Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 20:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe
-
Size
267KB
-
MD5
209d1e329a38c0329b0a926e2289f87b
-
SHA1
350b08d83135692b1e09a8016e574559cb52a77e
-
SHA256
2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d
-
SHA512
219505a4df6311f3d0e787b63fc07e579398e770f478e82fd7ba6bdf55e178955783e92b31558a86faeec02f9148d1276381e3d64524f089517662bf887a582b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMz:n3C9BRIG0asYFm71mPfkVB8dKwaWj
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1660-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/1660-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2156-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3012-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1072-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1880-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1756-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1872-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1984-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1684-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2516 9djpv.exe 3008 nnntnt.exe 2156 1rxxxff.exe 2628 rllxfrf.exe 2560 1pdjv.exe 2552 3dddv.exe 2548 hhtbhh.exe 2500 vpdpv.exe 3012 frxlrrl.exe 2964 ttnbnt.exe 2524 7dvvv.exe 1072 xrrxllf.exe 2760 7bbbnt.exe 2832 vvpvd.exe 2916 ffxxflr.exe 1880 rrlxlrx.exe 1756 hbnthn.exe 2284 vjdpv.exe 1872 rrrrlxx.exe 1728 7rrrfrl.exe 684 ppjvd.exe 1984 dvjpv.exe 820 llffrrl.exe 2876 bbnhnn.exe 1792 dvjdj.exe 980 xfrlrlr.exe 1324 nbntbh.exe 984 nhhnbt.exe 2896 vvvdv.exe 1684 rlfrxlx.exe 1020 1htbnb.exe 3064 vdvjd.exe 1608 5rffffr.exe 1660 lfrfrxf.exe 1624 ttntnt.exe 2932 nhbhtb.exe 1428 7vjpp.exe 2564 pjdvd.exe 2660 rrlfllx.exe 2568 flflxfr.exe 2724 9tthhh.exe 2856 ddvvp.exe 2044 vvjpd.exe 2480 rxxrxfx.exe 2452 rrrxrxl.exe 2136 9nhbhn.exe 3060 pvvpp.exe 2148 ppjpd.exe 1664 9fxlxfr.exe 2612 rllfxfx.exe 2732 hhtnhn.exe 2764 pjddj.exe 2140 dvpdd.exe 556 lffrffx.exe 672 9xrlrrr.exe 1744 bbnhth.exe 2052 nntbnn.exe 1528 7dvdp.exe 2056 xrxxllr.exe 1876 llrrfxr.exe 1728 nbhttn.exe 1628 1nbnbb.exe 1984 ddddj.exe 2404 vvpdp.exe -
resource yara_rule behavioral1/memory/1660-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2516 1660 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 28 PID 1660 wrote to memory of 2516 1660 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 28 PID 1660 wrote to memory of 2516 1660 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 28 PID 1660 wrote to memory of 2516 1660 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 28 PID 2516 wrote to memory of 3008 2516 9djpv.exe 29 PID 2516 wrote to memory of 3008 2516 9djpv.exe 29 PID 2516 wrote to memory of 3008 2516 9djpv.exe 29 PID 2516 wrote to memory of 3008 2516 9djpv.exe 29 PID 3008 wrote to memory of 2156 3008 nnntnt.exe 30 PID 3008 wrote to memory of 2156 3008 nnntnt.exe 30 PID 3008 wrote to memory of 2156 3008 nnntnt.exe 30 PID 3008 wrote to memory of 2156 3008 nnntnt.exe 30 PID 2156 wrote to memory of 2628 2156 1rxxxff.exe 31 PID 2156 wrote to memory of 2628 2156 1rxxxff.exe 31 PID 2156 wrote to memory of 2628 2156 1rxxxff.exe 31 PID 2156 wrote to memory of 2628 2156 1rxxxff.exe 31 PID 2628 