Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe
-
Size
72KB
-
MD5
6ae6ef071cb042615d07dcd412fab4cb
-
SHA1
547c791205c3636b568c92837dc14804b97c31d2
-
SHA256
3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c
-
SHA512
8401e6bc31129de1a6b4e8dbb07348b9fd693d1bcd675e2fb99aeea111988c4858c14997ff5c20a32d629caca84ab391208b84fb1fcadf66201acb051d6c4fde
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnaHj:ymb3NkkiQ3mdBjFIgUEq
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/1576-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/1576-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2320-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2360-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2168-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/280-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/896-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1620-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1140-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2604-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1948-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 836 xxxllxr.exe 2320 9xrrxlf.exe 2360 tbtnbn.exe 2748 dvjvp.exe 2940 fxlrxll.exe 2668 lllrllf.exe 2644 1hbhnb.exe 2524 7hthtt.exe 2384 5ppdj.exe 2568 ppjjv.exe 2820 lffxlrf.exe 2168 ffxlxfr.exe 1708 ntnbhb.exe 280 lfllrfl.exe 2216 9xrxrxr.exe 896 tnhtnt.exe 1620 bbtntt.exe 1140 pvjjd.exe 1724 rlrfrfl.exe 2908 3hbbbh.exe 2888 3nnnhh.exe 2108 jjpvp.exe 2604 dvvpv.exe 628 ffrxflr.exe 2400 9bhbnn.exe 2172 hbbbbh.exe 2860 vvdpp.exe 1948 rlfxlrr.exe 1268 7thtbh.exe 2980 pddjd.exe 1512 9ddvp.exe 1148 rlflrxl.exe 2340 1hbtth.exe 836 nbtbnt.exe 2260 vpdjd.exe 2664 ppdpd.exe 2740 7lfrflx.exe 2640 frxfrrf.exe 2728 tnbnbb.exe 2808 9bbhtb.exe 2552 rxrxrll.exe 2516 7nhttt.exe 2440 nnnhnn.exe 2276 vpdjd.exe 2524 pjdjj.exe 1748 rxlllxx.exe 2768 flflfrf.exe 2828 bthtbb.exe 2020 nhbbht.exe 324 jdpdj.exe 2036 7xxxflx.exe 536 frlxlrx.exe 2244 bhtbhb.exe 1484 7nbhnt.exe 340 vdpdd.exe 1980 7dvjv.exe 1572 ffrrffl.exe 2912 lxrllrf.exe 2544 hbtbtb.exe 2272 tttbnb.exe 2964 dddjv.exe 1848 vvpjp.exe 584 7rlrxxl.exe 2060 xlrlllf.exe -
resource yara_rule behavioral1/memory/1576-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1140-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 836 1576 3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe 28 PID 1576 wrote to memory of 836 1576 3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe 28 PID 1576 wrote to memory of 836 1576 3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe 28 PID 1576 wrote to memory of 836 1576 3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe 28 PID 836 wrote to memory of 2320 836 xxxllxr.exe 29 PID 836 wrote to memory of 2320 836 xxxllxr.exe 29 PID 836 wrote to memory of 2320 836 xxxllxr.exe 29 PID 836 wrote to memory of 2320 836 xxxllxr.exe 29 PID 2320 wrote to memory of 2360 2320 9xrrxlf.exe 30 PID 2320 wrote to memory of 2360 2320 9xrrxlf.exe 30 PID 2320 wrote to memory of 2360 2320 9xrrxlf.exe 30 PID 2320 wrote to memory of 2360 2320 9xrrxlf.exe 30 PID 2360 wrote to memory of 2748 2360 tbtnbn.exe 31 PID 2360 wrote to memory of 2748 2360 tbtnbn.exe 31 PID 2360 wrote to memory of 2748 2360 tbtnbn.exe 31 PID 2360 wrote to memory of 2748 2360 tbtnbn.exe 31 PID 2748 