Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe
-
Size
95KB
-
MD5
4c533b6ed122abf7387d15b8b3e3e6db
-
SHA1
f8e0028963a1f0c321e451359bf4414d3033d434
-
SHA256
fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588
-
SHA512
ee02519ecd66d39609086d5059fabc397327edaca17438b76079eb1ce36ca1eb5da0d5dfc8b28aeeeba56360f9160ecf131d735bd425890033e10afa9f87f391
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTA:ymb3NkkiQ3mdBjFIj+qNhvZuHQYk
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/408-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral1/memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1744-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2600-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2808-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2764-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2920-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/320-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2268-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1832-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2108-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2152-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/540-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/272-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2324-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/408-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1288-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1744 7nhtbb.exe 2744 1jdjd.exe 2648 xxlflfx.exe 2600 hthnbb.exe 2808 7jdpj.exe 2480 frlxlrf.exe 2452 xxrrrlx.exe 2892 hthntt.exe 2764 dpdpd.exe 2920 5frxrrf.exe 2248 lfrxxxf.exe 320 nntbhb.exe 1976 pvvdp.exe 1644 dvdpp.exe 2268 xlfxffl.exe 1832 xrlxlrf.exe 852 thbhhb.exe 2108 pjvpv.exe 2828 3rffflr.exe 2152 rfxfxxl.exe 540 5nnttt.exe 272 dvvvv.exe 1504 5dvjj.exe 2324 rlflrfr.exe 408 nhhhnt.exe 1088 bthhtt.exe 1288 pjvdd.exe 1780 ffrrfff.exe 2380 nnbbhh.exe 1524 ppddd.exe 1760 vppjd.exe 2228 xxrrffr.exe 2104 rrlrxll.exe 2636 nnbbhn.exe 2688 nhbbbb.exe 2040 1dvpp.exe 2652 vvpjv.exe 2632 fxflllr.exe 2736 rlxfffl.exe 2772 bthnbt.exe 2568 hnhhnn.exe 2508 jvvjv.exe 2888 vpdpp.exe 292 5xxfllf.exe 2544 fxlrrrx.exe 2788 1bhhnt.exe 2124 3thnhb.exe 1828 pjvvj.exe 816 5vdvv.exe 1976 lfrrffr.exe 2172 lfllrxx.exe 2524 bntbhn.exe 1540 nnbbhh.exe 1832 jdjjj.exe 2296 9vdvv.exe 2832 3flllrr.exe 2156 frfxxff.exe 2208 5hntbb.exe 600 btbttt.exe 1068 pjpvv.exe 1188 pjvjv.exe 1156 lxrrxfx.exe 1872 lfxxxfl.exe 1296 1hbbht.exe -
resource yara_rule behavioral1/memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/408-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1744 2032 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 28 PID 2032 wrote to memory of 1744 2032 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 28 PID 2032 wrote to memory of 1744 2032 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 28 PID 2032 wrote to memory of 1744 2032 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 28 PID 1744 wrote to memory of 2744 1744 7nhtbb.exe 29 PID 1744 wrote to memory of 2744 1744 7nhtbb.exe 29 PID 1744 wrote to memory of 2744 1744 7nhtbb.exe 29 PID 1744 wrote to memory of 2744 1744 7nhtbb.exe 29 PID 2744 wrote to memory of 2648 2744 1jdjd.exe 30 PID 2744 wrote to memory of 2648 2744 1jdjd.exe 30 PID 2744 wrote to memory of 2648 