Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe
-
Size
63KB
-
MD5
1cd6beb3db803de72c24bfe505c5e455
-
SHA1
ff373248e2ef7b31891e72ac812af2a6723866bd
-
SHA256
2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c
-
SHA512
776efd4485a167fa84a64028d3ac870ff6fb697c4a6da2c6b9fdedf8dc687f58014c6d1341e7e45680b6186d5255e05a7c76def4f0712fc7618a2149b1f11a88
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDAB:ymb3NkkiQ3mdBjFIk8B
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4480-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/4480-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2184-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4536-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2664-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4908-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3104-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/428-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3936-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3936-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3936-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3936-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4152-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3236-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4108-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/852-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/432-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2500-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2272-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/740-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4424-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2616-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4632-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4820-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2184 rrxrffl.exe 3688 nhbbbb.exe 4536 bnhtbb.exe 2664 ppjdp.exe 4908 xrrfxll.exe 3104 3rrrllf.exe 4768 ttttnn.exe 428 vjjdv.exe 3936 lflfffl.exe 4844 hthbtt.exe 4152 ddddv.exe 3464 llffffx.exe 3236 xrxxrrl.exe 4108 nnhbbh.exe 852 ddpjd.exe 3660 fxxrffx.exe 432 bbnnbh.exe 3512 3btnbb.exe 376 dvddj.exe 2500 7rxlxfx.exe 2272 fxlxlfr.exe 740 bbhhnn.exe 4424 3jdvv.exe 4952 vvvvj.exe 2616 fxxrffl.exe 4632 7hbthb.exe 2364 dvpjp.exe 4820 fllflff.exe 3928 fxrflfx.exe 2060 nhbtbb.exe 2056 jvpjv.exe 4644 rffxrll.exe 4792 xrxxxxr.exe 544 nnnnhh.exe 3632 nttnhh.exe 3412 dvdjj.exe 1604 3xxrffx.exe 4864 tthhhh.exe 1916 nhbhhh.exe 4536 7vddv.exe 1936 vvvdj.exe 2052 ffrrrxr.exe 1948 xxrllrl.exe 996 nbhhht.exe 228 7pvpj.exe 3972 jppjd.exe 3168 xlxxxff.exe 2040 rrrrlll.exe 396 ntttbn.exe 1680 jvdvp.exe 4836 pjdvp.exe 1496 xfxrrlr.exe 3840 xlxrxxf.exe 3492 thhhbh.exe 4376 thnhbb.exe 4008 dvvpj.exe 2220 jvpjp.exe 4996 fllfxff.exe 2400 9nhbtt.exe 444 9bbtnb.exe 2260 1vdvv.exe 1628 5vpjj.exe 4980 rlrllrl.exe 3912 xllrllf.exe -
resource yara_rule behavioral2/memory/4480-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2184 4480 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 82 PID 4480 wrote to memory of 2184 4480 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 82 PID 4480 wrote to memory of 2184 4480 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 82 PID 2184 wrote to memory of 3688 2184 rrxrffl.exe 83 PID 2184 wrote to memory of 3688 2184 rrxrffl.exe 83 PID 2184 wrote to memory of 3688 2184 rrxrffl.exe 83 PID 3688 