wrote to memory of 2940 2748 dvjvp.exe 32 PID 2748 wrote to memory of 2940 2748 dvjvp.exe 32 PID 2748 wrote to memory of 2940 2748 dvjvp.exe 32 PID 2748 wrote to memory of 2940 2748 dvjvp.exe 32 PID 2940 wrote to memory of 2668 2940 fxlrxll.exe 33 PID 2940 wrote to memory of 2668 2940 fxlrxll.exe 33 PID 2940 wrote to memory of 2668 2940 fxlrxll.exe 33 PID 2940 wrote to memory of 2668 2940 fxlrxll.exe 33 PID 2668 wrote to memory of 2644 2668 lllrllf.exe 34 PID 2668 wrote to memory of 2644 2668 lllrllf.exe 34 PID 2668 wrote to memory of 2644 2668 lllrllf.exe 34 PID 2668 wrote to memory of 2644 2668 lllrllf.exe 34 PID 2644 wrote to memory of 2524 2644 1hbhnb.exe 35 PID 2644 wrote to memory of 2524 2644 1hbhnb.exe 35 PID 2644 wrote to memory of 2524 2644 1hbhnb.exe 35 PID 2644 wrote to memory of 2524 2644 1hbhnb.exe 35 PID 2524 wrote to memory of 2384 2524 7hthtt.exe 36 PID 2524 wrote to memory of 2384 2524 7hthtt.exe 36 PID 2524 wrote to memory of 2384 2524 7hthtt.exe 36 PID 2524 wrote to memory of 2384 2524 7hthtt.exe 36 PID 2384 wrote to memory of 2568 2384 5ppdj.exe 37 PID 2384 wrote to memory of 2568 2384 5ppdj.exe 37 PID 2384 wrote to memory of 2568 2384 5ppdj.exe 37 PID 2384 wrote to memory of 2568 2384 5ppdj.exe 37 PID 2568 wrote to memory of 2820 2568 ppjjv.exe 38 PID 2568 wrote to memory of 2820 2568 ppjjv.exe 38 PID 2568 wrote to memory of 2820 2568 ppjjv.exe 38 PID 2568 wrote to memory of 2820 2568 ppjjv.exe 38 PID 2820 wrote to memory of 2168 2820 lffxlrf.exe 39 PID 2820 wrote to memory of 2168 2820 lffxlrf.exe 39 PID 2820 wrote to memory of 2168 2820 lffxlrf.exe 39 PID 2820 wrote to memory of 2168 2820 lffxlrf.exe 39 PID 2168 wrote to memory of 1708 2168 ffxlxfr.exe 40 PID 2168 wrote to memory of 1708 2168 ffxlxfr.exe 40 PID 2168 wrote to memory of 1708 2168 ffxlxfr.exe 40 PID 2168 wrote to memory of 1708 2168 ffxlxfr.exe 40 PID 1708 wrote to memory of 280 1708 ntnbhb.exe 41 PID 1708 wrote to memory of 280 1708 ntnbhb.exe 41 PID 1708 wrote to memory of 280 1708 ntnbhb.exe 41 PID 1708 wrote to memory of 280 1708 ntnbhb.exe 41 PID 280 wrote to memory of 2216 280 lfllrfl.exe 42 PID 280 wrote to memory of 2216 280 lfllrfl.exe 42 PID 280 wrote to memory of 2216 280 lfllrfl.exe 42 PID 280 wrote to memory of 2216 280 lfllrfl.exe 42 PID 2216 wrote to memory of 896 2216 9xrxrxr.exe 43 PID 2216 wrote to memory of 896 2216 9xrxrxr.exe 43 PID 2216 wrote to memory of 896 2216 9xrxrxr.exe 43 PID 2216 wrote to memory of 896 2216 9xrxrxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe"C:\Users\Admin\AppData\Local\Temp\3ffe146ef81f1febf8f7d72a3cf80bc04366273acc51323e46b71fd62439b89c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xxxllxr.exec:\xxxllxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\9xrrxlf.exec:\9xrrxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\tbtnbn.exec:\tbtnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\dvjvp.exec:\dvjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fxlrxll.exec:\fxlrxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lllrllf.exec:\lllrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1hbhnb.exec:\1hbhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7hthtt.exec:\7hthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5ppdj.exec:\5ppdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ppjjv.exec:\ppjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lffxlrf.exec:\lffxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ntnbhb.exec:\ntnbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lfllrfl.exec:\lfllrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\9xrxrxr.exec:\9xrxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\tnhtnt.exec:\tnhtnt.exe17⤵
