Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 18:12
Behavioral task
behavioral1
Sample
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
Resource
win7-20240220-en
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
-
Size
94KB
-
MD5
fa561f5076f3425f1d910882f7096bc1
-
SHA1
aa6e59d89ca18465328f2a9dfe534d8ce1a87b57
-
SHA256
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255
-
SHA512
a64a0cb7b51937bc47486d91911ccf453dd44a02897d5ccc5113beaa8f14f4d1efc9ce25e8fce9e4b477d2d26ce949a315d51fbf6f09a30954a6461c5244d384
-
SSDEEP
1536:GvQBeOGtrYS3srx93UBWfwC6Ggnouy8STCRBHkOl0JnSLa:GhOmTsF93UYfwC6GIoutXBO/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4424-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1312 fxlfrlf.exe 4616 lrrrxfl.exe 1592 btbbbh.exe 2868 fflffff.exe 2292 bthhtb.exe 3652 ddjjv.exe 876 vpddp.exe 2124 xrxxrff.exe 3004 5tttnt.exe 3012 1jppd.exe 60 jdjdd.exe 1044 rlrlrrr.exe 4060 bbtbbb.exe 3640 dvjjp.exe 640 vdpjd.exe 3068 lxffxxf.exe 1972 9nhhbh.exe 3140 jvjjd.exe 1724 jdddj.exe 1036 3lffrxr.exe 3452 ntbnhh.exe 1128 1pvvp.exe 1764 7vppp.exe 1460 rfrllll.exe 1448 nnhbhb.exe 4208 jjppp.exe 1404 pjppp.exe 2944 xxlrxll.exe 316 5xllrrx.exe 4684 vpddp.exe 1580 rxrrxxl.exe 1116 bthhbh.exe 1276 pjppp.exe 1804 rrffxxx.exe 2312 ffxxxff.exe 4264 hbttbh.exe 2060 ttnntt.exe 2364 vvppj.exe 1640 dvdjj.exe 628 rfflfrf.exe 4436 xxxrlll.exe 4268 tnntbh.exe 1196 5htbbh.exe 4008 dvpvp.exe 2764 vvpvj.exe 2680 3rfxrrx.exe 4404 lrrrxff.exe 1592 tnbbhh.exe 3964 5btnbh.exe 3700 jpdvp.exe 2924 9rffflr.exe 684 rrfrrxl.exe 3124 bhhnnt.exe 876 tntbth.exe 4476 nnnhtt.exe 3004 jvvvv.exe 3624 flrrlxf.exe 1748 lfffrrl.exe 4696 5htnnn.exe 4060 ttbhbt.exe 2040 tbhhbh.exe 2644 ddpdd.exe 116 djdpv.exe 3068 xrxxxxr.exe -
resource yara_rule behavioral2/memory/4424-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b47-4.dat upx behavioral2/files/0x000a000000023ba6-8.dat upx behavioral2/memory/1312-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-14.dat upx behavioral2/memory/4616-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1592-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-20.dat upx behavioral2/memory/1592-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba9-24.dat upx behavioral2/memory/2868-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baa-30.dat upx behavioral2/memory/2292-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-35.dat upx behavioral2/memory/3652-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-40.dat upx behavioral2/memory/2124-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bad-45.dat upx behavioral2/memory/2124-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bae-50.dat upx behavioral2/memory/3004-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baf-55.dat upx behavioral2/files/0x000a000000023bb0-59.dat upx behavioral2/memory/60-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb1-64.dat upx behavioral2/memory/1044-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb2-69.dat upx behavioral2/memory/4060-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb3-74.dat upx behavioral2/memory/3640-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb4-79.dat upx behavioral2/memory/640-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb5-84.dat upx behavioral2/memory/3068-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb6-90.dat upx behavioral2/memory/3140-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb7-95.dat upx behavioral2/files/0x000a000000023bb8-99.dat upx behavioral2/memory/1724-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb9-104.dat upx behavioral2/files/0x000a000000023bba-108.dat upx behavioral2/memory/3452-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1128-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bbb-114.dat upx behavioral2/files/0x000a000000023bbc-118.dat upx