Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe
-
Size
308KB
-
MD5
17a51fa72d5a9e3b466eeec37c5a706b
-
SHA1
7527223c1349ca49bc75e1996cb6436504a5bb33
-
SHA256
e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0
-
SHA512
e306c5f83cda0d65b0fc83d329b34462585763f470185d9314e1c2b0c6617586b969798559581875901bde3e2c6c13f01cc53d50a4ce0352ccd5ab3afd1d9b3a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDLS0k+sLiiBVS0ILlMcGGW7sRCl9eMw:n3C9BRo/AIuunS3+sOiBVSXxMxTsm9ep
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2292-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/2292-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2792-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2792-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1656-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2184-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1160-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1780-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1648-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2352-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1340-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1692-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2792 nhntbn.exe 2896 rrlxrfx.exe 2728 jjjdp.exe 2856 dvpvj.exe 2744 hbtbnt.exe 2780 dvpjp.exe 2532 bnnntn.exe 2572 vjvpj.exe 1952 rxlfrxr.exe 1656 btnntt.exe 2916 jjvvd.exe 2184 rrrxlrl.exe 1160 jjdpd.exe 2452 9xlxflf.exe 1780 vpdjv.exe 288 lflrffr.exe 2248 htttbn.exe 2880 vpvdd.exe 2700 xxrflrx.exe 484 ddvjd.exe 1648 lllxrff.exe 1900 1ntbtt.exe 2976 xrllxlr.exe 2352 hthnnt.exe 3056 lfxxfrf.exe 1340 nhtbbn.exe 2952 vvpvj.exe 2276 rlrrxxf.exe 1692 bnbbhb.exe 2152 9jvpp.exe 1680 5fxflrx.exe 1720 tbnnht.exe 1752 5dppj.exe 1884 xxrffrr.exe 2796 bbthth.exe 2792 jvdpp.exe 2724 5llrxxl.exe 2672 9fllrrr.exe 2676 hthbbt.exe 2652 ntnbnn.exe 1700 pddpv.exe 2432 7frrffl.exe 2780 ntbtbn.exe 2928 ttthbh.exe 1628 3dddv.exe 1896 xrllrxf.exe 1952 9bnhnh.exe 3016 btnnbt.exe 1444 xflfflr.exe 848 7rffxxr.exe 1184 nhttbt.exe 2196 vvvvp.exe 2160 rxxlrxr.exe 1076 frrxrff.exe 1332 hhhthn.exe 2380 dpjdp.exe 2248 rxlxlxr.exe 2280 rlrxffr.exe 600 bthbht.exe 280 jdpdd.exe 1060 rxxrrff.exe 2300 hththb.exe 340 ppvdv.exe 2360 vjdjj.exe -
resource yara_rule behavioral1/memory/2292-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2792 2292 e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe 28 PID 2292 wrote to memory of 2792 2292 e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe 28 PID 2292 wrote to memory of 2792 2292 e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe 28 PID 2292 wrote to memory of 2792 2292 e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe 28 PID 2792 wrote to memory of 2896 2792 nhntbn.exe 29 PID 2792 wrote to memory of 2896 2792 nhntbn.exe 29 PID 2792 wrote to memory of 2896 2792 nhntbn.exe 29 PID 2792 wrote to memory of 2896 2792 nhntbn.exe 29 PID 2896 wrote to memory of 2728 2896 rrlxrfx.exe 30 PID 2896 wrote to memory of 2728 2896 rrlxrfx.exe 30 PID 2896 wrote to memory of 2728 2896 rrlxrfx.exe 30 PID 2896 wrote to memory of 2728 2896 rrlxrfx.exe 30 PID 2728 wrote to memory of 2856 2728 jjjdp.exe 31 PID 2728 wrote to memory of 2856 2728 jjjdp.exe 31 PID 2728 wrote to memory of 2856 2728 jjjdp.exe 