Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe
-
Size
61KB
-
MD5
d7efd1ba109c208083f1ade1bdd94323
-
SHA1
5c6825e692d6249541683b012499498ee6d3f351
-
SHA256
fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce
-
SHA512
a45b2cd51c76b23a4b86b1f8a48c76f3fb88fdef61ff97edfa650d17acba5678a77e0ca0f4bad3f9f56b4fbecb3b32c5952b5c9316ad37997a01e8c860ea6c64
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEo:ymb3NkkiQ3mdBjFII9ZvHKEo
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1608-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral2/memory/1608-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3856-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4464-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2664-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4980-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3396-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1120-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5088-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3944-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2280-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2732-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4864-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4428-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1660-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/372-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4292-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4796-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/400-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3856 9lxxrxx.exe 4464 hnthhn.exe 2664 1vpdj.exe 4980 jvvvd.exe 3396 fxrrrxx.exe 1120 tbhnnn.exe 2236 9djjp.exe 5088 xxfffff.exe 3576 bbnnnt.exe 4868 jjdvp.exe 2984 flrrrxf.exe 4644 hbttth.exe 3944 bhtntn.exe 2280 vvvvp.exe 3844 frrrffl.exe 2732 bbbnnt.exe 4864 3tttbh.exe 4428 vvddv.exe 4448 rlllllr.exe 1660 ttttnn.exe 2652 5hnhhb.exe 372 jpjjd.exe 4712 frxxrrl.exe 4292 nnnnbb.exe 1140 bthhhn.exe 4796 ppvdj.exe 400 xfrflrx.exe 3124 thnbhb.exe 4700 pddvv.exe 3560 rflffff.exe 1136 frfxxxx.exe 1804 3hhnnn.exe 3908 jjvvv.exe 2328 rrxrlrf.exe 3612 xlrrlrr.exe 3312 3htnnt.exe 220 vppjj.exe 1556 ddddd.exe 4456 xlffrfx.exe 1552 lffffff.exe 4216 hbntnb.exe 4856 jvdvj.exe 2724 vpdvp.exe 4416 rlffxrx.exe 1864 lxxllfr.exe 5024 tnnntt.exe 4624 7hnhbh.exe 3448 vjvvp.exe 3136 lxxxxxx.exe 5084 lxxrfll.exe 3660 tbhhhh.exe 4812 pppdd.exe 800 bbbtnn.exe 1424 dvppp.exe 1016 jjppd.exe 4404 rfrlrrx.exe 620 lrrrxxx.exe 2308 hnbbhh.exe 2228 vvvpd.exe 32 vpjdj.exe 2032 fflfffl.exe 4408 rlllfrr.exe 1148 hhhhhn.exe 3852 vvdpv.exe -
resource yara_rule behavioral2/memory/1608-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 3856 1608 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 84 PID 1608 wrote to memory of 3856 1608 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 84 PID 1608 wrote to memory of 3856 1608 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 84 PID 3856 wrote to memory of 4464 3856 9lxxrxx.exe 85 PID 3856 wrote to memory of 4464 3856 9lxxrxx.exe 85 PID 3856 wrote to memory of 4464 3856 9lxxrxx.exe 85 PID 4464 wrote to memory of 2664 4464 hnthhn.exe 86 PID 4464 wrote to memory of 2664 4464 hnthhn.exe 86 PID 4464 wrote to memory of 2664 4464 hnthhn.exe 86 PID 2664 wrote to memory of 4980 2664 1vpdj.exe 87 PID 2664 wrote to