Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 00:33
Behavioral task
behavioral1
Sample
96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe
-
Size
331KB
-
MD5
06650cd13ea18309302c12420e46f657
-
SHA1
a2e38d14c5b44fe1ce89d9c6d3a924a7cb1f51e3
-
SHA256
96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64
-
SHA512
42fbcbf5fbf40e72056c1ec384b06e2d1185c467010fb28a7332adc05869289de19d5ef390785ff3a4076db66bb5e5ab0889906f05a5281940ad2865810adb7b
-
SSDEEP
6144:9cm4FmowdHoS4BftapTs8Hoo+6MjTVhRDqzS:/4wFHoS4d0G8HoljTVhRDqzS
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/3028-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-46-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/404-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-637-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2316-668-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1172-690-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-876-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2700-874-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2540-900-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-1028-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1968-1154-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2704 rlrrlrx.exe 2544 xllxlrx.exe 2680 hbtbnn.exe 2600 htttbh.exe 2560 rlrffxl.exe 2536 bhnhnb.exe 2396 3xrlrlr.exe 2328 5fxfrxr.exe 1576 vvpjv.exe 2468 9fxxlrx.exe 2712 5tnhnh.exe 852 jppdp.exe 2152 9lxrrff.exe 768 bthttb.exe 1964 pjpdj.exe 1272 xllxflx.exe 336 vjvdj.exe 2156 flxxrff.exe 2036 htbnnn.exe 2496 pjddj.exe 1908 lfllxxl.exe 2824 nththt.exe 2072 pjvdp.exe 1588 lxrxfxf.exe 2764 nnhnth.exe 1572 jjjpj.exe 1028 5nnthh.exe 1688 jpdjj.exe 616 rxfflff.exe 2276 tbtnnh.exe 404 3lxfrrf.exe 2872 btntht.exe 1612 jpdjp.exe 1928 9vjdv.exe 2228 rlfllfx.exe 2584 5vpvd.exe 2540 rlfffxx.exe 2652 ffxrflx.exe 2628 htthhh.exe 2532 pvdvv.exe 2436 xxrxllr.exe 2760 hhhtht.exe 2568 jjjvj.exe 2536 9xxxlxl.exe 2876 ffxlrff.exe 2888 hbtbhh.exe 1856 dvjpv.exe 2660 fxxrflf.exe 2468 bnthtb.exe 2712 jdppv.exe 1380 pjdpv.exe 2216 xlxfllx.exe 276 fxxllrr.exe 768 9nhntb.exe 1288 7vdjv.exe 680 jjdjj.exe 816 ttthtb.exe 2792 nbtthn.exe 2264 jdvpd.exe 1724 xfllrff.exe 2236 rfflrrl.exe 2780 1bbtnn.exe 2384 vjvvp.exe 576 rxlrffx.exe -
resource yara_rule behavioral1/memory/3028-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001431b-5.dat upx behavioral1/memory/2704-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0031000000015d9c-18.dat upx behavioral1/memory/2544-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016122-26.dat upx behavioral1/memory/2680-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000163eb-36.dat upx behavioral1/memory/2600-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000164ec-43.dat upx behavioral1/memory/2560-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016575-54.dat upx behavioral1/memory/2536-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d21-64.dat upx behavioral1/files/0x0006000000016d29-75.dat upx behavioral1/memory/2396-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d31-82.dat upx behavioral1/memory/2328-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1576-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d81-93.dat upx behavioral1/files/0x0006000000016d85-100.dat upx behavioral1/memory/2468-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da9-111.dat upx behavioral1/files/0x0006000000016e56-118.dat upx behavioral1/files/0x0006000000016f7e-127.dat upx behavioral1/files/0x000600000001737b-134.dat upx behavioral1/memory/768-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001737e-145.dat upx behavioral1/memory/1964-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001738c-152.dat upx behavioral1/files/0x00060000000173c5-163.dat upx behavioral1/files/0x0010000000015f23-170.dat upx behavioral1/files/0x00060000000173dc-179.dat upx behavioral1/files/0x00060000000173df-186.dat upx