31 PID 2728 wrote to memory of 2856 2728 jjjdp.exe 31 PID 2856 wrote to memory of 2744 2856 dvpvj.exe 32 PID 2856 wrote to memory of 2744 2856 dvpvj.exe 32 PID 2856 wrote to memory of 2744 2856 dvpvj.exe 32 PID 2856 wrote to memory of 2744 2856 dvpvj.exe 32 PID 2744 wrote to memory of 2780 2744 hbtbnt.exe 33 PID 2744 wrote to memory of 2780 2744 hbtbnt.exe 33 PID 2744 wrote to memory of 2780 2744 hbtbnt.exe 33 PID 2744 wrote to memory of 2780 2744 hbtbnt.exe 33 PID 2780 wrote to memory of 2532 2780 dvpjp.exe 34 PID 2780 wrote to memory of 2532 2780 dvpjp.exe 34 PID 2780 wrote to memory of 2532 2780 dvpjp.exe 34 PID 2780 wrote to memory of 2532 2780 dvpjp.exe 34 PID 2532 wrote to memory of 2572 2532 bnnntn.exe 35 PID 2532 wrote to memory of 2572 2532 bnnntn.exe 35 PID 2532 wrote to memory of 2572 2532 bnnntn.exe 35 PID 2532 wrote to memory of 2572 2532 bnnntn.exe 35 PID 2572 wrote to memory of 1952 2572 vjvpj.exe 36 PID 2572 wrote to memory of 1952 2572 vjvpj.exe 36 PID 2572 wrote to memory of 1952 2572 vjvpj.exe 36 PID 2572 wrote to memory of 1952 2572 vjvpj.exe 36 PID 1952 wrote to memory of 1656 1952 rxlfrxr.exe 37 PID 1952 wrote to memory of 1656 1952 rxlfrxr.exe 37 PID 1952 wrote to memory of 1656 1952 rxlfrxr.exe 37 PID 1952 wrote to memory of 1656 1952 rxlfrxr.exe 37 PID 1656 wrote to memory of 2916 1656 btnntt.exe 38 PID 1656 wrote to memory of 2916 1656 btnntt.exe 38 PID 1656 wrote to memory of 2916 1656 btnntt.exe 38 PID 1656 wrote to memory of 2916 1656 btnntt.exe 38 PID 2916 wrote to memory of 2184 2916 jjvvd.exe 39 PID 2916 wrote to memory of 2184 2916 jjvvd.exe 39 PID 2916 wrote to memory of 2184 2916 jjvvd.exe 39 PID 2916 wrote to memory of 2184 2916 jjvvd.exe 39 PID 2184 wrote to memory of 1160 2184 rrrxlrl.exe 40 PID 2184 wrote to memory of 1160 2184 rrrxlrl.exe 40 PID 2184 wrote to memory of 1160 2184 rrrxlrl.exe 40 PID 2184 wrote to memory of 1160 2184 rrrxlrl.exe 40 PID 1160 wrote to memory of 2452 1160 jjdpd.exe 41 PID 1160 wrote to memory of 2452 1160 jjdpd.exe 41 PID 1160 wrote to memory of 2452 1160 jjdpd.exe 41 PID 1160 wrote to memory of 2452 1160 jjdpd.exe 41 PID 2452 wrote to memory of 1780 2452 9xlxflf.exe 42 PID 2452 wrote to memory of 1780 2452 9xlxflf.exe 42 PID 2452 wrote to memory of 1780 2452 9xlxflf.exe 42 PID 2452 wrote to memory of 1780 2452 9xlxflf.exe 42 PID 1780 wrote to memory of 288 1780 vpdjv.exe 43 PID 1780 wrote to memory of 288 1780 vpdjv.exe 43 PID 1780 wrote to memory of 288 1780 vpdjv.exe 43 PID 1780 wrote to memory of 288 1780 vpdjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe"C:\Users\Admin\AppData\Local\Temp\e9b05d1af3c858aa6399ee61b9f41a2ea409d4275eda9c7f9aa78eec031bcae0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\nhntbn.exec:\nhntbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jjjdp.exec:\jjjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dvpvj.exec:\dvpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\hbtbnt.exec:\hbtbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dvpjp.exec:\dvpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bnnntn.exec:\bnnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\vjvpj.exec:\vjvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rxlfrxr.exec:\rxlfrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\btnntt.exec:\btnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\jjvvd.exec:\jjvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jjdpd.exec:\jjdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\9xlxflf.exec:\9xlxflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\vpdjv.exec:\vpdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\lflrffr.exec:\lflrffr.exe17⤵
