Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe
-
Size
57KB
-
MD5
b51bdd5df765e7dcb1055b4d8323ae4c
-
SHA1
e8df4da0bfeb0f4401d1cc4489378192b0be4f0d
-
SHA256
cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd
-
SHA512
e832b20d9325a545338f46b0b1047448386e288978d47329abb7bb3c983e5fa2302cc0bc090738fe3f8c76284666fc2465e2da7067d64137ab582f4f60665c01
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFaEt:ymb3NkkiQ3mdBjFIvIFaEt
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3900-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/3900-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/508-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/696-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3544-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1212-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1212-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3096-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4564-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1260-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1260-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1260-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1260-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5104-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1804-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2036-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3496-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/652-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4516-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4512-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1392-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3204-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1820-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3740-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4632-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 508 nnhnbt.exe 696 9xfflff.exe 4932 tthnnt.exe 3544 vdddp.exe 4496 ffrrfll.exe 1776 lxflffr.exe 1212 nnbnht.exe 3096 vpvpd.exe 4564 rxrrllx.exe 1260 tbbbbh.exe 5104 5pjjd.exe 3808 fxfxrlf.exe 1804 5hthtn.exe 2036 vppvv.exe 3496 fxrfxlr.exe 4680 thtbtb.exe 652 bhtbnn.exe 4516 rfflrxf.exe 4880 lfffflx.exe 4512 tnhhbb.exe 1392 jddvv.exe 3440 lrrlfxx.exe 2440 nnbhhn.exe 3204 jppjj.exe 1840 vpjdd.exe 1820 5rxrllf.exe 3740 hnhttn.exe 4040 bbnhhb.exe 4632 dpppv.exe 2936 lxlrlff.exe 3052 hbbttt.exe 4444 vjvdp.exe 380 rrrxxxx.exe 1188 xxlrfll.exe 3916 hnnnnn.exe 1124 3ttttb.exe 1440 1ppdd.exe 676 vppjj.exe 2636 rrfxxff.exe 4440 lllxrrl.exe 4320 bthttn.exe 5004 djjpj.exe 3124 jvddj.exe 4020 ffxrlxl.exe 4932 hhbtnn.exe 1676 nnbtbn.exe 1180 jdppp.exe 4384 9fxrflr.exe 2916 xxrlxxr.exe 980 nbnnbh.exe 3084 nbnhnn.exe 1604 dvddp.exe 4736 1lxlrxr.exe 3236 nhtnhb.exe 3572 vppjj.exe 2640 fxlxrrl.exe 4540 frlrlll.exe 3484 bntttt.exe 3408 ntttnh.exe 4908 vvdpp.exe 1240 ffxrlll.exe 5044 7thbtt.exe 224 3pdpj.exe 3088 jvdjd.exe -
