Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe
-
Size
66KB
-
MD5
a55eb07619918ae5d33b80a48e378d92
-
SHA1
1c467a58b76d727113de3f4a13809eceae87cd9b
-
SHA256
462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93
-
SHA512
0628c9186efba7cd11c50c56ae6208c5f197e8a0b55eb1a86e0a5a508483da53576302a25679958783488518242b8e806edd6f83a15b7eecfbf41042977944ee
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIw:ymb3NkkiQ3mdBjFIFdJ8b2
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2240-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1300-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3040-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2080-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2080-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3028-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/864-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1700-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1300-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/644-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/580-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2256-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1768-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3040 jvvjp.exe 2976 frlrrrx.exe 2668 hbhhtt.exe 2080 7lffxlr.exe 2616 nhttnt.exe 2592 ttnbtb.exe 2452 dpjdd.exe 2916 lrffffr.exe 1892 hbnbnb.exe 2632 hbhnhb.exe 3028 dvpvv.exe 1708 vpjjj.exe 2336 rlxffll.exe 864 thnnnt.exe 2012 hbhhnn.exe 2504 dvjdj.exe 1700 lxfflff.exe 1300 rxxffrf.exe 644 nhnnnh.exe 3064 bntbhh.exe 2040 5vpvd.exe 488 frfrxxr.exe 580 5xfxlxf.exe 2256 3ntttb.exe 288 bttthb.exe 624 dvvdv.exe 2540 fxlfffl.exe 2840 lxxlfrf.exe 1768 bhbbht.exe 2960 thbtnn.exe 916 jvddp.exe 1908 flrffrl.exe 3036 xfrflrf.exe 2584 ttntnb.exe 1732 bnhhhh.exe 2988 pjdpv.exe 2604 7vjdd.exe 2720 xlflxlr.exe 2712 frfxfxx.exe 2832 ntttbt.exe 2624 1nbhhh.exe 1184 nbtnnh.exe 2456 vjppj.exe 2928 9pvpj.exe 2968 rflxxrx.exe 2792 9flrxll.exe 2764 3htnbn.exe 1600 htbttb.exe 2004 7vjjp.exe 1708 3jppv.exe 380 5xrrrrr.exe 1072 lrlflrl.exe 2696 bbbnnt.exe 1052 htbhbb.exe 1616 dvjpp.exe 1700 9pvpp.exe 2860 lffxxlx.exe 2308 rffxlrx.exe 2440 9rxllfx.exe 384 bnttbb.exe 2040 ththbb.exe 564 jjjdd.exe 1736 9pvvp.exe 1500 tbnhhb.exe -
resource yara_rule behavioral1/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1300-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 3040 2240 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 28 PID 2240 wrote to memory of 3040 2240 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 28 PID 2240 wrote to memory of 3040 2240 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 28 PID 2240 wrote to memory of 3040 2240 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 28 PID 3040 wrote to memory of 2976 3040 jvvjp.exe 29 PID 3040 wrote to memory of 2976 3040 jvvjp.exe 29 PID 3040 wrote to memory of 2976 3040 jvvjp.exe 29 PID 3040 wrote to memory of 2976 3040 jvvjp.exe 29 PID 2976 wrote to memory of 2668 2976 frlrrrx.exe 30 PID 2976 wrote to memory of 2668 2976 frlrrrx.exe 30 PID 2976 wrote to memory of 2668 2976 frlrrrx.exe 30 PID 2976 wrote to memory of 2668 2976 frlrrrx.exe 30 PID 2668 wrote to memory of 2080 2668 hbhhtt.exe 31 PID 2668 wrote to memory of 2080 2668 hbhhtt.exe 31 PID 2668 wrote to memory of 2080 2668 