Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe
-
Size
55KB
-
MD5
e034c30cd04d381720f3a691960839c7
-
SHA1
d531ae810fba3bbe0dc947f94d9604bcc3f1302e
-
SHA256
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c
-
SHA512
f9098cdfe997080ecfd87efbe33d797309f4d9e96c5c5ba6d6a1f46a140878e900c29ff3adb13d22834165512169e6d288304ed7eebe505134cc3d803af7c06e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFK:ymb3NkkiQ3mdBjFIFK
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3060-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-2049-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral1/memory/3060-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1696-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3032-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3032-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/376-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1588-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1240-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1912-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1664-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1656-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2296-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1476-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1232-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2044-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1016-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2132-2049-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2132 jddjd.exe 1696 djvpp.exe 3032 llfrxfx.exe 376 ttbttn.exe 2644 5pvpp.exe 2864 7dpvj.exe 2736 thnthb.exe 2612 jvpvv.exe 2492 xlrlxff.exe 3020 3rfrlfx.exe 1588 1nbnbb.exe 1240 7djjp.exe 1040 fxlxlrl.exe 2184 hhnbbb.exe 1912 hnthbn.exe 2692 jjvjd.exe 1664 rxrxrxl.exe 1656 7fxfxlx.exe 2816 tnhntb.exe 2296 jpvpd.exe 2276 vdjdj.exe 776 7rxrxxf.exe 1476 ttbbhb.exe 2952 ttbtht.exe 1496 vdjvd.exe 2856 jdjpd.exe 1232 llxfxrx.exe 2200 7hthbh.exe 2044 bnnhnn.exe 1016 jdvdv.exe 764 rlrfxxl.exe 2192 9fxlffx.exe 2748 7thhnt.exe 2036 9hnnhh.exe 1732 dpdpv.exe 3012 rfxfllf.exe 2584 tnhntb.exe 1700 djppv.exe 2672 5jpvj.exe 2592 1llrlrl.exe 3016 xrlrffr.exe 2932 hhhhtt.exe 1152 nthhtn.exe 2472 jppdp.exe 2516 pjjpv.exe 1220 llfxrfx.exe 1716 lfflxfr.exe 1960 btnnbb.exe 1872 nthhbh.exe 1528 3jppv.exe 2508 3dvdp.exe 1940 fxlrffr.exe 2780 5xfrrfr.exe 2788 7bbhtb.exe 1924 tnhtht.exe 2808 vpvdj.exe 1656 ppppd.exe 2816 ppdpd.exe 936 rfxrfxx.exe 484 ntthnt.exe 1332 jvpjj.exe 956 dpddp.exe 852 lrxrlll.exe 2412 ttbnbn.exe -
resource yara_rule behavioral1/memory/3060-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-2049-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2132 3060 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 28 PID 3060 wrote to memory of 2132 3060 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 28 PID 3060 wrote to memory of 2132 3060 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 28 PID 3060 wrote to memory of 2132 3060 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 28 PID 2132 wrote to memory of 1696 2132 jddjd.exe 29 PID 2132 wrote to memory of 1696 2132 jddjd.exe 29 PID 2132 wrote to memory of 1696 2132 jddjd.exe 29 PID 2132 wrote to memory of 1696 2132 jddjd.exe 29 PID 1696 wrote to memory of 3032 1696 djvpp.exe 30 PID 1696 wrote to memory of 3032 1696 djvpp.exe 30 PID 1696 wrote to