Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe
-
Size
78KB
-
MD5
2ad142098a4c969d4317b60c1932c948
-
SHA1
be01a69f4cb90e3e0e9d40f4e0a2696767f1621e
-
SHA256
c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3
-
SHA512
7252fcaa04fd5004e7779412b9ab62fd45d12196c6c1eba3a4e4ad935292895e2a51d19d704440e7a65d57cd1bbd5f1863a5fb6c7e856748bb1879e648151739
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJEd2arzle:ymb3NkkiQ3mdBjFI3eFC/rzA
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2312-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/2312-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1872-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3684-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1636-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1568-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/440-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/440-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2320-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1312-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5024-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1312-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/432-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2684-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2996-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1224-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3664-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4796-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3444-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3616-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3024-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2268-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1872 vvvvd.exe 3684 rrxrlrr.exe 1636 bttttt.exe 1568 1hhbbt.exe 4508 pvvjd.exe 440 dvdvj.exe 2712 5ththb.exe 2320 djjjd.exe 1312 dvvdv.exe 5024 tbhbtt.exe 436 bthbbb.exe 432 ddvpp.exe 2684 lfrlxlr.exe 1772 3nnnhh.exe 4744 vjjvv.exe 2996 jvjdj.exe 1224 rlxxxxx.exe 2204 bbhbtt.exe 3664 dvpvv.exe 888 ddppj.exe 4512 nhhbhb.exe 3288 nhtnhb.exe 4796 vpjpj.exe 3444 lfllffx.exe 4516 nnnntb.exe 3616 dpvvp.exe 2924 dpvpj.exe 3024 lrxxllf.exe 3700 5hbtbb.exe 1764 hhbtnh.exe 2268 vpddv.exe 3736 lrxrffx.exe 4444 hbbbbb.exe 116 vpjdv.exe 4980 jpvvj.exe 2856 frflrfr.exe 4048 rrxxxfx.exe 1068 hhbhhb.exe 1904 nntnhh.exe 4604 pjppj.exe 2312 jppjd.exe 4880 rfrrlrr.exe 2744 lflllll.exe 1352 thhnnh.exe 4216 vpdvj.exe 1128 ddddv.exe 916 lxrlffl.exe 5056 frfxfff.exe 3176 tnbnth.exe 1976 hhnnht.exe 4968 xxffffl.exe 1624 xlffffl.exe 4636 3rrxxxx.exe 3536 hhbbtt.exe 2488 djpjj.exe 4872 frxrrfl.exe 2776 7fxfffx.exe 5104 ntbbtb.exe 3952 9pjjd.exe 1224 pppvv.exe 5108 xxxxrxx.exe 3800 rrrrllf.exe 2688 1thtnn.exe 3880 pjddp.exe -
resource yara_rule behavioral2/memory/2312-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1872 2312 c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe 83 PID 2312 wrote to memory of 1872 2312 c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe 83 PID 2312 wrote to memory of 1872 2312 c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe 83 PID 1872 wrote to memory of 3684 1872 vvvvd.exe 84 PID 1872 wrote to memory of 3684 1872 vvvvd.exe 84 PID 1872 wrote to memory of 3684 1872 vvvvd.exe 84 PID 3684 wrote to memory of 1636 3684 rrxrlrr.exe 85 PID 3684 wrote to memory of 1636 3684 rrxrlrr.exe 