wrote to memory of 2560 2628 rllxfrf.exe 32 PID 2628 wrote to memory of 2560 2628 rllxfrf.exe 32 PID 2628 wrote to memory of 2560 2628 rllxfrf.exe 32 PID 2628 wrote to memory of 2560 2628 rllxfrf.exe 32 PID 2560 wrote to memory of 2552 2560 1pdjv.exe 33 PID 2560 wrote to memory of 2552 2560 1pdjv.exe 33 PID 2560 wrote to memory of 2552 2560 1pdjv.exe 33 PID 2560 wrote to memory of 2552 2560 1pdjv.exe 33 PID 2552 wrote to memory of 2548 2552 3dddv.exe 34 PID 2552 wrote to memory of 2548 2552 3dddv.exe 34 PID 2552 wrote to memory of 2548 2552 3dddv.exe 34 PID 2552 wrote to memory of 2548 2552 3dddv.exe 34 PID 2548 wrote to memory of 2500 2548 hhtbhh.exe 35 PID 2548 wrote to memory of 2500 2548 hhtbhh.exe 35 PID 2548 wrote to memory of 2500 2548 hhtbhh.exe 35 PID 2548 wrote to memory of 2500 2548 hhtbhh.exe 35 PID 2500 wrote to memory of 3012 2500 vpdpv.exe 36 PID 2500 wrote to memory of 3012 2500 vpdpv.exe 36 PID 2500 wrote to memory of 3012 2500 vpdpv.exe 36 PID 2500 wrote to memory of 3012 2500 vpdpv.exe 36 PID 3012 wrote to memory of 2964 3012 frxlrrl.exe 37 PID 3012 wrote to memory of 2964 3012 frxlrrl.exe 37 PID 3012 wrote to memory of 2964 3012 frxlrrl.exe 37 PID 3012 wrote to memory of 2964 3012 frxlrrl.exe 37 PID 2964 wrote to memory of 2524 2964 ttnbnt.exe 38 PID 2964 wrote to memory of 2524 2964 ttnbnt.exe 38 PID 2964 wrote to memory of 2524 2964 ttnbnt.exe 38 PID 2964 wrote to memory of 2524 2964 ttnbnt.exe 38 PID 2524 wrote to memory of 1072 2524 7dvvv.exe 39 PID 2524 wrote to memory of 1072 2524 7dvvv.exe 39 PID 2524 wrote to memory of 1072 2524 7dvvv.exe 39 PID 2524 wrote to memory of 1072 2524 7dvvv.exe 39 PID 1072 wrote to memory of 2760 1072 xrrxllf.exe 40 PID 1072 wrote to memory of 2760 1072 xrrxllf.exe 40 PID 1072 wrote to memory of 2760 1072 xrrxllf.exe 40 PID 1072 wrote to memory of 2760 1072 xrrxllf.exe 40 PID 2760 wrote to memory of 2832 2760 7bbbnt.exe 41 PID 2760 wrote to memory of 2832 2760 7bbbnt.exe 41 PID 2760 wrote to memory of 2832 2760 7bbbnt.exe 41 PID 2760 wrote to memory of 2832 2760 7bbbnt.exe 41 PID 2832 wrote to memory of 2916 2832 vvpvd.exe 42 PID 2832 wrote to memory of 2916 2832 vvpvd.exe 42 PID 2832 wrote to memory of 2916 2832 vvpvd.exe 42 PID 2832 wrote to memory of 2916 2832 vvpvd.exe 42 PID 2916 wrote to memory of 1880 2916 ffxxflr.exe 43 PID 2916 wrote to memory of 1880 2916 ffxxflr.exe 43 PID 2916 wrote to memory of 1880 2916 ffxxflr.exe 43 PID 2916 wrote to memory of 1880 2916 ffxxflr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe"C:\Users\Admin\AppData\Local\Temp\2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\9djpv.exec:\9djpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nnntnt.exec:\nnntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\1rxxxff.exec:\1rxxxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\rllxfrf.exec:\rllxfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\1pdjv.exec:\1pdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3dddv.exec:\3dddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hhtbhh.exec:\hhtbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vpdpv.exec:\vpdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\frxlrrl.exec:\frxlrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