memory of 3032 1696 djvpp.exe 30 PID 1696 wrote to memory of 3032 1696 djvpp.exe 30 PID 3032 wrote to memory of 376 3032 llfrxfx.exe 31 PID 3032 wrote to memory of 376 3032 llfrxfx.exe 31 PID 3032 wrote to memory of 376 3032 llfrxfx.exe 31 PID 3032 wrote to memory of 376 3032 llfrxfx.exe 31 PID 376 wrote to memory of 2644 376 ttbttn.exe 32 PID 376 wrote to memory of 2644 376 ttbttn.exe 32 PID 376 wrote to memory of 2644 376 ttbttn.exe 32 PID 376 wrote to memory of 2644 376 ttbttn.exe 32 PID 2644 wrote to memory of 2864 2644 5pvpp.exe 33 PID 2644 wrote to memory of 2864 2644 5pvpp.exe 33 PID 2644 wrote to memory of 2864 2644 5pvpp.exe 33 PID 2644 wrote to memory of 2864 2644 5pvpp.exe 33 PID 2864 wrote to memory of 2736 2864 7dpvj.exe 34 PID 2864 wrote to memory of 2736 2864 7dpvj.exe 34 PID 2864 wrote to memory of 2736 2864 7dpvj.exe 34 PID 2864 wrote to memory of 2736 2864 7dpvj.exe 34 PID 2736 wrote to memory of 2612 2736 thnthb.exe 35 PID 2736 wrote to memory of 2612 2736 thnthb.exe 35 PID 2736 wrote to memory of 2612 2736 thnthb.exe 35 PID 2736 wrote to memory of 2612 2736 thnthb.exe 35 PID 2612 wrote to memory of 2492 2612 jvpvv.exe 36 PID 2612 wrote to memory of 2492 2612 jvpvv.exe 36 PID 2612 wrote to memory of 2492 2612 jvpvv.exe 36 PID 2612 wrote to memory of 2492 2612 jvpvv.exe 36 PID 2492 wrote to memory of 3020 2492 xlrlxff.exe 37 PID 2492 wrote to memory of 3020 2492 xlrlxff.exe 37 PID 2492 wrote to memory of 3020 2492 xlrlxff.exe 37 PID 2492 wrote to memory of 3020 2492 xlrlxff.exe 37 PID 3020 wrote to memory of 1588 3020 3rfrlfx.exe 38 PID 3020 wrote to memory of 1588 3020 3rfrlfx.exe 38 PID 3020 wrote to memory of 1588 3020 3rfrlfx.exe 38 PID 3020 wrote to memory of 1588 3020 3rfrlfx.exe 38 PID 1588 wrote to memory of 1240 1588 1nbnbb.exe 39 PID 1588 wrote to memory of 1240 1588 1nbnbb.exe 39 PID 1588 wrote to memory of 1240 1588 1nbnbb.exe 39 PID 1588 wrote to memory of 1240 1588 1nbnbb.exe 39 PID 1240 wrote to memory of 1040 1240 7djjp.exe 40 PID 1240 wrote to memory of 1040 1240 7djjp.exe 40 PID 1240 wrote to memory of 1040 1240 7djjp.exe 40 PID 1240 wrote to memory of 1040 1240 7djjp.exe 40 PID 1040 wrote to memory of 2184 1040 fxlxlrl.exe 41 PID 1040 wrote to memory of 2184 1040 fxlxlrl.exe 41 PID 1040 wrote to memory of 2184 1040 fxlxlrl.exe 41 PID 1040 wrote to memory of 2184 1040 fxlxlrl.exe 41 PID 2184 wrote to memory of 1912 2184 hhnbbb.exe 42 PID 2184 wrote to memory of 1912 2184 hhnbbb.exe 42 PID 2184 wrote to memory of 1912 2184 hhnbbb.exe 42 PID 2184 wrote to memory of 1912 2184 hhnbbb.exe 42 PID 1912 wrote to memory of 2692 1912 hnthbn.exe 43 PID 1912 wrote to memory of 2692 1912 hnthbn.exe 43 PID 1912 wrote to memory of 2692 1912 hnthbn.exe 43 PID 1912 wrote to memory of 2692 1912 hnthbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe"C:\Users\Admin\AppData\Local\Temp\2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jddjd.exec:\jddjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\djvpp.exec:\djvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\llfrxfx.exec:\llfrxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ttbttn.exec:\ttbttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\5pvpp.exec:\5pvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7dpvj.exec:\7dpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\thnthb.exec:\thnthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