Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe
-
Size
82KB
-
MD5
2202d448ecab075af478ecd25a206973
-
SHA1
2446152ac46786d157b542bd90ab5618760d7663
-
SHA256
c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d
-
SHA512
65e9e264efa8960cf8a1b4cf2d6b5875afbeea9004578bd89ba00c1662e147c1d61beb4f1d7e37bf51fa2051676c20d3dfb91b920dc02934bf34e75d7584090d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2v7:ymb3NkkiQ3mdBjFo6Pfgy3dbc/7
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3024-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3024-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4904-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2912-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1604-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4156-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2912-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4900-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4556-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4556-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4556-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2284-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3672-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3880-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/388-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4204-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4000-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4584-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1612-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1976-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2480-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/536-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4552-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5100-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/832-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1004 fxrxrxl.exe 1052 3ntbbb.exe 4904 jvpjp.exe 4156 3ppjj.exe 2384 btbbtb.exe 1604 tnnhbt.exe 2912 9vvvv.exe 4900 btbthh.exe 4556 7vddp.exe 2284 7lrrrll.exe 5060 hnbhnn.exe 3672 vpppp.exe 3880 ddjjj.exe 388 5rrrflr.exe 4204 bthnbt.exe 4000 jpppj.exe 3308 xrrrrrr.exe 4584 bbbhhn.exe 2032 hbhbbb.exe 1612 djvdd.exe 5000 rrfffrl.exe 3520 nbnnnh.exe 1976 pddpj.exe 2480 dvvpd.exe 536 xlxxrrl.exe 4552 ntbbbn.exe 1788 btthhn.exe 5100 9pjdv.exe 2168 3xxffll.exe 5052 7bnhbh.exe 832 frlllxf.exe 2636 xxxrrrr.exe 3828 tnnttt.exe 1480 vvdvv.exe 4840 vjdjp.exe 3928 xxrrrrr.exe 2632 fllrrll.exe 4316 llrrxxl.exe 4380 9hhbnn.exe 5060 pjdvp.exe 4284 ppjjp.exe 5004 xxxffll.exe 4724 nhhhnb.exe 1192 1bbbtb.exe 4468 5vppp.exe 2664 lxxxxlf.exe 2316 fxxrllf.exe 1064 hnnbnn.exe 4584 tttnhh.exe 4608 jppvv.exe 2032 jdjpd.exe 2188 9rlfrxl.exe 4960 hbhhbb.exe 4328 tntnhh.exe 4964 dvddd.exe 1976 7jppj.exe 3276 xrlfrrr.exe 2408 hthhhh.exe 1392 tnnhtn.exe 2860 ddvjd.exe 1052 vjjjd.exe 2580 rxfllrx.exe 1116 xxrllll.exe 2168 hhhhhh.exe -