ttnbnt.exec:\ttnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7dvvv.exec:\7dvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xrrxllf.exec:\xrrxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\7bbbnt.exec:\7bbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vvpvd.exec:\vvpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ffxxflr.exec:\ffxxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe17⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbnthn.exec:\hbnthn.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vjdpv.exec:\vjdpv.exe19⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rrrrlxx.exec:\rrrrlxx.exe20⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7rrrfrl.exec:\7rrrfrl.exe21⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ppjvd.exec:\ppjvd.exe22⤵
- Executes dropped EXE
PID:684 -
\??\c:\dvjpv.exec:\dvjpv.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\llffrrl.exec:\llffrrl.exe24⤵
- Executes dropped EXE
PID:820 -
\??\c:\bbnhnn.exec:\bbnhnn.exe25⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dvjdj.exec:\dvjdj.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xfrlrlr.exec:\xfrlrlr.exe27⤵
- Executes dropped EXE
PID:980 -
\??\c:\nbntbh.exec:\nbntbh.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nhhnbt.exec:\nhhnbt.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\vvvdv.exec:\vvvdv.exe30⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1htbnb.exec:\1htbnb.exe32⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vdvjd.exec:\vdvjd.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5rffffr.exec:\5rffffr.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe35⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ttntnt.exec:\ttntnt.exe36⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhbhtb.exec:\nhbhtb.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7vjpp.exec:\7vjpp.exe38⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pjdvd.exec:\pjdvd.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rrlfllx.exec:\rrlfllx.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\flflxfr.exec:\flflxfr.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9tthhh.exec:\9tthhh.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ddvvp.exec:\ddvvp.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vvjpd.exec:\vvjpd.exe44⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rxxrxfx.exec:\rxxrxfx.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9nhbhn.exec:\9nhbhn.exe47⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pvvpp.exec:\pvvpp.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ppjpd.exec:\ppjpd.exe49⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9fxlxfr.exec:\9fxlxfr.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rllfxfx.exec:\rllfxfx.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hhtnhn.exec:\hhtnhn.exe52⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pjddj.exec:\pjddj.exe53⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvpdd.exec:\dvpdd.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lffrffx.exec:\lffrffx.exe55⤵
- Executes dropped EXE
PID:556 -
