Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe
-
Size
84KB
-
MD5
423959f9dda91641b41a383a97b05993
-
SHA1
090e84b0bcdbb763418b5e221fc3828626d6a957
-
SHA256
9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197
-
SHA512
7fd1351e380f9aca6a967800269b5548309a3e530154d435ba4038e7ef5d5b681cb861112e86e13d932551877cfc12c0893292fe4158b91f2567723ff4ee6d5a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/K0Xt:ymb3NkkiQ3mdBjFo73tvn+Yp99zx
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/1780-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral1/memory/1780-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2028-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2028-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2028-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2116-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2664-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/760-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1420-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2212-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/568-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1540-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1244-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/320-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/632-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/948-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2860-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3016-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/848-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/876-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2028 xffxrlr.exe 2116 fxrfrxf.exe 2620 ttbttt.exe 2664 lrrlxxx.exe 2652 3ddjd.exe 2720 5rrflrf.exe 2472 dvvjj.exe 2904 pppjp.exe 760 ddddd.exe 1420 3lrrxll.exe 2776 ntbtht.exe 2212 llffffx.exe 1948 bnbbbn.exe 1996 9vpvj.exe 1848 bnthhb.exe 568 ddpjv.exe 2176 rxxffrf.exe 1540 tntthh.exe 2264 5dddd.exe 1244 1xfflxr.exe 2456 3pjvj.exe 320 rxlrffl.exe 632 vjppp.exe 2316 fllrrrf.exe 948 bhtntn.exe 2860 rlfxlxx.exe 3016 1djpj.exe 848 3lxrlxf.exe 1368 thbtth.exe 2852 vvpvj.exe 876 lrrlfxr.exe 2940 ntbbtn.exe 1952 ttttth.exe 2656 1dpjp.exe 2416 rfrrxrx.exe 2668 btbtbn.exe 2616 jjvvj.exe 2728 rrrffxf.exe 1700 hhtbtb.exe 2920 pjdpd.exe 2180 7xlrxrx.exe 2504 bbbhnt.exe 2112 1pjvj.exe 2144 fxrrfff.exe 1688 nbbhnn.exe 2572 dvvdd.exe 2712 lrlfxrl.exe 2004 bbnbbn.exe 844 jpjjp.exe 1980 rrfflrf.exe 1296 rrrlxlf.exe 2396 9bhbbb.exe 1292 jjvdp.exe 1568 lrlfflf.exe 2280 nnhtnt.exe 2228 jdvpj.exe 2276 xrfflxf.exe 1888 5thbtb.exe 1264 pddpj.exe 668 lxlfllr.exe 572 bhnbbt.exe 2104 pvddj.exe 1656 lxlllrf.exe 2296 llxfrxl.exe -
resource yara_rule behavioral1/memory/1780-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2028 1780 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 28 PID 1780 wrote to memory of 2028 1780 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 28 PID 1780 wrote to memory of 2028 1780 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 28 PID 1780 wrote to memory of 2028 1780 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 28 PID 2028 wrote to memory of 2116 2028 xffxrlr.exe 29 PID 2028 wrote to memory of 2116 2028 xffxrlr.exe 29 PID 2028 wrote to memory of 2116 2028 xffxrlr.exe 29 PID 2028 wrote to memory of 2116 2028 xffxrlr.exe 