Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe
-
Size
77KB
-
MD5
7eca1619dc0b3af265d2f918a8ab6b7a
-
SHA1
6d3484b570ae4e8e43088425b60085e6a8f271ff
-
SHA256
7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566
-
SHA512
217ee96b2cd881106e178b6bf2c59b9e7a9e6b6095fbede86811944da70f2ddc25ef83332d8649c11aa4d1f898a32cf55a3765630a72fc66ebfbd295464d552f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcY:ymb3NkkiQ3mdBjFo68YBVIJc9JtxY
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/836-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/836-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2312-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1824-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1484-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/604-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/300-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1904-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2152-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1072-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1816-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1856-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2312 nnbttb.exe 2348 pdjjj.exe 2100 5lxlffl.exe 2672 nthntb.exe 2816 rrxlllr.exe 2756 lxlrllf.exe 2628 nhbtnt.exe 2524 vvpjd.exe 2896 fxrrxfr.exe 2300 7hntbh.exe 1824 bhnnnt.exe 1972 ppvjp.exe 1688 9rfffrr.exe 1992 bbtbnh.exe 1484 3tbnht.exe 1524 9jpdp.exe 1512 5ffllfx.exe 2892 5hhnhb.exe 1048 bhhnhh.exe 2240 ddvdp.exe 604 rlfflff.exe 300 1flxrfl.exe 1904 tbtnbn.exe 2432 jjpvj.exe 2968 vpdjp.exe 2152 7fllxxl.exe 1072 bnbhnh.exe 1816 3vjjv.exe 1728 xxrllfl.exe 2332 fxxxxlx.exe 1856 hhbnbn.exe 1244 jvvdd.exe 1216 rlffrxl.exe 1468 tnbbhn.exe 1708 1bnntt.exe 2552 pdjpj.exe 2804 lxlrrxx.exe 2660 xrrflrr.exe 2732 tnhnnt.exe 2484 jdjdj.exe 2784 jppjv.exe 2460 9rllrxf.exe 2532 xfxrlrf.exe 2904 5hhhbn.exe 2220 nbnnnb.exe 3052 jdvjp.exe 2300 djvpp.exe 1632 rrllfff.exe 2180 nbhbtb.exe 764 hhhthn.exe 2120 pjdjp.exe 1992 jdpdv.exe 1528 xrflrlx.exe 1424 jppdp.exe 1148 ddppv.exe 2944 9fxlxfr.exe 2088 1tbbht.exe 2132 1nnnnn.exe 2124 pdpvd.exe 1652 xrlfxlr.exe 1900 xxlxfxx.exe 560 nbhhth.exe 1832 nthtnh.exe 1940 jppjd.exe -
resource yara_rule behavioral1/memory/836-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 2312 836 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 28 PID 836 wrote to memory of 2312 836 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 28 PID 836 wrote to memory of 2312 836 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 28 PID 836 wrote to memory of 2312 836 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 28 PID 2312 wrote to memory of 2348 2312 nnbttb.exe 29 PID 2312 wrote to memory of 2348 2312 nnbttb.exe 29 PID 2312 wrote to memory of 2348 2312 nnbttb.exe 29 PID 2312 wrote to memory of 2348 2312 nnbttb.exe 29 PID 2348 wrote to memory of 2100 2348 pdjjj.exe 30 PID 2348 wrote to memory of 2100 2348 pdjjj.exe 30 PID 2348 wrote to memory of 2100 2348 pdjjj.exe 30 PID 2348 wrote to memory of 2100 2348 pdjjj.exe 30 PID 2100 wrote to memory of 2672 2100 5lxlffl.exe 31 PID 2100 wrote to memory of 2672 2100 5lxlffl.exe 31 PID 2100 wrote to memory of 2672 2100 5lxlffl.exe 31 PID 2100 wrote to memory of 2672 2100 5lxlffl.exe 31 PID 2672 wrote to memory of 2816 