- Executes dropped EXE
PID:896 -
\??\c:\bbtntt.exec:\bbtntt.exe18⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pvjjd.exec:\pvjjd.exe19⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rlrfrfl.exec:\rlrfrfl.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3hbbbh.exec:\3hbbbh.exe21⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3nnnhh.exec:\3nnnhh.exe22⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jjpvp.exec:\jjpvp.exe23⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvvpv.exec:\dvvpv.exe24⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ffrxflr.exec:\ffrxflr.exe25⤵
- Executes dropped EXE
PID:628 -
\??\c:\9bhbnn.exec:\9bhbnn.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hbbbbh.exec:\hbbbbh.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vvdpp.exec:\vvdpp.exe28⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rlfxlrr.exec:\rlfxlrr.exe29⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7thtbh.exec:\7thtbh.exe30⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pddjd.exec:\pddjd.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9ddvp.exec:\9ddvp.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlflrxl.exec:\rlflrxl.exe33⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1hbtth.exec:\1hbtth.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nbtbnt.exec:\nbtbnt.exe35⤵
- Executes dropped EXE
PID:836 -
\??\c:\vpdjd.exec:\vpdjd.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ppdpd.exec:\ppdpd.exe37⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7lfrflx.exec:\7lfrflx.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\frxfrrf.exec:\frxfrrf.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tnbnbb.exec:\tnbnbb.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9bbhtb.exec:\9bbhtb.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rxrxrll.exec:\rxrxrll.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7nhttt.exec:\7nhttt.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnnhnn.exec:\nnnhnn.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vpdjd.exec:\vpdjd.exe45⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pjdjj.exec:\pjdjj.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rxlllxx.exec:\rxlllxx.exe47⤵
- Executes dropped EXE
PID:1748 -
\??\c:\flflfrf.exec:\flflfrf.exe48⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bthtbb.exec:\bthtbb.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nhbbht.exec:\nhbbht.exe50⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdpdj.exec:\jdpdj.exe51⤵
- Executes dropped EXE
PID:324 -
\??\c:\7xxxflx.exec:\7xxxflx.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\frlxlrx.exec:\frlxlrx.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\bhtbhb.exec:\bhtbhb.exe54⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7nbhnt.exec:\7nbhnt.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vdpdd.exec:\vdpdd.exe56⤵