behavioral2/memory/1764-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023bbd-123.dat upx behavioral2/files/0x0031000000023bbe-127.dat upx behavioral2/memory/1448-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023bbf-132.dat upx behavioral2/files/0x000a000000023bc0-136.dat upx behavioral2/memory/2944-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1404-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bc1-142.dat upx behavioral2/files/0x000a000000023bab-146.dat upx behavioral2/memory/316-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4684-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba3-152.dat upx behavioral2/memory/1580-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bc2-157.dat upx behavioral2/memory/1276-161-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4424 wrote to memory of 1312 4424 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 86 PID 4424 wrote to memory of 1312 4424 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 86 PID 4424 wrote to memory of 1312 4424 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 86 PID 1312 wrote to memory of 4616 1312 fxlfrlf.exe 87 PID 1312 wrote to memory of 4616 1312 fxlfrlf.exe 87 PID 1312 wrote to memory of 4616 1312 fxlfrlf.exe 87 PID 4616 wrote to memory of 1592 4616 lrrrxfl.exe 88 PID 4616 wrote to memory of 1592 4616 lrrrxfl.exe 88 PID 4616 wrote to memory of 1592 4616 lrrrxfl.exe 88 PID 1592 wrote to memory of 2868 1592 btbbbh.exe 89 PID 1592 wrote to memory of 2868 1592 btbbbh.exe 89 PID 1592 wrote to memory of 2868 1592 btbbbh.exe 89 PID 2868 wrote to memory of 2292 2868 fflffff.exe 90 PID 2868 wrote to memory of 2292 2868 fflffff.exe 90 PID 2868 wrote to memory of 2292 2868 fflffff.exe 90 PID 2292 wrote to memory of 3652 2292 bthhtb.exe 91 PID 2292 wrote to memory of 3652 2292 bthhtb.exe 91 PID 2292 wrote to memory of 3652 2292 bthhtb.exe 91 PID 3652 wrote to memory of 876 3652 ddjjv.exe 92 PID 3652 wrote to memory of 876 3652 ddjjv.exe 92 PID 3652 wrote to memory of 876 3652 ddjjv.exe 92 PID 876 wrote to memory of 2124 876 vpddp.exe 93 PID 876 wrote to memory of 2124 876 vpddp.exe 93 PID 876 wrote to memory of 2124 876 vpddp.exe 93 PID 2124 wrote to memory of 3004 2124 xrxxrff.exe 94 PID 2124 wrote to memory of 3004 2124 xrxxrff.exe 94 PID 2124 wrote to memory of 3004 2124 xrxxrff.exe 94 PID 3004 wrote to memory of 3012 3004 5tttnt.exe 95 PID 3004 wrote to memory of 3012 3004 5tttnt.exe 95 PID 3004 wrote to memory of 3012 3004 5tttnt.exe 95 PID 3012 wrote to memory of 60 3012 1jppd.exe 96 PID 3012 wrote to memory of 60 3012 1jppd.exe 96 PID 3012 wrote to memory of 60 3012 1jppd.exe 96 PID 60 wrote to memory of 1044 60 jdjdd.exe 97 PID 60 wrote to memory of 1044 60 jdjdd.exe 97 PID 60 wrote to memory of 1044 60 jdjdd.exe 97 PID 1044 wrote to memory of 4060 1044 rlrlrrr.exe 98 PID 1044 wrote to memory of 4060 1044 rlrlrrr.exe 98 PID 1044 wrote to memory of 4060 1044 rlrlrrr.exe 98 PID 4060 wrote to memory of 3640 4060 bbtbbb.exe 99 PID 4060 wrote to memory of 3640 4060 bbtbbb.exe 99 PID 4060 wrote to memory of 3640 4060 bbtbbb.exe 99 PID 3640 wrote to memory of 640 3640 dvjjp.exe 100 PID 3640 wrote to memory of 640 3640 dvjjp.exe 100 PID 3640 wrote to memory of 640 3640 dvjjp.exe 100 PID 640 wrote to memory of 3068 640 vdpjd.exe 101 PID 640 wrote to memory of 3068 640 vdpjd.exe 101 PID 640 wrote to memory of 3068 640 vdpjd.exe 101 PID 3068 wrote to memory of 1972 3068 lxffxxf.exe 102 PID 3068 wrote to memory of 1972 3068 lxffxxf.exe 102 PID 3068 wrote to memory of 1972 3068 lxffxxf.exe 102 PID 1972 wrote to memory of 3140 1972 9nhhbh.exe 103 PID 1972 wrote to memory of 3140 1972 9nhhbh.exe 103 PID 1972 wrote to memory of 3140 1972 9nhhbh.exe 103 PID 3140 wrote to memory of 1724 3140 jvjjd.exe 104 PID 3140 wrote to memory of 1724 3140 jvjjd.exe 104 PID 3140 wrote to memory of 1724 3140 jvjjd.exe 104 PID 1724 wrote to memory of 1036 1724 jdddj.exe 106 PID 1724 wrote to memory of 1036 1724 jdddj.exe 106 PID 1724 wrote to memory of 1036 1724 jdddj.exe 106 PID 1036 wrote to memory of 3452 1036 3lffrxr.exe 107 PID 1036 wrote to memory of 3452 1036 3lffrxr.exe 107 PID 1036 wrote to memory of 3452 1036 3lffrxr.exe 107 PID 3452 wrote to memory of 1128 3452 ntbnhh.