Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe
-
Size
94KB
-
MD5
8d8b90c4e3754ad32505fc40989faaaf
-
SHA1
a95db69036b984a8e9be3a6a9d157228d2c14943
-
SHA256
feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c
-
SHA512
cc96e0b5743026521f49300302ee7e582e1e3034fefc709f69a3330ef3c98c815ec179e0f57e68e56c1d005b19ee891c4df19d356409b488aea42ef621180d34
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEq:ymb3NkkiQ3mdBjFoLucjDilOZhoP
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4920-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6060-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6084-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6084-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5632-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5360-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5636-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5368-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5144-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5504-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral2/memory/4920-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2992-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3996-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/6060-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/6084-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5632-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1128-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1384-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1304-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5360-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2404-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5116-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4188-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1180-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5636-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5368-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1628-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5144-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5504-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2992 rfxlrlx.exe 3996 1xxxlfx.exe 2616 3ttnhh.exe 6060 vdvdp.exe 6084 rlllrlf.exe 5632 nhhtht.exe 3648 jpppv.exe 1128 9djdp.exe 1972 rxrlfxr.exe 1384 xxrlrrr.exe 1304 tbbtnh.exe 3332 jvpdp.exe 5360 xxxlffx.exe 2404 tntnhb.exe 5096 pdpvj.exe 4968 pjjdp.exe 5116 xxflffx.exe 4188 thbbnn.exe 4056 jjjvj.exe 4044 ffxlxrl.exe 5304 tbtnhb.exe 1180 tnhhbt.exe 5636 vpjjd.exe 5368 3jjdj.exe 1964 xxrfffx.exe 1628 hhhbnh.exe 5144 ddjpd.exe 5504 jpvdj.exe 3880 3rxlrlf.exe 4900 3bbnht.exe 636 pjdpp.exe 3308 jvvdd.exe 5036 frxfxfx.exe 3412 hnbnhh.exe 3176 9pjdd.exe 1532 jvvpp.exe 2464 1fxlffl.exe 5584 9lrfxrl.exe 3196 3hbttt.exe 3720 7pvjv.exe 5416 vdvpd.exe 1448 rlrllfr.exe 2768 tnhbth.exe 2536 3hhbhn.exe 5064 1jjvp.exe 2384 7pvjv.exe 2880 1flrfff.exe 6136 nnhbtn.exe 388 btnhtn.exe 1872 vjvdp.exe 2280 pjvpj.exe 2832 xxxlfrl.exe 5372 ffxrrll.exe 2304 3htnhb.exe 5520 ttttnt.exe 684 dppjp.exe 2740 ddvjd.exe 2028 lxfxrrl.exe 2972 5lrlffx.exe 4796 1nhhhn.exe 5492 nhbnbb.exe 4780 ddpjj.exe 1380 dvvpv.exe 4180 lxlffff.exe -
resource yara_rule behavioral2/memory/4920-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6060-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6084-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5632-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5360-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5636-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5368-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5144-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5504-184-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2992 4920 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 81 PID 4920 wrote to memory of 2992 4920 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 81 PID 4920 wrote to memory of 2992 4920 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 81 PID 2992 wrote to memory of 3996 2992 rfxlrlx.exe 82 PID 2992 wrote to memory of 3996 2992 rfxlrlx.exe 82 PID 2992 wrote to memory of 3996 2992 rfxlrlx.exe 82 PID 3996 wrote to memory of 2616 3996 1xxxlfx.exe 83 PID 3996 wrote to memory of 2616 3996 1xxxlfx.exe 83 PID 3996 wrote to memory of 2616 3996 1xxxlfx.exe 83 PID 2616 wrote to memory of 6060 2616 3ttnhh.exe 