memory of 4980 2664 1vpdj.exe 87 PID 2664 wrote to memory of 4980 2664 1vpdj.exe 87 PID 4980 wrote to memory of 3396 4980 jvvvd.exe 88 PID 4980 wrote to memory of 3396 4980 jvvvd.exe 88 PID 4980 wrote to memory of 3396 4980 jvvvd.exe 88 PID 3396 wrote to memory of 1120 3396 fxrrrxx.exe 89 PID 3396 wrote to memory of 1120 3396 fxrrrxx.exe 89 PID 3396 wrote to memory of 1120 3396 fxrrrxx.exe 89 PID 1120 wrote to memory of 2236 1120 tbhnnn.exe 90 PID 1120 wrote to memory of 2236 1120 tbhnnn.exe 90 PID 1120 wrote to memory of 2236 1120 tbhnnn.exe 90 PID 2236 wrote to memory of 5088 2236 9djjp.exe 91 PID 2236 wrote to memory of 5088 2236 9djjp.exe 91 PID 2236 wrote to memory of 5088 2236 9djjp.exe 91 PID 5088 wrote to memory of 3576 5088 xxfffff.exe 92 PID 5088 wrote to memory of 3576 5088 xxfffff.exe 92 PID 5088 wrote to memory of 3576 5088 xxfffff.exe 92 PID 3576 wrote to memory of 4868 3576 bbnnnt.exe 93 PID 3576 wrote to memory of 4868 3576 bbnnnt.exe 93 PID 3576 wrote to memory of 4868 3576 bbnnnt.exe 93 PID 4868 wrote to memory of 2984 4868 jjdvp.exe 94 PID 4868 wrote to memory of 2984 4868 jjdvp.exe 94 PID 4868 wrote to memory of 2984 4868 jjdvp.exe 94 PID 2984 wrote to memory of 4644 2984 flrrrxf.exe 95 PID 2984 wrote to memory of 4644 2984 flrrrxf.exe 95 PID 2984 wrote to memory of 4644 2984 flrrrxf.exe 95 PID 4644 wrote to memory of 3944 4644 hbttth.exe 96 PID 4644 wrote to memory of 3944 4644 hbttth.exe 96 PID 4644 wrote to memory of 3944 4644 hbttth.exe 96 PID 3944 wrote to memory of 2280 3944 bhtntn.exe 97 PID 3944 wrote to memory of 2280 3944 bhtntn.exe 97 PID 3944 wrote to memory of 2280 3944 bhtntn.exe 97 PID 2280 wrote to memory of 3844 2280 vvvvp.exe 98 PID 2280 wrote to memory of 3844 2280 vvvvp.exe 98 PID 2280 wrote to memory of 3844 2280 vvvvp.exe 98 PID 3844 wrote to memory of 2732 3844 frrrffl.exe 99 PID 3844 wrote to memory of 2732 3844 frrrffl.exe 99 PID 3844 wrote to memory of 2732 3844 frrrffl.exe 99 PID 2732 wrote to memory of 4864 2732 bbbnnt.exe 100 PID 2732 wrote to memory of 4864 2732 bbbnnt.exe 100 PID 2732 wrote to memory of 4864 2732 bbbnnt.exe 100 PID 4864 wrote to memory of 4428 4864 3tttbh.exe 101 PID 4864 wrote to memory of 4428 4864 3tttbh.exe 101 PID 4864 wrote to memory of 4428 4864 3tttbh.exe 101 PID 4428 wrote to memory of 4448 4428 vvddv.exe 102 PID 4428 wrote to memory of 4448 4428 vvddv.exe 102 PID 4428 wrote to memory of 4448 4428 vvddv.exe 102 PID 4448 wrote to memory of 1660 4448 rlllllr.exe 103 PID 4448 wrote to memory of 1660 4448 rlllllr.exe 103 PID 4448 wrote to memory of 1660 4448 rlllllr.exe 103 PID 1660 wrote to memory of 2652 1660 ttttnn.exe 104 PID 1660 wrote to memory of 2652 1660 ttttnn.exe 104 PID 1660 wrote to memory of 2652 1660 ttttnn.exe 104 PID 2652 wrote to memory of 372 2652 5hnhhb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe"C:\Users\Admin\AppData\Local\Temp\fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\9lxxrxx.exec:\9lxxrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\hnthhn.exec:\hnthhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\1vpdj.exec:\1vpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jvvvd.exec:\jvvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\tbhnnn.exec:\tbhnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\9djjp.exec:\9djjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\xxfffff.exec:\xxfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\bbnnnt.exec:\bbnnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\jjdvp.exec:\jjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\flrrrxf.exec:\flrrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hbttth.exec:\hbttth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\bhtntn.exec:\bhtntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\vvvvp.exec:\vvvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\frrrffl.exec:\frrrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\bbbnnt.exec:\bbbnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3tttbh.exec:\3tttbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vvddv.exec:\vvddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\rlllllr.exec:\rlllllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\ttttnn.exec:\ttttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\5hnhhb.exec:\5hnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jpjjd.exec:\jpjjd.exe23⤵
- Executes dropped EXE
PID:372 -
\??\c:\frxxrrl.exec:\frxxrrl.exe24⤵
- Executes dropped EXE
PID:4712 -
\??\c:\nnnnbb.exec:\nnnnbb.exe25⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bthhhn.exec:\bthhhn.exe26⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ppvdj.exec:\ppvdj.exe27⤵
- Executes dropped EXE
PID:4796 -
\??\c:\xfrflrx.exec:\xfrflrx.exe28⤵
- Executes dropped EXE
PID:400 -
\??\c:\thnbhb.exec:\thnbhb.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\pddvv.exec:\pddvv.exe30⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rflffff.exec:\rflffff.exe31⤵
- Executes dropped EXE
PID:3560 -
\??\c:\frfxxxx.exec:\frfxxxx.exe32⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3hhnnn.exec:\3hhnnn.exe33⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jjvvv.exec:\jjvvv.exe34⤵
- Executes dropped EXE
PID:3908 -
\??\c:\rrxrlrf.exec:\rrxrlrf.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe36⤵
- Executes dropped EXE
PID:3612 -
\??\c:\3htnnt.exec:\3htnnt.exe37⤵
- Executes dropped EXE
PID:3312 -
\??\c:\vppjj.exec:\vppjj.exe38⤵
- Executes dropped EXE
PID:220 -
\??\c:\ddddd.exec:\ddddd.exe39⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xlffrfx.exec:\xlffrfx.exe40⤵
- Executes dropped EXE
PID:4456 -
\??\c:\lffffff.exec:\lffffff.exe41⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hbntnb.exec:\hbntnb.exe42⤵
- Executes dropped EXE
PID:4216 -
\??\c:\jvdvj.exec:\jvdvj.exe43⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpdvp.exec:\vpdvp.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlffxrx.exec:\rlffxrx.exe45⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lxxllfr.exec:\lxxllfr.exe46⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tnnntt.exec:\tnnntt.exe47⤵
- Executes dropped EXE
PID:5024 -
\??\c:\7hnhbh.exec:\7hnhbh.exe48⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vjvvp.exec:\vjvvp.exe49⤵
- Executes dropped EXE
PID:3448 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe50⤵
- Executes dropped EXE
PID:3136 -
\??\c:\lxxrfll.exec:\lxxrfll.exe51⤵
- Executes dropped EXE
PID:5084 -
\??\c:\tbhhhh.exec:\tbhhhh.exe52⤵
- Executes dropped EXE
PID:3660 -
\??\c:\pppdd.exec:\pppdd.exe53⤵
- Executes dropped EXE
PID:4812 -
\??\c:\bbbtnn.exec:\bbbtnn.exe54⤵
- Executes dropped EXE
PID:800 -
