Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe
-
Size
446KB
-
MD5
a4fc0640b546cfcddc3d11ab3fbd1111
-
SHA1
1a811d7d1028a55cc2496cd4f422ac5e7ded82e2
-
SHA256
c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659
-
SHA512
beaa578c87cdeb986256d77a5242392e5b4a2373b81cec4893d7a565d0362b3cc011778e7efa389ff3ebadf0575c320441fb3cca20249f4c8e0e733fe6578a4b
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JsB:n3C9ytvn8whkb4i3e3GFO6JsB
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1684-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/1684-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1684-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2324-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3052-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2872-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1536-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/324-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1500-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1540-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1860-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2156-304-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2324 5tnttb.exe 2592 7bnhtn.exe 2096 1jdjp.exe 2828 flflrfx.exe 3052 vpjjv.exe 2712 rlfffrx.exe 2444 jdpjp.exe 2476 bhhbnt.exe 1832 xrxfrxl.exe 2788 nbnhtb.exe 2936 vvdvv.exe 2872 5xrrffr.exe 2012 nhhthb.exe 2652 dvdvj.exe 1248 tnnnth.exe 1536 1dvdj.exe 2068 bnnhnt.exe 1944 jppdv.exe 2384 rllxlrf.exe 324 nhtbhh.exe 1500 rlxflxr.exe 1140 hnbbhh.exe 2372 nnnbtb.exe 1540 xxfrfff.exe 3060 htnbnt.exe 1860 flffrrl.exe 320 nhnttt.exe 956 dpjjj.exe 2160 hnbhhb.exe 1060 pvdpd.exe 2156 rfxllfr.exe 1512 bnbhtb.exe 2172 xxrrxll.exe 2300 jdddj.exe 1208 1lffrfr.exe 2540 bthntt.exe 2592 3vjdj.exe 2508 rxflfrl.exe 2408 3tthtn.exe 2720 dppdd.exe 2424 rrlxfrl.exe 2564 tbnbnb.exe 2412 jjjpv.exe 2512 flllrlr.exe 1176 tnnbnh.exe 2756 jdvvd.exe 2796 jddpd.exe 2780 9lflrrx.exe 2936 9bnnht.exe 1972 vdvdp.exe 2648 9fxflrl.exe 2764 5hnhbh.exe 2752 djjjd.exe 1212 lfrfffl.exe 2040 ntnntt.exe 1304 nbbnbb.exe 2032 jddvv.exe 2792 xxxflrl.exe 684 hhhtnh.exe 924 pdppv.exe 904 9ffrxfr.exe 1888 htbhhh.exe 1140 pvpjp.exe 1124 ppppd.exe -
resource yara_rule behavioral1/memory/1684-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2324 1684 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 28 PID 1684 wrote to memory of 2324 1684 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 28 PID 1684 wrote to memory of 2324 1684 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 28 PID 1684 wrote to memory of 2324 1684 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 28 PID 2324 wrote to memory of 2592 2324 5tnttb.exe 29 PID 2324 wrote to memory of 2592 2324 5tnttb.exe 29 PID 2324 wrote to memory of 2592 2324 5tnttb.exe 29 PID 2324 wrote to memory of 2592 2324 5tnttb.exe 29 PID 2592 wrote to memory of 2096 2592 7bnhtn.exe 30 PID 2592 wrote to memory of 2096 2592 7bnhtn.exe 30 PID 2592 wrote to memory of 2096 2592 7bnhtn.exe 30 PID 2592 wrote to memory of 2096 2592 7bnhtn.exe 30 PID 2096 wrote to memory of 2828 2096 1jdjp.exe 31 PID 2096 wrote to memory of 2828 2096 1jdjp.exe 31 PID 2096 wrote to memory of 2828 2096 1jdjp.exe 31 PID 2096 wrote to memory of 2828 2096 