 2444 wrote to memory of 776 2444 5lxxffl.exe 37 PID 2444 wrote to memory of 776 2444 5lxxffl.exe 37 PID 776 wrote to memory of 2632 776 hnhtnb.exe 38 PID 776 wrote to memory of 2632 776 hnhtnb.exe 38 PID 776 wrote to memory of 2632 776 hnhtnb.exe 38 PID 776 wrote to memory of 2632 776 hnhtnb.exe 38 PID 2632 wrote to memory of 2724 2632 ttnnnt.exe 39 PID 2632 wrote to memory of 2724 2632 ttnnnt.exe 39 PID 2632 wrote to memory of 2724 2632 ttnnnt.exe 39 PID 2632 wrote to memory of 2724 2632 ttnnnt.exe 39 PID 2724 wrote to memory of 2844 2724 3jdpj.exe 40 PID 2724 wrote to memory of 2844 2724 3jdpj.exe 40 PID 2724 wrote to memory of 2844 2724 3jdpj.exe 40 PID 2724 wrote to memory of 2844 2724 3jdpj.exe 40 PID 2844 wrote to memory of 292 2844 dvddd.exe 41 PID 2844 wrote to memory of 292 2844 dvddd.exe 41 PID 2844 wrote to memory of 292 2844 dvddd.exe 41 PID 2844 wrote to memory of 292 2844 dvddd.exe 41 PID 292 wrote to memory of 468 292 xxlrrrf.exe 42 PID 292 wrote to memory of 468 292 xxlrrrf.exe 42 PID 292 wrote to memory of 468 292 xxlrrrf.exe 42 PID 292 wrote to memory of 468 292 xxlrrrf.exe 42 PID 468 wrote to memory of 2176 468 7rrxfrf.exe 43 PID 468 wrote to memory of 2176 468 7rrxfrf.exe 43 PID 468 wrote to memory of 2176 468 7rrxfrf.exe 43 PID 468 wrote to memory of 2176 468 7rrxfrf.exe 43 PID 2176 wrote to memory of 2160 2176 hbnthh.exe 44 PID 2176 wrote to memory of 2160 2176 hbnthh.exe 44 PID 2176 wrote to memory of 2160 2176 hbnthh.exe 44 PID 2176 wrote to memory of 2160 2176 hbnthh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe"C:\Users\Admin\AppData\Local\Temp\354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\tththb.exec:\tththb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\dvjjj.exec:\dvjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\5jddj.exec:\5jddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hbnbtt.exec:\hbnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ppjvv.exec:\ppjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pjjvd.exec:\pjjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\5lxxffl.exec:\5lxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\hnhtnb.exec:\hnhtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\ttnnnt.exec:\ttnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\3jdpj.exec:\3jdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dvddd.exec:\dvddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xxlrrrf.exec:\xxlrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\7rrxfrf.exec:\7rrxfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\hbnthh.exec:\hbnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\1nhbnt.exec:\1nhbnt.exe17⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jvdvd.exec:\jvdvd.exe18⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rfxxrxf.exec:\rfxxrxf.exe20⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bbtbhn.exec:\bbtbhn.exe21⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dvjpv.exec:\dvjpv.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5pjpp.exec:\5pjpp.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\1rflrfl.exec:\1rflrfl.exe24⤵
- Executes dropped EXE
PID:528 -
\??\c:\xrffrll.exec:\xrffrll.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bthhtn.exec:\bthhtn.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hthbnt.exec:\hthbnt.exe27⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9ppdj.exec:\9ppdj.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dvdvj.exec:\dvdvj.exe29⤵
- Executes dropped EXE
PID:1000 -
\??\c:\fxllxfr.exec:\fxllxfr.exe30⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhbthn.exec:\nhbthn.exe31⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3tnnbh.exec:\3tnnbh.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1vvjj.exec:\1vvjj.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5frlrrx.exec:\5frlrrx.exe34⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xfrxrxx.exec:\xfrxrxx.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbtbnn.exec:\hbtbnn.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3hbbnn.exec:\3hbbnn.exe37⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjppj.exec:\pjppj.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jjvdv.exec:\jjvdv.exe39⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rfffrfr.exec:\rfffrfr.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\frfxflr.exec:\frfxflr.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7lfrfrl.exec:\7lfrfrl.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\htnhnn.exec:\htnhnn.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7pjvj.exec:\7pjvj.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rffxlfl.exec:\rffxlfl.exe45⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lflrflx.exec:\lflrflx.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7nnnbb.exec:\7nnnbb.exe47⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bbhnhn.exec:\bbhnhn.exe48⤵
