Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe
-
Size
58KB
-
MD5
6d7b7eaf67d4b8f294d18165bc1036ad
-
SHA1
697c1e3ccbf398651e8964907b9aebeed3c0c873
-
SHA256
354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973
-
SHA512
1e7df61febd0a52c141af462909c468744197ea9064581a9af52eaaf4ee36503d5687e6d958fc03505c3e36d9b4db1c35c2f9b69d1206a6e72c99e66fc3c25df
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L5:ymb3NkkiQ3mdBjFI99
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4728-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral2/memory/4728-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4728-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2556-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2268-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5012-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5012-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5072-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1652-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4324-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5084-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/8-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4496-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4312-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2968-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3992-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2412-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4604-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2492-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2260-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/988-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4716-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4268-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3284-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3252-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4276-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2556 3ppjd.exe 2236 1thbbb.exe 2924 pddjj.exe 2268 xxrrllf.exe 5012 5ntbtt.exe 5072 vdpjv.exe 1940 vvjjv.exe 1652 llfllfx.exe 4324 ttbbbb.exe 5084 thnbtn.exe 4988 jpjdv.exe 8 rfxfrrl.exe 4496 xxxrflf.exe 4708 hhnnht.exe 4312 ppjdp.exe 2968 lfxllrr.exe 3992 lfrlxxr.exe 2412 nbbbtn.exe 4604 7vpdv.exe 3008 xrllrxf.exe 2492 9xfxflf.exe 2260 hntnbn.exe 3988 dvvvd.exe 988 vdjvp.exe 4716 lxxrffx.exe 2988 fxxxrlf.exe 4268 hbhhbb.exe 3228 9ntnbh.exe 3284 jvpdp.exe 3252 rfxlxrf.exe 4276 xrlflll.exe 1608 tnttnt.exe 2956 5thbht.exe 964 jppjd.exe 4208 rfrlffx.exe 3412 3fxxrrl.exe 1604 ntnnnn.exe 3344 9jdvj.exe 680 vpppp.exe 3728 rfllxrr.exe 4524 fxfxxxr.exe 1888 hhnbtt.exe 4308 9ttnbt.exe 2556 ddvvv.exe 3828 jdjdd.exe 3596 rlfxffx.exe 2748 xxlfxrl.exe 4508 tntntt.exe 1872 hbhhtt.exe 5072 vvjdp.exe 3772 rlxrllf.exe 1652 btbbnn.exe 2428 jjdpd.exe 1204 vjpvp.exe 3028 jvppd.exe 4544 lfflxxl.exe 3184 xlfxrlf.exe 812 5hbnhh.exe 4040 pvddp.exe 3908 dvvjv.exe 4884 lflfxff.exe 3056 bbbtbn.exe 2384 ppvdv.exe 2052 vjjdv.exe -