85 PID 3684 wrote to memory of 1636 3684 rrxrlrr.exe 85 PID 1636 wrote to memory of 1568 1636 bttttt.exe 86 PID 1636 wrote to memory of 1568 1636 bttttt.exe 86 PID 1636 wrote to memory of 1568 1636 bttttt.exe 86 PID 1568 wrote to memory of 4508 1568 1hhbbt.exe 87 PID 1568 wrote to memory of 4508 1568 1hhbbt.exe 87 PID 1568 wrote to memory of 4508 1568 1hhbbt.exe 87 PID 4508 wrote to memory of 440 4508 pvvjd.exe 88 PID 4508 wrote to memory of 440 4508 pvvjd.exe 88 PID 4508 wrote to memory of 440 4508 pvvjd.exe 88 PID 440 wrote to memory of 2712 440 dvdvj.exe 89 PID 440 wrote to memory of 2712 440 dvdvj.exe 89 PID 440 wrote to memory of 2712 440 dvdvj.exe 89 PID 2712 wrote to memory of 2320 2712 5ththb.exe 90 PID 2712 wrote to memory of 2320 2712 5ththb.exe 90 PID 2712 wrote to memory of 2320 2712 5ththb.exe 90 PID 2320 wrote to memory of 1312 2320 djjjd.exe 91 PID 2320 wrote to memory of 1312 2320 djjjd.exe 91 PID 2320 wrote to memory of 1312 2320 djjjd.exe 91 PID 1312 wrote to memory of 5024 1312 dvvdv.exe 92 PID 1312 wrote to memory of 5024 1312 dvvdv.exe 92 PID 1312 wrote to memory of 5024 1312 dvvdv.exe 92 PID 5024 wrote to memory of 436 5024 tbhbtt.exe 93 PID 5024 wrote to memory of 436 5024 tbhbtt.exe 93 PID 5024 wrote to memory of 436 5024 tbhbtt.exe 93 PID 436 wrote to memory of 432 436 bthbbb.exe 94 PID 436 wrote to memory of 432 436 bthbbb.exe 94 PID 436 wrote to memory of 432 436 bthbbb.exe 94 PID 432 wrote to memory of 2684 432 ddvpp.exe 95 PID 432 wrote to memory of 2684 432 ddvpp.exe 95 PID 432 wrote to memory of 2684 432 ddvpp.exe 95 PID 2684 wrote to memory of 1772 2684 lfrlxlr.exe 96 PID 2684 wrote to memory of 1772 2684 lfrlxlr.exe 96 PID 2684 wrote to memory of 1772 2684 lfrlxlr.exe 96 PID 1772 wrote to memory of 4744 1772 3nnnhh.exe 97 PID 1772 wrote to memory of 4744 1772 3nnnhh.exe 97 PID 1772 wrote to memory of 4744 1772 3nnnhh.exe 97 PID 4744 wrote to memory of 2996 4744 vjjvv.exe 98 PID 4744 wrote to memory of 2996 4744 vjjvv.exe 98 PID 4744 wrote to memory of 2996 4744 vjjvv.exe 98 PID 2996 wrote to memory of 1224 2996 jvjdj.exe 99 PID 2996 wrote to memory of 1224 2996 jvjdj.exe 99 PID 2996 wrote to memory of 1224 2996 jvjdj.exe 99 PID 1224 wrote to memory of 2204 1224 rlxxxxx.exe 100 PID 1224 wrote to memory of 2204 1224 rlxxxxx.exe 100 PID 1224 wrote to memory of 2204 1224 rlxxxxx.exe 100 PID 2204 wrote to memory of 3664 2204 bbhbtt.exe 101 PID 2204 wrote to memory of 3664 2204 bbhbtt.exe 101 PID 2204 wrote to memory of 3664 2204 bbhbtt.exe 101 PID 3664 wrote to memory of 888 3664 dvpvv.exe 102 PID 3664 wrote to memory of 888 3664 dvpvv.exe 102 PID 3664 wrote to memory of 888 3664 dvpvv.exe 102 PID 888 wrote to memory of 4512 888 ddppj.exe 103 PID 888 wrote to memory of 4512 888 ddppj.exe 103 PID 888 wrote to memory of 4512 888 ddppj.exe 103 PID 4512 wrote to memory of 3288 4512 nhhbhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe"C:\Users\Admin\AppData\Local\Temp\c0f579a583852a8cff9878a122cfb6eb0eadca56f6f7c530311543d427f812a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vvvvd.exec:\vvvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\rrxrlrr.exec:\rrxrlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\bttttt.exec:\bttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\1hhbbt.exec:\1hhbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\pvvjd.exec:\pvvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