hbhhtt.exe 31 PID 2668 wrote to memory of 2080 2668 hbhhtt.exe 31 PID 2080 wrote to memory of 2616 2080 7lffxlr.exe 32 PID 2080 wrote to memory of 2616 2080 7lffxlr.exe 32 PID 2080 wrote to memory of 2616 2080 7lffxlr.exe 32 PID 2080 wrote to memory of 2616 2080 7lffxlr.exe 32 PID 2616 wrote to memory of 2592 2616 nhttnt.exe 33 PID 2616 wrote to memory of 2592 2616 nhttnt.exe 33 PID 2616 wrote to memory of 2592 2616 nhttnt.exe 33 PID 2616 wrote to memory of 2592 2616 nhttnt.exe 33 PID 2592 wrote to memory of 2452 2592 ttnbtb.exe 34 PID 2592 wrote to memory of 2452 2592 ttnbtb.exe 34 PID 2592 wrote to memory of 2452 2592 ttnbtb.exe 34 PID 2592 wrote to memory of 2452 2592 ttnbtb.exe 34 PID 2452 wrote to memory of 2916 2452 dpjdd.exe 35 PID 2452 wrote to memory of 2916 2452 dpjdd.exe 35 PID 2452 wrote to memory of 2916 2452 dpjdd.exe 35 PID 2452 wrote to memory of 2916 2452 dpjdd.exe 35 PID 2916 wrote to memory of 1892 2916 lrffffr.exe 36 PID 2916 wrote to memory of 1892 2916 lrffffr.exe 36 PID 2916 wrote to memory of 1892 2916 lrffffr.exe 36 PID 2916 wrote to memory of 1892 2916 lrffffr.exe 36 PID 1892 wrote to memory of 2632 1892 hbnbnb.exe 37 PID 1892 wrote to memory of 2632 1892 hbnbnb.exe 37 PID 1892 wrote to memory of 2632 1892 hbnbnb.exe 37 PID 1892 wrote to memory of 2632 1892 hbnbnb.exe 37 PID 2632 wrote to memory of 3028 2632 hbhnhb.exe 38 PID 2632 wrote to memory of 3028 2632 hbhnhb.exe 38 PID 2632 wrote to memory of 3028 2632 hbhnhb.exe 38 PID 2632 wrote to memory of 3028 2632 hbhnhb.exe 38 PID 3028 wrote to memory of 1708 3028 dvpvv.exe 39 PID 3028 wrote to memory of 1708 3028 dvpvv.exe 39 PID 3028 wrote to memory of 1708 3028 dvpvv.exe 39 PID 3028 wrote to memory of 1708 3028 dvpvv.exe 39 PID 1708 wrote to memory of 2336 1708 vpjjj.exe 40 PID 1708 wrote to memory of 2336 1708 vpjjj.exe 40 PID 1708 wrote to memory of 2336 1708 vpjjj.exe 40 PID 1708 wrote to memory of 2336 1708 vpjjj.exe 40 PID 2336 wrote to memory of 864 2336 rlxffll.exe 41 PID 2336 wrote to memory of 864 2336 rlxffll.exe 41 PID 2336 wrote to memory of 864 2336 rlxffll.exe 41 PID 2336 wrote to memory of 864 2336 rlxffll.exe 41 PID 864 wrote to memory of 2012 864 thnnnt.exe 42 PID 864 wrote to memory of 2012 864 thnnnt.exe 42 PID 864 wrote to memory of 2012 864 thnnnt.exe 42 PID 864 wrote to memory of 2012 864 thnnnt.exe 42 PID 2012 wrote to memory of 2504 2012 hbhhnn.exe 43 PID 2012 wrote to memory of 2504 2012 hbhhnn.exe 43 PID 2012 wrote to memory of 2504 2012 hbhhnn.exe 43 PID 2012 wrote to memory of 2504 2012 hbhhnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe"C:\Users\Admin\AppData\Local\Temp\462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jvvjp.exec:\jvvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\frlrrrx.exec:\frlrrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hbhhtt.exec:\hbhhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7lffxlr.exec:\7lffxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\nhttnt.exec:\nhttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ttnbtb.exec:\ttnbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\dpjdd.exec:\dpjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\lrffffr.exec:\lrffffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\hbnbnb.exec:\hbnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