resource yara_rule behavioral2/memory/4728-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 2556 4728 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 83 PID 4728 wrote to memory of 2556 4728 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 83 PID 4728 wrote to memory of 2556 4728 354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe 83 PID 2556 wrote to memory of 2236 2556 3ppjd.exe 84 PID 2556 wrote to memory of 2236 2556 3ppjd.exe 84 PID 2556 wrote to memory of 2236 2556 3ppjd.exe 84 PID 2236 wrote to memory of 2924 2236 1thbbb.exe 85 PID 2236 wrote to memory of 2924 2236 1thbbb.exe 85 PID 2236 wrote to memory of 2924 2236 1thbbb.exe 85 PID 2924 wrote to memory of 2268 2924 pddjj.exe 86 PID 2924 wrote to memory of 2268 2924 pddjj.exe 86 PID 2924 wrote to memory of 2268 2924 pddjj.exe 86 PID 2268 wrote to memory of 5012 2268 xxrrllf.exe 87 PID 2268 wrote to memory of 5012 2268 xxrrllf.exe 87 PID 2268 wrote to memory of 5012 2268 xxrrllf.exe 87 PID 5012 wrote to memory of 5072 5012 5ntbtt.exe 88 PID 5012 wrote to memory of 5072 5012 5ntbtt.exe 88 PID 5012 wrote to memory of 5072 5012 5ntbtt.exe 88 PID 5072 wrote to memory of 1940 5072 vdpjv.exe 89 PID 5072 wrote to memory of 1940 5072 vdpjv.exe 89 PID 5072 wrote to memory of 1940 5072 vdpjv.exe 89 PID 1940 wrote to memory of 1652 1940 vvjjv.exe 90 PID 1940 wrote to memory of 1652 1940 vvjjv.exe 90 PID 1940 wrote to memory of 1652 1940 vvjjv.exe 90 PID 1652 wrote to memory of 4324 1652 llfllfx.exe 91 PID 1652 wrote to memory of 4324 1652 llfllfx.exe 91 PID 1652 wrote to memory of 4324 1652 llfllfx.exe 91 PID 4324 wrote to memory of 5084 4324 ttbbbb.exe 92 PID 4324 wrote to memory of 5084 4324 ttbbbb.exe 92 PID 4324 wrote to memory of 5084 4324 ttbbbb.exe 92 PID 5084 wrote to memory of 4988 5084 thnbtn.exe 93 PID 5084 wrote to memory of 4988 5084 thnbtn.exe 93 PID 5084 wrote to memory of 4988 5084 thnbtn.exe 93 PID 4988 wrote to memory of 8 4988 jpjdv.exe 94 PID 4988 wrote to memory of 8 4988 jpjdv.exe 94 PID 4988 wrote to memory of 8 4988 jpjdv.exe 94 PID 8 wrote to memory of 4496 8 rfxfrrl.exe 95 PID 8 wrote to memory of 4496 8 rfxfrrl.exe 95 PID 8 wrote to memory of 4496 8 rfxfrrl.exe 95 PID 4496 wrote to memory of 4708 4496 xxxrflf.exe 96 PID 4496 wrote to memory of 4708 4496 xxxrflf.exe 96 PID 4496 wrote to memory of 4708 4496 xxxrflf.exe 96 PID 4708 wrote to memory of 4312 4708 hhnnht.exe 97 PID 4708 wrote to memory of 4312 4708 hhnnht.exe 97 PID 4708 wrote to memory of 4312 4708 hhnnht.exe 97 PID 4312 wrote to memory of 2968 4312 ppjdp.exe 98 PID 4312 wrote to memory of 2968 4312 ppjdp.exe 98 PID 4312 wrote to memory of 2968 4312 ppjdp.exe 98 PID 2968 wrote to memory of 3992 2968 lfxllrr.exe 99 PID 2968 wrote to memory of 3992 2968 lfxllrr.exe 99 PID 2968 wrote to memory of 3992 2968 lfxllrr.exe 99 PID 3992 wrote to memory of 2412 3992 lfrlxxr.exe 100 PID 3992 wrote to memory of 2412 3992 lfrlxxr.exe 100 PID 3992 wrote to memory of 2412 3992 lfrlxxr.exe 100 PID 2412 wrote to memory of 4604 2412 nbbbtn.exe 101 PID 2412 wrote to memory of 4604 2412 nbbbtn.exe 101 PID 2412 wrote to memory of 4604 2412 nbbbtn.exe 101 PID 4604 wrote to memory of 3008 4604 7vpdv.exe 102 PID 4604 wrote to memory of 3008 4604 7vpdv.exe 102 PID 4604 wrote to memory of 3008 4604 7vpdv.exe 102 PID 3008 wrote to memory of 2492 3008 xrllrxf.exe 103 PID 3008 wrote to memory of 2492 3008 xrllrxf.exe 103 PID 3008 wrote to memory of 2492 3008 xrllrxf.exe 103 PID 2492 wrote to memory of 2260 2492 9xfxflf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe"C:\Users\Admin\AppData\Local\Temp\354d0cd3f3749e6fbac1bc0d1bf58a8588e73d6bfb34670cea714284fda3f973.