Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 22:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe
-
Size
90KB
-
MD5
b8ab20732cfc88ac7196951f445329ed
-
SHA1
c4e7102f99daa17a707beb4b16b7ffd5d9bdbe0c
-
SHA256
5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77
-
SHA512
177e0c8ca7b9f987bc7faf1b93865bca4ec0aa17ce6d681b9d322de49417f171181ce62480e4799f281aef9a1ace4c6b134e8a6eec1847cb45958eeb2fcd5e3e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBb:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBn
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/1744-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-1407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-2638-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/1744-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2284-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1448-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2432-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1500-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/564-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/640-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/304-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3060-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2284-2638-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2284 rxrlrfx.exe 2348 7nnntb.exe 2740 fxlflff.exe 2096 7hnttb.exe 2864 vpvvj.exe 2568 3llrlrr.exe 2556 5djvv.exe 3008 ppddp.exe 1448 5bntht.exe 2824 nnnbbn.exe 2892 jjvjd.exe 2896 7xflrxx.exe 1824 bttbtb.exe 2432 5dvvd.exe 1796 xxlxrrx.exe 1500 7flxxxf.exe 1280 5ntnnb.exe 2100 vvpvj.exe 1964 xrflflx.exe 2208 3rlrffx.exe 1916 djjdp.exe 564 jjvjp.exe 1268 3xrrflx.exe 640 fxfxrfr.exe 448 tbnnnb.exe 304 ppvjj.exe 3060 ffrflxr.exe 2120 thntbh.exe 560 ppdvd.exe 540 9jpjp.exe 2916 lfrfxlf.exe 2804 tttnbt.exe 1600 vppvd.exe 1124 lxffrrx.exe 2172 fffxrxr.exe 2796 hbntnb.exe 2648 vpjjj.exe 2640 pdvdp.exe 2552 rrfrxfl.exe 2660 fflffll.exe 2528 hbbnhh.exe 2636 ppdjd.exe 2356 dvdjj.exe 1800 rlfxrfx.exe 2812 rlfrxlx.exe 2612 nhhbht.exe 2832 tnnhbt.exe 868 ppdvv.exe 1852 jpvpp.exe 2316 xxrxffr.exe 1828 tnhnbh.exe 1808 7tnntt.exe 2240 dddjv.exe 1260 9pjjd.exe 1212 lfxfrfr.exe 2040 xrlflxx.exe 2100 nbbtth.exe 2508 tnbhnn.exe 2000 jdddj.exe 484 pjjdj.exe 676 xrxxlrl.exe 564 rxllrxr.exe 2992 7bhntt.exe 408 1jdjp.exe -
resource yara_rule behavioral1/memory/1744-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-2638-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2284 1744 5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe 28 PID 1744 wrote to memory of 2284 1744 5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe 28 PID 1744 wrote to memory of 2284 1744 5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe 28 PID 1744 wrote to memory of 2284 1744 5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe 28 PID 2284 wrote to memory of 2348 2284 rxrlrfx.exe 29 PID 2284 wrote to memory of 2348 2284 rxrlrfx.exe 29 PID 2284 wrote to memory of 2348 2284 rxrlrfx.exe 29 PID 2284 wrote to memory of 2348 2284 rxrlrfx.exe 29 PID 2348 wrote to memory of 2740 2348 7nnntb.exe 30 PID 2348 wrote to memory of 2740 2348 7nnntb.exe 30 PID 2348 wrote to memory of 2740 2348 7nnntb.exe 30 PID 2348 wrote to memory of 2740 2348 7nnntb.exe 30 PID 2740 wrote to memory