Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe
-
Size
95KB
-
MD5
4c533b6ed122abf7387d15b8b3e3e6db
-
SHA1
f8e0028963a1f0c321e451359bf4414d3033d434
-
SHA256
fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588
-
SHA512
ee02519ecd66d39609086d5059fabc397327edaca17438b76079eb1ce36ca1eb5da0d5dfc8b28aeeeba56360f9160ecf131d735bd425890033e10afa9f87f391
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTA:ymb3NkkiQ3mdBjFIj+qNhvZuHQYk
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/208-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral2/memory/208-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4332-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3604-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2564-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4396-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/396-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1268-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1268-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1268-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1268-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3108-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4272-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2704-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4712-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1412-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3208-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4500-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4772-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1844-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/700-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4660-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2884-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4184-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4668-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/936-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2444-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1632-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4332 vpjjp.exe 116 xfrflfr.exe 3604 btnhbt.exe 2564 5jjvj.exe 4396 fxxrrxr.exe 396 hhhbtn.exe 1268 hnnhhh.exe 3108 dpddp.exe 5060 lflfrrr.exe 2132 htbtnt.exe 4272 dvjdd.exe 64 lrxxxff.exe 2704 nttnnn.exe 1916 bhhnhb.exe 4712 vvjdp.exe 1412 xlffxxr.exe 3208 fflfrrl.exe 4500 1nbnhb.exe 4772 7jpjp.exe 1844 xlrlffx.exe 700 tbnhtn.exe 4660 pjjjd.exe 2884 djjdv.exe 1052 fxxllfx.exe 4184 btnhhh.exe 412 vvvpp.exe 3544 rfllflf.exe 4668 ttnnhb.exe 936 htthhb.exe 2444 dpjjd.exe 1632 9llfrlf.exe 3508 tttbtt.exe 3600 nbnnhn.exe 804 vpjpp.exe 3904 jjvvp.exe 3908 llxxlll.exe 4828 nnntnt.exe 1016 pjvdv.exe 2984 llxrrll.exe 4364 hbbbhh.exe 228 1bhhhn.exe 4244 dvjdp.exe 1452 djjvd.exe 828 rfrrflx.exe 3652 hbbtnn.exe 4200 nthnhn.exe 1056 dvvvp.exe 1172 1rxrffx.exe 5032 xflfffx.exe 4836 7bbbtt.exe 4152 nbnthh.exe 4968 pjjdv.exe 5008 5lllxxx.exe 2132 lfrrxxf.exe 4272 hbntnn.exe 64 dvpdv.exe 2704 7pvpp.exe 4572 xllfffx.exe 3812 fxrrlff.exe 4556 3hhhbb.exe 2060 ddpjp.exe 3852 5pdvd.exe 548 7fllfff.exe 3472 lrxffff.exe -