\dvdvj.exec:\dvdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\5ththb.exec:\5ththb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\djjjd.exec:\djjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\dvvdv.exec:\dvvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\tbhbtt.exec:\tbhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\bthbbb.exec:\bthbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\ddvpp.exec:\ddvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\lfrlxlr.exec:\lfrlxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3nnnhh.exec:\3nnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vjjvv.exec:\vjjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\jvjdj.exec:\jvjdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\bbhbtt.exec:\bbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\dvpvv.exec:\dvpvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\ddppj.exec:\ddppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\nhhbhb.exec:\nhhbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\nhtnhb.exec:\nhtnhb.exe23⤵
- Executes dropped EXE
PID:3288 -
\??\c:\vpjpj.exec:\vpjpj.exe24⤵
- Executes dropped EXE
PID:4796 -
\??\c:\lfllffx.exec:\lfllffx.exe25⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nnnntb.exec:\nnnntb.exe26⤵
- Executes dropped EXE
PID:4516 -
\??\c:\dpvvp.exec:\dpvvp.exe27⤵
- Executes dropped EXE
PID:3616 -
\??\c:\dpvpj.exec:\dpvpj.exe28⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lrxxllf.exec:\lrxxllf.exe29⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5hbtbb.exec:\5hbtbb.exe30⤵
- Executes dropped EXE
PID:3700 -
\??\c:\hhbtnh.exec:\hhbtnh.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vpddv.exec:\vpddv.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lrxrffx.exec:\lrxrffx.exe33⤵
- Executes dropped EXE
PID:3736 -
\??\c:\hbbbbb.exec:\hbbbbb.exe34⤵
- Executes dropped EXE
PID:4444 -
\??\c:\vpjdv.exec:\vpjdv.exe35⤵
- Executes dropped EXE
PID:116 -
\??\c:\jpvvj.exec:\jpvvj.exe36⤵
- Executes dropped EXE
PID:4980 -
\??\c:\frflrfr.exec:\frflrfr.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rrxxxfx.exec:\rrxxxfx.exe38⤵
- Executes dropped EXE
PID:4048 -
\??\c:\hhbhhb.exec:\hhbhhb.exe39⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nntnhh.exec:\nntnhh.exe40⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pjppj.exec:\pjppj.exe41⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jppjd.exec:\jppjd.exe42⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe43⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lflllll.exec:\lflllll.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\thhnnh.exec:\thhnnh.exe45⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vpdvj.exec:\vpdvj.exe46⤵
- Executes dropped EXE
PID:4216 -
\??\c:\ddddv.exec:\ddddv.exe47⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lxrlffl.exec:\lxrlffl.exe48⤵
- Executes dropped EXE
PID:916 -
\??\c:\frfxfff.exec:\frfxfff.exe49⤵
- Executes dropped EXE
PID:5056 -
\??\c:\tnbnth.exec:\tnbnth.exe50⤵
- Executes dropped EXE
PID:3176 -
\??\c:\hhnnht.exec:\hhnnht.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xxffffl.exec:\xxffffl.exe52⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xlffffl.exec:\xlffffl.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3rrxxxx.exec:\3rrxxxx.exe54⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hhbbtt.exec:\hhbbtt.exe55⤵
