Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe
-
Size
313KB
-
MD5
25b05699cbd7d41d71d8019781536cf4
-
SHA1
726585b933b77b6f3d39715c6c6697287aecf2b6
-
SHA256
e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45
-
SHA512
df6e4db7f5945464b5fa807d2e78d60e7a9a1a8f495ca572c6c1dcdbb7c57fbc1627e30933ddb6352879729ecd566305a90e5aa9bd8a2e42664462c5c31b8d74
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwc:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q79
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3064-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2176-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1932-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/864-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2064-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1232-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1136-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1064-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1104-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2396-250-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1328-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/844-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3064 dpdvv.exe 2756 hnnbtb.exe 2572 ffxfrfx.exe 2624 tthbnn.exe 2740 pjpvd.exe 2772 frllfxr.exe 2488 nbntbt.exe 2496 rlllxxf.exe 2052 1bnhhh.exe 1708 tbhntt.exe 2420 fxfrxfl.exe 2700 5hhbhb.exe 2016 pjdpv.exe 1956 xxlrlrl.exe 2176 5bntbh.exe 1932 jjvjp.exe 2332 xrfxfxf.exe 864 tnhhtb.exe 2064 jdvvd.exe 1232 nhhnhh.exe 2824 jjpdv.exe 1136 xxxfrfl.exe 1064 nnbtnn.exe 1104 vvjjj.exe 1960 xlfflrx.exe 2396 flxxrfx.exe 1728 vpvdj.exe 1328 rrflfxr.exe 844 5thhnt.exe 1564 rlrrflr.exe 2292 pvpjv.exe 1988 jdpdv.exe 1724 ttntnt.exe 1588 vvvdv.exe 2132 ffxlxlf.exe 3056 frllrxl.exe 2628 1tnbtt.exe 2576 ddvvd.exe 2712 5rfrxlx.exe 2548 xrrxffl.exe 2456 hhttnb.exe 2460 ddpvd.exe 2484 5lfrfrr.exe 2912 rrlxfrl.exe 2480 hnnhnh.exe 2408 9ppjp.exe 1708 ppvpv.exe 2420 xrrlfrf.exe 2848 hbbtnt.exe 1044 pvpvj.exe 1936 1ppdv.exe 1252 lxrlrfl.exe 2248 hhbhnn.exe 1656 5ddvd.exe 1448 jjvpd.exe 1740 1xfrlrl.exe 2276 hhhhnt.exe 2064 5djdv.exe 1668 jdjdd.exe 2080 xlffxfl.exe 324 nnhnbn.exe 1136 tbtbnb.exe 2348 vdvdj.exe 1860 llflxxf.exe -
resource yara_rule behavioral1/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3064 2268 e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe 28 PID 2268 wrote to memory of 3064 2268 e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe 28 PID 2268 wrote to memory of 3064 2268 e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe 28 PID 2268 wrote to memory of 3064 2268 e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe 28 PID 3064 wrote to memory of 2756 3064 dpdvv.exe 29 PID 3064 wrote to memory of 2756 3064 dpdvv.exe 29 PID 3064 wrote to memory of 2756 3064 dpdvv.exe 29 PID 3064 wrote to memory of 2756 3064 dpdvv.exe 29 PID 2756 wrote to memory of 2572 2756 hnnbtb.exe 30 PID 2756 wrote to memory of 2572 2756 hnnbtb.exe 30 PID 2756 wrote to memory of 2572 2756 hnnbtb.exe 30 PID 2756 wrote to memory of 2572 2756 hnnbtb.exe 30 PID 2572 wrote to memory of 2624 2572 ffxfrfx.exe 31 PID 2572 wrote to memory of 2624 2572 ffxfrfx.exe 31 PID 2572 wrote to memory of 2624 2572 ffxfrfx.exe 31 PID 2572 wrote to memory of 2624 2572 