Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe
-
Size
125KB
-
MD5
1128b026863c6de50b8bbe24c5eb5855
-
SHA1
7e379d733b3996c276e207553baee9612cc755e3
-
SHA256
527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309
-
SHA512
2e8054abc187f0b8c5b94e4ece538d6dc111d8c5c61c443cc38e5eb0fb748e8c4d4f4ae6df1df2bbd7224959404fd68a0ee2b5731bd8d5a5210156db7ead7119
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0NgVyFsZq:ymb3NkkiQ3mdBjFo73HUoMsAbrxVBc
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2412-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 35 IoCs
resource yara_rule behavioral2/memory/2412-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3608-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1932-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1932-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2476-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1932-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4324-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4160-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4160-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4160-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4160-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4392-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2296-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4132-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4604-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2312-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4388-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1552-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4916-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1948-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3608 xflfxlf.exe 1932 nhbnbn.exe 2476 vvdjj.exe 4952 1frlxrl.exe 4324 rflxlfr.exe 4160 nhtbnh.exe 3468 5jdvd.exe 1948 xlxrlfx.exe 2984 5xxlxfr.exe 3136 nbnbnh.exe 4392 hhtthh.exe 1432 vvjjv.exe 220 5xrfrlr.exe 4916 rxxrrlf.exe 1784 thnbtt.exe 2296 hnhhtn.exe 4132 dpppj.exe 4604 dvjjp.exe 404 rffllfl.exe 4932 fxrrfrr.exe 2312 thbbtb.exe 3840 tnhthb.exe 4860 jvdpv.exe 1168 lxfrffx.exe 2764 9ffrfxf.exe 848 9tnhtn.exe 2116 1bhtnt.exe 1496 vdpvp.exe 4684 3vjvj.exe 1552 lfxrfxr.exe 4388 htnhtn.exe 368 1bbnnh.exe 684 jdvpj.exe 464 jpvpj.exe 2884 frlxlfr.exe 1060 fllxlfr.exe 3852 hnnbtn.exe 3040 bbtbtn.exe 2592 vppdj.exe 1508 djpvj.exe 3684 5rlrlxl.exe 2104 frlxxxx.exe 4440 ntbnbb.exe 2732 9hhnht.exe 4644 pppdv.exe 4080 lxfxfxr.exe 1072 lfxlfxl.exe 408 nbbnbt.exe 3088 pdvjv.exe 220 ddjjp.exe 2536 3llxllx.exe 2792 nhbnnh.exe 2856 nnnbth.exe 3672 vjvdp.exe 2852 3rlxlfr.exe 4604 3rlfxrl.exe 4312 hbtnnh.exe 5020 9htnbh.exe 1680 pjdvd.exe 380 3rrlfxl.exe 856 fxxxlfr.exe 3840 9ttnnh.exe 2692 tthhhn.exe 3784 pjdpj.exe -
resource yara_rule behavioral2/memory/2412-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-66-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 3608 2412 527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe 85 PID 2412 wrote to memory of 3608 2412 527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe 85 PID 2412 wrote to memory of 3608 2412 527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe 85 PID 3608 wrote to memory of 1932 3608 xflfxlf.exe 86 PID 3608 wrote to memory of 1932 3608 xflfxlf.exe 86 PID 3608 wrote to memory of 1932 3608 xflfxlf.exe 86 PID 1932 wrote to