- Executes dropped EXE
PID:3536 -
\??\c:\djpjj.exec:\djpjj.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\frxrrfl.exec:\frxrrfl.exe57⤵
- Executes dropped EXE
PID:4872 -
\??\c:\7fxfffx.exec:\7fxfffx.exe58⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ntbbtb.exec:\ntbbtb.exe59⤵
- Executes dropped EXE
PID:5104 -
\??\c:\9pjjd.exec:\9pjjd.exe60⤵
- Executes dropped EXE
PID:3952 -
\??\c:\pppvv.exec:\pppvv.exe61⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe62⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rrrrllf.exec:\rrrrllf.exe63⤵
- Executes dropped EXE
PID:3800 -
\??\c:\1thtnn.exec:\1thtnn.exe64⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjddp.exec:\pjddp.exe65⤵
- Executes dropped EXE
PID:3880 -
\??\c:\ddvpd.exec:\ddvpd.exe66⤵PID:4148
-
\??\c:\5dvpp.exec:\5dvpp.exe67⤵PID:4828
-
\??\c:\3fxxxff.exec:\3fxxxff.exe68⤵PID:4796
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe69⤵PID:968
-
\??\c:\hhtbtb.exec:\hhtbtb.exe70⤵PID:2448
-
\??\c:\tnntnt.exec:\tnntnt.exe71⤵PID:3876
-
\??\c:\djdjj.exec:\djdjj.exe72⤵PID:2828
-
\??\c:\vjdvp.exec:\vjdvp.exe73⤵PID:3668
-
\??\c:\rffrllr.exec:\rffrllr.exe74⤵PID:4428
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe75⤵PID:540
-
\??\c:\nbhhhh.exec:\nbhhhh.exe76⤵PID:4724
-
\??\c:\5bbbth.exec:\5bbbth.exe77⤵PID:1844
-
\??\c:\jjpvp.exec:\jjpvp.exe78⤵PID:1056
-
\??\c:\vvvpp.exec:\vvvpp.exe79⤵PID:3736
-
\??\c:\9vvpp.exec:\9vvpp.exe80⤵PID:2796
-
\??\c:\lllfxxx.exec:\lllfxxx.exe81⤵PID:3724
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe82⤵PID:4980
-
\??\c:\3bhbbt.exec:\3bhbbt.exe83⤵PID:3604
-
\??\c:\tbbthn.exec:\tbbthn.exe84⤵PID:4380
-
\??\c:\pppdv.exec:\pppdv.exe85⤵PID:4288
-
\??\c:\ppvvp.exec:\ppvvp.exe86⤵PID:4296
-
\??\c:\lffxrrl.exec:\lffxrrl.exe87⤵PID:3244
-
\??\c:\bnhbtt.exec:\bnhbtt.exe88⤵PID:3120
-
\??\c:\pjvpp.exec:\pjvpp.exe89⤵PID:2084
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe90⤵PID:4008
-
\??\c:\rfxffxr.exec:\rfxffxr.exe91⤵PID:3936
-
\??\c:\bbhhbn.exec:\bbhhbn.exe92⤵PID:704
-
\??\c:\pppjd.exec:\pppjd.exe93⤵PID:3172
-
\??\c:\jdjdv.exec:\jdjdv.exe94⤵PID:2024
-
\??\c:\9lrrrlr.exec:\9lrrrlr.exe95⤵PID:2320
-
\??\c:\llrxxxf.exec:\llrxxxf.exe96⤵PID:224
-
\??\c:\hhhnnn.exec:\hhhnnn.exe97⤵PID:1312
-
\??\c:\jdpjp.exec:\jdpjp.exe98⤵PID:2248
-
\??\c:\9lfxxxl.exec:\9lfxxxl.exe99⤵PID:1124
-
\??\c:\nbtnbt.exec:\nbtnbt.exe100⤵PID:2488
-
\??\c:\tnbtnb.exec:\tnbtnb.exe101⤵PID:4812
-
\??\c:\ppvdv.exec:\ppvdv.exe102⤵PID:764
-
\??\c:\pvppp.exec:\pvppp.exe103⤵PID:1340
-
\??\c:\9xxxxff.exec:\9xxxxff.exe104⤵PID:368
-
\??\c:\xllllll.exec:\xllllll.exe105⤵PID:2012
-
\??\c:\hnbttt.exec:\hnbttt.exe106⤵PID:3904
-
\??\c:\nbtnhh.exec:\nbtnhh.exe107⤵PID:1192
-
\??\c:\pjpjj.exec:\pjpjj.exe108⤵PID:1572
-
\??\c:\lxlrlrr.exec:\lxlrlrr.exe109⤵PID:3292
-
\??\c:\ffffxff.exec:\ffffxff.exe110⤵PID:4148
-
\??\c:\5hnnnn.exec:\5hnnnn.exe111⤵PID:4828
-
\??\c:\1bbthh.exec:\1bbthh.exe112⤵PID:3656
-
\??\c:\bbnbtb.exec:\bbnbtb.exe113⤵PID:4808
-
\??\c:\jjjdd.exec:\jjjdd.exe114⤵PID:3616
-
\??\c:\vddvv.exec:\vddvv.exe115⤵PID:2924
-
\??\c:\xxfrfxl.exec:\xxfrfxl.exe116⤵PID:548
-
\??\c:\thnttb.exec:\thnttb.exe117⤵PID:776
-
\??\c:\ttnnnt.exec:\ttnnnt.exe118⤵PID:2888
-
\??\c:\nnhhth.exec:\nnhhth.exe119⤵PID:4724
-
\??\c:\dvvvv.exec:\dvvvv.exe120⤵PID:3236
-
\??\c:\djdvv.exec:\djdvv.exe121⤵PID:3488
-
\??\c:\lflflll.exec:\lflflll.exe122⤵PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-