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe"C:\Users\Admin\AppData\Local\Temp\f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\lrrrxfl.exec:\lrrrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\btbbbh.exec:\btbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\fflffff.exec:\fflffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bthhtb.exec:\bthhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\ddjjv.exec:\ddjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\vpddp.exec:\vpddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\xrxxrff.exec:\xrxxrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\5tttnt.exec:\5tttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\1jppd.exec:\1jppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jdjdd.exec:\jdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\bbtbbb.exec:\bbtbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\dvjjp.exec:\dvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\vdpjd.exec:\vdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\lxffxxf.exec:\lxffxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\9nhhbh.exec:\9nhhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\jvjjd.exec:\jvjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\jdddj.exec:\jdddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\3lffrxr.exec:\3lffrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\ntbnhh.exec:\ntbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\1pvvp.exec:\1pvvp.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\7vppp.exec:\7vppp.exe24⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rfrllll.exec:\rfrllll.exe25⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nnhbhb.exec:\nnhbhb.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jjppp.exec:\jjppp.exe27⤵
- Executes dropped EXE
PID:4208 -
\??\c:\pjppp.exec:\pjppp.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xxlrxll.exec:\xxlrxll.exe29⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5xllrrx.exec:\5xllrrx.exe30⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpddp.exec:\vpddp.exe31⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rxrrxxl.exec:\rxrrxxl.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bthhbh.exec:\bthhbh.exe33⤵
- Executes dropped EXE
PID:1116 -
\??\c:\pjppp.exec:\pjppp.exe34⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rrffxxx.exec:\rrffxxx.exe35⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ffxxxff.exec:\ffxxxff.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbttbh.exec:\hbttbh.exe37⤵
- Executes dropped EXE
PID:4264 -
\??\c:\ttnntt.exec:\ttnntt.exe38⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vvppj.exec:\vvppj.exe39⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dvdjj.exec:\dvdjj.exe40⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rfflfrf.exec:\rfflfrf.exe41⤵
- Executes dropped EXE
PID:628 -
\??\c:\xxxrlll.exec:\xxxrlll.exe42⤵
- Executes dropped EXE
PID:4436 -
\??\c:\tnntbh.exec:\tnntbh.exe43⤵
- Executes dropped EXE
PID:4268 -
\??\c:\5htbbh.exec:\5htbbh.exe44⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dvpvp.exec:\dvpvp.exe45⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vvpvj.exec:\vvpvj.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3rfxrrx.exec:\3rfxrrx.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lrrrxff.exec:\lrrrxff.exe48⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tnbbhh.exec:\tnbbhh.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5btnbh.exec:\5btnbh.exe50⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jpdvp.exec:\jpdvp.exe51⤵