2672 nthntb.exe 32 PID 2672 wrote to memory of 2816 2672 nthntb.exe 32 PID 2672 wrote to memory of 2816 2672 nthntb.exe 32 PID 2672 wrote to memory of 2816 2672 nthntb.exe 32 PID 2816 wrote to memory of 2756 2816 rrxlllr.exe 33 PID 2816 wrote to memory of 2756 2816 rrxlllr.exe 33 PID 2816 wrote to memory of 2756 2816 rrxlllr.exe 33 PID 2816 wrote to memory of 2756 2816 rrxlllr.exe 33 PID 2756 wrote to memory of 2628 2756 lxlrllf.exe 34 PID 2756 wrote to memory of 2628 2756 lxlrllf.exe 34 PID 2756 wrote to memory of 2628 2756 lxlrllf.exe 34 PID 2756 wrote to memory of 2628 2756 lxlrllf.exe 34 PID 2628 wrote to memory of 2524 2628 nhbtnt.exe 35 PID 2628 wrote to memory of 2524 2628 nhbtnt.exe 35 PID 2628 wrote to memory of 2524 2628 nhbtnt.exe 35 PID 2628 wrote to memory of 2524 2628 nhbtnt.exe 35 PID 2524 wrote to memory of 2896 2524 vvpjd.exe 36 PID 2524 wrote to memory of 2896 2524 vvpjd.exe 36 PID 2524 wrote to memory of 2896 2524 vvpjd.exe 36 PID 2524 wrote to memory of 2896 2524 vvpjd.exe 36 PID 2896 wrote to memory of 2300 2896 fxrrxfr.exe 37 PID 2896 wrote to memory of 2300 2896 fxrrxfr.exe 37 PID 2896 wrote to memory of 2300 2896 fxrrxfr.exe 37 PID 2896 wrote to memory of 2300 2896 fxrrxfr.exe 37 PID 2300 wrote to memory of 1824 2300 7hntbh.exe 38 PID 2300 wrote to memory of 1824 2300 7hntbh.exe 38 PID 2300 wrote to memory of 1824 2300 7hntbh.exe 38 PID 2300 wrote to memory of 1824 2300 7hntbh.exe 38 PID 1824 wrote to memory of 1972 1824 bhnnnt.exe 39 PID 1824 wrote to memory of 1972 1824 bhnnnt.exe 39 PID 1824 wrote to memory of 1972 1824 bhnnnt.exe 39 PID 1824 wrote to memory of 1972 1824 bhnnnt.exe 39 PID 1972 wrote to memory of 1688 1972 ppvjp.exe 40 PID 1972 wrote to memory of 1688 1972 ppvjp.exe 40 PID 1972 wrote to memory of 1688 1972 ppvjp.exe 40 PID 1972 wrote to memory of 1688 1972 ppvjp.exe 40 PID 1688 wrote to memory of 1992 1688 9rfffrr.exe 41 PID 1688 wrote to memory of 1992 1688 9rfffrr.exe 41 PID 1688 wrote to memory of 1992 1688 9rfffrr.exe 41 PID 1688 wrote to memory of 1992 1688 9rfffrr.exe 41 PID 1992 wrote to memory of 1484 1992 bbtbnh.exe 42 PID 1992 wrote to memory of 1484 1992 bbtbnh.exe 42 PID 1992 wrote to memory of 1484 1992 bbtbnh.exe 42 PID 1992 wrote to memory of 1484 1992 bbtbnh.exe 42 PID 1484 wrote to memory of 1524 1484 3tbnht.exe 43 PID 1484 wrote to memory of 1524 1484 3tbnht.exe 43 PID 1484 wrote to memory of 1524 1484 3tbnht.exe 43 PID 1484 wrote to memory of 1524 1484 3tbnht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe"C:\Users\Admin\AppData\Local\Temp\7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\nnbttb.exec:\nnbttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\pdjjj.exec:\pdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\5lxlffl.exec:\5lxlffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\nthntb.exec:\nthntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rrxlllr.exec:\rrxlllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lxlrllf.exec:\lxlrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nhbtnt.exec:\nhbtnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vvpjd.exec:\vvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\7hntbh.exec:\7hntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\bhnnnt.exec:\bhnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\