wrote to memory of 4536 3688 nhbbbb.exe 84 PID 3688 wrote to memory of 4536 3688 nhbbbb.exe 84 PID 3688 wrote to memory of 4536 3688 nhbbbb.exe 84 PID 4536 wrote to memory of 2664 4536 bnhtbb.exe 85 PID 4536 wrote to memory of 2664 4536 bnhtbb.exe 85 PID 4536 wrote to memory of 2664 4536 bnhtbb.exe 85 PID 2664 wrote to memory of 4908 2664 ppjdp.exe 86 PID 2664 wrote to memory of 4908 2664 ppjdp.exe 86 PID 2664 wrote to memory of 4908 2664 ppjdp.exe 86 PID 4908 wrote to memory of 3104 4908 xrrfxll.exe 87 PID 4908 wrote to memory of 3104 4908 xrrfxll.exe 87 PID 4908 wrote to memory of 3104 4908 xrrfxll.exe 87 PID 3104 wrote to memory of 4768 3104 3rrrllf.exe 88 PID 3104 wrote to memory of 4768 3104 3rrrllf.exe 88 PID 3104 wrote to memory of 4768 3104 3rrrllf.exe 88 PID 4768 wrote to memory of 428 4768 ttttnn.exe 89 PID 4768 wrote to memory of 428 4768 ttttnn.exe 89 PID 4768 wrote to memory of 428 4768 ttttnn.exe 89 PID 428 wrote to memory of 3936 428 vjjdv.exe 90 PID 428 wrote to memory of 3936 428 vjjdv.exe 90 PID 428 wrote to memory of 3936 428 vjjdv.exe 90 PID 3936 wrote to memory of 4844 3936 lflfffl.exe 91 PID 3936 wrote to memory of 4844 3936 lflfffl.exe 91 PID 3936 wrote to memory of 4844 3936 lflfffl.exe 91 PID 4844 wrote to memory of 4152 4844 hthbtt.exe 92 PID 4844 wrote to memory of 4152 4844 hthbtt.exe 92 PID 4844 wrote to memory of 4152 4844 hthbtt.exe 92 PID 4152 wrote to memory of 3464 4152 ddddv.exe 93 PID 4152 wrote to memory of 3464 4152 ddddv.exe 93 PID 4152 wrote to memory of 3464 4152 ddddv.exe 93 PID 3464 wrote to memory of 3236 3464 llffffx.exe 94 PID 3464 wrote to memory of 3236 3464 llffffx.exe 94 PID 3464 wrote to memory of 3236 3464 llffffx.exe 94 PID 3236 wrote to memory of 4108 3236 xrxxrrl.exe 95 PID 3236 wrote to memory of 4108 3236 xrxxrrl.exe 95 PID 3236 wrote to memory of 4108 3236 xrxxrrl.exe 95 PID 4108 wrote to memory of 852 4108 nnhbbh.exe 96 PID 4108 wrote to memory of 852 4108 nnhbbh.exe 96 PID 4108 wrote to memory of 852 4108 nnhbbh.exe 96 PID 852 wrote to memory of 3660 852 ddpjd.exe 97 PID 852 wrote to memory of 3660 852 ddpjd.exe 97 PID 852 wrote to memory of 3660 852 ddpjd.exe 97 PID 3660 wrote to memory of 432 3660 fxxrffx.exe 98 PID 3660 wrote to memory of 432 3660 fxxrffx.exe 98 PID 3660 wrote to memory of 432 3660 fxxrffx.exe 98 PID 432 wrote to memory of 3512 432 bbnnbh.exe 99 PID 432 wrote to memory of 3512 432 bbnnbh.exe 99 PID 432 wrote to memory of 3512 432 bbnnbh.exe 99 PID 3512 wrote to memory of 376 3512 3btnbb.exe 100 PID 3512 wrote to memory of 376 3512 3btnbb.exe 100 PID 3512 wrote to memory of 376 3512 3btnbb.exe 100 PID 376 wrote to memory of 2500 376 dvddj.exe 101 PID 376 wrote to memory of 2500 376 dvddj.exe 101 PID 376 wrote to memory of 2500 376 dvddj.exe 101 PID 2500 wrote to memory of 2272 2500 7rxlxfx.exe 102 PID 2500 wrote to memory of 2272 2500 7rxlxfx.exe 102 PID 2500 wrote to memory of 2272 2500 7rxlxfx.exe 102 PID 2272 wrote to memory of 740 2272 fxlxlfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe"C:\Users\Admin\AppData\Local\Temp\2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\rrxrffl.exec:\rrxrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nhbbbb.exec:\nhbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\bnhtbb.exec:\bnhtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\ppjdp.exec:\ppjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\xrrfxll.exec:\xrrfxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\3rrrllf.exec:\3rrrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\ttttnn.exec:\ttttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\vjjdv.exec:\vjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\lflfffl.exec:\lflfffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\hthbtt.exec:\hthbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\ddddv.exec:\ddddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\llffffx.exec:\llffffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\nnhbbh.exec:\nnhbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\ddpjd.exec:\ddpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\fxxrffx.exec:\fxxrffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\bbnnbh.exec:\bbnnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\3btnbb.exec:\3btnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\dvddj.exec:\dvddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\7rxlxfx.exec:\7rxlxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\fxlxlfr.exec:\fxlxlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\bbhhnn.exec:\bbhhnn.exe23⤵
- Executes dropped EXE
PID:740 -
\??\c:\3jdvv.exec:\3jdvv.exe24⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vvvvj.exec:\vvvvj.exe25⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fxxrffl.exec:\fxxrffl.exe26⤵
- Executes dropped EXE
PID:2616 -
\??\c:\7hbthb.exec:\7hbthb.exe27⤵
- Executes dropped EXE
PID:4632 -
\??\c:\dvpjp.exec:\dvpjp.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fllflff.exec:\fllflff.exe29⤵
- Executes dropped EXE
PID:4820 -
\??\c:\fxrflfx.exec:\fxrflfx.exe30⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nhbtbb.exec:\nhbtbb.exe31⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jvpjv.exec:\jvpjv.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rffxrll.exec:\rffxrll.exe33⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe34⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nnnnhh.exec:\nnnnhh.exe35⤵
- Executes dropped EXE
PID:544 -
\??\c:\nttnhh.exec:\nttnhh.exe36⤵
- Executes dropped EXE
PID:3632 -
\??\c:\dvdjj.exec:\dvdjj.exe37⤵
- Executes dropped EXE
PID:3412 -
\??\c:\3xxrffx.exec:\3xxrffx.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tthhhh.exec:\tthhhh.exe39⤵
- Executes dropped EXE
PID:4864 -
\??\c:\nhbhhh.exec:\nhbhhh.exe40⤵
- Executes dropped EXE
PID:1916 -
\??\c:\7vddv.exec:\7vddv.exe41⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vvvdj.exec:\vvvdj.exe42⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ffrrrxr.exec:\ffrrrxr.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xxrllrl.exec:\xxrllrl.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nbhhht.exec:\nbhhht.exe45⤵
- Executes dropped EXE
PID:996 -
\??\c:\7pvpj.exec:\7pvpj.exe46⤵
- Executes dropped EXE
PID:228 -
\??\c:\jppjd.exec:\jppjd.exe47⤵
- Executes dropped EXE
PID:3972 -
\??\c:\xlxxxff.exec:\xlxxxff.exe48⤵
- Executes dropped EXE
PID:3168 -
\??\c:\rrrrlll.exec:\rrrrlll.exe49⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ntttbn.exec:\ntttbn.exe50⤵
- Executes dropped EXE
PID:396 -
\??\c:\jvdvp.exec:\jvdvp.exe51⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjdvp.exec:\pjdvp.exe52⤵
- Executes dropped EXE
PID:4836 -
\??\c:\xfxrrlr.exec:\xfxrrlr.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe54⤵
- Executes dropped EXE
PID:3840 -
\??\c:\thhhbh.exec:\thhhbh.exe55⤵