\??\c:\dvppp.exec:\dvppp.exe55⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jjppd.exec:\jjppd.exe56⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rfrlrrx.exec:\rfrlrrx.exe57⤵
- Executes dropped EXE
PID:4404 -
\??\c:\lrrrxxx.exec:\lrrrxxx.exe58⤵
- Executes dropped EXE
PID:620 -
\??\c:\hnbbhh.exec:\hnbbhh.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vvvpd.exec:\vvvpd.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vpjdj.exec:\vpjdj.exe61⤵
- Executes dropped EXE
PID:32 -
\??\c:\fflfffl.exec:\fflfffl.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlllfrr.exec:\rlllfrr.exe63⤵
- Executes dropped EXE
PID:4408 -
\??\c:\hhhhhn.exec:\hhhhhn.exe64⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vvdpv.exec:\vvdpv.exe65⤵
- Executes dropped EXE
PID:3852 -
\??\c:\jjjjj.exec:\jjjjj.exe66⤵PID:3468
-
\??\c:\7llrrxx.exec:\7llrrxx.exe67⤵PID:760
-
\??\c:\xrrxxfx.exec:\xrrxxfx.exe68⤵PID:1720
-
\??\c:\bthnnt.exec:\bthnnt.exe69⤵PID:2204
-
\??\c:\nnbbbh.exec:\nnbbbh.exe70⤵PID:4400
-
\??\c:\pdjpj.exec:\pdjpj.exe71⤵PID:4128
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe72⤵PID:4964
-
\??\c:\llxxxff.exec:\llxxxff.exe73⤵PID:2208
-
\??\c:\tbnhhh.exec:\tbnhhh.exe74⤵PID:3628
-
\??\c:\htnnnn.exec:\htnnnn.exe75⤵PID:3344
-
\??\c:\jjvvj.exec:\jjvvj.exe76⤵PID:3892
-
\??\c:\pjjjd.exec:\pjjjd.exe77⤵PID:3132
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe78⤵PID:4368
-
\??\c:\fxflfll.exec:\fxflfll.exe79⤵PID:2720
-
\??\c:\tntntt.exec:\tntntt.exe80⤵PID:4564
-
\??\c:\3jddv.exec:\3jddv.exe81⤵PID:3564
-
\??\c:\9vdvj.exec:\9vdvj.exe82⤵PID:216
-
\??\c:\frxrxxr.exec:\frxrxxr.exe83⤵PID:4168
-
\??\c:\5bnnnt.exec:\5bnnnt.exe84⤵PID:4696
-
\??\c:\vjvvv.exec:\vjvvv.exe85⤵PID:4924
-
\??\c:\9pddv.exec:\9pddv.exe86⤵PID:4588
-
\??\c:\5lrrrlr.exec:\5lrrrlr.exe87⤵PID:848
-
\??\c:\nthhnb.exec:\nthhnb.exe88⤵PID:1648
-
\??\c:\5bbnbh.exec:\5bbnbh.exe89⤵PID:3180
-
\??\c:\ppddv.exec:\ppddv.exe90⤵PID:2784
-
\??\c:\xrfxrxx.exec:\xrfxrxx.exe91⤵PID:3516
-
\??\c:\hnnhht.exec:\hnnhht.exe92⤵PID:2608
-
\??\c:\vdpvv.exec:\vdpvv.exe93⤵PID:5016
-
\??\c:\lxffflf.exec:\lxffflf.exe94⤵PID:4972
-
\??\c:\xlrrlll.exec:\xlrrlll.exe95⤵PID:2780
-
\??\c:\thbttt.exec:\thbttt.exe96⤵PID:4672
-
\??\c:\bnbbtt.exec:\bnbbtt.exe97⤵PID:4868
-
\??\c:\9dpjj.exec:\9dpjj.exe98⤵PID:2984
-
\??\c:\vpjjp.exec:\vpjjp.exe99⤵PID:4640
-
\??\c:\xrrllll.exec:\xrrllll.exe100⤵PID:4212
-
\??\c:\lflrrrx.exec:\lflrrrx.exe101⤵PID:2520
-
\??\c:\bbhbtt.exec:\bbhbtt.exe102⤵PID:1964
-
\??\c:\tbbbtb.exec:\tbbbtb.exe103⤵PID:2768
-
\??\c:\9jvjv.exec:\9jvjv.exe104⤵PID:3456
-
\??\c:\vvjjd.exec:\vvjjd.exe105⤵PID:2264
-
\??\c:\lxxrlll.exec:\lxxrlll.exe106⤵PID:3884
-
\??\c:\xrllfrr.exec:\xrllfrr.exe107⤵PID:4408
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe108⤵PID:3960
-
\??\c:\htbbbb.exec:\htbbbb.exe109⤵PID:1268
-
\??\c:\nbhhtt.exec:\nbhhtt.exe110⤵PID:2828
-
\??\c:\vpvpd.exec:\vpvpd.exe111⤵PID:760
-
\??\c:\pjppj.exec:\pjppj.exe112⤵PID:3648
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe113⤵PID:2204
-
\??\c:\xrxffff.exec:\xrxffff.exe114⤵PID:4400
-
\??\c:\hbntht.exec:\hbntht.exe115⤵PID:3808
-
\??\c:\nnhbbh.exec:\nnhbbh.exe116⤵PID:1220
-
\??\c:\jdjjd.exec:\jdjjd.exe117⤵PID:2420
-
\??\c:\rlrxllr.exec:\rlrxllr.exe118⤵PID:3628
-
\??\c:\frrxrrr.exec:\frrxrrr.exe119⤵PID:388
-
\??\c:\tbhhbh.exec:\tbhhbh.exe120⤵PID:3980
-
\??\c:\tthnbb.exec:\tthnbb.exe121⤵PID:3064
-
\??\c:\pvjjd.exec:\pvjjd.exe122⤵PID:1440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-