resource yara_rule behavioral2/memory/3024-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1004 3024 c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe 90 PID 3024 wrote to memory of 1004 3024 c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe 90 PID 3024 wrote to memory of 1004 3024 c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe 90 PID 1004 wrote to memory of 1052 1004 fxrxrxl.exe 91 PID 1004 wrote to memory of 1052 1004 fxrxrxl.exe 91 PID 1004 wrote to memory of 1052 1004 fxrxrxl.exe 91 PID 1052 wrote to memory of 4904 1052 3ntbbb.exe 92 PID 1052 wrote to memory of 4904 1052 3ntbbb.exe 92 PID 1052 wrote to memory of 4904 1052 3ntbbb.exe 92 PID 4904 wrote to memory of 4156 4904 jvpjp.exe 93 PID 4904 wrote to memory of 4156 4904 jvpjp.exe 93 PID 4904 wrote to memory of 4156 4904 jvpjp.exe 93 PID 4156 wrote to memory of 2384 4156 3ppjj.exe 94 PID 4156 wrote to memory of 2384 4156 3ppjj.exe 94 PID 4156 wrote to memory of 2384 4156 3ppjj.exe 94 PID 2384 wrote to memory of 1604 2384 btbbtb.exe 95 PID 2384 wrote to memory of 1604 2384 btbbtb.exe 95 PID 2384 wrote to memory of 1604 2384 btbbtb.exe 95 PID 1604 wrote to memory of 2912 1604 tnnhbt.exe 96 PID 1604 wrote to memory of 2912 1604 tnnhbt.exe 96 PID 1604 wrote to memory of 2912 1604 tnnhbt.exe 96 PID 2912 wrote to memory of 4900 2912 9vvvv.exe 97 PID 2912 wrote to memory of 4900 2912 9vvvv.exe 97 PID 2912 wrote to memory of 4900 2912 9vvvv.exe 97 PID 4900 wrote to memory of 4556 4900 btbthh.exe 98 PID 4900 wrote to memory of 4556 4900 btbthh.exe 98 PID 4900 wrote to memory of 4556 4900 btbthh.exe 98 PID 4556 wrote to memory of 2284 4556 7vddp.exe 99 PID 4556 wrote to memory of 2284 4556 7vddp.exe 99 PID 4556 wrote to memory of 2284 4556 7vddp.exe 99 PID 2284 wrote to memory of 5060 2284 7lrrrll.exe 100 PID 2284 wrote to memory of 5060 2284 7lrrrll.exe 100 PID 2284 wrote to memory of 5060 2284 7lrrrll.exe 100 PID 5060 wrote to memory of 3672 5060 hnbhnn.exe 101 PID 5060 wrote to memory of 3672 5060 hnbhnn.exe 101 PID 5060 wrote to memory of 3672 5060 hnbhnn.exe 101 PID 3672 wrote to memory of 3880 3672 vpppp.exe 102 PID 3672 wrote to memory of 3880 3672 vpppp.exe 102 PID 3672 wrote to memory of 3880 3672 vpppp.exe 102 PID 3880 wrote to memory of 388 3880 ddjjj.exe 103 PID 3880 wrote to memory of 388 3880 ddjjj.exe 103 PID 3880 wrote to memory of 388 3880 ddjjj.exe 103 PID 388 wrote to memory of 4204 388 5rrrflr.exe 104 PID 388 wrote to memory of 4204 388 5rrrflr.exe 104 PID 388 wrote to memory of 4204 388 5rrrflr.exe 104 PID 4204 wrote to memory of 4000 4204 bthnbt.exe 105 PID 4204 wrote to memory of 4000 4204 bthnbt.exe 105 PID 4204 wrote to memory of 4000 4204 bthnbt.exe 105 PID 4000 wrote to memory of 3308 4000 jpppj.exe 106 PID 4000 wrote to memory of 3308 4000 jpppj.exe 106 PID 4000 wrote to memory of 3308 4000 jpppj.exe 106 PID 3308 wrote to memory of 4584 3308 xrrrrrr.exe 107 PID 3308 wrote to memory of 4584 3308 xrrrrrr.exe 107 PID 3308 wrote to memory of 4584 3308 xrrrrrr.exe 107 PID 4584 wrote to memory of 2032 4584 bbbhhn.exe 108 PID 4584 wrote to memory of 2032 4584 bbbhhn.exe 108 PID 4584 wrote to memory of 2032 4584 bbbhhn.exe 108 PID 2032 wrote to memory of 1612 2032 hbhbbb.exe 110 PID 2032 wrote to memory of 1612 2032 hbhbbb.exe 110 PID 2032 wrote to memory of 1612 2032 hbhbbb.exe 110 PID 1612 wrote to memory of 5000 1612 djvdd.exe 111 PID 1612 wrote to memory of 5000 1612 djvdd.exe 111 PID 1612 wrote to memory of 5000 1612 djvdd.exe 111 PID 5000 wrote to memory of 3520 5000 rrfffrl.