84 PID 2616 wrote to memory of 6060 2616 3ttnhh.exe 84 PID 2616 wrote to memory of 6060 2616 3ttnhh.exe 84 PID 6060 wrote to memory of 6084 6060 vdvdp.exe 85 PID 6060 wrote to memory of 6084 6060 vdvdp.exe 85 PID 6060 wrote to memory of 6084 6060 vdvdp.exe 85 PID 6084 wrote to memory of 5632 6084 rlllrlf.exe 86 PID 6084 wrote to memory of 5632 6084 rlllrlf.exe 86 PID 6084 wrote to memory of 5632 6084 rlllrlf.exe 86 PID 5632 wrote to memory of 3648 5632 nhhtht.exe 87 PID 5632 wrote to memory of 3648 5632 nhhtht.exe 87 PID 5632 wrote to memory of 3648 5632 nhhtht.exe 87 PID 3648 wrote to memory of 1128 3648 jpppv.exe 88 PID 3648 wrote to memory of 1128 3648 jpppv.exe 88 PID 3648 wrote to memory of 1128 3648 jpppv.exe 88 PID 1128 wrote to memory of 1972 1128 9djdp.exe 89 PID 1128 wrote to memory of 1972 1128 9djdp.exe 89 PID 1128 wrote to memory of 1972 1128 9djdp.exe 89 PID 1972 wrote to memory of 1384 1972 rxrlfxr.exe 90 PID 1972 wrote to memory of 1384 1972 rxrlfxr.exe 90 PID 1972 wrote to memory of 1384 1972 rxrlfxr.exe 90 PID 1384 wrote to memory of 1304 1384 xxrlrrr.exe 91 PID 1384 wrote to memory of 1304 1384 xxrlrrr.exe 91 PID 1384 wrote to memory of 1304 1384 xxrlrrr.exe 91 PID 1304 wrote to memory of 3332 1304 tbbtnh.exe 92 PID 1304 wrote to memory of 3332 1304 tbbtnh.exe 92 PID 1304 wrote to memory of 3332 1304 tbbtnh.exe 92 PID 3332 wrote to memory of 5360 3332 jvpdp.exe 93 PID 3332 wrote to memory of 5360 3332 jvpdp.exe 93 PID 3332 wrote to memory of 5360 3332 jvpdp.exe 93 PID 5360 wrote to memory of 2404 5360 xxxlffx.exe 94 PID 5360 wrote to memory of 2404 5360 xxxlffx.exe 94 PID 5360 wrote to memory of 2404 5360 xxxlffx.exe 94 PID 2404 wrote to memory of 5096 2404 tntnhb.exe 95 PID 2404 wrote to memory of 5096 2404 tntnhb.exe 95 PID 2404 wrote to memory of 5096 2404 tntnhb.exe 95 PID 5096 wrote to memory of 4968 5096 pdpvj.exe 96 PID 5096 wrote to memory of 4968 5096 pdpvj.exe 96 PID 5096 wrote to memory of 4968 5096 pdpvj.exe 96 PID 4968 wrote to memory of 5116 4968 pjjdp.exe 98 PID 4968 wrote to memory of 5116 4968 pjjdp.exe 98 PID 4968 wrote to memory of 5116 4968 pjjdp.exe 98 PID 5116 wrote to memory of 4188 5116 xxflffx.exe 99 PID 5116 wrote to memory of 4188 5116 xxflffx.exe 99 PID 5116 wrote to memory of 4188 5116 xxflffx.exe 99 PID 4188 wrote to memory of 4056 4188 thbbnn.exe 100 PID 4188 wrote to memory of 4056 4188 thbbnn.exe 100 PID 4188 wrote to memory of 4056 4188 thbbnn.exe 100 PID 4056 wrote to memory of 4044 4056 jjjvj.exe 101 PID 4056 wrote to memory of 4044 4056 jjjvj.exe 101 PID 4056 wrote to memory of 4044 4056 jjjvj.exe 101 PID 4044 wrote to memory of 5304 4044 ffxlxrl.exe 102 PID 4044 wrote to memory of 5304 4044 ffxlxrl.exe 102 PID 4044 wrote to memory of 5304 4044 ffxlxrl.exe 102 PID 5304 wrote to memory of 1180 5304 tbtnhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe"C:\Users\Admin\AppData\Local\Temp\feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rfxlrlx.exec:\rfxlrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\1xxxlfx.exec:\1xxxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\3ttnhh.exec:\3ttnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vdvdp.exec:\vdvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
\??\c:\rlllrlf.exec:\rlllrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
\??\c:\nhhtht.exec:\nhhtht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
\??\c:\jpppv.exec:\jpppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\9djdp.exec:\9djdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\xxrlrrr.exec:\xxrlrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\tbbtnh.exec:\tbbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\jvpdp.exec:\jvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\xxxlffx.exec:\xxxlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
\??\c:\tntnhb.exec:\tntnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\pdpvj.exec:\pdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\pjjdp.exec:\pjjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\xxflffx.exec:\xxflffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\thbbnn.exec:\thbbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\jjjvj.exec:\jjjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\tbtnhb.exec:\tbtnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
\??\c:\tnhhbt.exec:\tnhhbt.exe23⤵
- Executes dropped EXE
PID:1180 -