2744 1jdjd.exe 30 PID 2744 wrote to memory of 2648 2744 1jdjd.exe 30 PID 2648 wrote to memory of 2600 2648 xxlflfx.exe 31 PID 2648 wrote to memory of 2600 2648 xxlflfx.exe 31 PID 2648 wrote to memory of 2600 2648 xxlflfx.exe 31 PID 2648 wrote to memory of 2600 2648 xxlflfx.exe 31 PID 2600 wrote to memory of 2808 2600 hthnbb.exe 32 PID 2600 wrote to memory of 2808 2600 hthnbb.exe 32 PID 2600 wrote to memory of 2808 2600 hthnbb.exe 32 PID 2600 wrote to memory of 2808 2600 hthnbb.exe 32 PID 2808 wrote to memory of 2480 2808 7jdpj.exe 33 PID 2808 wrote to memory of 2480 2808 7jdpj.exe 33 PID 2808 wrote to memory of 2480 2808 7jdpj.exe 33 PID 2808 wrote to memory of 2480 2808 7jdpj.exe 33 PID 2480 wrote to memory of 2452 2480 frlxlrf.exe 34 PID 2480 wrote to memory of 2452 2480 frlxlrf.exe 34 PID 2480 wrote to memory of 2452 2480 frlxlrf.exe 34 PID 2480 wrote to memory of 2452 2480 frlxlrf.exe 34 PID 2452 wrote to memory of 2892 2452 xxrrrlx.exe 35 PID 2452 wrote to memory of 2892 2452 xxrrrlx.exe 35 PID 2452 wrote to memory of 2892 2452 xxrrrlx.exe 35 PID 2452 wrote to memory of 2892 2452 xxrrrlx.exe 35 PID 2892 wrote to memory of 2764 2892 hthntt.exe 36 PID 2892 wrote to memory of 2764 2892 hthntt.exe 36 PID 2892 wrote to memory of 2764 2892 hthntt.exe 36 PID 2892 wrote to memory of 2764 2892 hthntt.exe 36 PID 2764 wrote to memory of 2920 2764 dpdpd.exe 37 PID 2764 wrote to memory of 2920 2764 dpdpd.exe 37 PID 2764 wrote to memory of 2920 2764 dpdpd.exe 37 PID 2764 wrote to memory of 2920 2764 dpdpd.exe 37 PID 2920 wrote to memory of 2248 2920 5frxrrf.exe 38 PID 2920 wrote to memory of 2248 2920 5frxrrf.exe 38 PID 2920 wrote to memory of 2248 2920 5frxrrf.exe 38 PID 2920 wrote to memory of 2248 2920 5frxrrf.exe 38 PID 2248 wrote to memory of 320 2248 lfrxxxf.exe 39 PID 2248 wrote to memory of 320 2248 lfrxxxf.exe 39 PID 2248 wrote to memory of 320 2248 lfrxxxf.exe 39 PID 2248 wrote to memory of 320 2248 lfrxxxf.exe 39 PID 320 wrote to memory of 1976 320 nntbhb.exe 40 PID 320 wrote to memory of 1976 320 nntbhb.exe 40 PID 320 wrote to memory of 1976 320 nntbhb.exe 40 PID 320 wrote to memory of 1976 320 nntbhb.exe 40 PID 1976 wrote to memory of 1644 1976 pvvdp.exe 41 PID 1976 wrote to memory of 1644 1976 pvvdp.exe 41 PID 1976 wrote to memory of 1644 1976 pvvdp.exe 41 PID 1976 wrote to memory of 1644 1976 pvvdp.exe 41 PID 1644 wrote to memory of 2268 1644 dvdpp.exe 42 PID 1644 wrote to memory of 2268 1644 dvdpp.exe 42 PID 1644 wrote to memory of 2268 1644 dvdpp.exe 42 PID 1644 wrote to memory of 2268 1644 dvdpp.exe 42 PID 2268 wrote to memory of 1832 2268 xlfxffl.exe 43 PID 2268 wrote to memory of 1832 2268 xlfxffl.exe 43 PID 2268 wrote to memory of 1832 2268 xlfxffl.exe 43 PID 2268 wrote to memory of 1832 2268 xlfxffl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe"C:\Users\Admin\AppData\Local\Temp\fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\7nhtbb.exec:\7nhtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\1jdjd.exec:\1jdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xxlflfx.exec:\xxlflfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hthnbb.exec:\hthnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7jdpj.exec:\7jdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\frlxlrf.exec:\frlxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xxrrrlx.exec:\xxrrrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\hthntt.exec:\hthntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dpdpd.exec:\dpdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5frxrrf.exec:\5frxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nntbhb.exec:\nntbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\pvvdp.exec:\pvvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\dvdpp.exec:\dvdpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\xlfxffl.exec:\xlfxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe17⤵
- Executes dropped EXE
PID:1832 -
\??\c:\thbhhb.exec:\thbhhb.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\pjvpv.exec:\pjvpv.exe19⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3rffflr.exec:\3rffflr.exe20⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rfxfxxl.exec:\rfxfxxl.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5nnttt.exec:\5nnttt.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\dvvvv.exec:\dvvvv.exe23⤵
- Executes dropped EXE
PID:272 -
\??\c:\5dvjj.exec:\5dvjj.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rlflrfr.exec:\rlflrfr.exe25⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhhhnt.exec:\nhhhnt.exe26⤵
- Executes dropped EXE
PID:408 -
\??\c:\bthhtt.exec:\bthhtt.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pjvdd.exec:\pjvdd.exe28⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ffrrfff.exec:\ffrrfff.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnbbhh.exec:\nnbbhh.exe30⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ppddd.exec:\ppddd.exe31⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vppjd.exec:\vppjd.exe32⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xxrrffr.exec:\xxrrffr.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rrlrxll.exec:\rrlrxll.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nnbbhn.exec:\nnbbhn.exe35⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nhbbbb.exec:\nhbbbb.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1dvpp.exec:\1dvpp.exe37⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvpjv.exec:\vvpjv.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxflllr.exec:\fxflllr.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlxfffl.exec:\rlxfffl.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bthnbt.exec:\bthnbt.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hnhhnn.exec:\hnhhnn.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jvvjv.exec:\jvvjv.exe43⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpdpp.exec:\vpdpp.exe44⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5xxfllf.exec:\5xxfllf.exe45⤵
- Executes dropped EXE
PID:292 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1bhhnt.exec:\1bhhnt.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3thnhb.exec:\3thnhb.exe48⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjvvj.exec:\pjvvj.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\5vdvv.exec:\5vdvv.exe50⤵
- Executes dropped EXE
PID:816 -
\??\c:\lfrrffr.exec:\lfrrffr.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lfllrxx.exec:\lfllrxx.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bntbhn.exec:\bntbhn.exe53⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nnbbhh.exec:\nnbbhh.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jdjjj.exec:\jdjjj.exe55⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9vdvv.exec:\9vdvv.exe56⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3flllrr.exec:\3flllrr.exe57⤵
