Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe
-
Size
66KB
-
MD5
a55eb07619918ae5d33b80a48e378d92
-
SHA1
1c467a58b76d727113de3f4a13809eceae87cd9b
-
SHA256
462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93
-
SHA512
0628c9186efba7cd11c50c56ae6208c5f197e8a0b55eb1a86e0a5a508483da53576302a25679958783488518242b8e806edd6f83a15b7eecfbf41042977944ee
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIw:ymb3NkkiQ3mdBjFIFdJ8b2
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1936-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/632-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2800-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1140-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/988-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3220-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3384-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2532-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4552-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3660-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3656-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2440-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1192-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1628-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4396-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/636-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1016-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4180-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3504-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2468-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/756-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2064 dvvpj.exe 1940 htthtb.exe 1936 btbthb.exe 632 vjvjd.exe 2800 7rlxlfr.exe 1140 nttnhn.exe 228 9nnthh.exe 4344 5dvpj.exe 988 5flllrx.exe 3220 ttnhbb.exe 4836 tnnhtt.exe 3804 jjdvp.exe 3384 fxrlxxl.exe 2532 9hbtnh.exe 4552 jjdvp.exe 3660 ppvvv.exe 3656 fxrfxfl.exe 2440 hbbttn.exe 1192 dvvjd.exe 1628 lfrlllr.exe 4396 5bhbnn.exe 636 nhbthh.exe 3180 pdpvp.exe 4576 rllxlfx.exe 1016 thhbnb.exe 4180 vdpdj.exe 3504 jvddd.exe 2468 3ffrlfx.exe 756 hnnnth.exe 1420 jvpvv.exe 2812 9xxrlfx.exe 3856 tbhbhh.exe 4800 ddjjj.exe 1744 xlllxlf.exe 1028 hbbbtt.exe 1288 ntttbb.exe 544 jppjd.exe 2476 lrxxrxf.exe 4332 hthhbb.exe 2572 vpvpp.exe 2768 pjvpj.exe 1796 xxlxxlx.exe 1320 1nthbt.exe 2044 7dvpd.exe 2528 5lxrlrf.exe 216 ffxrrrl.exe 4928 hbhbbb.exe 1912 hnhbbt.exe 4344 dvpjj.exe 904 9rrlxrl.exe 4024 tntbnb.exe 3976 jpjdv.exe 3236 pjddv.exe 844 rlxxlrx.exe 1044 nbbbtt.exe 2316 9vjpd.exe 4548 xlrxllr.exe 1972 xffrfrl.exe 3660 5btttn.exe 4580 ddddp.exe 4772 rflfxrl.exe 2400 5xfxrxr.exe 1192 htntbn.exe 3388 dvpdv.exe -
resource yara_rule behavioral2/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2064 2352 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 82 PID 2352 wrote to memory of 2064 2352 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 82 PID 2352 wrote to memory of 2064 2352 462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe 82 PID 2064 wrote to memory of 1940 2064 dvvpj.exe 83 PID 2064 wrote to memory of 1940 2064 dvvpj.exe 83 PID 2064 wrote to memory of 1940 2064 dvvpj.exe 83 PID 1940 wrote to memory of 1936 1940 htthtb.exe 84 PID 1940 wrote to memory of 1936 1940 htthtb.exe 84 PID 1940 wrote to memory of 1936 1940 