resource yara_rule behavioral2/memory/3900-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3900 wrote to memory of 508 3900 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 82 PID 3900 wrote to memory of 508 3900 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 82 PID 3900 wrote to memory of 508 3900 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 82 PID 508 wrote to memory of 696 508 nnhnbt.exe 83 PID 508 wrote to memory of 696 508 nnhnbt.exe 83 PID 508 wrote to memory of 696 508 nnhnbt.exe 83 PID 696 wrote to memory of 4932 696 9xfflff.exe 84 PID 696 wrote to memory of 4932 696 9xfflff.exe 84 PID 696 wrote to memory of 4932 696 9xfflff.exe 84 PID 4932 wrote to memory of 3544 4932 tthnnt.exe 85 PID 4932 wrote to memory of 3544 4932 tthnnt.exe 85 PID 4932 wrote to memory of 3544 4932 tthnnt.exe 85 PID 3544 wrote to memory of 4496 3544 vdddp.exe 86 PID 3544 wrote to memory of 4496 3544 vdddp.exe 86 PID 3544 wrote to memory of 4496 3544 vdddp.exe 86 PID 4496 wrote to memory of 1776 4496 ffrrfll.exe 87 PID 4496 wrote to memory of 1776 4496 ffrrfll.exe 87 PID 4496 wrote to memory of 1776 4496 ffrrfll.exe 87 PID 1776 wrote to memory of 1212 1776 lxflffr.exe 88 PID 1776 wrote to memory of 1212 1776 lxflffr.exe 88 PID 1776 wrote to memory of 1212 1776 lxflffr.exe 88 PID 1212 wrote to memory of 3096 1212 nnbnht.exe 89 PID 1212 wrote to memory of 3096 1212 nnbnht.exe 89 PID 1212 wrote to memory of 3096 1212 nnbnht.exe 89 PID 3096 wrote to memory of 4564 3096 vpvpd.exe 90 PID 3096 wrote to memory of 4564 3096 vpvpd.exe 90 PID 3096 wrote to memory of 4564 3096 vpvpd.exe 90 PID 4564 wrote to memory of 1260 4564 rxrrllx.exe 91 PID 4564 wrote to memory of 1260 4564 rxrrllx.exe 91 PID 4564 wrote to memory of 1260 4564 rxrrllx.exe 91 PID 1260 wrote to memory of 5104 1260 tbbbbh.exe 92 PID 1260 wrote to memory of 5104 1260 tbbbbh.exe 92 PID 1260 wrote to memory of 5104 1260 tbbbbh.exe 92 PID 5104 wrote to memory of 3808 5104 5pjjd.exe 93 PID 5104 wrote to memory of 3808 5104 5pjjd.exe 93 PID 5104 wrote to memory of 3808 5104 5pjjd.exe 93 PID 3808 wrote to memory of 1804 3808 fxfxrlf.exe 94 PID 3808 wrote to memory of 1804 3808 fxfxrlf.exe 94 PID 3808 wrote to memory of 1804 3808 fxfxrlf.exe 94 PID 1804 wrote to memory of 2036 1804 5hthtn.exe 95 PID 1804 wrote to memory of 2036 1804 5hthtn.exe 95 PID 1804 wrote to memory of 2036 1804 5hthtn.exe 95 PID 2036 wrote to memory of 3496 2036 vppvv.exe 96 PID 2036 wrote to memory of 3496 2036 vppvv.exe 96 PID 2036 wrote to memory of 3496 2036 vppvv.exe 96 PID 3496 wrote to memory of 4680 3496 fxrfxlr.exe 97 PID 3496 wrote to memory of 4680 3496 fxrfxlr.exe 97 PID 3496 wrote to memory of 4680 3496 fxrfxlr.exe 97 PID 4680 wrote to memory of 652 4680 thtbtb.exe 98 PID 4680 wrote to memory of 652 4680 thtbtb.exe 98 PID 4680 wrote to memory of 652 4680 thtbtb.exe 98 PID 652 wrote to memory of 4516 652 bhtbnn.exe 99 PID 652 wrote to memory of 4516 652 bhtbnn.exe 99 PID 652 wrote to memory of 4516 652 bhtbnn.exe 99 PID 4516 wrote to memory of 4880 4516 rfflrxf.exe 100 PID 4516 wrote to memory of 4880 4516 rfflrxf.exe 100 PID 4516 wrote to memory of 4880 4516 rfflrxf.exe 100 PID 4880 wrote to memory of 4512 4880 lfffflx.exe 101 PID 4880 wrote to memory of 4512 4880 lfffflx.exe 101 PID 4880 wrote to memory of 4512 4880 lfffflx.exe 101 PID 4512 wrote to memory of 1392 4512 tnhhbb.exe 102 PID 4512 wrote to memory of 1392 4512 tnhhbb.exe 102 PID 4512 wrote to memory of 1392 4512 tnhhbb.exe 102 PID 1392 wrote to memory of 3440 1392 jddvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe"C:\Users\Admin\AppData\Local\Temp\cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\nnhnbt.exec:\nnhnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\9xfflff.exec:\9xfflff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\tthnnt.exec:\tthnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\vdddp.exec:\vdddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\ffrrfll.exec:\ffrrfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\lxflffr.exec:\lxflffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\nnbnht.exec:\nnbnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\vpvpd.exec:\vpvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\rxrrllx.exec:\rxrrllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\tbbbbh.exec:\tbbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\5pjjd.exec:\5pjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\5hthtn.exec:\5hthtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vppvv.exec:\vppvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\fxrfxlr.exec:\fxrfxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\thtbtb.exec:\thtbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\bhtbnn.exec:\bhtbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\rfflrxf.exec:\rfflrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\lfffflx.exec:\lfffflx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\tnhhbb.exec:\tnhhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\jddvv.exec:\jddvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe23⤵
- Executes dropped EXE
PID:3440 -
\??\c:\nnbhhn.exec:\nnbhhn.exe24⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jppjj.exec:\jppjj.exe25⤵
- Executes dropped EXE
PID:3204 -
\??\c:\vpjdd.exec:\vpjdd.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\5rxrllf.exec:\5rxrllf.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hnhttn.exec:\hnhttn.exe28⤵
- Executes dropped EXE
PID:3740 -
\??\c:\bbnhhb.exec:\bbnhhb.exe29⤵
- Executes dropped EXE
PID:4040 -
\??\c:\dpppv.exec:\dpppv.exe30⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lxlrlff.exec:\lxlrlff.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hbbttt.exec:\hbbttt.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vjvdp.exec:\vjvdp.exe33⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rrrxxxx.exec:\rrrxxxx.exe34⤵
- Executes dropped EXE
PID:380 -
\??\c:\xxlrfll.exec:\xxlrfll.exe35⤵
- Executes dropped EXE
PID:1188 -
\??\c:\hnnnnn.exec:\hnnnnn.exe36⤵
- Executes dropped EXE
PID:3916 -
\??\c:\3ttttb.exec:\3ttttb.exe37⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1ppdd.exec:\1ppdd.exe38⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vppjj.exec:\vppjj.exe39⤵
- Executes dropped EXE
PID:676 -
\??\c:\rrfxxff.exec:\rrfxxff.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lllxrrl.exec:\lllxrrl.exe41⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bthttn.exec:\bthttn.exe42⤵
- Executes dropped EXE
PID:4320 -
\??\c:\djjpj.exec:\djjpj.exe43⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jvddj.exec:\jvddj.exe44⤵
- Executes dropped EXE
PID:3124 -
\??\c:\ffxrlxl.exec:\ffxrlxl.exe45⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hhbtnn.exec:\hhbtnn.exe46⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nnbtbn.exec:\nnbtbn.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jdppp.exec:\jdppp.exe48⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9fxrflr.exec:\9fxrflr.exe49⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nbnnbh.exec:\nbnnbh.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\nbnhnn.exec:\nbnhnn.exe52⤵
- Executes dropped EXE
PID:3084 -
\??\c:\dvddp.exec:\dvddp.exe53⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1lxlrxr.exec:\1lxlrxr.exe54⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nhtnhb.exec:\nhtnhb.exe55⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vppjj.exec:\vppjj.exe56⤵