ppvjp.exec:\ppvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\9rfffrr.exec:\9rfffrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bbtbnh.exec:\bbtbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\3tbnht.exec:\3tbnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\9jpdp.exec:\9jpdp.exe17⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5ffllfx.exec:\5ffllfx.exe18⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5hhnhb.exec:\5hhnhb.exe19⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhhnhh.exec:\bhhnhh.exe20⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ddvdp.exec:\ddvdp.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rlfflff.exec:\rlfflff.exe22⤵
- Executes dropped EXE
PID:604 -
\??\c:\1flxrfl.exec:\1flxrfl.exe23⤵
- Executes dropped EXE
PID:300 -
\??\c:\tbtnbn.exec:\tbtnbn.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jjpvj.exec:\jjpvj.exe25⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpdjp.exec:\vpdjp.exe26⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7fllxxl.exec:\7fllxxl.exe27⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bnbhnh.exec:\bnbhnh.exe28⤵
- Executes dropped EXE
PID:1072 -
\??\c:\3vjjv.exec:\3vjjv.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xxrllfl.exec:\xxrllfl.exe30⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxxxxlx.exec:\fxxxxlx.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hhbnbn.exec:\hhbnbn.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jvvdd.exec:\jvvdd.exe33⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rlffrxl.exec:\rlffrxl.exe34⤵
- Executes dropped EXE
PID:1216 -
\??\c:\tnbbhn.exec:\tnbbhn.exe35⤵
- Executes dropped EXE
PID:1468 -
\??\c:\1bnntt.exec:\1bnntt.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pdjpj.exec:\pdjpj.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lxlrrxx.exec:\lxlrrxx.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xrrflrr.exec:\xrrflrr.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnhnnt.exec:\tnhnnt.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdjdj.exec:\jdjdj.exe41⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jppjv.exec:\jppjv.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9rllrxf.exec:\9rllrxf.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xfxrlrf.exec:\xfxrlrf.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5hhhbn.exec:\5hhhbn.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nbnnnb.exec:\nbnnnb.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jdvjp.exec:\jdvjp.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djvpp.exec:\djvpp.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rrllfff.exec:\rrllfff.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nbhbtb.exec:\nbhbtb.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hhhthn.exec:\hhhthn.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\pjdjp.exec:\pjdjp.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jdpdv.exec:\jdpdv.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xrflrlx.exec:\xrflrlx.exe54⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jppdp.exec:\jppdp.exe55⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ddppv.exec:\ddppv.exe56⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9fxlxfr.exec:\9fxlxfr.