of 2096 2740 fxlflff.exe 31 PID 2740 wrote to memory of 2096 2740 fxlflff.exe 31 PID 2740 wrote to memory of 2096 2740 fxlflff.exe 31 PID 2740 wrote to memory of 2096 2740 fxlflff.exe 31 PID 2096 wrote to memory of 2864 2096 7hnttb.exe 32 PID 2096 wrote to memory of 2864 2096 7hnttb.exe 32 PID 2096 wrote to memory of 2864 2096 7hnttb.exe 32 PID 2096 wrote to memory of 2864 2096 7hnttb.exe 32 PID 2864 wrote to memory of 2568 2864 vpvvj.exe 33 PID 2864 wrote to memory of 2568 2864 vpvvj.exe 33 PID 2864 wrote to memory of 2568 2864 vpvvj.exe 33 PID 2864 wrote to memory of 2568 2864 vpvvj.exe 33 PID 2568 wrote to memory of 2556 2568 3llrlrr.exe 34 PID 2568 wrote to memory of 2556 2568 3llrlrr.exe 34 PID 2568 wrote to memory of 2556 2568 3llrlrr.exe 34 PID 2568 wrote to memory of 2556 2568 3llrlrr.exe 34 PID 2556 wrote to memory of 3008 2556 5djvv.exe 35 PID 2556 wrote to memory of 3008 2556 5djvv.exe 35 PID 2556 wrote to memory of 3008 2556 5djvv.exe 35 PID 2556 wrote to memory of 3008 2556 5djvv.exe 35 PID 3008 wrote to memory of 1448 3008 ppddp.exe 36 PID 3008 wrote to memory of 1448 3008 ppddp.exe 36 PID 3008 wrote to memory of 1448 3008 ppddp.exe 36 PID 3008 wrote to memory of 1448 3008 ppddp.exe 36 PID 1448 wrote to memory of 2824 1448 5bntht.exe 37 PID 1448 wrote to memory of 2824 1448 5bntht.exe 37 PID 1448 wrote to memory of 2824 1448 5bntht.exe 37 PID 1448 wrote to memory of 2824 1448 5bntht.exe 37 PID 2824 wrote to memory of 2892 2824 nnnbbn.exe 38 PID 2824 wrote to memory of 2892 2824 nnnbbn.exe 38 PID 2824 wrote to memory of 2892 2824 nnnbbn.exe 38 PID 2824 wrote to memory of 2892 2824 nnnbbn.exe 38 PID 2892 wrote to memory of 2896 2892 jjvjd.exe 39 PID 2892 wrote to memory of 2896 2892 jjvjd.exe 39 PID 2892 wrote to memory of 2896 2892 jjvjd.exe 39 PID 2892 wrote to memory of 2896 2892 jjvjd.exe 39 PID 2896 wrote to memory of 1824 2896 7xflrxx.exe 40 PID 2896 wrote to memory of 1824 2896 7xflrxx.exe 40 PID 2896 wrote to memory of 1824 2896 7xflrxx.exe 40 PID 2896 wrote to memory of 1824 2896 7xflrxx.exe 40 PID 1824 wrote to memory of 2432 1824 bttbtb.exe 41 PID 1824 wrote to memory of 2432 1824 bttbtb.exe 41 PID 1824 wrote to memory of 2432 1824 bttbtb.exe 41 PID 1824 wrote to memory of 2432 1824 bttbtb.exe 41 PID 2432 wrote to memory of 1796 2432 5dvvd.exe 42 PID 2432 wrote to memory of 1796 2432 5dvvd.exe 42 PID 2432 wrote to memory of 1796 2432 5dvvd.exe 42 PID 2432 wrote to memory of 1796 2432 5dvvd.exe 42 PID 1796 wrote to memory of 1500 1796 xxlxrrx.exe 43 PID 1796 wrote to memory of 1500 1796 xxlxrrx.exe 43 PID 1796 wrote to memory of 1500 1796 xxlxrrx.exe 43 PID 1796 wrote to memory of 1500 1796 xxlxrrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe"C:\Users\Admin\AppData\Local\Temp\5240072ee48d874369bfa590ac3a209e05fa3149fcce689c220c942dcc0a8c77.