resource yara_rule behavioral2/memory/208-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 208 wrote to memory of 4332 208 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 83 PID 208 wrote to memory of 4332 208 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 83 PID 208 wrote to memory of 4332 208 fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe 83 PID 4332 wrote to memory of 116 4332 vpjjp.exe 84 PID 4332 wrote to memory of 116 4332 vpjjp.exe 84 PID 4332 wrote to memory of 116 4332 vpjjp.exe 84 PID 116 wrote to memory of 3604 116 xfrflfr.exe 85 PID 116 wrote to memory of 3604 116 xfrflfr.exe 85 PID 116 wrote to memory of 3604 116 xfrflfr.exe 85 PID 3604 wrote to memory of 2564 3604 btnhbt.exe 86 PID 3604 wrote to memory of 2564 3604 btnhbt.exe 86 PID 3604 wrote to memory of 2564 3604 btnhbt.exe 86 PID 2564 wrote to memory of 4396 2564 5jjvj.exe 87 PID 2564 wrote to memory of 4396 2564 5jjvj.exe 87 PID 2564 wrote to memory of 4396 2564 5jjvj.exe 87 PID 4396 wrote to memory of 396 4396 fxxrrxr.exe 88 PID 4396 wrote to memory of 396 4396 fxxrrxr.exe 88 PID 4396 wrote to memory of 396 4396 fxxrrxr.exe 88 PID 396 wrote to memory of 1268 396 hhhbtn.exe 89 PID 396 wrote to memory of 1268 396 hhhbtn.exe 89 PID 396 wrote to memory of 1268 396 hhhbtn.exe 89 PID 1268 wrote to memory of 3108 1268 hnnhhh.exe 90 PID 1268 wrote to memory of 3108 1268 hnnhhh.exe 90 PID 1268 wrote to memory of 3108 1268 hnnhhh.exe 90 PID 3108 wrote to memory of 5060 3108 dpddp.exe 91 PID 3108 wrote to memory of 5060 3108 dpddp.exe 91 PID 3108 wrote to memory of 5060 3108 dpddp.exe 91 PID 5060 wrote to memory of 2132 5060 lflfrrr.exe 92 PID 5060 wrote to memory of 2132 5060 lflfrrr.exe 92 PID 5060 wrote to memory of 2132 5060 lflfrrr.exe 92 PID 2132 wrote to memory of 4272 2132 htbtnt.exe 93 PID 2132 wrote to memory of 4272 2132 htbtnt.exe 93 PID 2132 wrote to memory of 4272 2132 htbtnt.exe 93 PID 4272 wrote to memory of 64 4272 dvjdd.exe 94 PID 4272 wrote to memory of 64 4272 dvjdd.exe 94 PID 4272 wrote to memory of 64 4272 dvjdd.exe 94 PID 64 wrote to memory of 2704 64 lrxxxff.exe 95 PID 64 wrote to memory of 2704 64 lrxxxff.exe 95 PID 64 wrote to memory of 2704 64 lrxxxff.exe 95 PID 2704 wrote to memory of 1916 2704 nttnnn.exe 96 PID 2704 wrote to memory of 1916 2704 nttnnn.exe 96 PID 2704 wrote to memory of 1916 2704 nttnnn.exe 96 PID 1916 wrote to memory of 4712 1916 bhhnhb.exe 97 PID 1916 wrote to memory of 4712 1916 bhhnhb.exe 97 PID 1916 wrote to memory of 4712 1916 bhhnhb.exe 97 PID 4712 wrote to memory of 1412 4712 vvjdp.exe 98 PID 4712 wrote to memory of 1412 4712 vvjdp.exe 98 PID 4712 wrote to memory of 1412 4712 vvjdp.exe 98 PID 1412 wrote to memory of 3208 1412 xlffxxr.exe 99 PID 1412 wrote to memory of 3208 1412 xlffxxr.exe 99 PID 1412 wrote to memory of 3208 1412 xlffxxr.exe 99 PID 3208 wrote to memory of 4500 3208 fflfrrl.exe 100 PID 3208 wrote to memory of 4500 3208 fflfrrl.exe 100 PID 3208 wrote to memory of 4500 3208 fflfrrl.exe 100 PID 4500 wrote to memory of 4772 4500 1nbnhb.exe 101 PID 4500 wrote to memory of 4772 4500 1nbnhb.exe 101 PID 4500 wrote to memory of 4772 4500 1nbnhb.exe 101 PID 4772 wrote to memory of 1844 4772 7jpjp.exe 102 PID 4772 wrote to memory of 1844 4772 7jpjp.exe 102 PID 4772 wrote to memory of 1844 4772 7jpjp.exe 102 PID 1844 wrote to memory of 700 1844 xlrlffx.exe 103 PID 1844 wrote to memory of 700 1844 xlrlffx.exe 103 PID 1844 wrote to memory of 700 1844 xlrlffx.exe 103 PID 700 wrote to memory of 4660 700 tbnhtn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe"C:\Users\Admin\AppData\Local\Temp\fced689174f99dbd2fe160fcba2727fdc7d326d9e8f31b38e2965ceaf56f8588.