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\3ppjd.exec:\3ppjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\1thbbb.exec:\1thbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\pddjj.exec:\pddjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xxrrllf.exec:\xxrrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\5ntbtt.exec:\5ntbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vdpjv.exec:\vdpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\vvjjv.exec:\vvjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\llfllfx.exec:\llfllfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\ttbbbb.exec:\ttbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\thnbtn.exec:\thnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\jpjdv.exec:\jpjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\rfxfrrl.exec:\rfxfrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xxxrflf.exec:\xxxrflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\hhnnht.exec:\hhnnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\ppjdp.exec:\ppjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\lfxllrr.exec:\lfxllrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\nbbbtn.exec:\nbbbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\7vpdv.exec:\7vpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\xrllrxf.exec:\xrllrxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9xfxflf.exec:\9xfxflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\hntnbn.exec:\hntnbn.exe23⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dvvvd.exec:\dvvvd.exe24⤵
- Executes dropped EXE
PID:3988 -
\??\c:\vdjvp.exec:\vdjvp.exe25⤵
- Executes dropped EXE
PID:988 -
\??\c:\lxxrffx.exec:\lxxrffx.exe26⤵
- Executes dropped EXE
PID:4716 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe27⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hbhhbb.exec:\hbhhbb.exe28⤵
- Executes dropped EXE
PID:4268 -
\??\c:\9ntnbh.exec:\9ntnbh.exe29⤵
- Executes dropped EXE
PID:3228 -
\??\c:\jvpdp.exec:\jvpdp.exe30⤵
- Executes dropped EXE
PID:3284 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe31⤵
- Executes dropped EXE
PID:3252 -
\??\c:\xrlflll.exec:\xrlflll.exe32⤵
- Executes dropped EXE
PID:4276 -
\??\c:\tnttnt.exec:\tnttnt.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5thbht.exec:\5thbht.exe34⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jppjd.exec:\jppjd.exe35⤵
- Executes dropped EXE
PID:964 -
\??\c:\rfrlffx.exec:\rfrlffx.exe36⤵
- Executes dropped EXE
PID:4208 -
\??\c:\3fxxrrl.exec:\3fxxrrl.exe37⤵
- Executes dropped EXE
PID:3412 -
\??\c:\ntnnnn.exec:\ntnnnn.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9jdvj.exec:\9jdvj.exe39⤵
- Executes dropped EXE
PID:3344 -
\??\c:\vpppp.exec:\vpppp.exe40⤵
- Executes dropped EXE
PID:680 -
\??\c:\rfllxrr.exec:\rfllxrr.exe41⤵
- Executes dropped EXE
PID:3728 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe42⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hhnbtt.exec:\hhnbtt.exe43⤵
- Executes dropped EXE
PID:1888 -
\??\c:\9ttnbt.exec:\9ttnbt.exe44⤵
- Executes dropped EXE
PID:4308 -
\??\c:\ddvvv.exec:\ddvvv.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdjdd.exec:\jdjdd.exe46⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rlfxffx.exec:\rlfxffx.exe47⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe48⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tntntt.exec:\tntntt.exe49⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hbhhtt.exec:\hbhhtt.exe50⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vvjdp.exec:\vvjdp.exe51⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rlxrllf.exec:\rlxrllf.exe52⤵
- Executes dropped EXE
PID:3772 -