- Executes dropped EXE
PID:288 -
\??\c:\htttbn.exec:\htttbn.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpvdd.exec:\vpvdd.exe19⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxrflrx.exec:\xxrflrx.exe20⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ddvjd.exec:\ddvjd.exe21⤵
- Executes dropped EXE
PID:484 -
\??\c:\lllxrff.exec:\lllxrff.exe22⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1ntbtt.exec:\1ntbtt.exe23⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrllxlr.exec:\xrllxlr.exe24⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hthnnt.exec:\hthnnt.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfxxfrf.exec:\lfxxfrf.exe26⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nhtbbn.exec:\nhtbbn.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vvpvj.exec:\vvpvj.exe28⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bnbbhb.exec:\bnbbhb.exe30⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9jvpp.exec:\9jvpp.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5fxflrx.exec:\5fxflrx.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tbnnht.exec:\tbnnht.exe33⤵
- Executes dropped EXE
PID:1720 -
\??\c:\5dppj.exec:\5dppj.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xxrffrr.exec:\xxrffrr.exe35⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bbthth.exec:\bbthth.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jvdpp.exec:\jvdpp.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5llrxxl.exec:\5llrxxl.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9fllrrr.exec:\9fllrrr.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hthbbt.exec:\hthbbt.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ntnbnn.exec:\ntnbnn.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pddpv.exec:\pddpv.exe42⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7frrffl.exec:\7frrffl.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ntbtbn.exec:\ntbtbn.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ttthbh.exec:\ttthbh.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3dddv.exec:\3dddv.exe46⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xrllrxf.exec:\xrllrxf.exe47⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9bnhnh.exec:\9bnhnh.exe48⤵
- Executes dropped EXE
PID:1952 -
\??\c:\btnnbt.exec:\btnnbt.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xflfflr.exec:\xflfflr.exe50⤵
- Executes dropped EXE
PID:1444 -
\??\c:\7rffxxr.exec:\7rffxxr.exe51⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhttbt.exec:\nhttbt.exe52⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vvvvp.exec:\vvvvp.exe53⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxxlrxr.exec:\rxxlrxr.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frrxrff.exec:\frrxrff.exe55⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hhhthn.exec:\hhhthn.exe56⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dpjdp.exec:\dpjdp.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxlxlxr.exec:\rxlxlxr.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlrxffr.exec:\rlrxffr.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bthbht.exec:\bthbht.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\jdpdd.exec:\jdpdd.exe61⤵