memory of 2476 1932 nhbnbn.exe 87 PID 1932 wrote to memory of 2476 1932 nhbnbn.exe 87 PID 1932 wrote to memory of 2476 1932 nhbnbn.exe 87 PID 2476 wrote to memory of 4952 2476 vvdjj.exe 88 PID 2476 wrote to memory of 4952 2476 vvdjj.exe 88 PID 2476 wrote to memory of 4952 2476 vvdjj.exe 88 PID 4952 wrote to memory of 4324 4952 1frlxrl.exe 89 PID 4952 wrote to memory of 4324 4952 1frlxrl.exe 89 PID 4952 wrote to memory of 4324 4952 1frlxrl.exe 89 PID 4324 wrote to memory of 4160 4324 rflxlfr.exe 90 PID 4324 wrote to memory of 4160 4324 rflxlfr.exe 90 PID 4324 wrote to memory of 4160 4324 rflxlfr.exe 90 PID 4160 wrote to memory of 3468 4160 nhtbnh.exe 91 PID 4160 wrote to memory of 3468 4160 nhtbnh.exe 91 PID 4160 wrote to memory of 3468 4160 nhtbnh.exe 91 PID 3468 wrote to memory of 1948 3468 5jdvd.exe 92 PID 3468 wrote to memory of 1948 3468 5jdvd.exe 92 PID 3468 wrote to memory of 1948 3468 5jdvd.exe 92 PID 1948 wrote to memory of 2984 1948 xlxrlfx.exe 93 PID 1948 wrote to memory of 2984 1948 xlxrlfx.exe 93 PID 1948 wrote to memory of 2984 1948 xlxrlfx.exe 93 PID 2984 wrote to memory of 3136 2984 5xxlxfr.exe 94 PID 2984 wrote to memory of 3136 2984 5xxlxfr.exe 94 PID 2984 wrote to memory of 3136 2984 5xxlxfr.exe 94 PID 3136 wrote to memory of 4392 3136 nbnbnh.exe 95 PID 3136 wrote to memory of 4392 3136 nbnbnh.exe 95 PID 3136 wrote to memory of 4392 3136 nbnbnh.exe 95 PID 4392 wrote to memory of 1432 4392 hhtthh.exe 96 PID 4392 wrote to memory of 1432 4392 hhtthh.exe 96 PID 4392 wrote to memory of 1432 4392 hhtthh.exe 96 PID 1432 wrote to memory of 220 1432 vvjjv.exe 137 PID 1432 wrote to memory of 220 1432 vvjjv.exe 137 PID 1432 wrote to memory of 220 1432 vvjjv.exe 137 PID 220 wrote to memory of 4916 220 5xrfrlr.exe 98 PID 220 wrote to memory of 4916 220 5xrfrlr.exe 98 PID 220 wrote to memory of 4916 220 5xrfrlr.exe 98 PID 4916 wrote to memory of 1784 4916 rxxrrlf.exe 99 PID 4916 wrote to memory of 1784 4916 rxxrrlf.exe 99 PID 4916 wrote to memory of 1784 4916 rxxrrlf.exe 99 PID 1784 wrote to memory of 2296 1784 thnbtt.exe 101 PID 1784 wrote to memory of 2296 1784 thnbtt.exe 101 PID 1784 wrote to memory of 2296 1784 thnbtt.exe 101 PID 2296 wrote to memory of 4132 2296 hnhhtn.exe 102 PID 2296 wrote to memory of 4132 2296 hnhhtn.exe 102 PID 2296 wrote to memory of 4132 2296 hnhhtn.exe 102 PID 4132 wrote to memory of 4604 4132 dpppj.exe 143 PID 4132 wrote to memory of 4604 4132 dpppj.exe 143 PID 4132 wrote to memory of 4604 4132 dpppj.exe 143 PID 4604 wrote to memory of 404 4604 dvjjp.exe 105 PID 4604 wrote to memory of 404 4604 dvjjp.exe 105 PID 4604 wrote to memory of 404 4604 dvjjp.exe 105 PID 404 wrote to memory of 4932 404 rffllfl.exe 106 PID 404 wrote to memory of 4932 404 rffllfl.exe 106 PID 404 wrote to memory of 4932 404 rffllfl.exe 106 PID 4932 wrote to memory of 2312 4932 fxrrfrr.exe 107 PID 4932 wrote to memory of 2312 4932 fxrrfrr.exe 107 PID 4932 wrote to memory of 2312 4932 fxrrfrr.exe 107 PID 2312 wrote to memory of 3840 2312 thbbtb.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe"C:\Users\Admin\AppData\Local\Temp\527a9a708007ddea3f39606f236aa202bd9b47ac39d5ee3f47c86d31f6b56309.