Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 18:22
Behavioral task
behavioral1
Sample
b55ce0b48c766b699a73056303c17a04.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
b55ce0b48c766b699a73056303c17a04.exe
-
Size
143KB
-
MD5
b55ce0b48c766b699a73056303c17a04
-
SHA1
d1ccea5a0e76a2951b7fc08f2f790b71f13b566c
-
SHA256
d47231b1dc03614724c819f3fe052abec0f0e1661c6efaee26491342e166a549
-
SHA512
53df785601166fc08d139501bf2ae6f339b982f12a2f88ebbc84c1d570e5449ef7e6705f80cc764a8d1f69c40127030cc3d5c0adebc551fb60db644f5323fc7f
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBuItR8pLbtIBjOHCfOp2:9cm4FmowdHoS4BftapFApmp2
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1624-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-703-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1204 vvpdp.exe 4256 xlflxlf.exe 2648 tnhtnb.exe 2060 ttthtn.exe 4692 dppjd.exe 676 fllxffr.exe 4312 xxfffrf.exe 228 jjjvj.exe 4008 rllxlfr.exe 3840 9dvvp.exe 3580 lffrxrl.exe 4976 xfrlxxl.exe 4584 vpjvp.exe 2936 3xxlrll.exe 372 vdvjj.exe 2964 1xrxxlx.exe 2180 bthntn.exe 2976 3dvjv.exe 4420 rffrlff.exe 2888 9rlfxrr.exe 2240 thhtnh.exe 4184 7xxrrlr.exe 2480 fxlrffr.exe 1896 hbbnhb.exe 1664 xxfrfxl.exe 2848 5llxlrf.exe 3980 vjpdp.exe 1248 rfxlfxl.exe 3328 7rrlxrl.exe 3780 5hhhtt.exe 2168 vvdpv.exe 3560 frxlrlx.exe 4604 nhbthb.exe 1000 bhnnbn.exe 2248 1rrxrrl.exe 3952 7btnhb.exe 1224 7nbntt.exe 1308 jppjp.exe 3584 1vvpv.exe 3424 xrfrrll.exe 3124 tntntt.exe 4496 vjpvv.exe 5068 rflfxxx.exe 3200 nnthnn.exe 1788 1ttnbt.exe 2832 ffxrxxl.exe 3104 djjvp.exe 1804 llrllfr.exe 1764 frrflfl.exe 4824 bhtnnn.exe 4004 vddpv.exe 4040 jdjdp.exe 4008 bththt.exe 1196 3nhnhn.exe 660 dvpdp.exe 2504 jvpdd.exe 2560 jvjdv.exe 4816 tnbtbb.exe 2884 ppjvj.exe 3516 dpjvj.exe 3004 hthbhh.exe 2872 1bbnbt.exe 3716 rlxrflx.exe 3864 hnnhhh.exe -
resource yara_rule behavioral2/memory/1624-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000300000001e9a0-3.dat upx behavioral2/memory/1624-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0011000000023148-9.dat upx behavioral2/memory/4256-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322e-19.dat upx behavioral2/files/0x000a000000023228-16.dat upx behavioral2/memory/2648-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322f-24.dat upx behavioral2/memory/2060-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4692-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/676-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023231-37.dat upx behavioral2/files/0x0007000000023230-31.dat upx behavioral2/memory/4312-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023232-43.dat upx behavioral2/files/0x0007000000023233-50.dat upx behavioral2/memory/228-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023234-53.dat upx behavioral2/memory/4008-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023235-59.dat upx behavioral2/memory/3580-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023236-64.dat upx behavioral2/memory/3840-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4976-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023237-71.dat upx behavioral2/files/0x0007000000023238-78.dat