jvpvv.exec:\jvpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xlrlxff.exec:\xlrlxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\3rfrlfx.exec:\3rfrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\1nbnbb.exec:\1nbnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\7djjp.exec:\7djjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\fxlxlrl.exec:\fxlxlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\hhnbbb.exec:\hhnbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hnthbn.exec:\hnthbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\jjvjd.exec:\jjvjd.exe17⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rxrxrxl.exec:\rxrxrxl.exe18⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7fxfxlx.exec:\7fxfxlx.exe19⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnhntb.exec:\tnhntb.exe20⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jpvpd.exec:\jpvpd.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdjdj.exec:\vdjdj.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7rxrxxf.exec:\7rxrxxf.exe23⤵
- Executes dropped EXE
PID:776 -
\??\c:\ttbbhb.exec:\ttbbhb.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ttbtht.exec:\ttbtht.exe25⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vdjvd.exec:\vdjvd.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdjpd.exec:\jdjpd.exe27⤵
- Executes dropped EXE
PID:2856 -
\??\c:\llxfxrx.exec:\llxfxrx.exe28⤵
- Executes dropped EXE
PID:1232 -
\??\c:\7hthbh.exec:\7hthbh.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bnnhnn.exec:\bnnhnn.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jdvdv.exec:\jdvdv.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rlrfxxl.exec:\rlrfxxl.exe32⤵
- Executes dropped EXE
PID:764 -
\??\c:\9fxlffx.exec:\9fxlffx.exe33⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7thhnt.exec:\7thhnt.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9hnnhh.exec:\9hnnhh.exe35⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dpdpv.exec:\dpdpv.exe36⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rfxfllf.exec:\rfxfllf.exe37⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tnhntb.exec:\tnhntb.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\djppv.exec:\djppv.exe39⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5jpvj.exec:\5jpvj.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1llrlrl.exec:\1llrlrl.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrlrffr.exec:\xrlrffr.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhhhtt.exec:\hhhhtt.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nthhtn.exec:\nthhtn.exe44⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jppdp.exec:\jppdp.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjjpv.exec:\pjjpv.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\llfxrfx.exec:\llfxrfx.exe47⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lfflxfr.exec:\lfflxfr.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\btnnbb.exec:\btnnbb.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nthhbh.exec:\nthhbh.exe50⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3jppv.exec:\3jppv.exe51⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3dvdp.exec:\3dvdp.exe52⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fxlrffr.exec:\fxlrffr.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5xfrrfr.exec:\5xfrrfr.exe54⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7bbhtb.exec:\7bbhtb.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnhtht.exec:\tnhtht.exe56⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vpvdj.exec:\vpvdj.exe57⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ppppd.exec:\ppppd.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ppdpd.exec:\ppdpd.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rfxrfxx.exec:\rfxrfxx.exe60⤵