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\rxrlrfx.exec:\rxrlrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\7nnntb.exec:\7nnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\fxlflff.exec:\fxlflff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7hnttb.exec:\7hnttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vpvvj.exec:\vpvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3llrlrr.exec:\3llrlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\5djvv.exec:\5djvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ppddp.exec:\ppddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\5bntht.exec:\5bntht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\nnnbbn.exec:\nnnbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jjvjd.exec:\jjvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7xflrxx.exec:\7xflrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bttbtb.exec:\bttbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\5dvvd.exec:\5dvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xxlxrrx.exec:\xxlxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\7flxxxf.exec:\7flxxxf.exe17⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5ntnnb.exec:\5ntnnb.exe18⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vvpvj.exec:\vvpvj.exe19⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrflflx.exec:\xrflflx.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3rlrffx.exec:\3rlrffx.exe21⤵
- Executes dropped EXE
PID:2208 -
\??\c:\djjdp.exec:\djjdp.exe22⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jjvjp.exec:\jjvjp.exe23⤵
- Executes dropped EXE
PID:564 -
\??\c:\3xrrflx.exec:\3xrrflx.exe24⤵
- Executes dropped EXE
PID:1268 -
\??\c:\fxfxrfr.exec:\fxfxrfr.exe25⤵
- Executes dropped EXE
PID:640 -
\??\c:\tbnnnb.exec:\tbnnnb.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\ppvjj.exec:\ppvjj.exe27⤵
- Executes dropped EXE
PID:304 -
\??\c:\ffrflxr.exec:\ffrflxr.exe28⤵
- Executes dropped EXE
PID:3060 -
\??\c:\thntbh.exec:\thntbh.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ppdvd.exec:\ppdvd.exe30⤵
- Executes dropped EXE
PID:560 -
\??\c:\9jpjp.exec:\9jpjp.exe31⤵
- Executes dropped EXE
PID:540 -
\??\c:\lfrfxlf.exec:\lfrfxlf.exe32⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tttnbt.exec:\tttnbt.exe33⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vppvd.exec:\vppvd.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lxffrrx.exec:\lxffrrx.exe35⤵
- Executes dropped EXE
PID:1124 -
\??\c:\fffxrxr.exec:\fffxrxr.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hbntnb.exec:\hbntnb.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpjjj.exec:\vpjjj.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pdvdp.exec:\pdvdp.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fflffll.exec:\fflffll.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbbnhh.exec:\hbbnhh.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ppdjd.exec:\ppdjd.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dvdjj.exec:\dvdjj.exe44⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rlfxrfx.exec:\rlfxrfx.exe45⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nhhbht.exec:\nhhbht.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnnhbt.exec:\tnnhbt.exe48⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ppdvv.exec:\ppdvv.exe49⤵
- Executes dropped EXE
PID:868 -
\??\c:\jpvpp.exec:\jpvpp.exe50⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xxrxffr.exec:\xxrxffr.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tnhnbh.exec:\tnhnbh.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7tnntt.exec:\7tnntt.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dddjv.exec:\dddjv.exe54⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9pjjd.exec:\9pjjd.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe56⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xrlflxx.exec:\xrlflxx.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nbbtth.exec:\nbbtth.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tnbhnn.exec:\tnbhnn.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jdddj.exec:\jdddj.exe60⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pjjdj.exec:\pjjdj.exe61⤵
