Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe
-
Size
224KB
-
MD5
455fa0f4f4cd34d3402a200c703bd361
-
SHA1
a88b0e4f1fb544fe7e8f337f87ad523fde400ae2
-
SHA256
03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31
-
SHA512
bb8c21ec55592621d15ffb09d25aaed1f2da952cca366751d5c6267cafe6819ec664e1027641c1cbe70acf8643a9a5fb2234dae784c0066522cb18c1a8b5d3a3
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xL79:n3C9BRo7MlrWKo+lxKZ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4696-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/4696-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1152-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1600-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4388-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3092-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3356-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3868-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3868-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3868-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1496-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1980-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4296-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4012-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3828-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4936-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2952-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3040-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1488-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1492-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2000-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/408-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2964-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1664 pdvpj.exe 804 llxrrll.exe 1152 dvpdv.exe 4388 rflxrrl.exe 1600 tntttt.exe 2652 hbnhbt.exe 3092 hnhbbb.exe 3356 pppjp.exe 3868 rlxlxlx.exe 1496 jvvvp.exe 1980 flrfxxl.exe 4296 tntnhb.exe 2220 lfrfrfl.exe 4012 frlrfrr.exe 2408 htnhbb.exe 3828 rlxlfxr.exe 4936 tbhbtn.exe 2952 jdppd.exe 2960 nbhbnh.exe 3040 tnbnhh.exe 920 rxlxxrr.exe 2980 pjjdv.exe 4684 xlrlxxr.exe 1488 lfrlxxf.exe 1492 hbhhhh.exe 4184 vpvvj.exe 2996 frxrlff.exe 2000 nhnhbb.exe 408 thhhnb.exe 4848 vdjdp.exe 2964 3ntntn.exe 4804 vdpvj.exe 4972 flrfrfl.exe 412 lrrrllf.exe 3644 tbnhbt.exe 4396 jvjdj.exe 4448 frlfrrl.exe 2924 fxfxffx.exe 1516 btbttn.exe 1116 pddvp.exe 4248 pjpdj.exe 888 xlrrrff.exe 4868 bbbbbt.exe 1476 nnhbnn.exe 2028 vjddv.exe 4076 xxlffxx.exe 5008 tnhbhb.exe 4716 hhtttb.exe 3100 vpjdp.exe 4636 xrxflrr.exe 3528 3lxrllr.exe 836 1nhbtn.exe 2172 dvvpd.exe 1596 lrlfxlf.exe 3216 lxllllf.exe 468 hnttnt.exe 4036 ddjjv.exe 4012 5jpjj.exe 384 rfffxxx.exe 3448 ffllrrf.exe 4992 tnhbnh.exe 3684 jdvvj.exe 4720 xxrrxfr.exe 4816 fxlfffl.exe -
resource yara_rule behavioral2/memory/4696-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4696 wrote to memory of 1664 4696 03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe 83 PID 4696 wrote to memory of 1664 4696 03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe 83 PID 4696 wrote to memory of 1664 4696 03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe 83 PID 1664 wrote to memory of 804 1664 pdvpj.exe 84 PID 1664 wrote to memory of 804 1664 pdvpj.exe 84 PID 1664 wrote to memory of 804 1664 pdvpj.exe 84 PID 804 wrote to memory of 1152 804 llxrrll.exe 85 PID 