ffxfrfx.exe 31 PID 2624 wrote to memory of 2740 2624 tthbnn.exe 32 PID 2624 wrote to memory of 2740 2624 tthbnn.exe 32 PID 2624 wrote to memory of 2740 2624 tthbnn.exe 32 PID 2624 wrote to memory of 2740 2624 tthbnn.exe 32 PID 2740 wrote to memory of 2772 2740 pjpvd.exe 33 PID 2740 wrote to memory of 2772 2740 pjpvd.exe 33 PID 2740 wrote to memory of 2772 2740 pjpvd.exe 33 PID 2740 wrote to memory of 2772 2740 pjpvd.exe 33 PID 2772 wrote to memory of 2488 2772 frllfxr.exe 34 PID 2772 wrote to memory of 2488 2772 frllfxr.exe 34 PID 2772 wrote to memory of 2488 2772 frllfxr.exe 34 PID 2772 wrote to memory of 2488 2772 frllfxr.exe 34 PID 2488 wrote to memory of 2496 2488 nbntbt.exe 35 PID 2488 wrote to memory of 2496 2488 nbntbt.exe 35 PID 2488 wrote to memory of 2496 2488 nbntbt.exe 35 PID 2488 wrote to memory of 2496 2488 nbntbt.exe 35 PID 2496 wrote to memory of 2052 2496 rlllxxf.exe 36 PID 2496 wrote to memory of 2052 2496 rlllxxf.exe 36 PID 2496 wrote to memory of 2052 2496 rlllxxf.exe 36 PID 2496 wrote to memory of 2052 2496 rlllxxf.exe 36 PID 2052 wrote to memory of 1708 2052 1bnhhh.exe 37 PID 2052 wrote to memory of 1708 2052 1bnhhh.exe 37 PID 2052 wrote to memory of 1708 2052 1bnhhh.exe 37 PID 2052 wrote to memory of 1708 2052 1bnhhh.exe 37 PID 1708 wrote to memory of 2420 1708 tbhntt.exe 38 PID 1708 wrote to memory of 2420 1708 tbhntt.exe 38 PID 1708 wrote to memory of 2420 1708 tbhntt.exe 38 PID 1708 wrote to memory of 2420 1708 tbhntt.exe 38 PID 2420 wrote to memory of 2700 2420 fxfrxfl.exe 39 PID 2420 wrote to memory of 2700 2420 fxfrxfl.exe 39 PID 2420 wrote to memory of 2700 2420 fxfrxfl.exe 39 PID 2420 wrote to memory of 2700 2420 fxfrxfl.exe 39 PID 2700 wrote to memory of 2016 2700 5hhbhb.exe 40 PID 2700 wrote to memory of 2016 2700 5hhbhb.exe 40 PID 2700 wrote to memory of 2016 2700 5hhbhb.exe 40 PID 2700 wrote to memory of 2016 2700 5hhbhb.exe 40 PID 2016 wrote to memory of 1956 2016 pjdpv.exe 41 PID 2016 wrote to memory of 1956 2016 pjdpv.exe 41 PID 2016 wrote to memory of 1956 2016 pjdpv.exe 41 PID 2016 wrote to memory of 1956 2016 pjdpv.exe 41 PID 1956 wrote to memory of 2176 1956 xxlrlrl.exe 42 PID 1956 wrote to memory of 2176 1956 xxlrlrl.exe 42 PID 1956 wrote to memory of 2176 1956 xxlrlrl.exe 42 PID 1956 wrote to memory of 2176 1956 xxlrlrl.exe 42 PID 2176 wrote to memory of 1932 2176 5bntbh.exe 43 PID 2176 wrote to memory of 1932 2176 5bntbh.exe 43 PID 2176 wrote to memory of 1932 2176 5bntbh.exe 43 PID 2176 wrote to memory of 1932 2176 5bntbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe"C:\Users\Admin\AppData\Local\Temp\e4bf7a8d4c3e0aab39a32c2398082a94dacfd67bbd23bb9c6d7842cd023d2d45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\dpdvv.exec:\dpdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hnnbtb.exec:\hnnbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ffxfrfx.exec:\ffxfrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\tthbnn.exec:\tthbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pjpvd.exec:\pjpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\frllfxr.exec:\frllfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbntbt.exec:\nbntbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rlllxxf.exec:\rlllxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\1bnhhh.exec:\1bnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\tbhntt.exec:\tbhntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\fxfrxfl.exec:\fxfrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\5hhbhb.exec:\5hhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pjdpv.exec:\pjdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xxlrlrl.exec:\xxlrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\5bntbh.exec:\5bntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\jjvjp.exec:\jjvjp.