- Executes dropped EXE
PID:812 -
\??\c:\djjdp.exec:\djjdp.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5jdjp.exec:\5jdjp.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1lrrxxf.exec:\1lrrxxf.exe51⤵
- Executes dropped EXE
PID:292 -
\??\c:\xrxrfxl.exec:\xrxrfxl.exe52⤵
- Executes dropped EXE
PID:860 -
\??\c:\3hbhhh.exec:\3hbhhh.exe53⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bhtttb.exec:\bhtttb.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjjjd.exec:\pjjjd.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjppv.exec:\vjppv.exe56⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9lfrrrx.exec:\9lfrrrx.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxrxflr.exec:\fxrxflr.exe58⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tnbhnt.exec:\tnbhnt.exe59⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nnbtbb.exec:\nnbtbb.exe60⤵
- Executes dropped EXE
PID:792 -
\??\c:\ddvjj.exec:\ddvjj.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jpdvd.exec:\jpdvd.exe62⤵
- Executes dropped EXE
PID:656 -
\??\c:\rfrlrxf.exec:\rfrlrxf.exe63⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fxfxxlx.exec:\fxfxxlx.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hbhbbb.exec:\hbhbbb.exe65⤵
- Executes dropped EXE
PID:704 -
\??\c:\tnnthh.exec:\tnnthh.exe66⤵PID:916
-
\??\c:\1btbbh.exec:\1btbbh.exe67⤵PID:1908
-
\??\c:\pdppv.exec:\pdppv.exe68⤵PID:1988
-
\??\c:\ppjvp.exec:\ppjvp.exe69⤵PID:628
-
\??\c:\3xlrlfl.exec:\3xlrlfl.exe70⤵PID:2356
-
\??\c:\lrlllfr.exec:\lrlllfr.exe71⤵PID:1596
-
\??\c:\7thttb.exec:\7thttb.exe72⤵PID:2784
-
\??\c:\tnhhtt.exec:\tnhhtt.exe73⤵PID:1732
-
\??\c:\9pdjj.exec:\9pdjj.exe74⤵PID:1972
-
\??\c:\jjvvj.exec:\jjvvj.exe75⤵PID:1532
-
\??\c:\xxllrrx.exec:\xxllrrx.exe76⤵PID:2580
-
\??\c:\fxlrxxx.exec:\fxlrxxx.exe77⤵PID:2528
-
\??\c:\nbhhnn.exec:\nbhhnn.exe78⤵PID:2596
-
\??\c:\hthhhn.exec:\hthhhn.exe79⤵PID:2540
-
\??\c:\vpddp.exec:\vpddp.exe80⤵PID:2304
-
\??\c:\ppjvd.exec:\ppjvd.exe81⤵PID:2408
-
\??\c:\5lflrxx.exec:\5lflrxx.exe82⤵PID:2396
-
\??\c:\5lxfffl.exec:\5lxfffl.exe83⤵PID:2508
-
\??\c:\tnthtn.exec:\tnthtn.exe84⤵PID:2860
-
\??\c:\bbtbnn.exec:\bbtbnn.exe85⤵PID:2404
-
\??\c:\dpppj.exec:\dpppj.exe86⤵PID:1256
-
\??\c:\vppvd.exec:\vppvd.exe87⤵PID:2484
-
\??\c:\3jvpv.exec:\3jvpv.exe88⤵PID:2616
-
\??\c:\lxflxxr.exec:\lxflxxr.exe89⤵PID:2724
-
\??\c:\lflxlll.exec:\lflxlll.exe90⤵PID:1572
-
\??\c:\hbnbhn.exec:\hbnbhn.exe91⤵PID:1452
-
\??\c:\tnbhhh.exec:\tnbhhh.exe92⤵PID:2268
-
\??\c:\1pdjj.exec:\1pdjj.exe93⤵PID:292
-
\??\c:\pvdvv.exec:\pvdvv.exe94⤵PID:1260
-
\??\c:\7fffxxx.exec:\7fffxxx.exe95⤵PID:2028
-
\??\c:\fflrfxf.exec:\fflrfxf.exe96⤵PID:2804
-
\??\c:\tnhnbb.exec:\tnhnbb.exe97⤵PID:1540
-
\??\c:\thnnnn.exec:\thnnnn.exe98⤵PID:2212
-
\??\c:\tnbtbt.exec:\tnbtbt.exe99⤵PID:1940
-
\??\c:\jdppp.exec:\jdppp.exe100⤵PID:1960
-
\??\c:\vpvvv.exec:\vpvvv.exe101⤵PID:1744
-
\??\c:\xlrxffr.exec:\xlrxffr.exe102⤵PID:1420
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe103⤵PID:564
-
\??\c:\tbbbhb.exec:\tbbbhb.exe104⤵PID:2344
-
\??\c:\btbbtt.exec:\btbbtt.exe105⤵PID:2348
-
\??\c:\jvdvv.exec:\jvdvv.exe106⤵PID:2216
-
\??\c:\1pvvd.exec:\1pvvd.exe107⤵PID:1868
-
\??\c:\djvvv.exec:\djvvv.exe108⤵PID:1792
-
\??\c:\fxflrrf.exec:\fxflrrf.exe109⤵PID:1908
-
\??\c:\xfllrxx.exec:\xfllrxx.exe110⤵PID:804
-
\??\c:\thhhnt.exec:\thhhnt.exe111⤵PID:2768
-
\??\c:\htbhhn.exec:\htbhhn.exe112⤵PID:2172
-
\??\c:\hhnttt.exec:\hhnttt.exe113⤵PID:1596
-
\??\c:\pdjjj.exec:\pdjjj.exe114⤵PID:2192
-
\??\c:\dvddp.exec:\dvddp.exe115⤵PID:2076
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe116⤵PID:2468
-
\??\c:\3fxxffr.exec:\3fxxffr.exe117⤵PID:1036
-
\??\c:\frrrxxx.exec:\frrrxxx.exe118⤵PID:2492
-
\??\c:\bhnnhh.exec:\bhnnhh.exe119⤵PID:2544
-
\??\c:\btbhtt.exec:\btbhtt.exe120⤵PID:2660
-
\??\c:\vvdpp.exec:\vvdpp.exe121⤵PID:2148
-
\??\c:\9dppv.exec:\9dppv.exe122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-