\hbhnhb.exec:\hbhnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dvpvv.exec:\dvpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\vpjjj.exec:\vpjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\rlxffll.exec:\rlxffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\thnnnt.exec:\thnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\hbhhnn.exec:\hbhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\dvjdj.exec:\dvjdj.exe17⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lxfflff.exec:\lxfflff.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rxxffrf.exec:\rxxffrf.exe19⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nhnnnh.exec:\nhnnnh.exe20⤵
- Executes dropped EXE
PID:644 -
\??\c:\bntbhh.exec:\bntbhh.exe21⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5vpvd.exec:\5vpvd.exe22⤵
- Executes dropped EXE
PID:2040 -
\??\c:\frfrxxr.exec:\frfrxxr.exe23⤵
- Executes dropped EXE
PID:488 -
\??\c:\5xfxlxf.exec:\5xfxlxf.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\3ntttb.exec:\3ntttb.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bttthb.exec:\bttthb.exe26⤵
- Executes dropped EXE
PID:288 -
\??\c:\dvvdv.exec:\dvvdv.exe27⤵
- Executes dropped EXE
PID:624 -
\??\c:\fxlfffl.exec:\fxlfffl.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lxxlfrf.exec:\lxxlfrf.exe29⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bhbbht.exec:\bhbbht.exe30⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thbtnn.exec:\thbtnn.exe31⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvddp.exec:\jvddp.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\flrffrl.exec:\flrffrl.exe33⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xfrflrf.exec:\xfrflrf.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ttntnb.exec:\ttntnb.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bnhhhh.exec:\bnhhhh.exe36⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pjdpv.exec:\pjdpv.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7vjdd.exec:\7vjdd.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xlflxlr.exec:\xlflxlr.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\frfxfxx.exec:\frfxfxx.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ntttbt.exec:\ntttbt.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1nbhhh.exec:\1nbhhh.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbtnnh.exec:\nbtnnh.exe43⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vjppj.exec:\vjppj.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\9pvpj.exec:\9pvpj.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rflxxrx.exec:\rflxxrx.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9flrxll.exec:\9flrxll.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3htnbn.exec:\3htnbn.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\htbttb.exec:\htbttb.exe49⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7vjjp.exec:\7vjjp.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3jppv.exec:\3jppv.exe51⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5xrrrrr.exec:\5xrrrrr.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrlflrl.exec:\lrlflrl.exe53⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bbbnnt.exec:\bbbnnt.exe54⤵
- Executes dropped EXE
PID:2696 -
