Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 20:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe
-
Size
213KB
-
MD5
270bf9fb320cfc6ef65e5266e2cf2474
-
SHA1
d11a9e1661afca4b1803272436b500c266c13f6b
-
SHA256
34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5
-
SHA512
4724997b647bd7a1cf75c58be0da4f5019af46878b3b004c1378ca3bb3474c9087b907b625958ffbfc11454b6c439d94d7232b47d84297a947374138f23a270b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABvc:n3C9BRIG0asYFm71m8+GdkB9EBE
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2672-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/2672-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2852-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2852-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3020-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2684-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4520-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1996-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2064-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4740-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2368-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2420-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/768-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3588-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1788-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3000-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3832-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5116-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1344-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3364-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4596-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/644-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3724-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4676-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2852 1djvd.exe 3020 1ttnnb.exe 3836 3pjdd.exe 2684 pdpjd.exe 4520 dpvvp.exe 4524 lffxlll.exe 1996 xlxrlll.exe 4740 dvjpj.exe 2064 llxrllf.exe 1548 vvjdv.exe 2368 lfxxxxf.exe 2420 rllfxlf.exe 3980 jvppj.exe 768 9fffxrl.exe 3588 bnttnn.exe 3000 jvvjj.exe 1788 xrrlrlf.exe 3832 9lrlffx.exe 5116 vjdvj.exe 1344 fllfrlx.exe 3364 ffrrlxx.exe 4596 1hhbbb.exe 644 1ppjj.exe 3724 9rrllll.exe 4832 7bbttn.exe 2096 5dvjd.exe 3392 lxlfffl.exe 4012 flxxxxx.exe 4676 hbhbtn.exe 4080 3djdj.exe 2740 xrllrfl.exe 4552 bhhbtt.exe 2780 xxrfrxf.exe 4272 7frlffx.exe 464 hbntnb.exe 3484 dppvj.exe 4592 5vpjv.exe 1472 xxrxflx.exe 2692 tntnnt.exe 4060 nhhbhb.exe 4704 7jjdv.exe 1392 vjjdv.exe 3576 xxlfrrf.exe 1724 7bnhbb.exe 3836 5thnbb.exe 4380 jjjdp.exe 2788 ddpjv.exe 3900 xflfrll.exe 4524 xrrlxrf.exe 1220 bhnbnt.exe 3616 dpdvp.exe 4740 rllfrlr.exe 3872 fxlrxxr.exe 2916 btthtb.exe 4572 5ntbnh.exe 4448 pvvjj.exe 4444 vjvjj.exe 4780 lrxllxr.exe 5040 5ffrfxx.exe 2456 thnbhb.exe 3048 btnhtt.exe 404 3pppp.exe 848 5jjdv.exe 2680 9rxfrfx.exe -