- Executes dropped EXE
PID:3700 -
\??\c:\9rffflr.exec:\9rffflr.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rrfrrxl.exec:\rrfrrxl.exe53⤵
- Executes dropped EXE
PID:684 -
\??\c:\bhhnnt.exec:\bhhnnt.exe54⤵
- Executes dropped EXE
PID:3124 -
\??\c:\tntbth.exec:\tntbth.exe55⤵
- Executes dropped EXE
PID:876 -
\??\c:\nnnhtt.exec:\nnnhtt.exe56⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jvvvv.exec:\jvvvv.exe57⤵
- Executes dropped EXE
PID:3004 -
\??\c:\flrrlxf.exec:\flrrlxf.exe58⤵
- Executes dropped EXE
PID:3624 -
\??\c:\lfffrrl.exec:\lfffrrl.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5htnnn.exec:\5htnnn.exe60⤵
- Executes dropped EXE
PID:4696 -
\??\c:\ttbhbt.exec:\ttbhbt.exe61⤵
- Executes dropped EXE
PID:4060 -
\??\c:\tbhhbh.exec:\tbhhbh.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ddpdd.exec:\ddpdd.exe63⤵
- Executes dropped EXE
PID:2644 -
\??\c:\djdpv.exec:\djdpv.exe64⤵
- Executes dropped EXE
PID:116 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe65⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xrlffxf.exec:\xrlffxf.exe66⤵PID:3932
-
\??\c:\bbbtth.exec:\bbbtth.exe67⤵PID:1500
-
\??\c:\hhtbbb.exec:\hhtbbb.exe68⤵PID:3864
-
\??\c:\vpvpv.exec:\vpvpv.exe69⤵PID:4192
-
\??\c:\jjpdv.exec:\jjpdv.exe70⤵PID:2804
-
\??\c:\rxrxxff.exec:\rxrxxff.exe71⤵PID:528
-
\??\c:\xxxllrr.exec:\xxxllrr.exe72⤵PID:1588
-
\??\c:\hbhhhh.exec:\hbhhhh.exe73⤵PID:3452
-
\??\c:\hhhhbb.exec:\hhhhbb.exe74⤵PID:4892
-
\??\c:\dpddj.exec:\dpddj.exe75⤵PID:4768
-
\??\c:\vpddj.exec:\vpddj.exe76⤵PID:840
-
\??\c:\lrlfxff.exec:\lrlfxff.exe77⤵PID:1732
-
\??\c:\bthhhn.exec:\bthhhn.exe78⤵PID:392
-
\??\c:\bhbbhh.exec:\bhbbhh.exe79⤵PID:4208
-
\??\c:\jdvvp.exec:\jdvvp.exe80⤵PID:4108
-
\??\c:\dvddd.exec:\dvddd.exe81⤵PID:3648
-
\??\c:\xrfflll.exec:\xrfflll.exe82⤵PID:3440
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe83⤵PID:4068
-
\??\c:\7jddp.exec:\7jddp.exe84⤵PID:3388
-
\??\c:\vjvvv.exec:\vjvvv.exe85⤵PID:1908
-
\??\c:\pdjpj.exec:\pdjpj.exe86⤵PID:4332
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe87⤵PID:3668
-
\??\c:\thhtnh.exec:\thhtnh.exe88⤵PID:1000
-
\??\c:\jvdvp.exec:\jvdvp.exe89⤵PID:724
-
\??\c:\ddjjd.exec:\ddjjd.exe90⤵PID:4000
-
\??\c:\rllxxxf.exec:\rllxxxf.exe91⤵PID:2148
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe92⤵PID:4836
-
\??\c:\nthntb.exec:\nthntb.exe93⤵PID:3576
-
\??\c:\jvppp.exec:\jvppp.exe94⤵PID:3616
-
\??\c:\jjjjj.exec:\jjjjj.exe95⤵PID:4080
-
\??\c:\xxffxrr.exec:\xxffxrr.exe96⤵PID:812
-
\??\c:\xfxxxrr.exec:\xfxxxrr.exe97⤵PID:1668
-
\??\c:\nbhntt.exec:\nbhntt.exe98⤵PID:1312
-
\??\c:\hbnhnn.exec:\hbnhnn.exe99⤵PID:4272
-
\??\c:\ddddv.exec:\ddddv.exe100⤵PID:4616
-
\??\c:\1frrllr.exec:\1frrllr.exe101⤵PID:1400
-
\??\c:\llrrrrr.exec:\llrrrrr.exe102⤵PID:2784
-
\??\c:\1hbnhn.exec:\1hbnhn.exe103⤵PID:1168
-
\??\c:\nhtttt.exec:\nhtttt.exe104⤵PID:1716
-
\??\c:\ppppj.exec:\ppppj.exe105⤵PID:3580
-
\??\c:\jpvdv.exec:\jpvdv.exe106⤵PID:3588
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe107⤵PID:4556
-
\??\c:\nhhhnt.exec:\nhhhnt.exe108⤵PID:4932
-
\??\c:\ntbbbh.exec:\ntbbbh.exe109⤵PID:3916
-
\??\c:\jpjvd.exec:\jpjvd.exe110⤵PID:3632
-
\??\c:\pvvvp.exec:\pvvvp.exe111⤵PID:5008
-
\??\c:\7frrxfx.exec:\7frrxfx.exe112⤵PID:2652
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe113⤵PID:4508
-
\??\c:\nhtttt.exec:\nhtttt.exe114⤵PID:4472
-
\??\c:\hnthhb.exec:\hnthhb.exe115⤵PID:5052
-
\??\c:\5jjdd.exec:\5jjdd.exe116⤵PID:2468
-
\??\c:\1rfflrf.exec:\1rfflrf.exe117⤵PID:2828
-
\??\c:\rrrfxrr.exec:\rrrfxrr.exe118⤵PID:5012
-
\??\c:\nntttb.exec:\nntttb.exe119⤵PID:4584
-
\??\c:\jjppp.exec:\jjppp.exe120⤵PID:5072
-
\??\c:\7lllrxf.exec:\7lllrxf.exe121⤵PID:2644
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe122⤵PID:5040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-