29 PID 2116 wrote to memory of 2620 2116 fxrfrxf.exe 30 PID 2116 wrote to memory of 2620 2116 fxrfrxf.exe 30 PID 2116 wrote to memory of 2620 2116 fxrfrxf.exe 30 PID 2116 wrote to memory of 2620 2116 fxrfrxf.exe 30 PID 2620 wrote to memory of 2664 2620 ttbttt.exe 31 PID 2620 wrote to memory of 2664 2620 ttbttt.exe 31 PID 2620 wrote to memory of 2664 2620 ttbttt.exe 31 PID 2620 wrote to memory of 2664 2620 ttbttt.exe 31 PID 2664 wrote to memory of 2652 2664 lrrlxxx.exe 32 PID 2664 wrote to memory of 2652 2664 lrrlxxx.exe 32 PID 2664 wrote to memory of 2652 2664 lrrlxxx.exe 32 PID 2664 wrote to memory of 2652 2664 lrrlxxx.exe 32 PID 2652 wrote to memory of 2720 2652 3ddjd.exe 33 PID 2652 wrote to memory of 2720 2652 3ddjd.exe 33 PID 2652 wrote to memory of 2720 2652 3ddjd.exe 33 PID 2652 wrote to memory of 2720 2652 3ddjd.exe 33 PID 2720 wrote to memory of 2472 2720 5rrflrf.exe 34 PID 2720 wrote to memory of 2472 2720 5rrflrf.exe 34 PID 2720 wrote to memory of 2472 2720 5rrflrf.exe 34 PID 2720 wrote to memory of 2472 2720 5rrflrf.exe 34 PID 2472 wrote to memory of 2904 2472 dvvjj.exe 35 PID 2472 wrote to memory of 2904 2472 dvvjj.exe 35 PID 2472 wrote to memory of 2904 2472 dvvjj.exe 35 PID 2472 wrote to memory of 2904 2472 dvvjj.exe 35 PID 2904 wrote to memory of 760 2904 pppjp.exe 36 PID 2904 wrote to memory of 760 2904 pppjp.exe 36 PID 2904 wrote to memory of 760 2904 pppjp.exe 36 PID 2904 wrote to memory of 760 2904 pppjp.exe 36 PID 760 wrote to memory of 1420 760 ddddd.exe 37 PID 760 wrote to memory of 1420 760 ddddd.exe 37 PID 760 wrote to memory of 1420 760 ddddd.exe 37 PID 760 wrote to memory of 1420 760 ddddd.exe 37 PID 1420 wrote to memory of 2776 1420 3lrrxll.exe 38 PID 1420 wrote to memory of 2776 1420 3lrrxll.exe 38 PID 1420 wrote to memory of 2776 1420 3lrrxll.exe 38 PID 1420 wrote to memory of 2776 1420 3lrrxll.exe 38 PID 2776 wrote to memory of 2212 2776 ntbtht.exe 39 PID 2776 wrote to memory of 2212 2776 ntbtht.exe 39 PID 2776 wrote to memory of 2212 2776 ntbtht.exe 39 PID 2776 wrote to memory of 2212 2776 ntbtht.exe 39 PID 2212 wrote to memory of 1948 2212 llffffx.exe 40 PID 2212 wrote to memory of 1948 2212 llffffx.exe 40 PID 2212 wrote to memory of 1948 2212 llffffx.exe 40 PID 2212 wrote to memory of 1948 2212 llffffx.exe 40 PID 1948 wrote to memory of 1996 1948 bnbbbn.exe 41 PID 1948 wrote to memory of 1996 1948 bnbbbn.exe 41 PID 1948 wrote to memory of 1996 1948 bnbbbn.exe 41 PID 1948 wrote to memory of 1996 1948 bnbbbn.exe 41 PID 1996 wrote to memory of 1848 1996 9vpvj.exe 42 PID 1996 wrote to memory of 1848 1996 9vpvj.exe 42 PID 1996 wrote to memory of 1848 1996 9vpvj.exe 42 PID 1996 wrote to memory of 1848 1996 9vpvj.exe 42 PID 1848 wrote to memory of 568 1848 bnthhb.exe 43 PID 1848 wrote to memory of 568 1848 bnthhb.exe 43 PID 1848 wrote to memory of 568 1848 bnthhb.exe 43 PID 1848 wrote to memory of 568 1848 