\??\c:\btbbnn.exec:\btbbnn.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jjdpd.exec:\jjdpd.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vjpvp.exec:\vjpvp.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jvppd.exec:\jvppd.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lfflxxl.exec:\lfflxxl.exe57⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\5hbnhh.exec:\5hbnhh.exe59⤵
- Executes dropped EXE
PID:812 -
\??\c:\pvddp.exec:\pvddp.exe60⤵
- Executes dropped EXE
PID:4040 -
\??\c:\dvvjv.exec:\dvvjv.exe61⤵
- Executes dropped EXE
PID:3908 -
\??\c:\lflfxff.exec:\lflfxff.exe62⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bbbtbn.exec:\bbbtbn.exe63⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ppvdv.exec:\ppvdv.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vjjdv.exec:\vjjdv.exe65⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jdjdv.exec:\jdjdv.exe66⤵PID:3556
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe67⤵PID:4688
-
\??\c:\lfflllx.exec:\lfflllx.exe68⤵PID:4588
-
\??\c:\httnhb.exec:\httnhb.exe69⤵PID:3264
-
\??\c:\hnnnbb.exec:\hnnnbb.exe70⤵PID:1420
-
\??\c:\9dvpp.exec:\9dvpp.exe71⤵PID:768
-
\??\c:\dvpjv.exec:\dvpjv.exe72⤵PID:1152
-
\??\c:\7vdvv.exec:\7vdvv.exe73⤵PID:3012
-
\??\c:\xlrlffx.exec:\xlrlffx.exe74⤵PID:2248
-
\??\c:\llrlffx.exec:\llrlffx.exe75⤵PID:3244
-
\??\c:\bbbhhb.exec:\bbbhhb.exe76⤵PID:2736
-
\??\c:\nbhbbb.exec:\nbhbbb.exe77⤵PID:3640
-
\??\c:\jdjjj.exec:\jdjjj.exe78⤵PID:4596
-
\??\c:\pjdvj.exec:\pjdvj.exe79⤵PID:3328
-
\??\c:\frrfffx.exec:\frrfffx.exe80⤵PID:2012
-
\??\c:\3lllflf.exec:\3lllflf.exe81⤵PID:1988
-
\??\c:\3nthbn.exec:\3nthbn.exe82⤵PID:1796
-
\??\c:\bthhtn.exec:\bthhtn.exe83⤵PID:4724
-
\??\c:\jdjjv.exec:\jdjjv.exe84⤵PID:2340
-
\??\c:\dddvj.exec:\dddvj.exe85⤵PID:1740
-
\??\c:\xxfxrlr.exec:\xxfxrlr.exe86⤵PID:2656
-
\??\c:\3ffxrlf.exec:\3ffxrlf.exe87⤵PID:2500
-
\??\c:\nhtbtb.exec:\nhtbtb.exe88⤵PID:4212
-
\??\c:\nhnntt.exec:\nhnntt.exe89⤵PID:1076
-
\??\c:\ddjvj.exec:\ddjvj.exe90⤵PID:3820
-
\??\c:\jvjdd.exec:\jvjdd.exe91⤵PID:2928
-
\??\c:\xffxrfr.exec:\xffxrfr.exe92⤵PID:3320
-
\??\c:\hhhhhh.exec:\hhhhhh.exe93⤵PID:2472
-
\??\c:\ddjdv.exec:\ddjdv.exe94⤵PID:4388
-
\??\c:\djvvv.exec:\djvvv.exe95⤵PID:4896
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe96⤵PID:4904
-
\??\c:\nhhbtt.exec:\nhhbtt.exe97⤵PID:4696
-
\??\c:\9htnnn.exec:\9htnnn.exe98⤵PID:4520
-
\??\c:\pdddp.exec:\pdddp.exe99⤵PID:4324
-
\??\c:\vvddd.exec:\vvddd.exe100⤵PID:4528
-
\??\c:\xxffrlx.exec:\xxffrlx.exe101⤵PID:5112
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe102⤵PID:4084
-
\??\c:\bnbnnb.exec:\bnbnnb.exe103⤵PID:4948
-
\??\c:\bthbtt.exec:\bthbtt.exe104⤵PID:5096
-
\??\c:\pdjpj.exec:\pdjpj.exe105⤵PID:712
-
\??\c:\ddjvv.exec:\ddjvv.exe106⤵PID:3000
-
\??\c:\vppdp.exec:\vppdp.exe107⤵PID:3292
-
\??\c:\rffxrrx.exec:\rffxrrx.exe108⤵PID:3248
-
\??\c:\llrlffx.exec:\llrlffx.exe109⤵PID:2304
-
\??\c:\3nnnbt.exec:\3nnnbt.exe110⤵PID:3056
-
\??\c:\nhbthb.exec:\nhbthb.exe111⤵PID:2396
-
\??\c:\9jdvj.exec:\9jdvj.exe112⤵PID:3008
-
\??\c:\vvdpj.exec:\vvdpj.exe113⤵PID:3556
-
\??\c:\vjdjv.exec:\vjdjv.exe114⤵PID:4688
-
\??\c:\ffffrxr.exec:\ffffrxr.exe115⤵PID:4588
-
\??\c:\7lrrffx.exec:\7lrrffx.exe116⤵PID:3988
-
\??\c:\tnttbt.exec:\tnttbt.exe117⤵PID:1624
-
\??\c:\vjpjv.exec:\vjpjv.exe118⤵PID:3348
-
\??\c:\5vpdv.exec:\5vpdv.exe119⤵PID:4460
-
\??\c:\3lrlflf.exec:\3lrlflf.exe120⤵PID:3580
-
\??\c:\fxrrrxr.exec:\fxrrrxr.exe121⤵PID:3228
-
\??\c:\lxrrllf.exec:\lxrrllf.exe122⤵PID:1032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-