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe"C:\Users\Admin\AppData\Local\Temp\c18c11fc5c178ce0990eebc4d01c04a37d50dfa3d8f4605ee70574414fd4ec7d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\3ntbbb.exec:\3ntbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jvpjp.exec:\jvpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\3ppjj.exec:\3ppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\btbbtb.exec:\btbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\tnnhbt.exec:\tnnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\9vvvv.exec:\9vvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\btbthh.exec:\btbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\7vddp.exec:\7vddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\7lrrrll.exec:\7lrrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hnbhnn.exec:\hnbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vpppp.exec:\vpppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\ddjjj.exec:\ddjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\5rrrflr.exec:\5rrrflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\bthnbt.exec:\bthnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\jpppj.exec:\jpppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\bbbhhn.exec:\bbbhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\hbhbbb.exec:\hbhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\djvdd.exec:\djvdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rrfffrl.exec:\rrfffrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nbnnnh.exec:\nbnnnh.exe23⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pddpj.exec:\pddpj.exe24⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvvpd.exec:\dvvpd.exe25⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe26⤵
- Executes dropped EXE
PID:536 -
\??\c:\ntbbbn.exec:\ntbbbn.exe27⤵
- Executes dropped EXE
PID:4552 -
\??\c:\btthhn.exec:\btthhn.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9pjdv.exec:\9pjdv.exe29⤵
- Executes dropped EXE
PID:5100 -
\??\c:\3xxffll.exec:\3xxffll.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7bnhbh.exec:\7bnhbh.exe31⤵
- Executes dropped EXE
PID:5052 -
\??\c:\frlllxf.exec:\frlllxf.exe32⤵
- Executes dropped EXE
PID:832 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe33⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnnttt.exec:\tnnttt.exe34⤵
- Executes dropped EXE
PID:3828 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vjdjp.exec:\vjdjp.exe36⤵
- Executes dropped EXE
PID:4840 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe37⤵
- Executes dropped EXE
PID:3928 -
\??\c:\fllrrll.exec:\fllrrll.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llrrxxl.exec:\llrrxxl.exe39⤵
- Executes dropped EXE
PID:4316 -
\??\c:\9hhbnn.exec:\9hhbnn.exe40⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pjdvp.exec:\pjdvp.exe41⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ppjjp.exec:\ppjjp.exe42⤵
- Executes dropped EXE
PID:4284 -
\??\c:\xxxffll.exec:\xxxffll.exe43⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nhhhnb.exec:\nhhhnb.exe44⤵
- Executes dropped EXE
PID:4724 -
\??\c:\1bbbtb.exec:\1bbbtb.exe45⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5vppp.exec:\5vppp.exe46⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lxxxxlf.exec:\lxxxxlf.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fxxrllf.exec:\fxxrllf.exe48⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hnnbnn.exec:\hnnbnn.exe49⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tttnhh.exec:\tttnhh.exe50⤵
- Executes dropped EXE
PID:4584 -
\??\c:\jppvv.exec:\jppvv.exe51⤵
- Executes dropped EXE
PID:4608 -
\??\c:\jdjpd.exec:\jdjpd.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9rlfrxl.exec:\9rlfrxl.exe53⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbhhbb.exec:\hbhhbb.exe54⤵