bnthhb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe"C:\Users\Admin\AppData\Local\Temp\9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xffxrlr.exec:\xffxrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\ttbttt.exec:\ttbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lrrlxxx.exec:\lrrlxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3ddjd.exec:\3ddjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5rrflrf.exec:\5rrflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dvvjj.exec:\dvvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\pppjp.exec:\pppjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ddddd.exec:\ddddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\3lrrxll.exec:\3lrrxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\ntbtht.exec:\ntbtht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\llffffx.exec:\llffffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bnbbbn.exec:\bnbbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\9vpvj.exec:\9vpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\bnthhb.exec:\bnthhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\ddpjv.exec:\ddpjv.exe17⤵
- Executes dropped EXE
PID:568 -
\??\c:\rxxffrf.exec:\rxxffrf.exe18⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tntthh.exec:\tntthh.exe19⤵
- Executes dropped EXE
PID:1540 -
\??\c:\5dddd.exec:\5dddd.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1xfflxr.exec:\1xfflxr.exe21⤵
- Executes dropped EXE
PID:1244 -
\??\c:\3pjvj.exec:\3pjvj.exe22⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rxlrffl.exec:\rxlrffl.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\vjppp.exec:\vjppp.exe24⤵
- Executes dropped EXE
PID:632 -
\??\c:\fllrrrf.exec:\fllrrrf.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bhtntn.exec:\bhtntn.exe26⤵
- Executes dropped EXE
PID:948 -
\??\c:\rlfxlxx.exec:\rlfxlxx.exe27⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1djpj.exec:\1djpj.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3lxrlxf.exec:\3lxrlxf.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\thbtth.exec:\thbtth.exe30⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\ntbbtn.exec:\ntbbtn.exe33⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xfxrxrr.exec:\xfxrxrr.exe34⤵PID:1680
-
\??\c:\ttttth.exec:\ttttth.exe35⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1dpjp.exec:\1dpjp.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe37⤵
- Executes dropped EXE
PID:2416 -
\??\c:\btbtbn.exec:\btbtbn.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jjvvj.exec:\jjvvj.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rrrffxf.exec:\rrrffxf.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hhtbtb.exec:\hhtbtb.exe41⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pjdpd.exec:\pjdpd.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7xlrxrx.exec:\7xlrxrx.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bbbhnt.exec:\bbbhnt.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1pjvj.exec:\1pjvj.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxrrfff.exec:\fxrrfff.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nbbhnn.exec:\nbbhnn.exe47⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dvvdd.exec:\dvvdd.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe49⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bbnbbn.exec:\bbnbbn.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jpjjp.exec:\jpjjp.exe51⤵
- Executes dropped EXE
PID:844 -
\??\c:\rrfflrf.exec:\rrfflrf.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rrrlxlf.exec:\rrrlxlf.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9bhbbb.exec:\9bhbbb.exe54⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjvdp.exec:\jjvdp.exe55⤵
- Executes dropped EXE
PID:1292 -