- Executes dropped EXE
PID:2832 -
\??\c:\frfxxff.exec:\frfxxff.exe58⤵
- Executes dropped EXE
PID:2156 -
\??\c:\5hntbb.exec:\5hntbb.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btbttt.exec:\btbttt.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\pjpvv.exec:\pjpvv.exe61⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pjvjv.exec:\pjvjv.exe62⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxrrxfx.exec:\lxrrxfx.exe63⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe64⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1hbbht.exec:\1hbbht.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nnhnbh.exec:\nnhnbh.exe66⤵PID:380
-
\??\c:\jjvdj.exec:\jjvdj.exe67⤵PID:720
-
\??\c:\jdvvj.exec:\jdvvj.exe68⤵PID:2120
-
\??\c:\frlrrxf.exec:\frlrrxf.exe69⤵PID:2820
-
\??\c:\xrflrxl.exec:\xrflrxl.exe70⤵PID:2876
-
\??\c:\bhbnhb.exec:\bhbnhb.exe71⤵PID:2192
-
\??\c:\thtbnh.exec:\thtbnh.exe72⤵PID:2032
-
\??\c:\7djjp.exec:\7djjp.exe73⤵PID:2932
-
\??\c:\dppjj.exec:\dppjj.exe74⤵PID:1744
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe75⤵PID:2540
-
\??\c:\1xxxxfl.exec:\1xxxxfl.exe76⤵PID:3040
-
\??\c:\1nnnnh.exec:\1nnnnh.exe77⤵PID:2604
-
\??\c:\3bbbhh.exec:\3bbbhh.exe78⤵PID:2732
-
\??\c:\5pddj.exec:\5pddj.exe79⤵PID:2580
-
\??\c:\9dvdj.exec:\9dvdj.exe80⤵PID:1332
-
\??\c:\xxxrxxx.exec:\xxxrxxx.exe81⤵PID:2620
-
\??\c:\lxlfffl.exec:\lxlfffl.exe82⤵PID:2496
-
\??\c:\hthbnn.exec:\hthbnn.exe83⤵PID:2936
-
\??\c:\bthhnn.exec:\bthhnn.exe84⤵PID:2164
-
\??\c:\vpvjp.exec:\vpvjp.exe85⤵PID:2892
-
\??\c:\dvjjd.exec:\dvjjd.exe86⤵PID:500
-
\??\c:\5jjvv.exec:\5jjvv.exe87⤵PID:2752
-
\??\c:\lfllrrx.exec:\lfllrrx.exe88⤵PID:1824
-
\??\c:\frffllr.exec:\frffllr.exe89⤵PID:2248
-
\??\c:\thnnbb.exec:\thnnbb.exe90⤵PID:2280
-
\??\c:\thtbhb.exec:\thtbhb.exe91⤵PID:884
-
\??\c:\dvjvd.exec:\dvjvd.exe92⤵PID:2376
-
\??\c:\9pjdd.exec:\9pjdd.exe93⤵PID:1976
-
\??\c:\1jjpv.exec:\1jjpv.exe94⤵PID:2268
-
\??\c:\rlllrrx.exec:\rlllrrx.exe95⤵PID:1324
-
\??\c:\xrllxrf.exec:\xrllxrf.exe96⤵PID:1532
-
\??\c:\nhtthh.exec:\nhtthh.exe97⤵PID:2308
-
\??\c:\tnnttt.exec:\tnnttt.exe98⤵PID:2244
-
\??\c:\5dvjd.exec:\5dvjd.exe99⤵PID:2672
-
\??\c:\lfffxxr.exec:\lfffxxr.exe100⤵PID:384
-
\??\c:\9rxrfff.exec:\9rxrfff.exe101⤵PID:1180
-
\??\c:\7xrlrrl.exec:\7xrlrrl.exe102⤵PID:688
-
\??\c:\bhbbtb.exec:\bhbbtb.exe103⤵PID:1512
-
\??\c:\dpjdd.exec:\dpjdd.exe104⤵PID:932
-
\??\c:\xllxfff.exec:\xllxfff.exe105⤵PID:328
-
\??\c:\rlxflff.exec:\rlxflff.exe106⤵PID:1084
-
\??\c:\hbtbhn.exec:\hbtbhn.exe107⤵PID:2148
-
\??\c:\btbbnt.exec:\btbbnt.exe108⤵PID:1088
-
\??\c:\pdjdd.exec:\pdjdd.exe109⤵PID:1288
-
\??\c:\jjvvj.exec:\jjvvj.exe110⤵PID:2120
-
\??\c:\5rxrxxr.exec:\5rxrxxr.exe111⤵PID:2984
-
\??\c:\frxxfxr.exec:\frxxfxr.exe112⤵PID:1716
-
\??\c:\bhhntn.exec:\bhhntn.exe113⤵PID:2924
-
\??\c:\3hbhhh.exec:\3hbhhh.exe114⤵PID:2396
-
\??\c:\nbhhbt.exec:\nbhhbt.exe115⤵PID:2312
-
\??\c:\1djpp.exec:\1djpp.exe116⤵PID:280
-
\??\c:\3xrrrrx.exec:\3xrrrrx.exe117⤵PID:2744
-
\??\c:\9lrrrll.exec:\9lrrrll.exe118⤵PID:2648
-
\??\c:\nhhtnt.exec:\nhhtnt.exe119⤵PID:2464
-
\??\c:\hthntn.exec:\hthntn.exe120⤵PID:2600
-
\??\c:\pvddd.exec:\pvddd.exe121⤵PID:2628
-
\??\c:\jdvjj.exec:\jdvjj.exe122⤵PID:2200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-