Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 18:17 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe
-
Size
78KB
-
MD5
239664c882dfbf196dc75cd713388e98
-
SHA1
80b4e49292269a2722ddf6c186137124bc98d271
-
SHA256
05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b
-
SHA512
4411b92b44c5f57c26dcf19e90f89ebfb729bf5736863747000a5ef59759425ea13609f4bdab10ff26e6c6286f0bf867a157e601117dd6a80411add1ddeae1b0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnmUc7kJEsyP:ymb3NkkiQ3mdBjFIgUEXc7kJEFP
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral1/memory/2888-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-9-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-95-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral1/memory/2888-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2212-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1824-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1036-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1276-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/328-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/536-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1484-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1816-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1308-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1996-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2164-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1264-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2120 nnbnbb.exe 2832 1lfrxff.exe 2112 nhttbb.exe 2680 1lxfrxl.exe 2560 hhthth.exe 2740 btbntt.exe 2524 ppjpd.exe 2688 xxrrlxf.exe 2212 7lfxrff.exe 2840 tnhtbn.exe 2956 1ppdd.exe 1284 7lxflrx.exe 1824 9btbnt.exe 1036 hnbhtt.exe 1276 pppjp.exe 2052 7lrrxxl.exe 1796 3hhtnb.exe 328 nbbhnt.exe 2084 jdjjd.exe 2920 fllffrr.exe 2376 hhhtbh.exe 536 nnbnth.exe 764 9vvvd.exe 1484 xrflrrf.exe 1816 thbtbb.exe 1308 htthnb.exe 1996 dvvdj.exe 2200 lxllxxl.exe 804 tbbnhn.exe 2164 3jpdv.exe 1264 7vdjj.exe 1516 fffxxlf.exe 1560 nhtthn.exe 1612 1jvjj.exe 2088 dpvdj.exe 2724 5lffxll.exe 2720 bththb.exe 2648 btnntb.exe 2836 hbntnt.exe 2564 ppppv.exe 2636 vjpvj.exe 2544 rllxflx.exe 2600 bbnnbn.exe 2128 nhttnn.exe 3000 ppjpd.exe 1344 pvpvd.exe 2972 fflflrr.exe 2300 xrxfxxf.exe 1928 9nnttn.exe 1804 ntbttb.exe 1628 pppjj.exe 1644 jdvjp.exe 1432 rlrrffx.exe 756 fxrrxxl.exe 2060 thbbhn.exe 1776 bnnbtt.exe 1972 5pjjv.exe 2612 jvpvp.exe 2912 xlxrrlf.exe 380 lxfflll.exe 340 tnhhhb.exe 668 dpjpv.exe 836 dvjvp.exe 1484 lrlrxxx.exe -
resource yara_rule behavioral1/memory/2888-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2120 2888 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 28 PID 2888 wrote to memory of 2120 2888 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 28 PID 2888 wrote to memory of 2120 2888 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 28 PID 2888 wrote to memory of 2120 2888 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 28 PID 2120 wrote to memory of 2832 2120 nnbnbb.exe 29 PID 2120 wrote to memory of 2832 2120 nnbnbb.exe 29 PID 2120 wrote to memory of 2832 2120 nnbnbb.exe 29 PID 2120 wrote to memory of 2832 2120 nnbnbb.exe 29 PID 2832 wrote to memory of 2112 2832 1lfrxff.exe 30 PID 2832 wrote to memory of 2112 2832 1lfrxff.exe 30 PID 2832 wrote to memory of 2112 2832 1lfrxff.exe 30 PID 2832 wrote to memory