resource yara_rule behavioral2/memory/2672-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2852 2672 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 83 PID 2672 wrote to memory of 2852 2672 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 83 PID 2672 wrote to memory of 2852 2672 34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe 83 PID 2852 wrote to memory of 3020 2852 1djvd.exe 84 PID 2852 wrote to memory of 3020 2852 1djvd.exe 84 PID 2852 wrote to memory of 3020 2852 1djvd.exe 84 PID 3020 wrote to memory of 3836 3020 1ttnnb.exe 85 PID 3020 wrote to memory of 3836 3020 1ttnnb.exe 85 PID 3020 wrote to memory of 3836 3020 1ttnnb.exe 85 PID 3836 wrote to memory of 2684 3836 3pjdd.exe 86 PID 3836 wrote to memory of 2684 3836 3pjdd.exe 86 PID 3836 wrote to memory of 2684 3836 3pjdd.exe 86 PID 2684 wrote to memory of 4520 2684 pdpjd.exe 87 PID 2684 wrote to memory of 4520 2684 pdpjd.exe 87 PID 2684 wrote to memory of 4520 2684 pdpjd.exe 87 PID 4520 wrote to memory of 4524 4520 dpvvp.exe 88 PID 4520 wrote to memory of 4524 4520 dpvvp.exe 88 PID 4520 wrote to memory of 4524 4520 dpvvp.exe 88 PID 4524 wrote to memory of 1996 4524 lffxlll.exe 89 PID 4524 wrote to memory of 1996 4524 lffxlll.exe 89 PID 4524 wrote to memory of 1996 4524 lffxlll.exe 89 PID 1996 wrote to memory of 4740 1996 xlxrlll.exe 90 PID 1996 wrote to memory of 4740 1996 xlxrlll.exe 90 PID 1996 wrote to memory of 4740 1996 xlxrlll.exe 90 PID 4740 wrote to memory of 2064 4740 dvjpj.exe 91 PID 4740 wrote to memory of 2064 4740 dvjpj.exe 91 PID 4740 wrote to memory of 2064 4740 dvjpj.exe 91 PID 2064 wrote to memory of 1548 2064 llxrllf.exe 92 PID 2064 wrote to memory of 1548 2064 llxrllf.exe 92 PID 2064 wrote to memory of 1548 2064 llxrllf.exe 92 PID 1548 wrote to memory of 2368 1548 vvjdv.exe 93 PID 1548 wrote to memory of 2368 1548 vvjdv.exe 93 PID 1548 wrote to memory of 2368 1548 vvjdv.exe 93 PID 2368 wrote to memory of 2420 2368 lfxxxxf.exe 94 PID 2368 wrote to memory of 2420 2368 lfxxxxf.exe 94 PID 2368 wrote to memory of 2420 2368 lfxxxxf.exe 94 PID 2420 wrote to memory of 3980 2420 rllfxlf.exe 95 PID 2420 wrote to memory of 3980 2420 rllfxlf.exe 95 PID 2420 wrote to memory of 3980 2420 rllfxlf.exe 95 PID 3980 wrote to memory of 768 3980 jvppj.exe 96 PID 3980 wrote to memory of 768 3980 jvppj.exe 96 PID 3980 wrote to memory of 768 3980 jvppj.exe 96 PID 768 wrote to memory of 3588 768 9fffxrl.exe 97 PID 768 wrote to memory of 3588 768 9fffxrl.exe 97 PID 768 wrote to memory of 3588 768 9fffxrl.exe 97 PID 3588 wrote to memory of 3000 3588 bnttnn.exe 98 PID 3588 wrote to memory of 3000 3588 bnttnn.exe 98 PID 3588 wrote to memory of 3000 3588 bnttnn.exe 98 PID 3000 wrote to memory of 1788 3000 jvvjj.exe 99 PID 3000 wrote to memory of 1788 3000 jvvjj.exe 99 PID 3000 wrote to memory of 1788 3000 jvvjj.exe 99 PID 1788 wrote to memory of 3832 1788 xrrlrlf.exe 100 PID 1788 wrote to memory of 3832 1788 xrrlrlf.exe 100 PID 1788 wrote to memory of 3832 1788 xrrlrlf.exe 100 PID 3832 wrote to memory of 5116 3832 9lrlffx.exe 101 PID 3832 wrote to memory of 5116 3832 9lrlffx.exe 101 PID 3832 wrote to memory of 5116 3832 9lrlffx.exe 101 PID 5116 wrote to memory of 1344 5116 vjdvj.exe 102 PID 5116 wrote to memory of 1344 5116 vjdvj.exe 102 PID 5116 wrote to memory of 1344 5116 vjdvj.exe 102 PID 1344 wrote to memory of 3364 1344 fllfrlx.exe 104 PID 1344 wrote to memory of 3364 1344 fllfrlx.exe 104 PID 1344 wrote to memory of 3364 1344 fllfrlx.exe 104 PID 3364 wrote to memory of 4596 3364 ffrrlxx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe"C:\Users\Admin\AppData\Local\Temp\34ec01f1e7203721896295bccd79a737962db6e47d9090fb6b78234a91be5cb5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1djvd.exec:\1djvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1ttnnb.exec:\1ttnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\3pjdd.exec:\3pjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\pdpjd.exec:\pdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dpvvp.exec:\dpvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\lffxlll.exec:\lffxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\xlxrlll.exec:\xlxrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\dvjpj.exec:\dvjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\llxrllf.exec:\llxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vvjdv.exec:\vvjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rllfxlf.exec:\rllfxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jvppj.exec:\jvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\9fffxrl.exec:\9fffxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\bnttnn.exec:\bnttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\jvvjj.exec:\jvvjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xrrlrlf.exec:\xrrlrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\9lrlffx.exec:\9lrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\vjdvj.exec:\vjdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\fllfrlx.exec:\fllfrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\ffrrlxx.exec:\ffrrlxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\1hhbbb.exec:\1hhbbb.exe23⤵
- Executes dropped EXE
PID:4596 -
\??\c:\1ppjj.exec:\1ppjj.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\9rrllll.exec:\9rrllll.exe25⤵
- Executes dropped EXE
PID:3724 -
\??\c:\7bbttn.exec:\7bbttn.exe26⤵
- Executes dropped EXE
PID:4832 -
\??\c:\5dvjd.exec:\5dvjd.exe27⤵
- Executes dropped EXE
PID:2096 -
\??\c:\lxlfffl.exec:\lxlfffl.exe28⤵
- Executes dropped EXE
PID:3392 -
\??\c:\flxxxxx.exec:\flxxxxx.exe29⤵
- Executes dropped EXE
PID:4012 -
\??\c:\hbhbtn.exec:\hbhbtn.exe30⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3djdj.exec:\3djdj.exe31⤵
- Executes dropped EXE
PID:4080 -
\??\c:\xrllrfl.exec:\xrllrfl.exe32⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bhhbtt.exec:\bhhbtt.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe34⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7frlffx.exec:\7frlffx.exe35⤵
- Executes dropped EXE
PID:4272 -
\??\c:\hbntnb.exec:\hbntnb.exe36⤵
- Executes dropped EXE
PID:464 -
\??\c:\dppvj.exec:\dppvj.exe37⤵
- Executes dropped EXE
PID:3484 -
\??\c:\5vpjv.exec:\5vpjv.exe38⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xxrxflx.exec:\xxrxflx.exe39⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tntnnt.exec:\tntnnt.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhhbhb.exec:\nhhbhb.exe41⤵
- Executes dropped EXE
PID:4060 -
\??\c:\7jjdv.exec:\7jjdv.exe42⤵
- Executes dropped EXE
PID:4704 -
\??\c:\vjjdv.exec:\vjjdv.exe43⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xxlfrrf.exec:\xxlfrrf.exe44⤵
- Executes dropped EXE
PID:3576 -
\??\c:\7bnhbb.exec:\7bnhbb.exe45⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5thnbb.exec:\5thnbb.exe46⤵
- Executes dropped EXE
PID:3836 -
\??\c:\jjjdp.exec:\jjjdp.exe47⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ddpjv.exec:\ddpjv.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xflfrll.exec:\xflfrll.exe49⤵
- Executes dropped EXE
PID:3900 -
\??\c:\xrrlxrf.exec:\xrrlxrf.exe50⤵
- Executes dropped EXE
PID:4524 -
\??\c:\bhnbnt.exec:\bhnbnt.exe51⤵
- Executes dropped EXE
PID:1220 -
\??\c:\dpdvp.exec:\dpdvp.exe52⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rllfrlr.exec:\rllfrlr.exe53⤵
- Executes dropped EXE
PID:4740 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe54⤵