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\vpjjp.exec:\vpjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\xfrflfr.exec:\xfrflfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\btnhbt.exec:\btnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\5jjvj.exec:\5jjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hhhbtn.exec:\hhhbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\hnnhhh.exec:\hnnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\dpddp.exec:\dpddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\lflfrrr.exec:\lflfrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\htbtnt.exec:\htbtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvjdd.exec:\dvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\lrxxxff.exec:\lrxxxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\nttnnn.exec:\nttnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bhhnhb.exec:\bhhnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vvjdp.exec:\vvjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\xlffxxr.exec:\xlffxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\fflfrrl.exec:\fflfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\1nbnhb.exec:\1nbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\7jpjp.exec:\7jpjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xlrlffx.exec:\xlrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\tbnhtn.exec:\tbnhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\pjjjd.exec:\pjjjd.exe23⤵
- Executes dropped EXE
PID:4660 -
\??\c:\djjdv.exec:\djjdv.exe24⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxxllfx.exec:\fxxllfx.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\btnhhh.exec:\btnhhh.exe26⤵
- Executes dropped EXE
PID:4184 -
\??\c:\vvvpp.exec:\vvvpp.exe27⤵
- Executes dropped EXE
PID:412 -
\??\c:\rfllflf.exec:\rfllflf.exe28⤵
- Executes dropped EXE
PID:3544 -
\??\c:\ttnnhb.exec:\ttnnhb.exe29⤵
- Executes dropped EXE
PID:4668 -
\??\c:\htthhb.exec:\htthhb.exe30⤵
- Executes dropped EXE
PID:936 -
\??\c:\dpjjd.exec:\dpjjd.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9llfrlf.exec:\9llfrlf.exe32⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tttbtt.exec:\tttbtt.exe33⤵
- Executes dropped EXE
PID:3508 -
\??\c:\nbnnhn.exec:\nbnnhn.exe34⤵
- Executes dropped EXE
PID:3600 -
\??\c:\vpjpp.exec:\vpjpp.exe35⤵
- Executes dropped EXE
PID:804 -
\??\c:\jjvvp.exec:\jjvvp.exe36⤵
- Executes dropped EXE
PID:3904 -
\??\c:\llxxlll.exec:\llxxlll.exe37⤵
- Executes dropped EXE
PID:3908 -
\??\c:\nnntnt.exec:\nnntnt.exe38⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pjvdv.exec:\pjvdv.exe39⤵
- Executes dropped EXE
PID:1016 -
\??\c:\llxrrll.exec:\llxrrll.exe40⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hbbbhh.exec:\hbbbhh.exe41⤵
- Executes dropped EXE
PID:4364 -
\??\c:\1bhhhn.exec:\1bhhhn.exe42⤵
- Executes dropped EXE
PID:228 -
\??\c:\dvjdp.exec:\dvjdp.exe43⤵
- Executes dropped EXE
PID:4244 -
\??\c:\djjvd.exec:\djjvd.exe44⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rfrrflx.exec:\rfrrflx.exe45⤵
- Executes dropped EXE
PID:828 -
\??\c:\hbbtnn.exec:\hbbtnn.exe46⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nthnhn.exec:\nthnhn.exe47⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dvvvp.exec:\dvvvp.exe48⤵
- Executes dropped EXE
PID:1056 -
\??\c:\1rxrffx.exec:\1rxrffx.exe49⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xflfffx.exec:\xflfffx.exe50⤵
- Executes dropped EXE
PID:5032 -
\??\c:\7bbbtt.exec:\7bbbtt.exe51⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nbnthh.exec:\nbnthh.exe52⤵
- Executes dropped EXE