- Executes dropped EXE
PID:4960 -
\??\c:\tntnhh.exec:\tntnhh.exe55⤵
- Executes dropped EXE
PID:4328 -
\??\c:\dvddd.exec:\dvddd.exe56⤵
- Executes dropped EXE
PID:4964 -
\??\c:\7jppj.exec:\7jppj.exe57⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xrlfrrr.exec:\xrlfrrr.exe58⤵
- Executes dropped EXE
PID:3276 -
\??\c:\hthhhh.exec:\hthhhh.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tnnhtn.exec:\tnnhtn.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\ddvjd.exec:\ddvjd.exe61⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vjjjd.exec:\vjjjd.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxfllrx.exec:\rxfllrx.exe63⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xxrllll.exec:\xxrllll.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hhhhhh.exec:\hhhhhh.exe65⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nnhhhn.exec:\nnhhhn.exe66⤵PID:2464
-
\??\c:\dddvd.exec:\dddvd.exe67⤵PID:4648
-
\??\c:\pppjp.exec:\pppjp.exe68⤵PID:4508
-
\??\c:\lfllllx.exec:\lfllllx.exe69⤵PID:2116
-
\??\c:\hthhbt.exec:\hthhbt.exe70⤵PID:4900
-
\??\c:\httbbn.exec:\httbbn.exe71⤵PID:1756
-
\??\c:\1vdvj.exec:\1vdvj.exe72⤵PID:3040
-
\??\c:\pvjdj.exec:\pvjdj.exe73⤵PID:3688
-
\??\c:\xfxxlfl.exec:\xfxxlfl.exe74⤵PID:4820
-
\??\c:\rlxxlfx.exec:\rlxxlfx.exe75⤵PID:1384
-
\??\c:\bbbbnh.exec:\bbbbnh.exe76⤵PID:3336
-
\??\c:\3pdjp.exec:\3pdjp.exe77⤵PID:3672
-
\??\c:\vvdvp.exec:\vvdvp.exe78⤵PID:1044
-
\??\c:\rflffxr.exec:\rflffxr.exe79⤵PID:4200
-
\??\c:\nbnthh.exec:\nbnthh.exe80⤵PID:1404
-
\??\c:\vvppj.exec:\vvppj.exe81⤵PID:1996
-
\??\c:\pdddv.exec:\pdddv.exe82⤵PID:2664
-
\??\c:\xxfxllr.exec:\xxfxllr.exe83⤵PID:2316
-
\??\c:\xxlrrrr.exec:\xxlrrrr.exe84⤵PID:4836
-
\??\c:\hbbbbb.exec:\hbbbbb.exe85⤵PID:4584
-
\??\c:\5hbbtb.exec:\5hbbtb.exe86⤵PID:4608
-
\??\c:\7jvvj.exec:\7jvvj.exe87⤵PID:4344
-
\??\c:\dvpvp.exec:\dvpvp.exe88⤵PID:2188
-
\??\c:\frlfrrl.exec:\frlfrrl.exe89⤵PID:3004
-
\??\c:\xxrlrrl.exec:\xxrlrrl.exe90⤵PID:4328
-
\??\c:\bnhhhh.exec:\bnhhhh.exe91⤵PID:4964
-
\??\c:\dvvjd.exec:\dvvjd.exe92⤵PID:2160
-
\??\c:\jvvvv.exec:\jvvvv.exe93⤵PID:3276
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe94⤵PID:4552
-
\??\c:\llrlfxx.exec:\llrlfxx.exe95⤵PID:2692
-
\??\c:\5nnnhh.exec:\5nnnhh.exe96⤵PID:3028
-
\??\c:\bbhnhh.exec:\bbhnhh.exe97⤵PID:4748
-
\??\c:\5vdjj.exec:\5vdjj.exe98⤵PID:1344
-
\??\c:\vpjjp.exec:\vpjjp.exe99⤵PID:412
-
\??\c:\xrfffff.exec:\xrfffff.exe100⤵PID:4580
-
\??\c:\7nbttn.exec:\7nbttn.exe101⤵PID:4088
-
\??\c:\nttthh.exec:\nttthh.exe102⤵PID:2948
-
\??\c:\ppjpd.exec:\ppjpd.exe103⤵PID:3828
-
\??\c:\frlfrlx.exec:\frlfrlx.exe104⤵PID:1480
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe105⤵PID:2724
-
\??\c:\nbbthh.exec:\nbbthh.exe106⤵PID:1424
-
\??\c:\nntthb.exec:\nntthb.exe107⤵PID:4460
-
\??\c:\vjdvd.exec:\vjdvd.exe108⤵PID:4316
-
\??\c:\1rllffr.exec:\1rllffr.exe109⤵PID:732
-
\??\c:\llrrxlf.exec:\llrrxlf.exe110⤵PID:4696
-
\??\c:\nnttnt.exec:\nnttnt.exe111⤵PID:5004
-
\??\c:\hbtnhb.exec:\hbtnhb.exe112⤵PID:4928
-
\??\c:\ddjjv.exec:\ddjjv.exe113⤵PID:3208
-
\??\c:\dvdjv.exec:\dvdjv.exe114⤵PID:4896
-
\??\c:\5xfffll.exec:\5xfffll.exe115⤵PID:1996
-
\??\c:\xrlffff.exec:\xrlffff.exe116⤵PID:1924
-
\??\c:\bnnhhh.exec:\bnnhhh.exe117⤵PID:2316
-
\??\c:\3thhbh.exec:\3thhbh.exe118⤵PID:1548
-
\??\c:\dvvvp.exec:\dvvvp.exe119⤵PID:3068
-
\??\c:\jvpvj.exec:\jvpvj.exe120⤵PID:2788
-
\??\c:\fxxllff.exec:\fxxllff.exe121⤵PID:4676
-
\??\c:\tnbhtt.exec:\tnbhtt.exe122⤵PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-