- Executes dropped EXE
PID:3572 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe57⤵
- Executes dropped EXE
PID:2640 -
\??\c:\frlrlll.exec:\frlrlll.exe58⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bntttt.exec:\bntttt.exe59⤵
- Executes dropped EXE
PID:3484 -
\??\c:\ntttnh.exec:\ntttnh.exe60⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vvdpp.exec:\vvdpp.exe61⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ffxrlll.exec:\ffxrlll.exe62⤵
- Executes dropped EXE
PID:1240 -
\??\c:\7thbtt.exec:\7thbtt.exe63⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3pdpj.exec:\3pdpj.exe64⤵
- Executes dropped EXE
PID:224 -
\??\c:\jvdjd.exec:\jvdjd.exe65⤵
- Executes dropped EXE
PID:3088 -
\??\c:\xfrfxrl.exec:\xfrfxrl.exe66⤵PID:4512
-
\??\c:\5tbbnn.exec:\5tbbnn.exe67⤵PID:536
-
\??\c:\5tntbb.exec:\5tntbb.exe68⤵PID:2788
-
\??\c:\fxffxxl.exec:\fxffxxl.exe69⤵PID:796
-
\??\c:\rffxxrr.exec:\rffxxrr.exe70⤵PID:4928
-
\??\c:\tttnht.exec:\tttnht.exe71⤵PID:1144
-
\??\c:\djpvd.exec:\djpvd.exe72⤵PID:744
-
\??\c:\lxxxlff.exec:\lxxxlff.exe73⤵PID:8
-
\??\c:\bbbbtb.exec:\bbbbtb.exe74⤵PID:4924
-
\??\c:\jddjp.exec:\jddjp.exe75⤵PID:5040
-
\??\c:\7vvjv.exec:\7vvjv.exe76⤵PID:4040
-
\??\c:\xxxrxlf.exec:\xxxrxlf.exe77⤵PID:4632
-
\??\c:\hhntbt.exec:\hhntbt.exe78⤵PID:920
-
\??\c:\3pjvj.exec:\3pjvj.exe79⤵PID:392
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe80⤵PID:3400
-
\??\c:\rrrrfll.exec:\rrrrfll.exe81⤵PID:4356
-
\??\c:\hhhnnh.exec:\hhhnnh.exe82⤵PID:1968
-
\??\c:\jjdvv.exec:\jjdvv.exe83⤵PID:3116
-
\??\c:\vdvdj.exec:\vdvdj.exe84⤵PID:1596
-
\??\c:\lrffffx.exec:\lrffffx.exe85⤵PID:3396
-
\??\c:\7bnbbh.exec:\7bnbbh.exe86⤵PID:1712
-
\??\c:\vddvp.exec:\vddvp.exe87⤵PID:4456
-
\??\c:\9lxrrll.exec:\9lxrrll.exe88⤵PID:4088
-
\??\c:\xrllffr.exec:\xrllffr.exe89⤵PID:3068
-
\??\c:\btttnt.exec:\btttnt.exe90⤵PID:3124
-
\??\c:\vvppp.exec:\vvppp.exe91⤵PID:4020
-
\??\c:\9rxlfrr.exec:\9rxlfrr.exe92⤵PID:3372
-
\??\c:\lxffxxx.exec:\lxffxxx.exe93⤵PID:3544
-
\??\c:\hbtbbh.exec:\hbtbbh.exe94⤵PID:3148
-
\??\c:\hnttnb.exec:\hnttnb.exe95⤵PID:1776
-
\??\c:\vpjjd.exec:\vpjjd.exe96⤵PID:5028
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe97⤵PID:4060
-
\??\c:\rllxxrl.exec:\rllxxrl.exe98⤵PID:4652
-
\??\c:\tbtntt.exec:\tbtntt.exe99⤵PID:4344
-
\??\c:\jvppd.exec:\jvppd.exe100⤵PID:3236
-
\??\c:\5jjdp.exec:\5jjdp.exe101⤵PID:2152
-
\??\c:\lxxlrlf.exec:\lxxlrlf.exe102⤵PID:2640
-
\??\c:\9tttnn.exec:\9tttnn.exe103⤵PID:1148
-
\??\c:\hntttb.exec:\hntttb.exe104⤵PID:1080
-
\??\c:\vjddd.exec:\vjddd.exe105⤵PID:3268
-
\??\c:\ppjvj.exec:\ppjvj.exe106⤵PID:4680
-
\??\c:\xxlllrx.exec:\xxlllrx.exe107⤵PID:4972
-
\??\c:\7rflrxx.exec:\7rflrxx.exe108⤵PID:2096
-
\??\c:\5hhbbt.exec:\5hhbbt.exe109⤵PID:460
-
\??\c:\btbbtb.exec:\btbbtb.exe110⤵PID:4880
-
\??\c:\vpvjj.exec:\vpvjj.exe111⤵PID:1504
-
\??\c:\jjvvp.exec:\jjvvp.exe112⤵PID:5056
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe113⤵PID:4412
-
\??\c:\hbbtbn.exec:\hbbtbn.exe114⤵PID:3000
-
\??\c:\nbbbhn.exec:\nbbbhn.exe115⤵PID:368
-
\??\c:\3vvvv.exec:\3vvvv.exe116⤵PID:3204
-
\??\c:\ppjvv.exec:\ppjvv.exe117⤵PID:1144
-
\??\c:\lrrxxff.exec:\lrrxxff.exe118⤵PID:744
-
\??\c:\xfxxfxf.exec:\xfxxfxf.exe119⤵PID:8
-
\??\c:\nnttnt.exec:\nnttnt.exe120⤵PID:952
-
\??\c:\hhtbbb.exec:\hhtbbb.exe121⤵PID:5040
-
\??\c:\jjjpj.exec:\jjjpj.exe122⤵PID:220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-