behavioral1/memory/2496-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e7-197.dat upx behavioral1/memory/2824-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001745d-206.dat upx behavioral1/files/0x0006000000017472-213.dat upx behavioral1/memory/2072-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001748d-222.dat upx behavioral1/memory/2764-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017510-232.dat upx behavioral1/memory/1572-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001864a-242.dat upx behavioral1/memory/1028-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001865b-251.dat upx behavioral1/files/0x0005000000018674-258.dat upx behavioral1/files/0x000500000001877f-267.dat upx behavioral1/files/0x00060000000190b3-275.dat upx behavioral1/memory/404-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190bc-284.dat upx behavioral1/memory/2872-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1856-391-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-400-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2704 3028 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 28 PID 3028 wrote to memory of 2704 3028 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 28 PID 3028 wrote to memory of 2704 3028 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 28 PID 3028 wrote to memory of 2704 3028 96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe 28 PID 2704 wrote to memory of 2544 2704 rlrrlrx.exe 29 PID 2704 wrote to memory of 2544 2704 rlrrlrx.exe 29 PID 2704 wrote to memory of 2544 2704 rlrrlrx.exe 29 PID 2704 wrote to memory of 2544 2704 rlrrlrx.exe 29 PID 2544 wrote to memory of 2680 2544 xllxlrx.exe 30 PID 2544 wrote to memory of 2680 2544 xllxlrx.exe 30 PID 2544 wrote to memory of 2680 2544 xllxlrx.exe 30 PID 2544 wrote to memory of 2680 2544 xllxlrx.exe 30 PID 2680 wrote to memory of 2600 2680 hbtbnn.exe 31 PID 2680 wrote to memory of 2600 2680 hbtbnn.exe 31 PID 2680 wrote to memory of 2600 2680 hbtbnn.exe 31 PID 2680 wrote to memory of 2600 2680 hbtbnn.exe 31 PID 2600 wrote to memory of 2560 2600 htttbh.exe 32 PID 2600 wrote to memory of 2560 2600 htttbh.exe 32 PID 2600 wrote to memory of 2560 2600 htttbh.exe 32 PID 2600 wrote to memory of 2560 2600 htttbh.exe 32 PID 2560 wrote to memory of 2536 2560 rlrffxl.exe 33 PID 2560 wrote to memory of 2536 2560 rlrffxl.exe 33 PID 2560 wrote to memory of 2536 2560 rlrffxl.exe 33 PID 2560 wrote to memory of 2536 2560 rlrffxl.exe 33 PID 2536 wrote to memory of 2396 2536 bhnhnb.exe 34 PID 2536 wrote to memory of 2396 2536 bhnhnb.exe 34 PID 2536 wrote to memory of 2396 2536 bhnhnb.exe 34 PID 2536 wrote to memory of 2396 2536 bhnhnb.exe 34 PID 2396 wrote to memory of 2328 2396 3xrlrlr.exe 35 PID 2396 wrote to memory of 2328 2396 3xrlrlr.exe 35 PID 2396 wrote to memory of 2328 2396 3xrlrlr.exe 35 PID 2396 wrote to memory of 2328 2396 3xrlrlr.exe 35 PID 2328 wrote to memory of 1576 2328 5fxfrxr.exe 36 PID 2328 wrote to memory of 1576 2328 5fxfrxr.exe 36 PID 2328 wrote to memory of 1576 2328 5fxfrxr.exe 36 PID 2328 wrote to memory of 1576 2328 5fxfrxr.exe 36 PID 1576 wrote to memory of 2468 1576 vvpjv.exe 37 PID 1576 wrote to memory of 2468 1576 vvpjv.exe 37 PID 1576 wrote to memory of 2468 1576 vvpjv.exe 37 PID 1576 wrote to memory of 2468 1576 vvpjv.exe 37 PID 2468 wrote to memory of 2712 2468 9fxxlrx.exe 38 PID 2468 wrote to memory of 2712 2468 9fxxlrx.exe 38 PID 2468 wrote to memory of 2712 2468 9fxxlrx.exe 38 PID 2468 wrote to memory of 2712 2468 9fxxlrx.exe 38 PID 2712 wrote to memory of 852 2712 5tnhnh.exe 39 PID 2712 wrote to memory of 852 2712 5tnhnh.exe 39 PID 2712 wrote to memory of 852 2712 5tnhnh.exe 39 PID 2712 wrote to memory of 852 2712 5tnhnh.exe 39 PID 852 wrote to memory of 2152 852 jppdp.exe 40 PID 852 wrote to memory of 2152 852 jppdp.exe 40 PID 852 wrote to memory of 2152 852 jppdp.exe 40 PID 852 wrote to memory of 2152 852 jppdp.exe 40 PID 2152 wrote to memory of 768 2152 9lxrrff.exe 41 PID 2152 wrote to