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe18⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tnhhtb.exec:\tnhhtb.exe19⤵
- Executes dropped EXE
PID:864 -
\??\c:\jdvvd.exec:\jdvvd.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhhnhh.exec:\nhhnhh.exe21⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jjpdv.exec:\jjpdv.exe22⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xxxfrfl.exec:\xxxfrfl.exe23⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nnbtnn.exec:\nnbtnn.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vvjjj.exec:\vvjjj.exe25⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xlfflrx.exec:\xlfflrx.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\flxxrfx.exec:\flxxrfx.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vpvdj.exec:\vpvdj.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rrflfxr.exec:\rrflfxr.exe29⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5thhnt.exec:\5thhnt.exe30⤵
- Executes dropped EXE
PID:844 -
\??\c:\rlrrflr.exec:\rlrrflr.exe31⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pvpjv.exec:\pvpjv.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jdpdv.exec:\jdpdv.exe33⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ttntnt.exec:\ttntnt.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3thnbh.exec:\3thnbh.exe35⤵PID:2128
-
\??\c:\vvvdv.exec:\vvvdv.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe37⤵
- Executes dropped EXE
PID:2132 -
\??\c:\frllrxl.exec:\frllrxl.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1tnbtt.exec:\1tnbtt.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ddvvd.exec:\ddvvd.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5rfrxlx.exec:\5rfrxlx.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrrxffl.exec:\xrrxffl.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hhttnb.exec:\hhttnb.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddpvd.exec:\ddpvd.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5lfrfrr.exec:\5lfrfrr.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe46⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hnnhnh.exec:\hnnhnh.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9ppjp.exec:\9ppjp.exe48⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppvpv.exec:\ppvpv.exe49⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xrrlfrf.exec:\xrrlfrf.exe50⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbbtnt.exec:\hbbtnt.exe51⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pvpvj.exec:\pvpvj.exe52⤵
- Executes dropped EXE
PID:1044 -