PID:4152 -
\??\c:\pjjdv.exec:\pjjdv.exe53⤵
- Executes dropped EXE
PID:4968 -
\??\c:\5lllxxx.exec:\5lllxxx.exe54⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbntnn.exec:\hbntnn.exe56⤵
- Executes dropped EXE
PID:4272 -
\??\c:\dvpdv.exec:\dvpdv.exe57⤵
- Executes dropped EXE
PID:64 -
\??\c:\7pvpp.exec:\7pvpp.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xllfffx.exec:\xllfffx.exe59⤵
- Executes dropped EXE
PID:4572 -
\??\c:\fxrrlff.exec:\fxrrlff.exe60⤵
- Executes dropped EXE
PID:3812 -
\??\c:\3hhhbb.exec:\3hhhbb.exe61⤵
- Executes dropped EXE
PID:4556 -
\??\c:\ddpjp.exec:\ddpjp.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5pdvd.exec:\5pdvd.exe63⤵
- Executes dropped EXE
PID:3852 -
\??\c:\7fllfff.exec:\7fllfff.exe64⤵
- Executes dropped EXE
PID:548 -
\??\c:\lrxffff.exec:\lrxffff.exe65⤵
- Executes dropped EXE
PID:3472 -
\??\c:\nhnnhh.exec:\nhnnhh.exe66⤵PID:4948
-
\??\c:\thhbtt.exec:\thhbtt.exe67⤵PID:4808
-
\??\c:\vpvpj.exec:\vpvpj.exe68⤵PID:4660
-
\??\c:\ddddp.exec:\ddddp.exe69⤵PID:1764
-
\??\c:\xxxlffl.exec:\xxxlffl.exe70⤵PID:4104
-
\??\c:\1httbh.exec:\1httbh.exe71⤵PID:1960
-
\??\c:\hbbhhb.exec:\hbbhhb.exe72⤵PID:4600
-
\??\c:\pjdvp.exec:\pjdvp.exe73⤵PID:2992
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe74⤵PID:3972
-
\??\c:\lllxlrr.exec:\lllxlrr.exe75⤵PID:2684
-
\??\c:\bthnbh.exec:\bthnbh.exe76⤵PID:1428
-
\??\c:\3vjjd.exec:\3vjjd.exe77⤵PID:3948
-
\??\c:\1fxxlrl.exec:\1fxxlrl.exe78⤵PID:3988
-
\??\c:\5tttnn.exec:\5tttnn.exe79⤵PID:2912
-
\??\c:\tthbbb.exec:\tthbbb.exe80⤵PID:4916
-
\??\c:\jjvvj.exec:\jjvvj.exe81⤵PID:2480
-
\??\c:\lxxrlll.exec:\lxxrlll.exe82⤵PID:948
-
\??\c:\hbhhtb.exec:\hbhhtb.exe83⤵PID:3112
-
\??\c:\hhtnnh.exec:\hhtnnh.exe84⤵PID:3704
-
\??\c:\djpjd.exec:\djpjd.exe85⤵PID:1140
-
\??\c:\3vdpd.exec:\3vdpd.exe86⤵PID:1264
-
\??\c:\llxxffl.exec:\llxxffl.exe87⤵PID:5040
-
\??\c:\tntttb.exec:\tntttb.exe88⤵PID:4352
-
\??\c:\jdpvj.exec:\jdpvj.exe89⤵PID:208
-
\??\c:\vjvpj.exec:\vjvpj.exe90⤵PID:3176
-
\??\c:\lfflxxx.exec:\lfflxxx.exe91⤵PID:4468
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe92⤵PID:4816
-
\??\c:\nhhnbb.exec:\nhhnbb.exe93⤵PID:1612
-
\??\c:\pjjdv.exec:\pjjdv.exe94⤵PID:772
-
\??\c:\rlrxrff.exec:\rlrxrff.exe95⤵PID:1272
-
\??\c:\rxrfxrl.exec:\rxrfxrl.exe96⤵PID:4200
-
\??\c:\1htttb.exec:\1htttb.exe97⤵PID:1172
-
\??\c:\3bhbhn.exec:\3bhbhn.exe98⤵PID:1436
-
\??\c:\pjjjv.exec:\pjjjv.exe99⤵PID:4652
-
\??\c:\3djvp.exec:\3djvp.exe100⤵PID:2032
-
\??\c:\rxlrllf.exec:\rxlrllf.exe101⤵PID:2536
-
\??\c:\lrxrlll.exec:\lrxrlll.exe102⤵PID:2408
-
\??\c:\hbbthh.exec:\hbbthh.exe103⤵PID:960
-
\??\c:\pjvpp.exec:\pjvpp.exe104⤵PID:4524
-
\??\c:\pjjdd.exec:\pjjdd.exe105⤵PID:1816
-
\??\c:\rlxffff.exec:\rlxffff.exe106⤵PID:60
-
\??\c:\1xfrrrr.exec:\1xfrrrr.exe107⤵PID:1600
-
\??\c:\hbbntn.exec:\hbbntn.exe108⤵PID:4940
-
\??\c:\nhhtnn.exec:\nhhtnn.exe109⤵PID:2460
-
\??\c:\dpppj.exec:\dpppj.exe110⤵PID:4180
-
\??\c:\dvjdv.exec:\dvjdv.exe111⤵PID:1064
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe112⤵PID:3932
-
\??\c:\3lffxxx.exec:\3lffxxx.exe113⤵PID:2136
-
\??\c:\ttttnn.exec:\ttttnn.exe114⤵PID:760
-
\??\c:\vpddd.exec:\vpddd.exe115⤵PID:4168
-
\??\c:\dpjdd.exec:\dpjdd.exe116⤵PID:1920
-
\??\c:\lflllfl.exec:\lflllfl.exe117⤵PID:3008
-
\??\c:\lrffxff.exec:\lrffxff.exe118⤵PID:2364
-
\??\c:\9rflffx.exec:\9rflffx.exe119⤵PID:4268
-
\??\c:\hhhhhh.exec:\hhhhhh.exe120⤵PID:3544
-
\??\c:\bttnht.exec:\bttnht.exe121⤵PID:4716
-
\??\c:\vdddv.exec:\vdddv.exe122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-