1jdjp.exe 31 PID 2828 wrote to memory of 3052 2828 flflrfx.exe 32 PID 2828 wrote to memory of 3052 2828 flflrfx.exe 32 PID 2828 wrote to memory of 3052 2828 flflrfx.exe 32 PID 2828 wrote to memory of 3052 2828 flflrfx.exe 32 PID 3052 wrote to memory of 2712 3052 vpjjv.exe 33 PID 3052 wrote to memory of 2712 3052 vpjjv.exe 33 PID 3052 wrote to memory of 2712 3052 vpjjv.exe 33 PID 3052 wrote to memory of 2712 3052 vpjjv.exe 33 PID 2712 wrote to memory of 2444 2712 rlfffrx.exe 34 PID 2712 wrote to memory of 2444 2712 rlfffrx.exe 34 PID 2712 wrote to memory of 2444 2712 rlfffrx.exe 34 PID 2712 wrote to memory of 2444 2712 rlfffrx.exe 34 PID 2444 wrote to memory of 2476 2444 jdpjp.exe 35 PID 2444 wrote to memory of 2476 2444 jdpjp.exe 35 PID 2444 wrote to memory of 2476 2444 jdpjp.exe 35 PID 2444 wrote to memory of 2476 2444 jdpjp.exe 35 PID 2476 wrote to memory of 1832 2476 bhhbnt.exe 36 PID 2476 wrote to memory of 1832 2476 bhhbnt.exe 36 PID 2476 wrote to memory of 1832 2476 bhhbnt.exe 36 PID 2476 wrote to memory of 1832 2476 bhhbnt.exe 36 PID 1832 wrote to memory of 2788 1832 xrxfrxl.exe 37 PID 1832 wrote to memory of 2788 1832 xrxfrxl.exe 37 PID 1832 wrote to memory of 2788 1832 xrxfrxl.exe 37 PID 1832 wrote to memory of 2788 1832 xrxfrxl.exe 37 PID 2788 wrote to memory of 2936 2788 nbnhtb.exe 38 PID 2788 wrote to memory of 2936 2788 nbnhtb.exe 38 PID 2788 wrote to memory of 2936 2788 nbnhtb.exe 38 PID 2788 wrote to memory of 2936 2788 nbnhtb.exe 38 PID 2936 wrote to memory of 2872 2936 vvdvv.exe 39 PID 2936 wrote to memory of 2872 2936 vvdvv.exe 39 PID 2936 wrote to memory of 2872 2936 vvdvv.exe 39 PID 2936 wrote to memory of 2872 2936 vvdvv.exe 39 PID 2872 wrote to memory of 2012 2872 5xrrffr.exe 40 PID 2872 wrote to memory of 2012 2872 5xrrffr.exe 40 PID 2872 wrote to memory of 2012 2872 5xrrffr.exe 40 PID 2872 wrote to memory of 2012 2872 5xrrffr.exe 40 PID 2012 wrote to memory of 2652 2012 nhhthb.exe 41 PID 2012 wrote to memory of 2652 2012 nhhthb.exe 41 PID 2012 wrote to memory of 2652 2012 nhhthb.exe 41 PID 2012 wrote to memory of 2652 2012 nhhthb.exe 41 PID 2652 wrote to memory of 1248 2652 dvdvj.exe 42 PID 2652 wrote to memory of 1248 2652 dvdvj.exe 42 PID 2652 wrote to memory of 1248 2652 dvdvj.exe 42 PID 2652 wrote to memory of 1248 2652 dvdvj.exe 42 PID 1248 wrote to memory of 1536 1248 tnnnth.exe 43 PID 1248 wrote to memory of 1536 1248 tnnnth.exe 43 PID 1248 wrote to memory of 1536 1248 tnnnth.exe 43 PID 1248 wrote to memory of 1536 1248 tnnnth.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe"C:\Users\Admin\AppData\Local\Temp\c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\5tnttb.exec:\5tnttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\7bnhtn.exec:\7bnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1jdjp.exec:\1jdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\flflrfx.exec:\flflrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vpjjv.exec:\vpjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rlfffrx.exec:\rlfffrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jdpjp.exec:\jdpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\bhhbnt.exec:\bhhbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\nbnhtb.exec:\nbnhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