of 2112 2832 1lfrxff.exe 30 PID 2112 wrote to memory of 2680 2112 nhttbb.exe 31 PID 2112 wrote to memory of 2680 2112 nhttbb.exe 31 PID 2112 wrote to memory of 2680 2112 nhttbb.exe 31 PID 2112 wrote to memory of 2680 2112 nhttbb.exe 31 PID 2680 wrote to memory of 2560 2680 1lxfrxl.exe 32 PID 2680 wrote to memory of 2560 2680 1lxfrxl.exe 32 PID 2680 wrote to memory of 2560 2680 1lxfrxl.exe 32 PID 2680 wrote to memory of 2560 2680 1lxfrxl.exe 32 PID 2560 wrote to memory of 2740 2560 hhthth.exe 33 PID 2560 wrote to memory of 2740 2560 hhthth.exe 33 PID 2560 wrote to memory of 2740 2560 hhthth.exe 33 PID 2560 wrote to memory of 2740 2560 hhthth.exe 33 PID 2740 wrote to memory of 2524 2740 btbntt.exe 34 PID 2740 wrote to memory of 2524 2740 btbntt.exe 34 PID 2740 wrote to memory of 2524 2740 btbntt.exe 34 PID 2740 wrote to memory of 2524 2740 btbntt.exe 34 PID 2524 wrote to memory of 2688 2524 ppjpd.exe 35 PID 2524 wrote to memory of 2688 2524 ppjpd.exe 35 PID 2524 wrote to memory of 2688 2524 ppjpd.exe 35 PID 2524 wrote to memory of 2688 2524 ppjpd.exe 35 PID 2688 wrote to memory of 2212 2688 xxrrlxf.exe 36 PID 2688 wrote to memory of 2212 2688 xxrrlxf.exe 36 PID 2688 wrote to memory of 2212 2688 xxrrlxf.exe 36 PID 2688 wrote to memory of 2212 2688 xxrrlxf.exe 36 PID 2212 wrote to memory of 2840 2212 7lfxrff.exe 37 PID 2212 wrote to memory of 2840 2212 7lfxrff.exe 37 PID 2212 wrote to memory of 2840 2212 7lfxrff.exe 37 PID 2212 wrote to memory of 2840 2212 7lfxrff.exe 37 PID 2840 wrote to memory of 2956 2840 tnhtbn.exe 38 PID 2840 wrote to memory of 2956 2840 tnhtbn.exe 38 PID 2840 wrote to memory of 2956 2840 tnhtbn.exe 38 PID 2840 wrote to memory of 2956 2840 tnhtbn.exe 38 PID 2956 wrote to memory of 1284 2956 1ppdd.exe 39 PID 2956 wrote to memory of 1284 2956 1ppdd.exe 39 PID 2956 wrote to memory of 1284 2956 1ppdd.exe 39 PID 2956 wrote to memory of 1284 2956 1ppdd.exe 39 PID 1284 wrote to memory of 1824 1284 7lxflrx.exe 40 PID 1284 wrote to memory of 1824 1284 7lxflrx.exe 40 PID 1284 wrote to memory of 1824 1284 7lxflrx.exe 40 PID 1284 wrote to memory of 1824 1284 7lxflrx.exe 40 PID 1824 wrote to memory of 1036 1824 9btbnt.exe 41 PID 1824 wrote to memory of 1036 1824 9btbnt.exe 41 PID 1824 wrote to memory of 1036 1824 9btbnt.exe 41 PID 1824 wrote to memory of 1036 1824 9btbnt.exe 41 PID 1036 wrote to memory of 1276 1036 hnbhtt.exe 42 PID 1036 wrote to memory of 1276 1036 hnbhtt.exe 42 PID 1036 wrote to memory of 1276 1036 hnbhtt.exe 42 PID 1036 wrote to memory of 1276 1036 hnbhtt.exe 42 PID 1276 wrote to memory of 2052 1276 pppjp.exe 43 PID 1276 wrote to memory of 2052 1276 pppjp.exe 43 PID 1276 wrote to memory of 2052 1276 pppjp.exe 43 PID 1276 wrote to memory of 2052 1276 pppjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe"C:\Users\Admin\AppData\Local\Temp\05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nnbnbb.exec:\nnbnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\1lfrxff.exec:\1lfrxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nhttbb.exec:\nhttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\1lxfrxl.exec:\1lxfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hhthth.exec:\hhthth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\btbntt.exec:\btbntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ppjpd.exec:\ppjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xxrrlxf.exec:\xxrrlxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7lfxrff.exec:\7lfxrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\tnhtbn.exec:\tnhtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1ppdd.exec:\1ppdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\7lxflrx.exec:\7lxflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\9btbnt.exec:\9btbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hnbhtt.exec:\hnbhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\pppjp.exec:\pppjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\7lrrxxl.exec:\7lrrxxl.exe17⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3hhtnb.exec:\3hhtnb.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nbbhnt.exec:\nbbhnt.exe19⤵
- Executes dropped EXE
PID:328 -
\??\c:\jdjjd.exec:\jdjjd.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fllffrr.exec:\fllffrr.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hhhtbh.exec:\hhhtbh.exe22⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nnbnth.exec:\nnbnth.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\9vvvd.exec:\9vvvd.exe24⤵
- Executes dropped EXE
PID:764 -
\??\c:\xrflrrf.exec:\xrflrrf.exe25⤵
- Executes dropped EXE
PID:1484 -
\??\c:\thbtbb.exec:\thbtbb.exe26⤵
- Executes dropped EXE
PID:1816 -
\??\c:\htthnb.exec:\htthnb.exe27⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dvvdj.exec:\dvvdj.exe28⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lxllxxl.exec:\lxllxxl.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tbbnhn.exec:\tbbnhn.exe30⤵
- Executes dropped EXE
PID:804 -
\??\c:\3jpdv.exec:\3jpdv.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7vdjj.exec:\7vdjj.exe32⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fffxxlf.exec:\fffxxlf.exe33⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nhtthn.exec:\nhtthn.exe34⤵
- Executes dropped EXE
PID:1560 -
\??\c:\1jvjj.exec:\1jvjj.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dpvdj.exec:\dpvdj.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5lffxll.exec:\5lffxll.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bththb.exec:\bththb.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\btnntb.exec:\btnntb.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbntnt.exec:\hbntnt.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ppppv.exec:\ppppv.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vjpvj.exec:\vjpvj.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rllxflx.exec:\rllxflx.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbnnbn.exec:\bbnnbn.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nhttnn.exec:\nhttnn.exe45⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ppjpd.exec:\ppjpd.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pvpvd.exec:\pvpvd.exe47⤵
- Executes dropped EXE
PID:1344 -
\??\c:\fflflrr.exec:\fflflrr.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xrxfxxf.exec:\xrxfxxf.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9nnttn.exec:\9nnttn.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ntbttb.exec:\ntbttb.exe51⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pppjj.exec:\pppjj.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jdvjp.exec:\jdvjp.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rlrrffx.exec:\rlrrffx.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe55⤵
- Executes dropped EXE