htthtb.exe 84 PID 1936 wrote to memory of 632 1936 btbthb.exe 85 PID 1936 wrote to memory of 632 1936 btbthb.exe 85 PID 1936 wrote to memory of 632 1936 btbthb.exe 85 PID 632 wrote to memory of 2800 632 vjvjd.exe 86 PID 632 wrote to memory of 2800 632 vjvjd.exe 86 PID 632 wrote to memory of 2800 632 vjvjd.exe 86 PID 2800 wrote to memory of 1140 2800 7rlxlfr.exe 87 PID 2800 wrote to memory of 1140 2800 7rlxlfr.exe 87 PID 2800 wrote to memory of 1140 2800 7rlxlfr.exe 87 PID 1140 wrote to memory of 228 1140 nttnhn.exe 88 PID 1140 wrote to memory of 228 1140 nttnhn.exe 88 PID 1140 wrote to memory of 228 1140 nttnhn.exe 88 PID 228 wrote to memory of 4344 228 9nnthh.exe 89 PID 228 wrote to memory of 4344 228 9nnthh.exe 89 PID 228 wrote to memory of 4344 228 9nnthh.exe 89 PID 4344 wrote to memory of 988 4344 5dvpj.exe 90 PID 4344 wrote to memory of 988 4344 5dvpj.exe 90 PID 4344 wrote to memory of 988 4344 5dvpj.exe 90 PID 988 wrote to memory of 3220 988 5flllrx.exe 91 PID 988 wrote to memory of 3220 988 5flllrx.exe 91 PID 988 wrote to memory of 3220 988 5flllrx.exe 91 PID 3220 wrote to memory of 4836 3220 ttnhbb.exe 92 PID 3220 wrote to memory of 4836 3220 ttnhbb.exe 92 PID 3220 wrote to memory of 4836 3220 ttnhbb.exe 92 PID 4836 wrote to memory of 3804 4836 tnnhtt.exe 93 PID 4836 wrote to memory of 3804 4836 tnnhtt.exe 93 PID 4836 wrote to memory of 3804 4836 tnnhtt.exe 93 PID 3804 wrote to memory of 3384 3804 jjdvp.exe 94 PID 3804 wrote to memory of 3384 3804 jjdvp.exe 94 PID 3804 wrote to memory of 3384 3804 jjdvp.exe 94 PID 3384 wrote to memory of 2532 3384 fxrlxxl.exe 95 PID 3384 wrote to memory of 2532 3384 fxrlxxl.exe 95 PID 3384 wrote to memory of 2532 3384 fxrlxxl.exe 95 PID 2532 wrote to memory of 4552 2532 9hbtnh.exe 96 PID 2532 wrote to memory of 4552 2532 9hbtnh.exe 96 PID 2532 wrote to memory of 4552 2532 9hbtnh.exe 96 PID 4552 wrote to memory of 3660 4552 jjdvp.exe 97 PID 4552 wrote to memory of 3660 4552 jjdvp.exe 97 PID 4552 wrote to memory of 3660 4552 jjdvp.exe 97 PID 3660 wrote to memory of 3656 3660 ppvvv.exe 98 PID 3660 wrote to memory of 3656 3660 ppvvv.exe 98 PID 3660 wrote to memory of 3656 3660 ppvvv.exe 98 PID 3656 wrote to memory of 2440 3656 fxrfxfl.exe 99 PID 3656 wrote to memory of 2440 3656 fxrfxfl.exe 99 PID 3656 wrote to memory of 2440 3656 fxrfxfl.exe 99 PID 2440 wrote to memory of 1192 2440 hbbttn.exe 100 PID 2440 wrote to memory of 1192 2440 hbbttn.exe 100 PID 2440 wrote to memory of 1192 2440 hbbttn.exe 100 PID 1192 wrote to memory of 1628 1192 dvvjd.exe 101 PID 1192 wrote to memory of 1628 1192 dvvjd.exe 101 PID 1192 wrote to memory of 1628 1192 dvvjd.exe 101 PID 1628 wrote to memory of 4396 1628 lfrlllr.exe 102 PID 1628 wrote to memory of 4396 1628 lfrlllr.exe 102 PID 1628 wrote to memory of 4396 1628 lfrlllr.exe 102 PID 4396 wrote to memory of 636 4396 5bhbnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe"C:\Users\Admin\AppData\Local\Temp\462d1e637a22fe5999b11eeee8a1967ff0b6681f16d5b5e49bfca89502352f93.