vvdvv.exec:\vvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5xrrffr.exec:\5xrrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nhhthb.exec:\nhhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\dvdvj.exec:\dvdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\tnnnth.exec:\tnnnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\1dvdj.exec:\1dvdj.exe17⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bnnhnt.exec:\bnnhnt.exe18⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jppdv.exec:\jppdv.exe19⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rllxlrf.exec:\rllxlrf.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nhtbhh.exec:\nhtbhh.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\rlxflxr.exec:\rlxflxr.exe22⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hnbbhh.exec:\hnbbhh.exe23⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nnnbtb.exec:\nnnbtb.exe24⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxfrfff.exec:\xxfrfff.exe25⤵
- Executes dropped EXE
PID:1540 -
\??\c:\htnbnt.exec:\htnbnt.exe26⤵
- Executes dropped EXE
PID:3060 -
\??\c:\flffrrl.exec:\flffrrl.exe27⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nhnttt.exec:\nhnttt.exe28⤵
- Executes dropped EXE
PID:320 -
\??\c:\dpjjj.exec:\dpjjj.exe29⤵
- Executes dropped EXE
PID:956 -
\??\c:\hnbhhb.exec:\hnbhhb.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvdpd.exec:\pvdpd.exe31⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rfxllfr.exec:\rfxllfr.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bnbhtb.exec:\bnbhtb.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xxrrxll.exec:\xxrrxll.exe34⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9thbnt.exec:\9thbnt.exe35⤵PID:3016
-
\??\c:\jdddj.exec:\jdddj.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1lffrfr.exec:\1lffrfr.exe37⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bthntt.exec:\bthntt.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3vjdj.exec:\3vjdj.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rxflfrl.exec:\rxflfrl.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3tthtn.exec:\3tthtn.exe41⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dppdd.exec:\dppdd.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tbnbnb.exec:\tbnbnb.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jjjpv.exec:\jjjpv.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\flllrlr.exec:\flllrlr.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tnnbnh.exec:\tnnbnh.exe47⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jdvvd.exec:\jdvvd.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jddpd.exec:\jddpd.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9lflrrx.exec:\9lflrrx.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9bnnht.exec:\9bnnht.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vdvdp.exec:\vdvdp.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9fxflrl.exec:\9fxflrl.exe53⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5hnhbh.exec:\5hnhbh.exe54⤵
- Executes dropped EXE
PID:2764 -