memory of 768 2152 9lxrrff.exe 41 PID 2152 wrote to memory of 768 2152 9lxrrff.exe 41 PID 2152 wrote to memory of 768 2152 9lxrrff.exe 41 PID 768 wrote to memory of 1964 768 bthttb.exe 42 PID 768 wrote to memory of 1964 768 bthttb.exe 42 PID 768 wrote to memory of 1964 768 bthttb.exe 42 PID 768 wrote to memory of 1964 768 bthttb.exe 42 PID 1964 wrote to memory of 1272 1964 pjpdj.exe 43 PID 1964 wrote to memory of 1272 1964 pjpdj.exe 43 PID 1964 wrote to memory of 1272 1964 pjpdj.exe 43 PID 1964 wrote to memory of 1272 1964 pjpdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe"C:\Users\Admin\AppData\Local\Temp\96fda4b6b3946c6a6cdfe28148aafffbee0366b31002bb0f3a4a79be55945f64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\rlrrlrx.exec:\rlrrlrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xllxlrx.exec:\xllxlrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hbtbnn.exec:\hbtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\htttbh.exec:\htttbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rlrffxl.exec:\rlrffxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bhnhnb.exec:\bhnhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3xrlrlr.exec:\3xrlrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\5fxfrxr.exec:\5fxfrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vvpjv.exec:\vvpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\9fxxlrx.exec:\9fxxlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\5tnhnh.exec:\5tnhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jppdp.exec:\jppdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\9lxrrff.exec:\9lxrrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\bthttb.exec:\bthttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\pjpdj.exec:\pjpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\xllxflx.exec:\xllxflx.exe17⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vjvdj.exec:\vjvdj.exe18⤵
- Executes dropped EXE
PID:336 -
\??\c:\flxxrff.exec:\flxxrff.exe19⤵
- Executes dropped EXE
PID:2156 -
\??\c:\htbnnn.exec:\htbnnn.exe20⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lfllxxl.exec:\lfllxxl.exe22⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nththt.exec:\nththt.exe23⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pjvdp.exec:\pjvdp.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nnhnth.exec:\nnhnth.exe26⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jjjpj.exec:\jjjpj.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\5nnthh.exec:\5nnthh.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jpdjj.exec:\jpdjj.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rxfflff.exec:\rxfflff.exe30⤵
- Executes dropped EXE
PID:616 -
\??\c:\tbtnnh.exec:\tbtnnh.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3lxfrrf.exec:\3lxfrrf.exe32⤵
- Executes dropped EXE
PID:404 -
\??\c:\btntht.exec:\btntht.exe33⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jpdjp.exec:\jpdjp.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9vjdv.exec:\9vjdv.exe35⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rlfllfx.exec:\rlfllfx.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5vpvd.exec:\5vpvd.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rlfffxx.exec:\rlfffxx.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ffxrflx.exec:\ffxrflx.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\htthhh.exec:\htthhh.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pvdvv.exec:\pvdvv.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxrxllr.exec:\xxrxllr.exe42⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hhhtht.exec:\hhhtht.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjjvj.exec:\jjjvj.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9xxxlxl.exec:\9xxxlxl.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ffxlrff.exec:\ffxlrff.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hbtbhh.exec:\hbtbhh.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvjpv.exec:\dvjpv.exe48⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fxxrflf.exec:\fxxrflf.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bnthtb.exec:\bnthtb.exe50⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jdppv.exec:\jdppv.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pjdpv.exec:\pjdpv.exe52⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xlxfllx.exec:\xlxfllx.exe53⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxxllrr.exec:\fxxllrr.exe54⤵