\??\c:\lrlfflf.exec:\lrlfflf.exe56⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nnhtnt.exec:\nnhtnt.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdvpj.exec:\jdvpj.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xrfflxf.exec:\xrfflxf.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5thbtb.exec:\5thbtb.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pddpj.exec:\pddpj.exe61⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lxlfllr.exec:\lxlfllr.exe62⤵
- Executes dropped EXE
PID:668 -
\??\c:\bhnbbt.exec:\bhnbbt.exe63⤵
- Executes dropped EXE
PID:572 -
\??\c:\pvddj.exec:\pvddj.exe64⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lxlllrf.exec:\lxlllrf.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\llxfrxl.exec:\llxfrxl.exe66⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tbhnnn.exec:\tbhnnn.exe67⤵PID:928
-
\??\c:\llrlfrl.exec:\llrlfrl.exe68⤵PID:1620
-
\??\c:\ttbtbn.exec:\ttbtbn.exe69⤵PID:2308
-
\??\c:\1tnnbn.exec:\1tnnbn.exe70⤵PID:2204
-
\??\c:\1pjjj.exec:\1pjjj.exe71⤵PID:2336
-
\??\c:\lfxxflx.exec:\lfxxflx.exe72⤵PID:2036
-
\??\c:\nbnnhh.exec:\nbnnhh.exe73⤵PID:1728
-
\??\c:\1jdvj.exec:\1jdvj.exe74⤵PID:1724
-
\??\c:\3rrrfrf.exec:\3rrrfrf.exe75⤵PID:1708
-
\??\c:\bbbbtt.exec:\bbbbtt.exe76⤵PID:1924
-
\??\c:\tnhbhh.exec:\tnhbhh.exe77⤵PID:2756
-
\??\c:\vpjjd.exec:\vpjjd.exe78⤵PID:2960
-
\??\c:\fxfxxff.exec:\fxfxxff.exe79⤵PID:2660
-
\??\c:\hthhbh.exec:\hthhbh.exe80⤵PID:2692
-
\??\c:\jvjjp.exec:\jvjjp.exe81⤵PID:2604
-
\??\c:\3xfxlxx.exec:\3xfxlxx.exe82⤵PID:2744
-
\??\c:\bthntb.exec:\bthntb.exe83⤵PID:2496
-
\??\c:\vpjdv.exec:\vpjdv.exe84⤵PID:2528
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe85⤵PID:2492
-
\??\c:\bnttbb.exec:\bnttbb.exe86⤵PID:2524
-
\??\c:\vvdjp.exec:\vvdjp.exe87⤵PID:2548
-
\??\c:\5lxffll.exec:\5lxffll.exe88⤵PID:2128
-
\??\c:\3xlrfrr.exec:\3xlrfrr.exe89⤵PID:2448
-
\??\c:\btthhh.exec:\btthhh.exe90⤵PID:1660
-
\??\c:\vdddd.exec:\vdddd.exe91⤵PID:2404
-
\??\c:\1fxfrfx.exec:\1fxfrfx.exe92⤵PID:1904
-
\??\c:\hhhhbh.exec:\hhhhbh.exe93⤵PID:1964
-
\??\c:\7jdvp.exec:\7jdvp.exe94⤵PID:1948
-
\??\c:\dpjvj.exec:\dpjvj.exe95⤵PID:2364
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe96⤵PID:612
-
\??\c:\nthntt.exec:\nthntt.exe97⤵PID:2368
-
\??\c:\ppjpj.exec:\ppjpj.exe98⤵PID:1604
-
\??\c:\vvvdv.exec:\vvvdv.exe99⤵PID:1496
-
\??\c:\bnnhnh.exec:\bnnhnh.exe100⤵PID:1540
-
\??\c:\pdvvj.exec:\pdvvj.exe101⤵PID:1900
-
\??\c:\llflflf.exec:\llflflf.exe102⤵PID:2832
-
\??\c:\pvvjj.exec:\pvvjj.exe103⤵PID:1772
-
\??\c:\xrlfxxf.exec:\xrlfxxf.exe104⤵PID:1240
-
\??\c:\httbhb.exec:\httbhb.exe105⤵PID:1084
-
\??\c:\ppppd.exec:\ppppd.exe106⤵PID:1752
-
\??\c:\lrfrfxr.exec:\lrfrfxr.exe107⤵PID:1632
-
\??\c:\nbtbnt.exec:\nbtbnt.exe108⤵PID:3056
-
\??\c:\vdvpv.exec:\vdvpv.exe109⤵PID:1644
-
\??\c:\rfrlrfx.exec:\rfrlrfx.exe110⤵PID:880
-
\??\c:\1lxxffx.exec:\1lxxffx.exe111⤵PID:2220
-
\??\c:\9ppvj.exec:\9ppvj.exe112⤵PID:2812
-
\??\c:\djvvd.exec:\djvvd.exe113⤵PID:580
-
\??\c:\lllfrxf.exec:\lllfrxf.exe114⤵PID:888
-
\??\c:\btnbhn.exec:\btnbhn.exe115⤵PID:2992
-
\??\c:\djpjp.exec:\djpjp.exe116⤵PID:876
-
\??\c:\flrlxff.exec:\flrlxff.exe117⤵PID:1696
-
\??\c:\9nnbnt.exec:\9nnbnt.exe118⤵PID:2552
-
\??\c:\vjpvp.exec:\vjpvp.exe119⤵PID:1320
-
\??\c:\xflrllf.exec:\xflrllf.exe120⤵PID:2612
-
\??\c:\xfrrlff.exec:\xfrrlff.exe121⤵PID:2684
-
\??\c:\btntnt.exec:\btntnt.exe122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-