- Executes dropped EXE
PID:280 -
\??\c:\rxxrrff.exec:\rxxrrff.exe62⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hththb.exec:\hththb.exe63⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ppvdv.exec:\ppvdv.exe64⤵
- Executes dropped EXE
PID:340 -
\??\c:\vjdjj.exec:\vjdjj.exe65⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xrflrxl.exec:\xrflrxl.exe66⤵PID:1540
-
\??\c:\hbttbb.exec:\hbttbb.exe67⤵PID:1788
-
\??\c:\7djdd.exec:\7djdd.exe68⤵PID:1148
-
\??\c:\7jddp.exec:\7jddp.exe69⤵PID:1112
-
\??\c:\flfrllr.exec:\flfrllr.exe70⤵PID:1132
-
\??\c:\nbtbhh.exec:\nbtbhh.exe71⤵PID:1440
-
\??\c:\9hbhnn.exec:\9hbhnn.exe72⤵PID:2468
-
\??\c:\jppvd.exec:\jppvd.exe73⤵PID:2132
-
\??\c:\lfrxllr.exec:\lfrxllr.exe74⤵PID:2152
-
\??\c:\nbbttt.exec:\nbbttt.exe75⤵PID:1976
-
\??\c:\jvjjp.exec:\jvjjp.exe76⤵PID:1684
-
\??\c:\dvjdv.exec:\dvjdv.exe77⤵PID:1604
-
\??\c:\rllrxlf.exec:\rllrxlf.exe78⤵PID:2428
-
\??\c:\9hnnbb.exec:\9hnnbb.exe79⤵PID:2808
-
\??\c:\pdpvj.exec:\pdpvj.exe80⤵PID:2648
-
\??\c:\lfxfrxx.exec:\lfxfrxx.exe81⤵PID:2624
-
\??\c:\lllrffr.exec:\lllrffr.exe82⤵PID:2528
-
\??\c:\tbbbtb.exec:\tbbbtb.exe83⤵PID:2680
-
\??\c:\vpdjp.exec:\vpdjp.exe84⤵PID:2676
-
\??\c:\xrxlxxf.exec:\xrxlxxf.exe85⤵PID:2744
-
\??\c:\llrrxfx.exec:\llrrxfx.exe86⤵PID:2692
-
\??\c:\nnnbnn.exec:\nnnbnn.exe87⤵PID:2592
-
\??\c:\jpdpd.exec:\jpdpd.exe88⤵PID:2780
-
\??\c:\llxfxxx.exec:\llxfxxx.exe89⤵PID:1732
-
\??\c:\hbhhnn.exec:\hbhhnn.exe90⤵PID:1800
-
\??\c:\btntnb.exec:\btntnb.exe91⤵PID:2560
-
\??\c:\vpdjv.exec:\vpdjv.exe92⤵PID:2128
-
\??\c:\7lffffl.exec:\7lffffl.exe93⤵PID:3016
-
\??\c:\dpjjd.exec:\dpjjd.exe94⤵PID:1436
-
\??\c:\jvjjp.exec:\jvjjp.exe95⤵PID:2308
-
\??\c:\llxrlxl.exec:\llxrlxl.exe96⤵PID:1992
-
\??\c:\hntbhn.exec:\hntbhn.exe97⤵PID:2404
-
\??\c:\vvjpv.exec:\vvjpv.exe98⤵PID:2252
-
\??\c:\7dppp.exec:\7dppp.exe99⤵PID:2400
-
\??\c:\9xlfflr.exec:\9xlfflr.exe100⤵PID:2876
-
\??\c:\7nnhbt.exec:\7nnhbt.exe101⤵PID:2380
-
\??\c:\3jjdd.exec:\3jjdd.exe102⤵PID:2144
-
\??\c:\jjpjv.exec:\jjpjv.exe103⤵PID:704
-
\??\c:\7lxrfll.exec:\7lxrfll.exe104⤵PID:660
-
\??\c:\bnbbbb.exec:\bnbbbb.exe105⤵PID:840
-
\??\c:\thtthn.exec:\thtthn.exe106⤵PID:1536
-
\??\c:\1ddpv.exec:\1ddpv.exe107⤵PID:1028
-
\??\c:\rlxflxr.exec:\rlxflxr.exe108⤵PID:2976
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe109⤵PID:1812
-
\??\c:\tthnbh.exec:\tthnbh.exe110⤵PID:2032
-
\??\c:\5ttbnn.exec:\5ttbnn.exe111⤵PID:2044
-
\??\c:\jdjpp.exec:\jdjpp.exe112⤵PID:2040
-
\??\c:\lxrrffl.exec:\lxrrffl.exe113⤵PID:2952
-
\??\c:\9flrfll.exec:\9flrfll.exe114⤵PID:2276
-
\??\c:\1nnbhn.exec:\1nnbhn.exe115⤵PID:2900
-
\??\c:\dpvjj.exec:\dpvjj.exe116⤵PID:2844
-
\??\c:\jjjdj.exec:\jjjdj.exe117⤵PID:3040
-
\??\c:\flflrxx.exec:\flflrxx.exe118⤵PID:2060
-
\??\c:\3bnthh.exec:\3bnthh.exe119⤵PID:2600
-
\??\c:\pvjpj.exec:\pvjpj.exe120⤵PID:1612
-
\??\c:\1dvjp.exec:\1dvjp.exe121⤵PID:2816
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe122⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-