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dvvpj.exec:\dvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\htthtb.exec:\htthtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\btbthb.exec:\btbthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vjvjd.exec:\vjvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\7rlxlfr.exec:\7rlxlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nttnhn.exec:\nttnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\9nnthh.exec:\9nnthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\5dvpj.exec:\5dvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\5flllrx.exec:\5flllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\ttnhbb.exec:\ttnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\tnnhtt.exec:\tnnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\jjdvp.exec:\jjdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\9hbtnh.exec:\9hbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjdvp.exec:\jjdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\ppvvv.exec:\ppvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\hbbttn.exec:\hbbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\dvvjd.exec:\dvvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\lfrlllr.exec:\lfrlllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5bhbnn.exec:\5bhbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\nhbthh.exec:\nhbthh.exe23⤵
- Executes dropped EXE
PID:636 -
\??\c:\pdpvp.exec:\pdpvp.exe24⤵
- Executes dropped EXE
PID:3180 -
\??\c:\rllxlfx.exec:\rllxlfx.exe25⤵
- Executes dropped EXE
PID:4576 -
\??\c:\thhbnb.exec:\thhbnb.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vdpdj.exec:\vdpdj.exe27⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jvddd.exec:\jvddd.exe28⤵
- Executes dropped EXE
PID:3504 -
\??\c:\3ffrlfx.exec:\3ffrlfx.exe29⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hnnnth.exec:\hnnnth.exe30⤵
- Executes dropped EXE
PID:756 -
\??\c:\jvpvv.exec:\jvpvv.exe31⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9xxrlfx.exec:\9xxrlfx.exe32⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tbhbhh.exec:\tbhbhh.exe33⤵
- Executes dropped EXE
PID:3856 -
\??\c:\ddjjj.exec:\ddjjj.exe34⤵
- Executes dropped EXE
PID:4800 -
\??\c:\xlllxlf.exec:\xlllxlf.exe35⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hbbbtt.exec:\hbbbtt.exe36⤵
- Executes dropped EXE
PID:1028 -
\??\c:\ntttbb.exec:\ntttbb.exe37⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jppjd.exec:\jppjd.exe38⤵
- Executes dropped EXE
PID:544 -
\??\c:\lrxxrxf.exec:\lrxxrxf.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hthhbb.exec:\hthhbb.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\vpvpp.exec:\vpvpp.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pjvpj.exec:\pjvpj.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xxlxxlx.exec:\xxlxxlx.exe43⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1nthbt.exec:\1nthbt.exe44⤵
- Executes dropped EXE
PID:1320 -
\??\c:\7dvpd.exec:\7dvpd.exe45⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5lxrlrf.exec:\5lxrlrf.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe47⤵
- Executes dropped EXE
PID:216 -
\??\c:\hbhbbb.exec:\hbhbbb.exe48⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hnhbbt.exec:\hnhbbt.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvpjj.exec:\dvpjj.exe50⤵
- Executes dropped EXE
PID:4344 -
\??\c:\9rrlxrl.exec:\9rrlxrl.exe51⤵
- Executes dropped EXE
PID:904 -
\??\c:\tntbnb.exec:\tntbnb.exe52⤵
- Executes dropped EXE
PID:4024 -
\??\c:\jpjdv.exec:\jpjdv.exe53⤵
- Executes dropped EXE
PID:3976 -
\??\c:\pjddv.exec:\pjddv.exe54⤵
- Executes dropped EXE