804 wrote to memory of 1152 804 llxrrll.exe 85 PID 804 wrote to memory of 1152 804 llxrrll.exe 85 PID 1152 wrote to memory of 4388 1152 dvpdv.exe 86 PID 1152 wrote to memory of 4388 1152 dvpdv.exe 86 PID 1152 wrote to memory of 4388 1152 dvpdv.exe 86 PID 4388 wrote to memory of 1600 4388 rflxrrl.exe 87 PID 4388 wrote to memory of 1600 4388 rflxrrl.exe 87 PID 4388 wrote to memory of 1600 4388 rflxrrl.exe 87 PID 1600 wrote to memory of 2652 1600 tntttt.exe 88 PID 1600 wrote to memory of 2652 1600 tntttt.exe 88 PID 1600 wrote to memory of 2652 1600 tntttt.exe 88 PID 2652 wrote to memory of 3092 2652 hbnhbt.exe 90 PID 2652 wrote to memory of 3092 2652 hbnhbt.exe 90 PID 2652 wrote to memory of 3092 2652 hbnhbt.exe 90 PID 3092 wrote to memory of 3356 3092 hnhbbb.exe 91 PID 3092 wrote to memory of 3356 3092 hnhbbb.exe 91 PID 3092 wrote to memory of 3356 3092 hnhbbb.exe 91 PID 3356 wrote to memory of 3868 3356 pppjp.exe 93 PID 3356 wrote to memory of 3868 3356 pppjp.exe 93 PID 3356 wrote to memory of 3868 3356 pppjp.exe 93 PID 3868 wrote to memory of 1496 3868 rlxlxlx.exe 95 PID 3868 wrote to memory of 1496 3868 rlxlxlx.exe 95 PID 3868 wrote to memory of 1496 3868 rlxlxlx.exe 95 PID 1496 wrote to memory of 1980 1496 jvvvp.exe 96 PID 1496 wrote to memory of 1980 1496 jvvvp.exe 96 PID 1496 wrote to memory of 1980 1496 jvvvp.exe 96 PID 1980 wrote to memory of 4296 1980 flrfxxl.exe 97 PID 1980 wrote to memory of 4296 1980 flrfxxl.exe 97 PID 1980 wrote to memory of 4296 1980 flrfxxl.exe 97 PID 4296 wrote to memory of 2220 4296 tntnhb.exe 98 PID 4296 wrote to memory of 2220 4296 tntnhb.exe 98 PID 4296 wrote to memory of 2220 4296 tntnhb.exe 98 PID 2220 wrote to memory of 4012 2220 lfrfrfl.exe 99 PID 2220 wrote to memory of 4012 2220 lfrfrfl.exe 99 PID 2220 wrote to memory of 4012 2220 lfrfrfl.exe 99 PID 4012 wrote to memory of 2408 4012 frlrfrr.exe 100 PID 4012 wrote to memory of 2408 4012 frlrfrr.exe 100 PID 4012 wrote to memory of 2408 4012 frlrfrr.exe 100 PID 2408 wrote to memory of 3828 2408 htnhbb.exe 101 PID 2408 wrote to memory of 3828 2408 htnhbb.exe 101 PID 2408 wrote to memory of 3828 2408 htnhbb.exe 101 PID 3828 wrote to memory of 4936 3828 rlxlfxr.exe 102 PID 3828 wrote to memory of 4936 3828 rlxlfxr.exe 102 PID 3828 wrote to memory of 4936 3828 rlxlfxr.exe 102 PID 4936 wrote to memory of 2952 4936 tbhbtn.exe 103 PID 4936 wrote to memory of 2952 4936 tbhbtn.exe 103 PID 4936 wrote to memory of 2952 4936 tbhbtn.exe 103 PID 2952 wrote to memory of 2960 2952 jdppd.exe 104 PID 2952 wrote to memory of 2960 2952 jdppd.exe 104 PID 2952 wrote to memory of 2960 2952 jdppd.exe 104 PID 2960 wrote to memory of 3040 2960 nbhbnh.exe 105 PID 2960 wrote to memory of 3040 2960 nbhbnh.exe 105 PID 2960 wrote to memory of 3040 2960 nbhbnh.exe 105 PID 3040 wrote to memory of 920 3040 tnbnhh.exe 106 PID 3040 wrote to memory of 920 3040 tnbnhh.exe 106 PID 3040 wrote to memory of 920 3040 tnbnhh.exe 106 PID 920 wrote to memory of 2980 920 rxlxxrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe"C:\Users\Admin\AppData\Local\Temp\03038d53a7000b0955dee5816c114c99dfc4ef153a7297b86792c77f56d69f31.