upx behavioral2/memory/4584-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2936-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023239-83.dat upx behavioral2/files/0x000700000002323a-88.dat upx behavioral2/memory/372-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002323b-93.dat upx behavioral2/memory/2964-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002323c-97.dat upx behavioral2/files/0x000700000002323d-102.dat upx behavioral2/memory/4420-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4420-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002323e-109.dat upx behavioral2/memory/2888-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002323f-114.dat upx behavioral2/files/0x000b00000002322a-119.dat upx behavioral2/memory/2240-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4184-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023240-125.dat upx behavioral2/files/0x0007000000023241-132.dat upx behavioral2/memory/2480-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1896-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023242-138.dat upx behavioral2/files/0x0007000000023243-142.dat upx behavioral2/files/0x0007000000023244-147.dat upx behavioral2/memory/2848-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023245-151.dat upx behavioral2/files/0x0007000000023246-156.dat upx behavioral2/memory/3328-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023247-163.dat upx behavioral2/files/0x0007000000023248-168.dat upx behavioral2/memory/2168-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023249-174.dat upx behavioral2/memory/4604-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1308-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1308-198-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 1204 1624 b55ce0b48c766b699a73056303c17a04.exe 91 PID 1624 wrote to memory of 1204 1624 b55ce0b48c766b699a73056303c17a04.exe 91 PID 1624 wrote to memory of 1204 1624 b55ce0b48c766b699a73056303c17a04.exe 91 PID 1204 wrote to memory of 4256 1204 vvpdp.exe 92 PID 1204 wrote to memory of 4256 1204 vvpdp.exe 92 PID 1204 wrote to memory of 4256 1204 vvpdp.exe 92 PID 4256 wrote to memory of 2648 4256 xlflxlf.exe 93 PID 4256 wrote to memory of 2648 4256 xlflxlf.exe 93 PID 4256 wrote to memory of 2648 4256 xlflxlf.exe 93 PID 2648 wrote to memory of 2060 2648 tnhtnb.exe 94 PID 2648 wrote to memory of 2060 2648 tnhtnb.exe 94 PID 2648 wrote to memory of 2060 2648 tnhtnb.exe 94 PID 2060 wrote to memory of 4692 2060 ttthtn.exe 95 PID 2060 wrote to memory of 4692 2060 ttthtn.exe 95 PID 2060 wrote to memory of 4692 2060 ttthtn.exe 95 PID 4692 wrote to memory of 676 4692 dppjd.exe 96 PID 4692 wrote to memory of 676 4692 dppjd.exe 96 PID 4692 wrote to memory of 676 4692 dppjd.exe 96 PID 676 wrote to memory of 4312 676 fllxffr.exe 97 PID 676 wrote to memory of 4312 676 fllxffr.exe 97 PID 676 wrote to memory of 4312 676 fllxffr.exe 97 PID 4312 wrote to memory of 228 4312 xxfffrf.exe 98 PID 4312 wrote to memory of 228 4312 xxfffrf.exe 98 PID 4312 wrote to memory of 228 4312 xxfffrf.exe 98 PID 228 wrote to memory of 4008 228 jjjvj.exe 99 PID 228 wrote to