\??\c:\djjjd.exec:\djjjd.exe55⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lfrfffl.exec:\lfrfffl.exe56⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ntnntt.exec:\ntnntt.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nbbnbb.exec:\nbbnbb.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jddvv.exec:\jddvv.exe59⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xxxflrl.exec:\xxxflrl.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hhhtnh.exec:\hhhtnh.exe61⤵
- Executes dropped EXE
PID:684 -
\??\c:\pdppv.exec:\pdppv.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\9ffrxfr.exec:\9ffrxfr.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\htbhhh.exec:\htbhhh.exe64⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pvpjp.exec:\pvpjp.exe65⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ppppd.exec:\ppppd.exe66⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3fxlfrf.exec:\3fxlfrf.exe67⤵PID:1796
-
\??\c:\5nntbn.exec:\5nntbn.exe68⤵PID:1776
-
\??\c:\9vvjd.exec:\9vvjd.exe69⤵PID:1624
-
\??\c:\xlxlrfl.exec:\xlxlrfl.exe70⤵PID:1620
-
\??\c:\7hnbnb.exec:\7hnbnb.exe71⤵PID:320
-
\??\c:\7vjjp.exec:\7vjjp.exe72⤵PID:3004
-
\??\c:\rflflrr.exec:\rflflrr.exe73⤵PID:2864
-
\??\c:\lxrrrfr.exec:\lxrrrfr.exe74⤵PID:1872
-
\??\c:\bhbntb.exec:\bhbntb.exe75⤵PID:564
-
\??\c:\7vjpd.exec:\7vjpd.exe76⤵PID:2156
-
\??\c:\rxxlrlf.exec:\rxxlrlf.exe77⤵PID:1608
-
\??\c:\rlrfxlr.exec:\rlrfxlr.exe78⤵PID:1904
-
\??\c:\nnthtb.exec:\nnthtb.exe79⤵PID:3016
-
\??\c:\5djpd.exec:\5djpd.exe80⤵PID:288
-
\??\c:\lxfllrl.exec:\lxfllrl.exe81⤵PID:3020
-
\??\c:\htbbnn.exec:\htbbnn.exe82⤵PID:2540
-
\??\c:\pddjv.exec:\pddjv.exe83⤵PID:2592
-
\??\c:\jjjvp.exec:\jjjvp.exe84⤵PID:2724
-
\??\c:\llfxflf.exec:\llfxflf.exe85⤵PID:2596
-
\??\c:\nnnthh.exec:\nnnthh.exe86⤵PID:2436
-
\??\c:\vdddp.exec:\vdddp.exe87⤵PID:2456
-
\??\c:\lfxlrrr.exec:\lfxlrrr.exe88⤵PID:2420
-
\??\c:\nnbbnt.exec:\nnbbnt.exe89⤵PID:2924
-
\??\c:\nnbhth.exec:\nnbhth.exe90⤵PID:2972
-
\??\c:\lrxrlxx.exec:\lrxrlxx.exe91⤵PID:2580
-
\??\c:\bnttnn.exec:\bnttnn.exe92⤵PID:2892
-
\??\c:\ddpjp.exec:\ddpjp.exe93⤵PID:2932
-
\??\c:\1ddjj.exec:\1ddjj.exe94⤵PID:1444
-
\??\c:\3lxrxxl.exec:\3lxrxxl.exe95⤵PID:2872
-
\??\c:\7nbbhh.exec:\7nbbhh.exe96⤵PID:2740
-
\??\c:\vdpdv.exec:\vdpdv.exe97⤵PID:1876
-
\??\c:\xlflxxx.exec:\xlflxxx.exe98⤵PID:1644
-
\??\c:\hhbtbh.exec:\hhbtbh.exe99⤵PID:2200
-
\??\c:\nnbbbb.exec:\nnbbbb.exe100⤵PID:2228
-
\??\c:\5ddjv.exec:\5ddjv.exe101⤵PID:2088
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe102⤵PID:1788
-
\??\c:\nttnbn.exec:\nttnbn.exe103⤵PID:1268
-
\??\c:\jjddp.exec:\jjddp.exe104⤵PID:488
-
\??\c:\rxfrlrf.exec:\rxfrlrf.exe105⤵PID:684
-
\??\c:\bbhntt.exec:\bbhntt.exe106⤵PID:1500
-
\??\c:\5nntht.exec:\5nntht.exe107⤵PID:1328
-
\??\c:\ntbbht.exec:\ntbbht.exe108⤵PID:784
-
\??\c:\ttntnt.exec:\ttntnt.exe109⤵PID:2116
-
\??\c:\jddpp.exec:\jddpp.exe110⤵PID:1540
-
\??\c:\7xxxrlx.exec:\7xxxrlx.exe111⤵PID:1648
-
\??\c:\httbhn.exec:\httbhn.exe112⤵PID:1660
-
\??\c:\pjjjj.exec:\pjjjj.exe113⤵PID:628
-
\??\c:\xrflrxl.exec:\xrflrxl.exe114⤵PID:884
-
\??\c:\9hbhnt.exec:\9hbhnt.exe115⤵PID:2124
-
\??\c:\pdddp.exec:\pdddp.exe116⤵PID:2272
-
\??\c:\dpvpj.exec:\dpvpj.exe117⤵PID:1060
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe118⤵PID:3008
-
\??\c:\hbhntb.exec:\hbhntb.exe119⤵PID:564
-
\??\c:\ppjpv.exec:\ppjpv.exe120⤵PID:1708
-
\??\c:\fxllfxx.exec:\fxllfxx.exe121⤵PID:2316
-
\??\c:\nbntbt.exec:\nbntbt.exe122⤵PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-