\??\c:\htbhbb.exec:\htbhbb.exe55⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dvjpp.exec:\dvjpp.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9pvpp.exec:\9pvpp.exe57⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lffxxlx.exec:\lffxxlx.exe58⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rffxlrx.exec:\rffxlrx.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9rxllfx.exec:\9rxllfx.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bnttbb.exec:\bnttbb.exe61⤵
- Executes dropped EXE
PID:384 -
\??\c:\ththbb.exec:\ththbb.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jjjdd.exec:\jjjdd.exe63⤵
- Executes dropped EXE
PID:564 -
\??\c:\9pvvp.exec:\9pvvp.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tbnhhb.exec:\tbnhhb.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnthbt.exec:\tnthbt.exe66⤵PID:452
-
\??\c:\5jdpp.exec:\5jdpp.exe67⤵PID:1048
-
\??\c:\7jvdd.exec:\7jvdd.exe68⤵PID:2856
-
\??\c:\7lxllfx.exec:\7lxllfx.exe69⤵PID:1688
-
\??\c:\rlxflxf.exec:\rlxflxf.exe70⤵PID:2900
-
\??\c:\tnhbhb.exec:\tnhbhb.exe71⤵PID:572
-
\??\c:\9hnbbb.exec:\9hnbbb.exe72⤵PID:2220
-
\??\c:\jvddd.exec:\jvddd.exe73⤵PID:2960
-
\??\c:\jvvvj.exec:\jvvvj.exe74⤵PID:2740
-
\??\c:\9lrlfll.exec:\9lrlfll.exe75⤵PID:2380
-
\??\c:\3xlxfxf.exec:\3xlxfxf.exe76⤵PID:2136
-
\??\c:\nnthtb.exec:\nnthtb.exe77⤵PID:3040
-
\??\c:\5nhtbb.exec:\5nhtbb.exe78⤵PID:2088
-
\??\c:\pjjpp.exec:\pjjpp.exe79⤵PID:2680
-
\??\c:\pjvdp.exec:\pjvdp.exe80⤵PID:2612
-
\??\c:\fxfllff.exec:\fxfllff.exe81⤵PID:2580
-
\??\c:\lxlflll.exec:\lxlflll.exe82⤵PID:2492
-
\??\c:\tbbbnb.exec:\tbbbnb.exe83⤵PID:2480
-
\??\c:\9tnnhb.exec:\9tnnhb.exe84⤵PID:2572
-
\??\c:\1tbbtt.exec:\1tbbtt.exe85⤵PID:2568
-
\??\c:\dpppv.exec:\dpppv.exe86⤵PID:2500
-
\??\c:\pdvdd.exec:\pdvdd.exe87⤵PID:2204
-
\??\c:\9fxflrl.exec:\9fxflrl.exe88⤵PID:2928
-
\??\c:\xrfffff.exec:\xrfffff.exe89⤵PID:2916
-
\??\c:\1hbtnt.exec:\1hbtnt.exe90⤵PID:2196
-
\??\c:\5ntbtt.exec:\5ntbtt.exe91⤵PID:2344
-
\??\c:\7pjjp.exec:\7pjjp.exe92⤵PID:1880
-
\??\c:\dvppj.exec:\dvppj.exe93⤵PID:1820
-
\??\c:\jdjvv.exec:\jdjvv.exe94⤵PID:2336
-
\??\c:\fxrfllr.exec:\fxrfllr.exe95⤵PID:1452
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe96⤵PID:1724
-
\??\c:\bnhnnt.exec:\bnhnnt.exe97⤵PID:1668
-
\??\c:\7nbnbh.exec:\7nbnbh.exe98⤵PID:2092
-
\??\c:\djppv.exec:\djppv.exe99⤵PID:2056
-
\??\c:\3dvdj.exec:\3dvdj.exe100⤵PID:1336
-
\??\c:\7xfxlxf.exec:\7xfxlxf.exe101⤵PID:2172
-
\??\c:\5fxfrxr.exec:\5fxfrxr.exe102⤵PID:2308
-
\??\c:\7lxxfff.exec:\7lxxfff.exe103⤵PID:604
-
\??\c:\hhttbn.exec:\hhttbn.exe104⤵PID:1172
-
\??\c:\nbbbbb.exec:\nbbbbb.exe105⤵PID:2144
-
\??\c:\dppvv.exec:\dppvv.exe106⤵PID:1348
-
\??\c:\pjpjj.exec:\pjpjj.exe107⤵PID:1924
-
\??\c:\rflffxl.exec:\rflffxl.exe108⤵PID:1500
-
\??\c:\rfrxxll.exec:\rfrxxll.exe109⤵PID:2944
-
\??\c:\1frxfff.exec:\1frxfff.exe110⤵PID:1048
-
\??\c:\nbntnh.exec:\nbntnh.exe111⤵PID:1640
-
\??\c:\hthntn.exec:\hthntn.exe112⤵PID:1268
-
\??\c:\thhtnt.exec:\thhtnt.exe113⤵PID:2820
-
\??\c:\djppp.exec:\djppp.exe114⤵PID:2272
-
\??\c:\vdpjd.exec:\vdpjd.exe115⤵PID:2220
-
\??\c:\5rrllfr.exec:\5rrllfr.exe116⤵PID:1532
-
\??\c:\fxflrxl.exec:\fxflrxl.exe117⤵PID:912
-
\??\c:\hthbbt.exec:\hthbbt.exe118⤵PID:3020
-
\??\c:\tntbhb.exec:\tntbhb.exe119⤵PID:1636
-
\??\c:\1nttnt.exec:\1nttnt.exe120⤵PID:2660
-
\??\c:\jvdvv.exec:\jvdvv.exe121⤵PID:2976
-
\??\c:\vpjpd.exec:\vpjpd.exe122⤵PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-