memory of 4008 228 jjjvj.exe 99 PID 228 wrote to memory of 4008 228 jjjvj.exe 99 PID 4008 wrote to memory of 3840 4008 rllxlfr.exe 100 PID 4008 wrote to memory of 3840 4008 rllxlfr.exe 100 PID 4008 wrote to memory of 3840 4008 rllxlfr.exe 100 PID 3840 wrote to memory of 3580 3840 9dvvp.exe 101 PID 3840 wrote to memory of 3580 3840 9dvvp.exe 101 PID 3840 wrote to memory of 3580 3840 9dvvp.exe 101 PID 3580 wrote to memory of 4976 3580 lffrxrl.exe 102 PID 3580 wrote to memory of 4976 3580 lffrxrl.exe 102 PID 3580 wrote to memory of 4976 3580 lffrxrl.exe 102 PID 4976 wrote to memory of 4584 4976 xfrlxxl.exe 103 PID 4976 wrote to memory of 4584 4976 xfrlxxl.exe 103 PID 4976 wrote to memory of 4584 4976 xfrlxxl.exe 103 PID 4584 wrote to memory of 2936 4584 vpjvp.exe 104 PID 4584 wrote to memory of 2936 4584 vpjvp.exe 104 PID 4584 wrote to memory of 2936 4584 vpjvp.exe 104 PID 2936 wrote to memory of 372 2936 3xxlrll.exe 105 PID 2936 wrote to memory of 372 2936 3xxlrll.exe 105 PID 2936 wrote to memory of 372 2936 3xxlrll.exe 105 PID 372 wrote to memory of 2964 372 vdvjj.exe 106 PID 372 wrote to memory of 2964 372 vdvjj.exe 106 PID 372 wrote to memory of 2964 372 vdvjj.exe 106 PID 2964 wrote to memory of 2180 2964 1xrxxlx.exe 107 PID 2964 wrote to memory of 2180 2964 1xrxxlx.exe 107 PID 2964 wrote to memory of 2180 2964 1xrxxlx.exe 107 PID 2180 wrote to memory of 2976 2180 bthntn.exe 108 PID 2180 wrote to memory of 2976 2180 bthntn.exe 108 PID 2180 wrote to memory of 2976 2180 bthntn.exe 108 PID 2976 wrote to memory of 4420 2976 3dvjv.exe 109 PID 2976 wrote to memory of 4420 2976 3dvjv.exe 109 PID 2976 wrote to memory of 4420 2976 3dvjv.exe 109 PID 4420 wrote to memory of 2888 4420 rffrlff.exe 110 PID 4420 wrote to memory of 2888 4420 rffrlff.exe 110 PID 4420 wrote to memory of 2888 4420 rffrlff.exe 110 PID 2888 wrote to memory of 2240 2888 9rlfxrr.exe 111 PID 2888 wrote to memory of 2240 2888 9rlfxrr.exe 111 PID 2888 wrote to memory of 2240 2888 9rlfxrr.exe 111 PID 2240 wrote to memory of 4184 2240 thhtnh.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\b55ce0b48c766b699a73056303c17a04.exe"C:\Users\Admin\AppData\Local\Temp\b55ce0b48c766b699a73056303c17a04.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\vvpdp.exec:\vvpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\xlflxlf.exec:\xlflxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\tnhtnb.exec:\tnhtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ttthtn.exec:\ttthtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\dppjd.exec:\dppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\fllxffr.exec:\fllxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\xxfffrf.exec:\xxfffrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\jjjvj.exec:\jjjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\rllxlfr.exec:\rllxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\9dvvp.exec:\9dvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\lffrxrl.exec:\lffrxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\xfrlxxl.exec:\xfrlxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\vpjvp.exec:\vpjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