- Executes dropped EXE
PID:936 -
\??\c:\ntthnt.exec:\ntthnt.exe61⤵
- Executes dropped EXE
PID:484 -
\??\c:\jvpjj.exec:\jvpjj.exe62⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dpddp.exec:\dpddp.exe63⤵
- Executes dropped EXE
PID:956 -
\??\c:\lrxrlll.exec:\lrxrlll.exe64⤵
- Executes dropped EXE
PID:852 -
\??\c:\ttbnbn.exec:\ttbnbn.exe65⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vdjdd.exec:\vdjdd.exe66⤵PID:1124
-
\??\c:\vdjvj.exec:\vdjvj.exe67⤵PID:2080
-
\??\c:\xxrxlxl.exec:\xxrxlxl.exe68⤵PID:1248
-
\??\c:\lllxxxl.exec:\lllxxxl.exe69⤵PID:2900
-
\??\c:\ffxflrl.exec:\ffxflrl.exe70⤵PID:2284
-
\??\c:\bnnbhb.exec:\bnnbhb.exe71⤵PID:468
-
\??\c:\dpdjp.exec:\dpdjp.exe72⤵PID:892
-
\??\c:\7vjdp.exec:\7vjdp.exe73⤵PID:2068
-
\??\c:\lllrxfl.exec:\lllrxfl.exe74⤵PID:764
-
\??\c:\llrlxlr.exec:\llrlxlr.exe75⤵PID:1632
-
\??\c:\tnnnbb.exec:\tnnnbb.exe76⤵PID:2912
-
\??\c:\hhhnhn.exec:\hhhnhn.exe77⤵PID:3052
-
\??\c:\dpdjd.exec:\dpdjd.exe78⤵PID:2532
-
\??\c:\jddpv.exec:\jddpv.exe79⤵PID:2996
-
\??\c:\lrlrffr.exec:\lrlrffr.exe80⤵PID:1596
-
\??\c:\flfrlxr.exec:\flfrlxr.exe81⤵PID:2636
-
\??\c:\hbtnht.exec:\hbtnht.exe82⤵PID:2644
-
\??\c:\vpvvp.exec:\vpvvp.exe83⤵PID:2860
-
\??\c:\7vdpj.exec:\7vdpj.exe84⤵PID:2864
-
\??\c:\xlfflrf.exec:\xlfflrf.exe85⤵PID:2484
-
\??\c:\xrfrrlx.exec:\xrfrrlx.exe86⤵PID:2456
-
\??\c:\nnbhbb.exec:\nnbhbb.exe87⤵PID:2560
-
\??\c:\nnhnbh.exec:\nnhnbh.exe88⤵PID:2492
-
\??\c:\ddppv.exec:\ddppv.exe89⤵PID:2964
-
\??\c:\pjdjp.exec:\pjdjp.exe90⤵PID:2768
-
\??\c:\llfrffr.exec:\llfrffr.exe91⤵PID:2332
-
\??\c:\rxrflll.exec:\rxrflll.exe92⤵PID:1972
-
\??\c:\bhtbhh.exec:\bhtbhh.exe93⤵PID:1040
-
\??\c:\ttnbtb.exec:\ttnbtb.exe94⤵PID:2500
-
\??\c:\pdvvj.exec:\pdvvj.exe95⤵PID:2756
-
\??\c:\vvdpp.exec:\vvdpp.exe96⤵PID:2016
-
\??\c:\rlrrllx.exec:\rlrrllx.exe97⤵PID:1916
-
\??\c:\xfffflr.exec:\xfffflr.exe98⤵PID:2920
-
\??\c:\hbhnhh.exec:\hbhnhh.exe99⤵PID:2820
-
\??\c:\bbbnnt.exec:\bbbnnt.exe100⤵PID:2680
-
\??\c:\vpdpd.exec:\vpdpd.exe101⤵PID:2300
-
\??\c:\pdpdv.exec:\pdpdv.exe102⤵PID:536
-
\??\c:\rfrrfxl.exec:\rfrrfxl.exe103⤵PID:560
-
\??\c:\7ffxlrf.exec:\7ffxlrf.exe104⤵PID:1020
-
\??\c:\tbtbth.exec:\tbtbth.exe105⤵PID:1692
-
\??\c:\7bbhbh.exec:\7bbhbh.exe106⤵PID:1628
-
\??\c:\vdpdj.exec:\vdpdj.exe107⤵PID:1376
-
\??\c:\pdjjp.exec:\pdjjp.exe108⤵PID:1172
-
\??\c:\rfrrffl.exec:\rfrrffl.exe109⤵PID:2856
-
\??\c:\rlrxrfr.exec:\rlrxrfr.exe110⤵PID:1580
-
\??\c:\bthhtb.exec:\bthhtb.exe111⤵PID:1768
-
\??\c:\nntbnt.exec:\nntbnt.exe112⤵PID:2076
-
\??\c:\jdjjp.exec:\jdjjp.exe113⤵PID:2872
-
\??\c:\pjppv.exec:\pjppv.exe114⤵PID:2092
-
\??\c:\djdvp.exec:\djdvp.exe115⤵PID:880
-
\??\c:\frxlfrl.exec:\frxlfrl.exe116⤵PID:1188
-
\??\c:\hhbhht.exec:\hhbhht.exe117⤵PID:1216
-
\??\c:\ttthbn.exec:\ttthbn.exe118⤵PID:2028
-
\??\c:\1jddj.exec:\1jddj.exe119⤵PID:320
-
\??\c:\dddpp.exec:\dddpp.exe120⤵PID:2548
-
\??\c:\fxfrlxx.exec:\fxfrlxx.exe121⤵PID:2152
-
\??\c:\hnnbth.exec:\hnnbth.exe122⤵PID:376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-