\??\c:\9xrlrrr.exec:\9xrlrrr.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\bbnhth.exec:\bbnhth.exe57⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nntbnn.exec:\nntbnn.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7dvdp.exec:\7dvdp.exe59⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xrxxllr.exec:\xrxxllr.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\llrrfxr.exec:\llrrfxr.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nbhttn.exec:\nbhttn.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1nbnbb.exec:\1nbnbb.exe63⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ddddj.exec:\ddddj.exe64⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvpdp.exec:\vvpdp.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ffxfrfx.exec:\ffxfrfx.exe66⤵PID:2408
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe67⤵PID:1560
-
\??\c:\1ntbhn.exec:\1ntbhn.exe68⤵PID:660
-
\??\c:\9nbntb.exec:\9nbntb.exe69⤵PID:2016
-
\??\c:\jjvpj.exec:\jjvpj.exe70⤵PID:2032
-
\??\c:\1dvjd.exec:\1dvjd.exe71⤵PID:908
-
\??\c:\lxllxxl.exec:\lxllxxl.exe72⤵PID:312
-
\??\c:\nntntb.exec:\nntntb.exe73⤵PID:2824
-
\??\c:\nhhtbb.exec:\nhhtbb.exe74⤵PID:892
-
\??\c:\9hbhth.exec:\9hbhth.exe75⤵PID:2360
-
\??\c:\9pvdp.exec:\9pvdp.exe76⤵PID:2848
-
\??\c:\fxlrrfr.exec:\fxlrrfr.exe77⤵PID:2392
-
\??\c:\frfrfrx.exec:\frfrfrx.exe78⤵PID:3004
-
\??\c:\hbtbnn.exec:\hbtbnn.exe79⤵PID:3044
-
\??\c:\btttbh.exec:\btttbh.exe80⤵PID:2992
-
\??\c:\djdjd.exec:\djdjd.exe81⤵PID:2544
-
\??\c:\jjvvj.exec:\jjvvj.exe82⤵PID:2632
-
\??\c:\xxffllr.exec:\xxffllr.exe83⤵PID:2588
-
\??\c:\fxfrxxl.exec:\fxfrxxl.exe84⤵PID:3024
-
\??\c:\httbnh.exec:\httbnh.exe85⤵PID:2672
-
\??\c:\vvjjv.exec:\vvjjv.exe86⤵PID:2652
-
\??\c:\vvvjd.exec:\vvvjd.exe87⤵PID:2456
-
\??\c:\llfflrx.exec:\llfflrx.exe88⤵PID:2788
-
\??\c:\xllffxl.exec:\xllffxl.exe89⤵PID:2700
-
\??\c:\nhtthh.exec:\nhtthh.exe90⤵PID:1616
-
\??\c:\vvdjp.exec:\vvdjp.exe91⤵PID:2736
-
\??\c:\djvjp.exec:\djvjp.exe92⤵PID:1936
-
\??\c:\fxxfxff.exec:\fxxfxff.exe93⤵PID:1472
-
\??\c:\hhbhbh.exec:\hhbhbh.exe94⤵PID:2504
-
\??\c:\hhhnnt.exec:\hhhnnt.exe95⤵PID:2820
-
\??\c:\nhttbh.exec:\nhttbh.exe96⤵PID:1632
-
\??\c:\9vjjj.exec:\9vjjj.exe97⤵PID:1084
-
\??\c:\7xllrxf.exec:\7xllrxf.exe98⤵PID:1088
-
\??\c:\frxxfxx.exec:\frxxfxx.exe99⤵PID:2276
-
\??\c:\tnbbnt.exec:\tnbbnt.exe100⤵PID:2264
-
\??\c:\1bnnnb.exec:\1bnnnb.exe101⤵PID:2296
-
\??\c:\jpjdj.exec:\jpjdj.exe102⤵PID:1724
-
\??\c:\jvvdp.exec:\jvvdp.exe103⤵PID:540
-
\??\c:\5rllxlx.exec:\5rllxlx.exe104⤵PID:624
-
\??\c:\rlxxfff.exec:\rlxxfff.exe105⤵PID:684
-
\??\c:\hhhnhh.exec:\hhhnhh.exe106⤵PID:452
-
\??\c:\vpdpd.exec:\vpdpd.exe107⤵PID:2180
-
\??\c:\vvjjp.exec:\vvjjp.exe108⤵PID:356
-
\??\c:\frxxxrx.exec:\frxxxrx.exe109⤵PID:332
-
\??\c:\5lxxllx.exec:\5lxxllx.exe110⤵PID:1620
-
\??\c:\5ttnht.exec:\5ttnht.exe111⤵PID:1252
-
\??\c:\3bbhnt.exec:\3bbhnt.exe112⤵PID:1324
-
\??\c:\pddjp.exec:\pddjp.exe113⤵PID:884
-
\??\c:\vjjjj.exec:\vjjjj.exe114⤵PID:2984
-
\??\c:\7lflllr.exec:\7lflllr.exe115⤵PID:2216
-
\??\c:\llfxrfl.exec:\llfxrfl.exe116⤵PID:3052
-
\??\c:\bnhhbh.exec:\bnhhbh.exe117⤵PID:3068
-
\??\c:\vjvjv.exec:\vjvjv.exe118⤵PID:1064
-
\??\c:\5dddj.exec:\5dddj.exe119⤵PID:1716
-
\??\c:\xrllllr.exec:\xrllllr.exe120⤵PID:2864
-
\??\c:\frxxxxr.exec:\frxxxxr.exe121⤵PID:2516
-
\??\c:\tnbbtn.exec:\tnbbtn.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-