\3xxlrll.exec:\3xxlrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vdvjj.exec:\vdvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\1xrxxlx.exec:\1xrxxlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bthntn.exec:\bthntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\3dvjv.exec:\3dvjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rffrlff.exec:\rffrlff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\9rlfxrr.exec:\9rlfxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\thhtnh.exec:\thhtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\7xxrrlr.exec:\7xxrrlr.exe23⤵
- Executes dropped EXE
PID:4184 -
\??\c:\fxlrffr.exec:\fxlrffr.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hbbnhb.exec:\hbbnhb.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xxfrfxl.exec:\xxfrfxl.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5llxlrf.exec:\5llxlrf.exe27⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vjpdp.exec:\vjpdp.exe28⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rfxlfxl.exec:\rfxlfxl.exe29⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7rrlxrl.exec:\7rrlxrl.exe30⤵
- Executes dropped EXE
PID:3328 -
\??\c:\5hhhtt.exec:\5hhhtt.exe31⤵
- Executes dropped EXE
PID:3780 -
\??\c:\vvdpv.exec:\vvdpv.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\frxlrlx.exec:\frxlrlx.exe33⤵
- Executes dropped EXE
PID:3560 -
\??\c:\nhbthb.exec:\nhbthb.exe34⤵
- Executes dropped EXE
PID:4604 -
\??\c:\bhnnbn.exec:\bhnnbn.exe35⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1rrxrrl.exec:\1rrxrrl.exe36⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7btnhb.exec:\7btnhb.exe37⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7nbntt.exec:\7nbntt.exe38⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jppjp.exec:\jppjp.exe39⤵
- Executes dropped EXE
PID:1308 -
\??\c:\1vvpv.exec:\1vvpv.exe40⤵
- Executes dropped EXE
PID:3584 -
\??\c:\xrfrrll.exec:\xrfrrll.exe41⤵
- Executes dropped EXE
PID:3424 -
\??\c:\tntntt.exec:\tntntt.exe42⤵
- Executes dropped EXE
PID:3124 -
\??\c:\vjpvv.exec:\vjpvv.exe43⤵
- Executes dropped EXE
PID:4496 -
\??\c:\rflfxxx.exec:\rflfxxx.exe44⤵
- Executes dropped EXE
PID:5068 -
\??\c:\nnthnn.exec:\nnthnn.exe45⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1ttnbt.exec:\1ttnbt.exe46⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe47⤵
- Executes dropped EXE
PID:2832 -
\??\c:\djjvp.exec:\djjvp.exe48⤵
- Executes dropped EXE
PID:3104 -
\??\c:\llrllfr.exec:\llrllfr.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\frrflfl.exec:\frrflfl.exe50⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bhtnnn.exec:\bhtnnn.exe51⤵
- Executes dropped EXE
PID:4824 -
\??\c:\vddpv.exec:\vddpv.exe52⤵
- Executes dropped EXE
PID:4004 -
\??\c:\jdjdp.exec:\jdjdp.exe53⤵
- Executes dropped EXE
PID:4040 -
\??\c:\bththt.exec:\bththt.exe54⤵
- Executes dropped EXE
PID:4008 -
\??\c:\3nhnhn.exec:\3nhnhn.exe55⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dvpdp.exec:\dvpdp.exe56⤵
- Executes dropped EXE
PID:660 -
\??\c:\jvpdd.exec:\jvpdd.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jvjdv.exec:\jvjdv.exe58⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tnbtbb.exec:\tnbtbb.exe59⤵