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xflfxlf.exec:\xflfxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\nhbnbn.exec:\nhbnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\vvdjj.exec:\vvdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\1frlxrl.exec:\1frlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rflxlfr.exec:\rflxlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\nhtbnh.exec:\nhtbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\5jdvd.exec:\5jdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\5xxlxfr.exec:\5xxlxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\nbnbnh.exec:\nbnbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\hhtthh.exec:\hhtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\vvjjv.exec:\vvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\5xrfrlr.exec:\5xrfrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\thnbtt.exec:\thnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\hnhhtn.exec:\hnhhtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dpppj.exec:\dpppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\dvjjp.exec:\dvjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\rffllfl.exec:\rffllfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\fxrrfrr.exec:\fxrrfrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\thbbtb.exec:\thbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\tnhthb.exec:\tnhthb.exe23⤵
- Executes dropped EXE
PID:3840 -
\??\c:\jvdpv.exec:\jvdpv.exe24⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lxfrffx.exec:\lxfrffx.exe25⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9ffrfxf.exec:\9ffrfxf.exe26⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9tnhtn.exec:\9tnhtn.exe27⤵
- Executes dropped EXE
PID:848 -
\??\c:\1bhtnt.exec:\1bhtnt.exe28⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vdpvp.exec:\vdpvp.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3vjvj.exec:\3vjvj.exe30⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe31⤵
- Executes dropped EXE
PID:1552 -
\??\c:\htnhtn.exec:\htnhtn.exe32⤵
- Executes dropped EXE
PID:4388 -
\??\c:\1bbnnh.exec:\1bbnnh.exe33⤵
- Executes dropped EXE
PID:368 -
\??\c:\jdvpj.exec:\jdvpj.exe34⤵
- Executes dropped EXE
PID:684 -
\??\c:\jpvpj.exec:\jpvpj.exe35⤵
- Executes dropped EXE
PID:464 -
\??\c:\frlxlfr.exec:\frlxlfr.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fllxlfr.exec:\fllxlfr.exe37⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hnnbtn.exec:\hnnbtn.exe38⤵
- Executes dropped EXE
PID:3852 -
\??\c:\bbtbtn.exec:\bbtbtn.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vppdj.exec:\vppdj.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\djpvj.exec:\djpvj.exe41⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5rlrlxl.exec:\5rlrlxl.exe42⤵
- Executes dropped EXE
PID:3684 -
\??\c:\frlxxxx.exec:\frlxxxx.exe43⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ntbnbb.exec:\ntbnbb.exe44⤵
- Executes dropped EXE
PID:4440 -
\??\c:\9hhnht.exec:\9hhnht.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pppdv.exec:\pppdv.exe46⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe47⤵
- Executes dropped EXE
PID:4080 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nbbnbt.exec:\nbbnbt.exe49⤵
- Executes dropped EXE
PID:408 -
\??\c:\pdvjv.exec:\pdvjv.exe50⤵
- Executes dropped EXE
PID:3088 -
\??\c:\ddjjp.exec:\ddjjp.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\3llxllx.exec:\3llxllx.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhbnnh.exec:\nhbnnh.exe53⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nnnbth.exec:\nnnbth.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vjvdp.exec:\vjvdp.exe55⤵