PID:3236 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\nbbbtt.exec:\nbbbtt.exe56⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9vjpd.exec:\9vjpd.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xlrxllr.exec:\xlrxllr.exe58⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xffrfrl.exec:\xffrfrl.exe59⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5btttn.exec:\5btttn.exe60⤵
- Executes dropped EXE
PID:3660 -
\??\c:\ddddp.exec:\ddddp.exe61⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rflfxrl.exec:\rflfxrl.exe62⤵
- Executes dropped EXE
PID:4772 -
\??\c:\5xfxrxr.exec:\5xfxrxr.exe63⤵
- Executes dropped EXE
PID:2400 -
\??\c:\htntbn.exec:\htntbn.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvpdv.exec:\dvpdv.exe65⤵
- Executes dropped EXE
PID:3388 -
\??\c:\1rlfllr.exec:\1rlfllr.exe66⤵PID:4396
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe67⤵PID:4992
-
\??\c:\bbbthn.exec:\bbbthn.exe68⤵PID:4468
-
\??\c:\3btnbb.exec:\3btnbb.exe69⤵PID:4272
-
\??\c:\1pdvp.exec:\1pdvp.exe70⤵PID:3152
-
\??\c:\vpjdj.exec:\vpjdj.exe71⤵PID:1168
-
\??\c:\hnbttt.exec:\hnbttt.exe72⤵PID:3668
-
\??\c:\tnthbt.exec:\tnthbt.exe73⤵PID:2364
-
\??\c:\5vjjd.exec:\5vjjd.exe74⤵PID:1440
-
\??\c:\pdjdv.exec:\pdjdv.exe75⤵PID:4588
-
\??\c:\xfxlxxr.exec:\xfxlxxr.exe76⤵PID:756
-
\??\c:\thhhnn.exec:\thhhnn.exe77⤵PID:1420
-
\??\c:\nhtnbt.exec:\nhtnbt.exe78⤵PID:2812
-
\??\c:\jdvpj.exec:\jdvpj.exe79⤵PID:3356
-
\??\c:\jdvvp.exec:\jdvvp.exe80⤵PID:1528
-
\??\c:\frrfrxr.exec:\frrfrxr.exe81⤵PID:840
-
\??\c:\1ntthb.exec:\1ntthb.exe82⤵PID:1488
-
\??\c:\ntbnnt.exec:\ntbnnt.exe83⤵PID:1144
-
\??\c:\pjpjd.exec:\pjpjd.exe84⤵PID:3368
-
\??\c:\jddvp.exec:\jddvp.exe85⤵PID:3192
-
\??\c:\3llxrxr.exec:\3llxrxr.exe86⤵PID:2064
-
\??\c:\5hbhht.exec:\5hbhht.exe87⤵PID:2768
-
\??\c:\9tthbb.exec:\9tthbb.exe88⤵PID:4220
-
\??\c:\9pdvd.exec:\9pdvd.exe89⤵PID:2032
-
\??\c:\pvdjd.exec:\pvdjd.exe90⤵PID:1308
-
\??\c:\3lllffx.exec:\3lllffx.exe91⤵PID:2800
-
\??\c:\bbhhnh.exec:\bbhhnh.exe92⤵PID:3336
-
\??\c:\hhhhhn.exec:\hhhhhn.exe93⤵PID:2756
-
\??\c:\jddjv.exec:\jddjv.exe94⤵PID:5092
-
\??\c:\flrflfx.exec:\flrflfx.exe95⤵PID:3920
-
\??\c:\vjdjd.exec:\vjdjd.exe96⤵PID:2504
-
\??\c:\vvpjv.exec:\vvpjv.exe97⤵PID:3604
-
\??\c:\5rlfrlx.exec:\5rlfrlx.exe98⤵PID:4352
-
\??\c:\bthbnn.exec:\bthbnn.exe99⤵PID:3348
-
\??\c:\1hnhhh.exec:\1hnhhh.exe100⤵PID:4168
-
\??\c:\9pvdp.exec:\9pvdp.exe101⤵PID:5100
-
\??\c:\xlfrlfx.exec:\xlfrlfx.exe102⤵PID:3244
-
\??\c:\5llffff.exec:\5llffff.exe103⤵PID:2348
-
\??\c:\thhbth.exec:\thhbth.exe104⤵PID:2212
-
\??\c:\bhbttn.exec:\bhbttn.exe105⤵PID:2324
-
\??\c:\9vdvj.exec:\9vdvj.exe106⤵PID:1388
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe107⤵PID:4028
-
\??\c:\rlxxflx.exec:\rlxxflx.exe108⤵PID:4104
-
\??\c:\nntbnt.exec:\nntbnt.exe109⤵PID:4980
-
\??\c:\bhnhhb.exec:\bhnhhb.exe110⤵PID:4504
-
\??\c:\dpvpp.exec:\dpvpp.exe111⤵PID:3912
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe112⤵PID:4824
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe113⤵PID:3508
-
\??\c:\3bhbnn.exec:\3bhbnn.exe114⤵PID:1804
-
\??\c:\hntbnb.exec:\hntbnb.exe115⤵PID:4892
-
\??\c:\vppdp.exec:\vppdp.exe116⤵PID:1468
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe117⤵PID:2892
-
\??\c:\3rfxlfx.exec:\3rfxlfx.exe118⤵PID:3668
-
\??\c:\tnhbtn.exec:\tnhbtn.exe119⤵PID:2364
-
\??\c:\bnnhhh.exec:\bnnhhh.exe120⤵PID:1284
-
\??\c:\jvpjp.exec:\jvpjp.exe121⤵PID:756
-
\??\c:\7ddvj.exec:\7ddvj.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-