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\pdvpj.exec:\pdvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\llxrrll.exec:\llxrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\dvpdv.exec:\dvpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\rflxrrl.exec:\rflxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\tntttt.exec:\tntttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\hbnhbt.exec:\hbnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hnhbbb.exec:\hnhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\pppjp.exec:\pppjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\jvvvp.exec:\jvvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\flrfxxl.exec:\flrfxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\tntnhb.exec:\tntnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\lfrfrfl.exec:\lfrfrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\frlrfrr.exec:\frlrfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\htnhbb.exec:\htnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rlxlfxr.exec:\rlxlfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\tbhbtn.exec:\tbhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jdppd.exec:\jdppd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\nbhbnh.exec:\nbhbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\tnbnhh.exec:\tnbnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\rxlxxrr.exec:\rxlxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\pjjdv.exec:\pjjdv.exe23⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe24⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe25⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hbhhhh.exec:\hbhhhh.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vpvvj.exec:\vpvvj.exe27⤵
- Executes dropped EXE
PID:4184 -
\??\c:\frxrlff.exec:\frxrlff.exe28⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nhnhbb.exec:\nhnhbb.exe29⤵
- Executes dropped EXE
PID:2000 -
\??\c:\thhhnb.exec:\thhhnb.exe30⤵
- Executes dropped EXE
PID:408 -
\??\c:\vdjdp.exec:\vdjdp.exe31⤵
- Executes dropped EXE
PID:4848 -
\??\c:\3ntntn.exec:\3ntntn.exe32⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vdpvj.exec:\vdpvj.exe33⤵
- Executes dropped EXE
PID:4804 -
\??\c:\flrfrfl.exec:\flrfrfl.exe34⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lrrrllf.exec:\lrrrllf.exe35⤵
- Executes dropped EXE
PID:412 -
\??\c:\tbnhbt.exec:\tbnhbt.exe36⤵
- Executes dropped EXE
PID:3644 -
\??\c:\jvjdj.exec:\jvjdj.exe37⤵
- Executes dropped EXE
PID:4396 -
\??\c:\frlfrrl.exec:\frlfrrl.exe38⤵
- Executes dropped EXE
PID:4448 -
\??\c:\fxfxffx.exec:\fxfxffx.exe39⤵
- Executes dropped EXE
PID:2924 -
\??\c:\btbttn.exec:\btbttn.exe40⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pddvp.exec:\pddvp.exe41⤵
- Executes dropped EXE
PID:1116 -
\??\c:\pjpdj.exec:\pjpdj.exe42⤵
- Executes dropped EXE
PID:4248 -
\??\c:\xlrrrff.exec:\xlrrrff.exe43⤵
- Executes dropped EXE
PID:888 -
\??\c:\bbbbbt.exec:\bbbbbt.exe44⤵
- Executes dropped EXE
PID:4868 -
\??\c:\nnhbnn.exec:\nnhbnn.exe45⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vjddv.exec:\vjddv.exe46⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xxlffxx.exec:\xxlffxx.exe47⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tnhbhb.exec:\tnhbhb.exe48⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hhtttb.exec:\hhtttb.exe49⤵
- Executes dropped EXE
PID:4716 -
\??\c:\vpjdp.exec:\vpjdp.exe50⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xrxflrr.exec:\xrxflrr.exe51⤵
- Executes dropped EXE
PID:4636 -
\??\c:\3lxrllr.exec:\3lxrllr.exe52⤵
- Executes dropped EXE
PID:3528 -
\??\c:\1nhbtn.exec:\1nhbtn.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\dvvpd.exec:\dvvpd.exe54⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lrlfxlf.exec:\lrlfxlf.exe55⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lxllllf.exec:\lxllllf.exe56⤵