- Executes dropped EXE
PID:4816 -
\??\c:\ppjvj.exec:\ppjvj.exe60⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dpjvj.exec:\dpjvj.exe61⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hthbhh.exec:\hthbhh.exe62⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1bbnbt.exec:\1bbnbt.exe63⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlxrflx.exec:\rlxrflx.exe64⤵
- Executes dropped EXE
PID:3716 -
\??\c:\hnnhhh.exec:\hnnhhh.exe65⤵
- Executes dropped EXE
PID:3864 -
\??\c:\ttbntn.exec:\ttbntn.exe66⤵PID:1384
-
\??\c:\1jdpd.exec:\1jdpd.exe67⤵PID:4420
-
\??\c:\rxrrfxl.exec:\rxrrfxl.exe68⤵PID:2540
-
\??\c:\hbbnbb.exec:\hbbnbb.exe69⤵PID:4116
-
\??\c:\jdvjp.exec:\jdvjp.exe70⤵PID:2056
-
\??\c:\rlfxfxf.exec:\rlfxfxf.exe71⤵PID:2600
-
\??\c:\thnbnh.exec:\thnbnh.exe72⤵PID:968
-
\??\c:\9hhthb.exec:\9hhthb.exe73⤵PID:2528
-
\??\c:\1xxlxxr.exec:\1xxlxxr.exe74⤵PID:3408
-
\??\c:\xrfrlrl.exec:\xrfrlrl.exe75⤵PID:232
-
\??\c:\hththb.exec:\hththb.exe76⤵PID:4456
-
\??\c:\dddvv.exec:\dddvv.exe77⤵PID:1796
-
\??\c:\dvdpj.exec:\dvdpj.exe78⤵PID:3132
-
\??\c:\3jvjv.exec:\3jvjv.exe79⤵PID:1304
-
\??\c:\frxrrrx.exec:\frxrrrx.exe80⤵PID:4948
-
\??\c:\vpppv.exec:\vpppv.exe81⤵PID:4600
-
\??\c:\rxfrfff.exec:\rxfrfff.exe82⤵PID:3556
-
\??\c:\hhhbnh.exec:\hhhbnh.exe83⤵PID:408
-
\??\c:\tbbtbt.exec:\tbbtbt.exe84⤵PID:1188
-
\??\c:\ppddj.exec:\ppddj.exe85⤵PID:4404
-
\??\c:\7vvjv.exec:\7vvjv.exe86⤵PID:4240
-
\??\c:\rlrfxll.exec:\rlrfxll.exe87⤵PID:5092
-
\??\c:\hthhbn.exec:\hthhbn.exe88⤵PID:1308
-
\??\c:\tnbhth.exec:\tnbhth.exe89⤵PID:4408
-
\??\c:\vpvpp.exec:\vpvpp.exe90⤵PID:3424
-
\??\c:\rlxfxlf.exec:\rlxfxlf.exe91⤵PID:3124
-
\??\c:\xfxrxrl.exec:\xfxrxrl.exe92⤵PID:116
-
\??\c:\ttnhbt.exec:\ttnhbt.exe93⤵PID:4392
-
\??\c:\nbbnbt.exec:\nbbnbt.exe94⤵PID:2400
-
\??\c:\pjvdj.exec:\pjvdj.exe95⤵PID:2544
-
\??\c:\3frflfx.exec:\3frflfx.exe96⤵PID:4664
-
\??\c:\xrffxxf.exec:\xrffxxf.exe97⤵PID:2124
-
\??\c:\bthhnh.exec:\bthhnh.exe98⤵PID:3616
-
\??\c:\nbbnbt.exec:\nbbnbt.exe99⤵PID:4528
-
\??\c:\djpjv.exec:\djpjv.exe100⤵PID:3164
-
\??\c:\nnnhtn.exec:\nnnhtn.exe101⤵PID:2932
-
\??\c:\5pdpd.exec:\5pdpd.exe102⤵PID:3840
-
\??\c:\7vvpj.exec:\7vvpj.exe103⤵PID:4668
-
\??\c:\xffrfxr.exec:\xffrfxr.exe104⤵PID:3360
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe105⤵PID:2716
-
\??\c:\hbhbbb.exec:\hbhbbb.exe106⤵PID:800
-
\??\c:\djvpj.exec:\djvpj.exe107⤵PID:748
-
\??\c:\lffxlfx.exec:\lffxlfx.exe108⤵PID:2348
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe109⤵PID:4780
-
\??\c:\nbhtnh.exec:\nbhtnh.exe110⤵PID:1876
-
\??\c:\djppp.exec:\djppp.exe111⤵PID:2068
-
\??\c:\frfxrll.exec:\frfxrll.exe112⤵PID:4684
-
\??\c:\tnnhtn.exec:\tnnhtn.exe113⤵PID:4288
-
\??\c:\thbthb.exec:\thbthb.exe114⤵PID:2264
-
\??\c:\frrlfff.exec:\frrlfff.exe115⤵PID:2888
-
\??\c:\3xxlxrl.exec:\3xxlxrl.exe116⤵PID:2720
-
\??\c:\hnhbtn.exec:\hnhbtn.exe117⤵PID:1668
-
\??\c:\9dvdj.exec:\9dvdj.exe118⤵PID:4832
-
\??\c:\dpdvj.exec:\dpdvj.exe119⤵PID:3520
-
\??\c:\5flfrrl.exec:\5flfrrl.exe120⤵PID:2008
-
\??\c:\thbnbt.exec:\thbnbt.exe121⤵PID:2528
-
\??\c:\nbbthh.exec:\nbbthh.exe122⤵PID:3364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-