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1tbbht.exec:\1tbbht.exe58⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1nnnnn.exec:\1nnnnn.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pdpvd.exec:\pdpvd.exe60⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xrlfxlr.exec:\xrlfxlr.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xxlxfxx.exec:\xxlxfxx.exe62⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nbhhth.exec:\nbhhth.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\nthtnh.exec:\nthtnh.exe64⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jppjd.exec:\jppjd.exe65⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vjpdj.exec:\vjpdj.exe66⤵PID:1140
-
\??\c:\lxxflxl.exec:\lxxflxl.exe67⤵PID:1844
-
\??\c:\9fxxllx.exec:\9fxxllx.exe68⤵PID:1204
-
\??\c:\ttbnhh.exec:\ttbnhh.exe69⤵PID:2836
-
\??\c:\nththb.exec:\nththb.exe70⤵PID:2156
-
\??\c:\dppdj.exec:\dppdj.exe71⤵PID:2064
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe72⤵PID:2844
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe73⤵PID:888
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe74⤵PID:2320
-
\??\c:\nnbthn.exec:\nnbthn.exe75⤵PID:1244
-
\??\c:\1hbhnt.exec:\1hbhnt.exe76⤵PID:1808
-
\??\c:\pjdpp.exec:\pjdpp.exe77⤵PID:2424
-
\??\c:\vvvjp.exec:\vvvjp.exe78⤵PID:1708
-
\??\c:\xxflrfr.exec:\xxflrfr.exe79⤵PID:2644
-
\??\c:\9lrlfll.exec:\9lrlfll.exe80⤵PID:2804
-
\??\c:\7bnhtt.exec:\7bnhtt.exe81⤵PID:2652
-
\??\c:\1ttbnb.exec:\1ttbnb.exe82⤵PID:2732
-
\??\c:\3ppvd.exec:\3ppvd.exe83⤵PID:2484
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe84⤵PID:2632
-
\??\c:\fxrfllr.exec:\fxrfllr.exe85⤵PID:2460
-
\??\c:\tbbhtb.exec:\tbbhtb.exe86⤵PID:2780
-
\??\c:\hbnbht.exec:\hbnbht.exe87⤵PID:2904
-
\??\c:\pjvvv.exec:\pjvvv.exe88⤵PID:1588
-
\??\c:\9pvdv.exec:\9pvdv.exe89⤵PID:3052
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe90⤵PID:1692
-
\??\c:\xxrrflf.exec:\xxrrflf.exe91⤵PID:1632
-
\??\c:\hthhhh.exec:\hthhhh.exe92⤵PID:1684
-
\??\c:\btbnbb.exec:\btbnbb.exe93⤵PID:1668
-
\??\c:\1nnbth.exec:\1nnbth.exe94⤵PID:2120
-
\??\c:\vpdvv.exec:\vpdvv.exe95⤵PID:1992
-
\??\c:\dpdjj.exec:\dpdjj.exe96⤵PID:2876
-
\??\c:\llxlxfr.exec:\llxlxfr.exe97⤵PID:1424
-
\??\c:\lllrlrl.exec:\lllrlrl.exe98⤵PID:2128
-
\??\c:\thhntb.exec:\thhntb.exe99⤵PID:1048
-
\??\c:\5thhnt.exec:\5thhnt.exe100⤵PID:1964
-
\??\c:\pppdj.exec:\pppdj.exe101⤵PID:2132
-
\??\c:\pjvdj.exec:\pjvdj.exe102⤵PID:284
-
\??\c:\rlffllr.exec:\rlffllr.exe103⤵PID:1652
-
\??\c:\3llllfr.exec:\3llllfr.exe104⤵PID:1900
-
\??\c:\tnhhtb.exec:\tnhhtb.exe105⤵PID:560
-
\??\c:\9bbbtt.exec:\9bbbtt.exe106⤵PID:644
-
\??\c:\bbbbnh.exec:\bbbbnh.exe107⤵PID:1940
-
\??\c:\9ppvd.exec:\9ppvd.exe108⤵PID:1140
-
\??\c:\7xlrfll.exec:\7xlrfll.exe109⤵PID:1844
-
\??\c:\9fflxxl.exec:\9fflxxl.exe110⤵PID:1204
-
\??\c:\hnntht.exec:\hnntht.exe111⤵PID:2836
-
\??\c:\hhhbhn.exec:\hhhbhn.exe112⤵PID:2156
-
\??\c:\bhntht.exec:\bhntht.exe113⤵PID:2064
-
\??\c:\vdppv.exec:\vdppv.exe114⤵PID:2212
-
\??\c:\vvvvv.exec:\vvvvv.exe115⤵PID:2936
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe116⤵PID:2204
-
\??\c:\xllxfll.exec:\xllxfll.exe117⤵PID:2400
-
\??\c:\tttnhh.exec:\tttnhh.exe118⤵PID:1808
-
\??\c:\hthtbh.exec:\hthtbh.exe119⤵PID:2424
-
\??\c:\jpppd.exec:\jpppd.exe120⤵PID:1708
-
\??\c:\lxfflrx.exec:\lxfflrx.exe121⤵PID:2644
-
\??\c:\rxrflfx.exec:\rxrflfx.exe122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-