- Executes dropped EXE
PID:340 -
\??\c:\7dvjv.exec:\7dvjv.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffrrffl.exec:\ffrrffl.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lxrllrf.exec:\lxrllrf.exe59⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hbtbtb.exec:\hbtbtb.exe60⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tttbnb.exec:\tttbnb.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dddjv.exec:\dddjv.exe62⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vvpjp.exec:\vvpjp.exe63⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7rlrxxl.exec:\7rlrxxl.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\xlrlllf.exec:\xlrlllf.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9nhttt.exec:\9nhttt.exe66⤵PID:996
-
\??\c:\1httbn.exec:\1httbn.exe67⤵PID:1800
-
\??\c:\7pjpj.exec:\7pjpj.exe68⤵PID:884
-
\??\c:\1dpvj.exec:\1dpvj.exe69⤵PID:1920
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe70⤵PID:3056
-
\??\c:\fxrrrxr.exec:\fxrrrxr.exe71⤵PID:1728
-
\??\c:\lfflffl.exec:\lfflffl.exe72⤵PID:2980
-
\??\c:\hbtbnn.exec:\hbtbnn.exe73⤵PID:1448
-
\??\c:\dvjjp.exec:\dvjjp.exe74⤵PID:1996
-
\??\c:\vdvdd.exec:\vdvdd.exe75⤵PID:1584
-
\??\c:\fxxfxfr.exec:\fxxfxfr.exe76⤵PID:2340
-
\??\c:\1xflrlr.exec:\1xflrlr.exe77⤵PID:1320
-
\??\c:\hhhnbn.exec:\hhhnbn.exe78⤵PID:2360
-
\??\c:\5nhbnb.exec:\5nhbnb.exe79⤵PID:2656
-
\??\c:\ddpdj.exec:\ddpdj.exe80⤵PID:2708
-
\??\c:\jpdjd.exec:\jpdjd.exe81⤵PID:2640
-
\??\c:\rxrrrlr.exec:\rxrrrlr.exe82⤵PID:2676
-
\??\c:\bttnnt.exec:\bttnnt.exe83⤵PID:3036
-
\??\c:\hbhnbh.exec:\hbhnbh.exe84⤵PID:2564
-
\??\c:\hnnhnb.exec:\hnnhnb.exe85⤵PID:3008
-
\??\c:\jjjjv.exec:\jjjjv.exe86⤵PID:2044
-
\??\c:\lfrfxfl.exec:\lfrfxfl.exe87⤵PID:2576
-
\??\c:\xfxxrrx.exec:\xfxxrrx.exe88⤵PID:2836
-
\??\c:\nhtnnt.exec:\nhtnnt.exe89⤵PID:2856
-
\??\c:\tnntnt.exec:\tnntnt.exe90⤵PID:1820
-
\??\c:\dddpv.exec:\dddpv.exe91⤵PID:2828
-
\??\c:\jvvdv.exec:\jvvdv.exe92⤵PID:1708
-
\??\c:\9rllrxl.exec:\9rllrxl.exe93⤵PID:2232
-
\??\c:\hthnbb.exec:\hthnbb.exe94⤵PID:664
-
\??\c:\bhnntt.exec:\bhnntt.exe95⤵PID:976
-
\??\c:\djdvp.exec:\djdvp.exe96⤵PID:796
-
\??\c:\jjdjj.exec:\jjdjj.exe97⤵PID:1620
-
\??\c:\rrllflf.exec:\rrllflf.exe98⤵PID:2608
-
\??\c:\rfxrffr.exec:\rfxrffr.exe99⤵PID:1980
-
\??\c:\nthntt.exec:\nthntt.exe100⤵PID:2904
-
\??\c:\pvjjj.exec:\pvjjj.exe101⤵PID:3020
-
\??\c:\flrffxr.exec:\flrffxr.exe102⤵PID:2108
-
\??\c:\xlxxrlr.exec:\xlxxrlr.exe103⤵PID:2376
-
\??\c:\7hbhtb.exec:\7hbhtb.exe104⤵PID:2456
-
\??\c:\bhnnhb.exec:\bhnnhb.exe105⤵PID:2780
-
\??\c:\pppvp.exec:\pppvp.exe106⤵PID:444
-
\??\c:\pppvd.exec:\pppvd.exe107⤵PID:1776
-
\??\c:\9jjjd.exec:\9jjjd.exe108⤵PID:2448
-
\??\c:\rlffflr.exec:\rlffflr.exe109⤵PID:1712
-
\??\c:\5xfrlxr.exec:\5xfrlxr.exe110⤵PID:1532
-
\??\c:\hhthhb.exec:\hhthhb.exe111⤵PID:1432
-
\??\c:\ddpdv.exec:\ddpdv.exe112⤵PID:1732
-
\??\c:\ppdvj.exec:\ppdvj.exe113⤵PID:2428
-
\??\c:\9xrxlfr.exec:\9xrxlfr.exe114⤵PID:1576
-
\??\c:\xrxfxrl.exec:\xrxfxrl.exe115⤵PID:1564
-
\??\c:\hnthnb.exec:\hnthnb.exe116⤵PID:2148
-
\??\c:\nbnhhb.exec:\nbnhhb.exe117⤵PID:2364
-
\??\c:\dvjdp.exec:\dvjdp.exe118⤵PID:2340
-
\??\c:\3jdvj.exec:\3jdvj.exe119⤵PID:2128
-
\??\c:\rlffxff.exec:\rlffxff.exe120⤵PID:2264
-
\??\c:\ttnthh.exec:\ttnthh.exe121⤵PID:2624
-
\??\c:\ttntnt.exec:\ttntnt.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-