PID:756 -
\??\c:\thbbhn.exec:\thbbhn.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bnnbtt.exec:\bnnbtt.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5pjjv.exec:\5pjjv.exe58⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jvpvp.exec:\jvpvp.exe59⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xlxrrlf.exec:\xlxrrlf.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxfflll.exec:\lxfflll.exe61⤵
- Executes dropped EXE
PID:380 -
\??\c:\tnhhhb.exec:\tnhhhb.exe62⤵
- Executes dropped EXE
PID:340 -
\??\c:\dpjpv.exec:\dpjpv.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\dvjvp.exec:\dvjvp.exe64⤵
- Executes dropped EXE
PID:836 -
\??\c:\lrlrxxx.exec:\lrlrxxx.exe65⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lrfxxrx.exec:\lrfxxrx.exe66⤵PID:1816
-
\??\c:\tnhbnb.exec:\tnhbnb.exe67⤵PID:888
-
\??\c:\9ttnnn.exec:\9ttnnn.exe68⤵PID:904
-
\??\c:\jjdpd.exec:\jjdpd.exe69⤵PID:1652
-
\??\c:\jjdpj.exec:\jjdpj.exe70⤵PID:2040
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe71⤵PID:2472
-
\??\c:\btttbn.exec:\btttbn.exe72⤵PID:2460
-
\??\c:\nnnhht.exec:\nnnhht.exe73⤵PID:2136
-
\??\c:\jdvjd.exec:\jdvjd.exe74⤵PID:2116
-
\??\c:\dpdvj.exec:\dpdvj.exe75⤵PID:1736
-
\??\c:\lrrrfxl.exec:\lrrrfxl.exe76⤵PID:2400
-
\??\c:\7tnbbn.exec:\7tnbbn.exe77⤵PID:2152
-
\??\c:\nnhtbn.exec:\nnhtbn.exe78⤵PID:2716
-
\??\c:\ppppj.exec:\ppppj.exe79⤵PID:2780
-
\??\c:\dvpvj.exec:\dvpvj.exe80⤵PID:2792
-
\??\c:\3fxlxfl.exec:\3fxlxfl.exe81⤵PID:2808
-
\??\c:\fxxrxfx.exec:\fxxrxfx.exe82⤵PID:2548
-
\??\c:\5thbnb.exec:\5thbnb.exe83⤵PID:1984
-
\??\c:\bbthth.exec:\bbthth.exe84⤵PID:2540
-
\??\c:\5dpdd.exec:\5dpdd.exe85⤵PID:2524
-
\??\c:\jjjvj.exec:\jjjvj.exe86⤵PID:2980
-
\??\c:\3xxrffr.exec:\3xxrffr.exe87⤵PID:2760
-
\??\c:\7tbnnb.exec:\7tbnnb.exe88⤵PID:2756
-
\??\c:\bnthbh.exec:\bnthbh.exe89⤵PID:2840
-
\??\c:\1pvjd.exec:\1pvjd.exe90⤵PID:1272
-
\??\c:\ppvjd.exec:\ppvjd.exe91⤵PID:1812
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe92⤵PID:1792
-
\??\c:\flrffrf.exec:\flrffrf.exe93⤵PID:1948
-
\??\c:\bthnbb.exec:\bthnbb.exe94⤵PID:1964
-
\??\c:\ntthhn.exec:\ntthhn.exe95⤵PID:2752
-
\??\c:\ddppd.exec:\ddppd.exe96⤵PID:1800
-
\??\c:\7dvvd.exec:\7dvvd.exe97⤵PID:1732
-
\??\c:\1fxlflr.exec:\1fxlflr.exe98⤵PID:1728
-
\??\c:\fxllxfr.exec:\fxllxfr.exe99⤵PID:1540
-
\??\c:\nhbhtb.exec:\nhbhtb.exe100⤵PID:2104
-
\??\c:\1tbbhn.exec:\1tbbhn.exe101⤵PID:2368
-
\??\c:\3jpvd.exec:\3jpvd.exe102⤵PID:1684
-
\??\c:\5jdjd.exec:\5jdjd.exe103⤵PID:576
-
\??\c:\xlllfxr.exec:\xlllfxr.exe104⤵PID:656
-
\??\c:\5rrlrrl.exec:\5rrlrrl.exe105⤵PID:560
-
\??\c:\3nhhnn.exec:\3nhhnn.exe106⤵PID:1488
-
\??\c:\ddjvj.exec:\ddjvj.exe107⤵PID:1044
-
\??\c:\dpdjv.exec:\dpdjv.exe108⤵PID:2924
-
\??\c:\flrllxf.exec:\flrllxf.exe109⤵PID:880
-
\??\c:\nnhnnt.exec:\nnhnnt.exe110⤵PID:1996
-
\??\c:\bthntt.exec:\bthntt.exe111⤵PID:2296
-
\??\c:\vpjjd.exec:\vpjjd.exe112⤵PID:2316
-
\??\c:\ddvvd.exec:\ddvvd.exe113⤵PID:2608
-
\??\c:\fxrrxfx.exec:\fxrrxfx.exe114⤵PID:1584
-
\??\c:\5tthbb.exec:\5tthbb.exe115⤵PID:2136
-
\??\c:\3nnbnt.exec:\3nnbnt.exe116⤵PID:2388
-
\??\c:\pjjvd.exec:\pjjvd.exe117⤵PID:2384
-
\??\c:\vpjpv.exec:\vpjpv.exe118⤵PID:3060
-
\??\c:\xrfrxrx.exec:\xrfrxrx.exe119⤵PID:2668
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe120⤵PID:2728
-
\??\c:\hhbnbh.exec:\hhbnbh.exe121⤵PID:2532
-
\??\c:\hhbhnt.exec:\hhbhnt.exe122⤵PID:2180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-