\??\c:\1ppdv.exec:\1ppdv.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxrlrfl.exec:\lxrlrfl.exe54⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hhbhnn.exec:\hhbhnn.exe55⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5ddvd.exec:\5ddvd.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jjvpd.exec:\jjvpd.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1xfrlrl.exec:\1xfrlrl.exe58⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhhhnt.exec:\hhhhnt.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5djdv.exec:\5djdv.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdjdd.exec:\jdjdd.exe61⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xlffxfl.exec:\xlffxfl.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nnhnbn.exec:\nnhnbn.exe63⤵
- Executes dropped EXE
PID:324 -
\??\c:\tbtbnb.exec:\tbtbnb.exe64⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vdvdj.exec:\vdvdj.exe65⤵
- Executes dropped EXE
PID:2348 -
\??\c:\llflxxf.exec:\llflxxf.exe66⤵
- Executes dropped EXE
PID:1860 -
\??\c:\fxrlllx.exec:\fxrlllx.exe67⤵PID:1016
-
\??\c:\tnbthh.exec:\tnbthh.exe68⤵PID:1872
-
\??\c:\vpvdj.exec:\vpvdj.exe69⤵PID:2148
-
\??\c:\fxlrrlf.exec:\fxlrrlf.exe70⤵PID:1728
-
\??\c:\frlrfrx.exec:\frlrfrx.exe71⤵PID:1124
-
\??\c:\hbthnb.exec:\hbthnb.exe72⤵PID:3028
-
\??\c:\hbttht.exec:\hbttht.exe73⤵PID:1812
-
\??\c:\dvjdp.exec:\dvjdp.exe74⤵PID:1992
-
\??\c:\1rffflx.exec:\1rffflx.exe75⤵PID:2292
-
\??\c:\9lfrlxl.exec:\9lfrlxl.exe76⤵PID:1508
-
\??\c:\nbhhht.exec:\nbhhht.exe77⤵PID:1712
-
\??\c:\jpvdp.exec:\jpvdp.exe78⤵PID:2100
-
\??\c:\xrffllr.exec:\xrffllr.exe79⤵PID:3064
-
\??\c:\rxrxfff.exec:\rxrxfff.exe80⤵PID:2560
-
\??\c:\btntbn.exec:\btntbn.exe81⤵PID:2620
-
\??\c:\5vpvd.exec:\5vpvd.exe82⤵PID:2564
-
\??\c:\ddvdp.exec:\ddvdp.exe83⤵PID:2764
-
\??\c:\ffxlxxf.exec:\ffxlxxf.exe84⤵PID:2592
-
\??\c:\ntnnhh.exec:\ntnnhh.exe85⤵PID:2652
-
\??\c:\hbtbnb.exec:\hbtbnb.exe86⤵PID:2704
-
\??\c:\jjjjd.exec:\jjjjd.exe87⤵PID:2340
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe88⤵PID:2504
-
\??\c:\hhbtht.exec:\hhbtht.exe89⤵PID:2308
-
\??\c:\9vddp.exec:\9vddp.exe90⤵PID:1428
-
\??\c:\ppvjd.exec:\ppvjd.exe91⤵PID:2532
-
\??\c:\rrflflx.exec:\rrflflx.exe92⤵PID:1972
-
\??\c:\lxflxxr.exec:\lxflxxr.exe93⤵PID:2520
-
\??\c:\nhttbt.exec:\nhttbt.exe94⤵PID:1876
-
\??\c:\pjjjd.exec:\pjjjd.exe95⤵PID:892
-
\??\c:\7xxrxlx.exec:\7xxrxlx.exe96⤵PID:2220
-
\??\c:\9xxrxlr.exec:\9xxrxlr.exe97⤵PID:848
-
\??\c:\tthhbt.exec:\tthhbt.exe98⤵PID:2140
-
\??\c:\vdvdv.exec:\vdvdv.exe99⤵PID:2332
-
\??\c:\vjvvv.exec:\vjvvv.exe100⤵PID:2060
-
\??\c:\3rllxlf.exec:\3rllxlf.exe101⤵PID:2388
-
\??\c:\tbttnn.exec:\tbttnn.exe102⤵PID:3036
-
\??\c:\7btthn.exec:\7btthn.exe103⤵PID:1232
-
\??\c:\1dppd.exec:\1dppd.exe104⤵PID:2824
-
\??\c:\lflxxxl.exec:\lflxxxl.exe105⤵PID:1060
-
\??\c:\7lxxlrf.exec:\7lxxlrf.exe106⤵PID:3024
-
\??\c:\bhnnnn.exec:\bhnnnn.exe107⤵PID:1488
-
\??\c:\jjvjp.exec:\jjvjp.exe108⤵PID:2348
-
\??\c:\djvvp.exec:\djvvp.exe109⤵PID:1352
-
\??\c:\xxlxrll.exec:\xxlxrll.exe110⤵PID:1016
-
\??\c:\nhhhbb.exec:\nhhhbb.exe111⤵PID:1028
-
\??\c:\jdvdj.exec:\jdvdj.exe112⤵PID:568
-
\??\c:\ppjpd.exec:\ppjpd.exe113⤵PID:1284
-
\??\c:\9lrflxl.exec:\9lrflxl.exe114⤵PID:2780
-
\??\c:\nnhtbn.exec:\nnhtbn.exe115⤵PID:2264
-
\??\c:\nhtbnh.exec:\nhtbnh.exe116⤵PID:772
-
\??\c:\7vvpv.exec:\7vvpv.exe117⤵PID:2068
-
\??\c:\3rflxll.exec:\3rflxll.exe118⤵PID:2948
-
\??\c:\fllxflf.exec:\fllxflf.exe119⤵PID:2964
-
\??\c:\nnnttn.exec:\nnnttn.exe120⤵PID:1984
-
\??\c:\5vpjp.exec:\5vpjp.exe121⤵PID:1396
-
\??\c:\jjvpd.exec:\jjvpd.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-