- Executes dropped EXE
PID:3492 -
\??\c:\thnhbb.exec:\thnhbb.exe56⤵
- Executes dropped EXE
PID:4376 -
\??\c:\dvvpj.exec:\dvvpj.exe57⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jvpjp.exec:\jvpjp.exe58⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fllfxff.exec:\fllfxff.exe59⤵
- Executes dropped EXE
PID:4996 -
\??\c:\9nhbtt.exec:\9nhbtt.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9bbtnb.exec:\9bbtnb.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\1vdvv.exec:\1vdvv.exe62⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5vpjj.exec:\5vpjj.exe63⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rlrllrl.exec:\rlrllrl.exe64⤵
- Executes dropped EXE
PID:4980 -
\??\c:\xllrllf.exec:\xllrllf.exe65⤵
- Executes dropped EXE
PID:3912 -
\??\c:\htnhbt.exec:\htnhbt.exe66⤵PID:2536
-
\??\c:\7htntn.exec:\7htntn.exe67⤵PID:4992
-
\??\c:\7dpdv.exec:\7dpdv.exe68⤵PID:1732
-
\??\c:\dppjd.exec:\dppjd.exe69⤵PID:5008
-
\??\c:\9tthnt.exec:\9tthnt.exe70⤵PID:3944
-
\??\c:\ddjpp.exec:\ddjpp.exe71⤵PID:4032
-
\??\c:\lxrrxrl.exec:\lxrrxrl.exe72⤵PID:1452
-
\??\c:\xlrfxlf.exec:\xlrfxlf.exe73⤵PID:2364
-
\??\c:\hbnthn.exec:\hbnthn.exe74⤵PID:2544
-
\??\c:\tnhbnh.exec:\tnhbnh.exe75⤵PID:3084
-
\??\c:\vddvp.exec:\vddvp.exe76⤵PID:3928
-
\??\c:\dvjvj.exec:\dvjvj.exe77⤵PID:4084
-
\??\c:\3flrlxl.exec:\3flrlxl.exe78⤵PID:4368
-
\??\c:\bbnbtn.exec:\bbnbtn.exe79⤵PID:5024
-
\??\c:\nbthnh.exec:\nbthnh.exe80⤵PID:4556
-
\??\c:\nnnhbb.exec:\nnnhbb.exe81⤵PID:1704
-
\??\c:\dvvjv.exec:\dvvjv.exe82⤵PID:1432
-
\??\c:\ffxlrrf.exec:\ffxlrrf.exe83⤵PID:2816
-
\??\c:\htbtnh.exec:\htbtnh.exe84⤵PID:2572
-
\??\c:\jjjvj.exec:\jjjvj.exe85⤵PID:1604
-
\??\c:\dvvjv.exec:\dvvjv.exe86⤵PID:4168
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe87⤵PID:2252
-
\??\c:\5xlxrlf.exec:\5xlxrlf.exe88⤵PID:4536
-
\??\c:\tttbtn.exec:\tttbtn.exe89⤵PID:1308
-
\??\c:\pjdpd.exec:\pjdpd.exe90⤵PID:1864
-
\??\c:\djvjv.exec:\djvjv.exe91⤵PID:312
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe92⤵PID:4956
-
\??\c:\xrxllff.exec:\xrxllff.exe93⤵PID:3720
-
\??\c:\hnbbht.exec:\hnbbht.exe94⤵PID:3936
-
\??\c:\jddvd.exec:\jddvd.exe95⤵PID:3168
-
\??\c:\jjdjv.exec:\jjdjv.exe96⤵PID:4348
-
\??\c:\5ffffxx.exec:\5ffffxx.exe97⤵PID:3976
-
\??\c:\bnhbnb.exec:\bnhbnb.exe98⤵PID:2788
-
\??\c:\bhhtnt.exec:\bhhtnt.exe99⤵PID:4836
-
\??\c:\3jvjv.exec:\3jvjv.exe100⤵PID:3244
-
\??\c:\vpjdp.exec:\vpjdp.exe101⤵PID:2532
-
\??\c:\hnhthb.exec:\hnhthb.exe102⤵PID:3248
-
\??\c:\7dddv.exec:\7dddv.exe103⤵PID:4356
-
\??\c:\jvvvv.exec:\jvvvv.exe104⤵PID:4580
-
\??\c:\frflfxr.exec:\frflfxr.exe105⤵PID:4064
-
\??\c:\lxrllfr.exec:\lxrllfr.exe106⤵PID:4772
-
\??\c:\bhbthh.exec:\bhbthh.exe107⤵PID:376
-
\??\c:\vvpjv.exec:\vvpjv.exe108⤵PID:1768
-
\??\c:\dddvv.exec:\dddvv.exe109⤵PID:2272
-
\??\c:\9rrlrlf.exec:\9rrlrlf.exe110⤵PID:876
-
\??\c:\1lrffff.exec:\1lrffff.exe111⤵PID:2012
-
\??\c:\1ntnhn.exec:\1ntnhn.exe112⤵PID:3228
-
\??\c:\nntnbt.exec:\nntnbt.exe113⤵PID:2348
-
\??\c:\djddv.exec:\djddv.exe114⤵PID:3716
-
\??\c:\pvvpj.exec:\pvvpj.exe115⤵PID:2616
-
\??\c:\lrffxll.exec:\lrffxll.exe116⤵PID:3748
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe117⤵PID:1284
-
\??\c:\tbnbnt.exec:\tbnbnt.exe118⤵PID:3252
-
\??\c:\dppjv.exec:\dppjv.exe119⤵PID:2804
-
\??\c:\pdjvj.exec:\pdjvj.exe120⤵PID:4292
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe121⤵PID:3084
-
\??\c:\xfrrffx.exec:\xfrrffx.exe122⤵PID:2024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-