- Executes dropped EXE
PID:3872 -
\??\c:\btthtb.exec:\btthtb.exe55⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5ntbnh.exec:\5ntbnh.exe56⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pvvjj.exec:\pvvjj.exe57⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vjvjj.exec:\vjvjj.exe58⤵
- Executes dropped EXE
PID:4444 -
\??\c:\lrxllxr.exec:\lrxllxr.exe59⤵
- Executes dropped EXE
PID:4780 -
\??\c:\5ffrfxx.exec:\5ffrfxx.exe60⤵
- Executes dropped EXE
PID:5040 -
\??\c:\thnbhb.exec:\thnbhb.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\btnhtt.exec:\btnhtt.exe62⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3pppp.exec:\3pppp.exe63⤵
- Executes dropped EXE
PID:404 -
\??\c:\5jjdv.exec:\5jjdv.exe64⤵
- Executes dropped EXE
PID:848 -
\??\c:\9rxfrfx.exec:\9rxfrfx.exe65⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hhhbtn.exec:\hhhbtn.exe66⤵PID:4604
-
\??\c:\hnnnht.exec:\hnnnht.exe67⤵PID:1464
-
\??\c:\vdddv.exec:\vdddv.exe68⤵PID:976
-
\??\c:\1xrfrrl.exec:\1xrfrrl.exe69⤵PID:3796
-
\??\c:\3nnhnh.exec:\3nnhnh.exe70⤵PID:3364
-
\??\c:\nnhbnn.exec:\nnhbnn.exe71⤵PID:556
-
\??\c:\3vpdp.exec:\3vpdp.exe72⤵PID:4196
-
\??\c:\7vdpp.exec:\7vdpp.exe73⤵PID:4904
-
\??\c:\xxllxxx.exec:\xxllxxx.exe74⤵PID:2884
-
\??\c:\bbhbtt.exec:\bbhbtt.exe75⤵PID:4888
-
\??\c:\nnbthb.exec:\nnbthb.exe76⤵PID:888
-
\??\c:\7djdp.exec:\7djdp.exe77⤵PID:4964
-
\??\c:\5ddpj.exec:\5ddpj.exe78⤵PID:4124
-
\??\c:\lffxrrf.exec:\lffxrrf.exe79⤵PID:2352
-
\??\c:\bnnhtt.exec:\bnnhtt.exe80⤵PID:1328
-
\??\c:\5jvpd.exec:\5jvpd.exe81⤵PID:4368
-
\??\c:\flrlxrl.exec:\flrlxrl.exe82⤵PID:3508
-
\??\c:\bbnnhb.exec:\bbnnhb.exe83⤵PID:5052
-
\??\c:\bnbthb.exec:\bnbthb.exe84⤵PID:3672
-
\??\c:\1vddj.exec:\1vddj.exe85⤵PID:3368
-
\??\c:\tthbhh.exec:\tthbhh.exe86⤵PID:2792
-
\??\c:\httttn.exec:\httttn.exe87⤵PID:4564
-
\??\c:\vjdpj.exec:\vjdpj.exe88⤵PID:412
-
\??\c:\ddjvp.exec:\ddjvp.exe89⤵PID:212
-
\??\c:\ffxxxll.exec:\ffxxxll.exe90⤵PID:1776
-
\??\c:\bnnbtt.exec:\bnnbtt.exe91⤵PID:1088
-
\??\c:\jjdvp.exec:\jjdvp.exe92⤵PID:2344
-
\??\c:\vppjv.exec:\vppjv.exe93⤵PID:4724
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe94⤵PID:2524
-
\??\c:\1ttnhb.exec:\1ttnhb.exe95⤵PID:3568
-
\??\c:\dvpjv.exec:\dvpjv.exe96⤵PID:2816
-
\??\c:\xrxrlfl.exec:\xrxrlfl.exe97⤵PID:2336
-
\??\c:\bhnbth.exec:\bhnbth.exe98⤵PID:2724
-
\??\c:\vjpjv.exec:\vjpjv.exe99⤵PID:4120
-
\??\c:\bnbbbb.exec:\bnbbbb.exe100⤵PID:3820
-
\??\c:\vvpdp.exec:\vvpdp.exe101⤵PID:4848
-
\??\c:\vdpjp.exec:\vdpjp.exe102⤵PID:548
-
\??\c:\frrlxxf.exec:\frrlxxf.exe103⤵PID:3360
-
\??\c:\lrflxrl.exec:\lrflxrl.exe104⤵PID:1612
-
\??\c:\thhbtt.exec:\thhbtt.exe105⤵PID:2036
-
\??\c:\btnbnh.exec:\btnbnh.exe106⤵PID:716
-
\??\c:\dpdpd.exec:\dpdpd.exe107⤵PID:3212
-
\??\c:\fxxllfl.exec:\fxxllfl.exe108⤵PID:4992
-
\??\c:\rfxrxrr.exec:\rfxrxrr.exe109⤵PID:720
-
\??\c:\htbttn.exec:\htbttn.exe110⤵PID:1424
-
\??\c:\ddddp.exec:\ddddp.exe111⤵PID:396
-
\??\c:\pvjvp.exec:\pvjvp.exe112⤵PID:2056
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe113⤵PID:5012
-
\??\c:\5hnbnn.exec:\5hnbnn.exe114⤵PID:4952
-
\??\c:\nnhtnb.exec:\nnhtnb.exe115⤵PID:1740
-
\??\c:\jvdvp.exec:\jvdvp.exe116⤵PID:3984
-
\??\c:\vjjjp.exec:\vjjjp.exe117⤵PID:1804
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe118⤵PID:4020
-
\??\c:\thnnnh.exec:\thnnnh.exe119⤵PID:556
-
\??\c:\nhhtbt.exec:\nhhtbt.exe120⤵PID:4340
-
\??\c:\vpjvv.exec:\vpjvv.exe121⤵PID:3940
-
\??\c:\5ppdp.exec:\5ppdp.exe122⤵PID:4888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-