- Executes dropped EXE
PID:3672 -
\??\c:\3rlxlfr.exec:\3rlxlfr.exe56⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3rlfxrl.exec:\3rlfxrl.exe57⤵
- Executes dropped EXE
PID:4604 -
\??\c:\hbtnnh.exec:\hbtnnh.exe58⤵
- Executes dropped EXE
PID:4312 -
\??\c:\9htnbh.exec:\9htnbh.exe59⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pjdvd.exec:\pjdvd.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\3rrlfxl.exec:\3rrlfxl.exe61⤵
- Executes dropped EXE
PID:380 -
\??\c:\fxxxlfr.exec:\fxxxlfr.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\9ttnnh.exec:\9ttnnh.exe63⤵
- Executes dropped EXE
PID:3840 -
\??\c:\tthhhn.exec:\tthhhn.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjdpj.exec:\pjdpj.exe65⤵
- Executes dropped EXE
PID:3784 -
\??\c:\flfrfxl.exec:\flfrfxl.exe66⤵PID:436
-
\??\c:\lrfxlfr.exec:\lrfxlfr.exe67⤵PID:2408
-
\??\c:\nnhthb.exec:\nnhthb.exe68⤵PID:5072
-
\??\c:\1ppjv.exec:\1ppjv.exe69⤵PID:2116
-
\??\c:\ddjpd.exec:\ddjpd.exe70⤵PID:2164
-
\??\c:\lllxfxl.exec:\lllxfxl.exe71⤵PID:4496
-
\??\c:\ttbnbt.exec:\ttbnbt.exe72⤵PID:1004
-
\??\c:\7pdvj.exec:\7pdvj.exe73⤵PID:4852
-
\??\c:\lllrxxl.exec:\lllrxxl.exe74⤵PID:3912
-
\??\c:\bhnhtn.exec:\bhnhtn.exe75⤵PID:3888
-
\??\c:\vvpjv.exec:\vvpjv.exe76⤵PID:2384
-
\??\c:\5pjvp.exec:\5pjvp.exe77⤵PID:1704
-
\??\c:\xfrlxlx.exec:\xfrlxlx.exe78⤵PID:4944
-
\??\c:\9bttnh.exec:\9bttnh.exe79⤵PID:4176
-
\??\c:\nhhbnh.exec:\nhhbnh.exe80⤵PID:2712
-
\??\c:\dppjv.exec:\dppjv.exe81⤵PID:1240
-
\??\c:\pppdd.exec:\pppdd.exe82⤵PID:2796
-
\??\c:\9rrlrlf.exec:\9rrlrlf.exe83⤵PID:4972
-
\??\c:\tnhnbn.exec:\tnhnbn.exe84⤵PID:3436
-
\??\c:\pdvdp.exec:\pdvdp.exe85⤵PID:1328
-
\??\c:\7rfrflx.exec:\7rfrflx.exe86⤵PID:2104
-
\??\c:\7nbtnh.exec:\7nbtnh.exe87⤵PID:3380
-
\??\c:\jjdvd.exec:\jjdvd.exe88⤵PID:4616
-
\??\c:\jvvdv.exec:\jvvdv.exe89⤵PID:1916
-
\??\c:\rfrflfr.exec:\rfrflfr.exe90⤵PID:3060
-
\??\c:\bntnhb.exec:\bntnhb.exe91⤵PID:4128
-
\??\c:\htbnbt.exec:\htbnbt.exe92⤵PID:1620
-
\??\c:\vjvdj.exec:\vjvdj.exe93⤵PID:2396
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe94⤵PID:4448
-
\??\c:\1xrfrxr.exec:\1xrfrxr.exe95⤵PID:1828
-
\??\c:\nnnbnh.exec:\nnnbnh.exe96⤵PID:3864
-
\??\c:\vpdpp.exec:\vpdpp.exe97⤵PID:4908
-
\??\c:\5pdpd.exec:\5pdpd.exe98⤵PID:744
-
\??\c:\7xlxxrx.exec:\7xlxxrx.exe99⤵PID:3212
-
\??\c:\thbntn.exec:\thbntn.exe100⤵PID:4704
-
\??\c:\vpjpd.exec:\vpjpd.exe101⤵PID:912
-
\??\c:\rrrrflf.exec:\rrrrflf.exe102⤵PID:1680
-
\??\c:\ffflfrl.exec:\ffflfrl.exe103⤵PID:4612
-
\??\c:\bnhtbt.exec:\bnhtbt.exe104⤵PID:5084
-
\??\c:\5tthnb.exec:\5tthnb.exe105⤵PID:4108
-
\??\c:\3djdp.exec:\3djdp.exe106⤵PID:2136
-
\??\c:\xxflrff.exec:\xxflrff.exe107⤵PID:4120
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe108⤵PID:4296
-
\??\c:\7hnhhb.exec:\7hnhhb.exe109⤵PID:848
-
\??\c:\bhbntt.exec:\bhbntt.exe110⤵PID:212
-
\??\c:\djpjd.exec:\djpjd.exe111⤵PID:3652
-
\??\c:\lfxrflx.exec:\lfxrflx.exe112⤵PID:5100
-
\??\c:\xfrflxl.exec:\xfrflxl.exe113⤵PID:4684
-
\??\c:\nhhtth.exec:\nhhtth.exe114⤵PID:3288
-
\??\c:\5vpdp.exec:\5vpdp.exe115⤵PID:4396
-
\??\c:\9jvvj.exec:\9jvvj.exe116⤵PID:1676
-
\??\c:\rrffxfl.exec:\rrffxfl.exe117⤵PID:368
-
\??\c:\rfrlfxl.exec:\rfrlfxl.exe118⤵PID:2632
-
\??\c:\bthhhh.exec:\bthhhh.exe119⤵PID:3620
-
\??\c:\5jvpv.exec:\5jvpv.exe120⤵PID:4516
-
\??\c:\jdvpv.exec:\jdvpv.exe121⤵PID:1684
-
\??\c:\xffrxrl.exec:\xffrxrl.exe122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-