- Executes dropped EXE
PID:3216 -
\??\c:\hnttnt.exec:\hnttnt.exe57⤵
- Executes dropped EXE
PID:468 -
\??\c:\ddjjv.exec:\ddjjv.exe58⤵
- Executes dropped EXE
PID:4036 -
\??\c:\5jpjj.exec:\5jpjj.exe59⤵
- Executes dropped EXE
PID:4012 -
\??\c:\rfffxxx.exec:\rfffxxx.exe60⤵
- Executes dropped EXE
PID:384 -
\??\c:\ffllrrf.exec:\ffllrrf.exe61⤵
- Executes dropped EXE
PID:3448 -
\??\c:\tnhbnh.exec:\tnhbnh.exe62⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jdvvj.exec:\jdvvj.exe63⤵
- Executes dropped EXE
PID:3684 -
\??\c:\xxrrxfr.exec:\xxrrxfr.exe64⤵
- Executes dropped EXE
PID:4720 -
\??\c:\fxlfffl.exec:\fxlfffl.exe65⤵
- Executes dropped EXE
PID:4816 -
\??\c:\thtnnn.exec:\thtnnn.exe66⤵PID:876
-
\??\c:\pjjpj.exec:\pjjpj.exe67⤵PID:1172
-
\??\c:\dvvpj.exec:\dvvpj.exe68⤵PID:2004
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe69⤵PID:3888
-
\??\c:\hhbttn.exec:\hhbttn.exe70⤵PID:1700
-
\??\c:\djppp.exec:\djppp.exe71⤵PID:3200
-
\??\c:\1dddp.exec:\1dddp.exe72⤵PID:1936
-
\??\c:\rffxrlf.exec:\rffxrlf.exe73⤵PID:3732
-
\??\c:\1hhhhh.exec:\1hhhhh.exe74⤵PID:5060
-
\??\c:\nthbtt.exec:\nthbtt.exe75⤵PID:2904
-
\??\c:\jjvvd.exec:\jjvvd.exe76⤵PID:1820
-
\??\c:\3xxrfff.exec:\3xxrfff.exe77⤵PID:4068
-
\??\c:\llxrlff.exec:\llxrlff.exe78⤵PID:4100
-
\??\c:\3nnnnn.exec:\3nnnnn.exe79⤵PID:1640
-
\??\c:\vjjjj.exec:\vjjjj.exe80⤵PID:2288
-
\??\c:\dppjv.exec:\dppjv.exe81⤵PID:4668
-
\??\c:\fxxlllr.exec:\fxxlllr.exe82⤵PID:4904
-
\??\c:\tntnhb.exec:\tntnhb.exe83⤵PID:4392
-
\??\c:\nhbnhh.exec:\nhbnhh.exe84⤵PID:4480
-
\??\c:\jdpdd.exec:\jdpdd.exe85⤵PID:1436
-
\??\c:\xrrxllx.exec:\xrrxllx.exe86⤵PID:4048
-
\??\c:\tttttt.exec:\tttttt.exe87⤵PID:3016
-
\??\c:\jdjvv.exec:\jdjvv.exe88⤵PID:4192
-
\??\c:\5pjvp.exec:\5pjvp.exe89⤵PID:4200
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe90⤵PID:1152
-
\??\c:\7rxrllf.exec:\7rxrllf.exe91⤵PID:4016
-
\??\c:\hbnnbb.exec:\hbnnbb.exe92⤵PID:4592
-
\??\c:\hnbtnn.exec:\hnbtnn.exe93⤵PID:228
-
\??\c:\vpvvp.exec:\vpvvp.exe94⤵PID:2632
-
\??\c:\lfxrffx.exec:\lfxrffx.exe95⤵PID:4600
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe96⤵PID:3696
-
\??\c:\nbbthh.exec:\nbbthh.exe97⤵PID:4716
-
\??\c:\vvjjp.exec:\vvjjp.exe98⤵PID:3100
-
\??\c:\3vvvj.exec:\3vvvj.exe99⤵PID:4728
-
\??\c:\flrlxxr.exec:\flrlxxr.exe100⤵PID:1012
-
\??\c:\hhnnnn.exec:\hhnnnn.exe101⤵PID:4792
-
\??\c:\3djdj.exec:\3djdj.exe102⤵PID:3264
-
\??\c:\vvppp.exec:\vvppp.exe103⤵PID:2976
-
\??\c:\3lfxxff.exec:\3lfxxff.exe104⤵PID:3216
-
\??\c:\xrxfffr.exec:\xrxfffr.exe105⤵PID:468
-
\??\c:\bnnhbt.exec:\bnnhbt.exe106⤵PID:4036
-
\??\c:\5pvpd.exec:\5pvpd.exe107⤵PID:4884
-
\??\c:\7vdvv.exec:\7vdvv.exe108⤵PID:1072
-
\??\c:\rxfxrll.exec:\rxfxrll.exe109⤵PID:3392
-
\??\c:\1nnhhn.exec:\1nnhhn.exe110⤵PID:4612
-
\??\c:\7ttnhn.exec:\7ttnhn.exe111⤵PID:2848
-
\??\c:\pdpjj.exec:\pdpjj.exe112⤵PID:3428
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe113⤵PID:3684
-
\??\c:\rxllxxx.exec:\rxllxxx.exe114⤵PID:800
-
\??\c:\thnhhh.exec:\thnhhh.exe115⤵PID:1300
-
\??\c:\3hnhbb.exec:\3hnhbb.exe116⤵PID:1900
-
\??\c:\jvdvp.exec:\jvdvp.exe117⤵PID:1248
-
\??\c:\pddvv.exec:\pddvv.exe118⤵PID:4684
-
\??\c:\lrxfxxr.exec:\lrxfxxr.exe119⤵PID:2420
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe120⤵PID:3112
-
\??\c:\bnnnhh.exec:\bnnnhh.exe121⤵PID:1492
-
\??\c:\dvdvj.exec:\dvdvj.exe122⤵PID:4168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-