- Executes dropped EXE
PID:484 -
\??\c:\xrxxlrl.exec:\xrxxlrl.exe62⤵
- Executes dropped EXE
PID:676 -
\??\c:\rxllrxr.exec:\rxllrxr.exe63⤵
- Executes dropped EXE
PID:564 -
\??\c:\7bhntt.exec:\7bhntt.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1jdjp.exec:\1jdjp.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvppv.exec:\dvppv.exe66⤵PID:1152
-
\??\c:\rrllrrl.exec:\rrllrrl.exe67⤵PID:1756
-
\??\c:\3tnbnh.exec:\3tnbnh.exe68⤵PID:304
-
\??\c:\tthtnt.exec:\tthtnt.exe69⤵PID:3060
-
\??\c:\jjdjp.exec:\jjdjp.exe70⤵PID:988
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe71⤵PID:1632
-
\??\c:\5rffxxx.exec:\5rffxxx.exe72⤵PID:2032
-
\??\c:\hbtthh.exec:\hbtthh.exe73⤵PID:2420
-
\??\c:\7hbhhb.exec:\7hbhhb.exe74⤵PID:1944
-
\??\c:\jdvvv.exec:\jdvvv.exe75⤵PID:1708
-
\??\c:\pdpjj.exec:\pdpjj.exe76⤵PID:2628
-
\??\c:\rlrlrxl.exec:\rlrlrxl.exe77⤵PID:2632
-
\??\c:\9rrlrxf.exec:\9rrlrxf.exe78⤵PID:2348
-
\??\c:\3bhhtt.exec:\3bhhtt.exe79⤵PID:2532
-
\??\c:\thnbbh.exec:\thnbbh.exe80⤵PID:2656
-
\??\c:\djvpp.exec:\djvpp.exe81⤵PID:2096
-
\??\c:\3rrlllx.exec:\3rrlllx.exe82⤵PID:1996
-
\??\c:\xrllrxr.exec:\xrllrxr.exe83⤵PID:2536
-
\??\c:\nnbnbb.exec:\nnbnbb.exe84⤵PID:2520
-
\??\c:\bthntb.exec:\bthntb.exe85⤵PID:2572
-
\??\c:\dpjpj.exec:\dpjpj.exe86⤵PID:2352
-
\??\c:\jdpjp.exec:\jdpjp.exe87⤵PID:1800
-
\??\c:\1fflxfx.exec:\1fflxfx.exe88⤵PID:2812
-
\??\c:\ffrxxxr.exec:\ffrxxxr.exe89⤵PID:2184
-
\??\c:\1bbnth.exec:\1bbnth.exe90⤵PID:2892
-
\??\c:\tnthnh.exec:\tnthnh.exe91⤵PID:1804
-
\??\c:\3jdpp.exec:\3jdpp.exe92⤵PID:2176
-
\??\c:\vpjjj.exec:\vpjjj.exe93⤵PID:2232
-
\??\c:\jjvvd.exec:\jjvvd.exe94⤵PID:2496
-
\??\c:\fxllllr.exec:\fxllllr.exe95⤵PID:3024
-
\??\c:\nhthtt.exec:\nhthtt.exe96⤵PID:1052
-
\??\c:\hhnhth.exec:\hhnhth.exe97⤵PID:1768
-
\??\c:\hbbhtb.exec:\hbbhtb.exe98⤵PID:2376
-
\??\c:\vpjjv.exec:\vpjjv.exe99⤵PID:2124
-
\??\c:\1rrxffr.exec:\1rrxffr.exe100⤵PID:2060
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe101⤵PID:2452
-
\??\c:\fxlxrlx.exec:\fxlxrlx.exe102⤵PID:1916
-
\??\c:\3nbbnh.exec:\3nbbnh.exe103⤵PID:1492
-
\??\c:\vvpdp.exec:\vvpdp.exe104⤵PID:592
-
\??\c:\vjpvv.exec:\vjpvv.exe105⤵PID:1864
-
\??\c:\xffxrlf.exec:\xffxrlf.exe106⤵PID:3000
-
\??\c:\1xxxrfl.exec:\1xxxrfl.exe107⤵PID:788
-
\??\c:\ttntbb.exec:\ttntbb.exe108⤵PID:2396
-
\??\c:\dvjpj.exec:\dvjpj.exe109⤵PID:1976
-
\??\c:\1jddd.exec:\1jddd.exe110⤵PID:1704
-
\??\c:\lfxlllf.exec:\lfxlllf.exe111⤵PID:2956
-
\??\c:\rrlrffr.exec:\rrlrffr.exe112⤵PID:2072
-
\??\c:\ttnbht.exec:\ttnbht.exe113⤵PID:1984
-
\??\c:\hbtttb.exec:\hbtttb.exe114⤵PID:2244
-
\??\c:\tththn.exec:\tththn.exe115⤵PID:1740
-
\??\c:\3jvjv.exec:\3jvjv.exe116⤵PID:2608
-
\??\c:\5jdjj.exec:\5jdjj.exe117⤵PID:1600
-
\??\c:\xrlxffr.exec:\xrlxffr.exe118⤵PID:2628
-
\??\c:\3xrrfrf.exec:\3xrrfrf.exe119⤵PID:2172
-
\??\c:\1thnnn.exec:\1thnnn.exe120⤵PID:2092
-
\??\c:\1ththb.exec:\1ththb.exe121⤵PID:2684
-
\??\c:\pjppv.exec:\pjppv.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-