- Executes dropped EXE
PID:276 -
\??\c:\9nhntb.exec:\9nhntb.exe55⤵
- Executes dropped EXE
PID:768 -
\??\c:\7vdjv.exec:\7vdjv.exe56⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jjdjj.exec:\jjdjj.exe57⤵
- Executes dropped EXE
PID:680 -
\??\c:\ttthtb.exec:\ttthtb.exe58⤵
- Executes dropped EXE
PID:816 -
\??\c:\nbtthn.exec:\nbtthn.exe59⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jdvpd.exec:\jdvpd.exe60⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xfllrff.exec:\xfllrff.exe61⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rfflrrl.exec:\rfflrrl.exe62⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1bbtnn.exec:\1bbtnn.exe63⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vjvvp.exec:\vjvvp.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rxlrffx.exec:\rxlrffx.exe65⤵
- Executes dropped EXE
PID:576 -
\??\c:\nhtbhb.exec:\nhtbhb.exe66⤵PID:820
-
\??\c:\3nthtb.exec:\3nthtb.exe67⤵PID:2820
-
\??\c:\vppvj.exec:\vppvj.exe68⤵PID:848
-
\??\c:\jdvvj.exec:\jdvvj.exe69⤵PID:1304
-
\??\c:\3tbbnt.exec:\3tbbnt.exe70⤵PID:2060
-
\??\c:\pjddv.exec:\pjddv.exe71⤵PID:912
-
\??\c:\frxxxlx.exec:\frxxxlx.exe72⤵PID:3064
-
\??\c:\rxflfrf.exec:\rxflfrf.exe73⤵PID:1444
-
\??\c:\9nhnth.exec:\9nhnth.exe74⤵PID:2340
-
\??\c:\jjpvp.exec:\jjpvp.exe75⤵PID:572
-
\??\c:\ffxxrlr.exec:\ffxxrlr.exe76⤵PID:1668
-
\??\c:\fllflxr.exec:\fllflxr.exe77⤵PID:860
-
\??\c:\7hbbnt.exec:\7hbbnt.exe78⤵PID:2848
-
\??\c:\pvdjd.exec:\pvdjd.exe79⤵PID:1512
-
\??\c:\1jdjv.exec:\1jdjv.exe80⤵PID:2144
-
\??\c:\fxffxfr.exec:\fxffxfr.exe81⤵PID:2492
-
\??\c:\hbhhtt.exec:\hbhhtt.exe82⤵PID:2644
-
\??\c:\1vjpv.exec:\1vjpv.exe83⤵PID:2636
-
\??\c:\jvjvd.exec:\jvjvd.exe84⤵PID:2696
-
\??\c:\bbttht.exec:\bbttht.exe85⤵PID:2284
-
\??\c:\jjpvp.exec:\jjpvp.exe86⤵PID:2312
-
\??\c:\rrrllrl.exec:\rrrllrl.exe87⤵PID:2596
-
\??\c:\9lllfff.exec:\9lllfff.exe88⤵PID:2420
-
\??\c:\7xlrxfl.exec:\7xlrxfl.exe89⤵PID:2412
-
\??\c:\bbbhtb.exec:\bbbhtb.exe90⤵PID:2316
-
\??\c:\dvjdj.exec:\dvjdj.exe91⤵PID:1604
-
\??\c:\jvjjp.exec:\jvjjp.exe92⤵PID:1188
-
\??\c:\3fxxfll.exec:\3fxxfll.exe93⤵PID:2728
-
\??\c:\5bhnhh.exec:\5bhnhh.exe94⤵PID:1172
-
\??\c:\bthtnb.exec:\bthtnb.exe95⤵PID:1584
-
\??\c:\dvvdj.exec:\dvvdj.exe96⤵PID:1896
-
\??\c:\llfrllf.exec:\llfrllf.exe97⤵PID:1556
-
\??\c:\nntnhb.exec:\nntnhb.exe98⤵PID:1564
-
\??\c:\hhhhbb.exec:\hhhhbb.exe99⤵PID:1632
-
\??\c:\jdvpp.exec:\jdvpp.exe100⤵PID:1284
-
\??\c:\lrfrrrx.exec:\lrfrrrx.exe101⤵PID:992
-
\??\c:\hbnbtb.exec:\hbnbtb.exe102⤵PID:2784
-
\??\c:\nhnntn.exec:\nhnntn.exe103⤵PID:2776
-
\??\c:\jvjpp.exec:\jvjpp.exe104⤵PID:1700
-
\??\c:\7jvjd.exec:\7jvjd.exe105⤵PID:2036
-
\??\c:\9rxfxfr.exec:\9rxfxfr.exe106⤵PID:1108
-
\??\c:\bthhbh.exec:\bthhbh.exe107⤵PID:1548
-
\??\c:\nhtthh.exec:\nhtthh.exe108⤵PID:2240
-
\??\c:\1dpvp.exec:\1dpvp.exe109⤵PID:1640
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe110⤵PID:2384
-
\??\c:\rlffrrx.exec:\rlffrrx.exe111⤵PID:2576
-
\??\c:\tnnhtn.exec:\tnnhtn.exe112⤵PID:820
-
\??\c:\pjpjp.exec:\pjpjp.exe113⤵PID:2764
-
\??\c:\frfxfrl.exec:\frfxfrl.exe114⤵PID:1712
-
\??\c:\xflffll.exec:\xflffll.exe115⤵PID:888
-
\??\c:\hbtnbh.exec:\hbtnbh.exe116⤵PID:968
-
\??\c:\vvjvj.exec:\vvjvj.exe117⤵PID:1688
-
\??\c:\9vvdp.exec:\9vvdp.exe118⤵PID:1220
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe119⤵PID:1444
-
\??\c:\jjdpv.exec:\jjdpv.exe120⤵PID:2340
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe121⤵PID:1628
-
\??\c:\flxlrrl.exec:\flxlrrl.exe122⤵PID:1680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-