\??\c:\vpjjd.exec:\vpjjd.exe24⤵
- Executes dropped EXE
PID:5636 -
\??\c:\3jjdj.exec:\3jjdj.exe25⤵
- Executes dropped EXE
PID:5368 -
\??\c:\xxrfffx.exec:\xxrfffx.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hhhbnh.exec:\hhhbnh.exe27⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ddjpd.exec:\ddjpd.exe28⤵
- Executes dropped EXE
PID:5144 -
\??\c:\jpvdj.exec:\jpvdj.exe29⤵
- Executes dropped EXE
PID:5504 -
\??\c:\3rxlrlf.exec:\3rxlrlf.exe30⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3bbnht.exec:\3bbnht.exe31⤵
- Executes dropped EXE
PID:4900 -
\??\c:\pjdpp.exec:\pjdpp.exe32⤵
- Executes dropped EXE
PID:636 -
\??\c:\jvvdd.exec:\jvvdd.exe33⤵
- Executes dropped EXE
PID:3308 -
\??\c:\frxfxfx.exec:\frxfxfx.exe34⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hnbnhh.exec:\hnbnhh.exe35⤵
- Executes dropped EXE
PID:3412 -
\??\c:\9pjdd.exec:\9pjdd.exe36⤵
- Executes dropped EXE
PID:3176 -
\??\c:\jvvpp.exec:\jvvpp.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1fxlffl.exec:\1fxlffl.exe38⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9lrfxrl.exec:\9lrfxrl.exe39⤵
- Executes dropped EXE
PID:5584 -
\??\c:\3hbttt.exec:\3hbttt.exe40⤵
- Executes dropped EXE
PID:3196 -
\??\c:\7pvjv.exec:\7pvjv.exe41⤵
- Executes dropped EXE
PID:3720 -
\??\c:\vdvpd.exec:\vdvpd.exe42⤵
- Executes dropped EXE
PID:5416 -
\??\c:\rlrllfr.exec:\rlrllfr.exe43⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tnhbth.exec:\tnhbth.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3hhbhn.exec:\3hhbhn.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1jjvp.exec:\1jjvp.exe46⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7pvjv.exec:\7pvjv.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1flrfff.exec:\1flrfff.exe48⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nnhbtn.exec:\nnhbtn.exe49⤵
- Executes dropped EXE
PID:6136 -
\??\c:\btnhtn.exec:\btnhtn.exe50⤵
- Executes dropped EXE
PID:388 -
\??\c:\vjvdp.exec:\vjvdp.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pjvpj.exec:\pjvpj.exe52⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ffxrrll.exec:\ffxrrll.exe54⤵
- Executes dropped EXE
PID:5372 -
\??\c:\3htnhb.exec:\3htnhb.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ttttnt.exec:\ttttnt.exe56⤵
- Executes dropped EXE
PID:5520 -
\??\c:\dppjp.exec:\dppjp.exe57⤵
- Executes dropped EXE
PID:684 -
\??\c:\ddvjd.exec:\ddvjd.exe58⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5lrlffx.exec:\5lrlffx.exe60⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1nhhhn.exec:\1nhhhn.exe61⤵
- Executes dropped EXE
PID:4796 -
\??\c:\nhbnbb.exec:\nhbnbb.exe62⤵
- Executes dropped EXE
PID:5492 -
\??\c:\ddpjj.exec:\ddpjj.exe63⤵
- Executes dropped EXE
PID:4780 -
\??\c:\dvvpv.exec:\dvvpv.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lxlffff.exec:\lxlffff.exe65⤵
- Executes dropped EXE
PID:4180 -
\??\c:\1hnhtn.exec:\1hnhtn.exe66⤵PID:5476
-
\??\c:\bnbnbb.exec:\bnbnbb.exe67⤵PID:1084
-
\??\c:\jppdv.exec:\jppdv.exe68⤵PID:6112
-
\??\c:\3pvpj.exec:\3pvpj.exe69⤵PID:4020
-
\??\c:\pvvpv.exec:\pvvpv.exe70⤵PID:4000
-
\??\c:\flxrflr.exec:\flxrflr.exe71⤵PID:3408
-
\??\c:\xlxrfxl.exec:\xlxrfxl.exe72⤵PID:5676
-
\??\c:\btbtnh.exec:\btbtnh.exe73⤵PID:4492
-
\??\c:\5nnnbt.exec:\5nnnbt.exe74⤵PID:4868
-
\??\c:\pdjdp.exec:\pdjdp.exe75⤵PID:4228
-
\??\c:\7vvjv.exec:\7vvjv.exe76⤵PID:4924
-
\??\c:\1rfxlfx.exec:\1rfxlfx.exe77⤵PID:4552
-
\??\c:\nhhbtt.exec:\nhhbtt.exe78⤵PID:4768
-
\??\c:\1thtnn.exec:\1thtnn.exe79⤵PID:2580
-
\??\c:\jppjv.exec:\jppjv.exe80⤵PID:3560
-
\??\c:\llffrrl.exec:\llffrrl.exe81⤵PID:2372
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe82⤵PID:3084
-
\??\c:\bnnhhb.exec:\bnnhhb.exe83⤵PID:2416
-
\??\c:\dpddj.exec:\dpddj.exe84⤵PID:1600
-
\??\c:\1jddp.exec:\1jddp.exe85⤵PID:4572
-
\??\c:\9ffxlxr.exec:\9ffxlxr.exe86⤵PID:4288
-
\??\c:\fllllfr.exec:\fllllfr.exe87⤵PID:5712
-
\??\c:\9pppj.exec:\9pppj.exe88⤵PID:5752
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe89⤵PID:4536
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe90⤵PID:3332
-
\??\c:\3btnbt.exec:\3btnbt.exe91⤵PID:4032
-
\??\c:\jvvpd.exec:\jvvpd.exe92⤵PID:5604
-
\??\c:\frxlfxx.exec:\frxlfxx.exe93⤵PID:4948
-
\??\c:\bbntht.exec:\bbntht.exe94⤵PID:5232
-
\??\c:\3nthtt.exec:\3nthtt.exe95⤵PID:4968
-
\??\c:\jpddv.exec:\jpddv.exe96⤵PID:1820
-
\??\c:\dvdjj.exec:\dvdjj.exe97⤵PID:4908
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe98⤵PID:400
-
\??\c:\5hnhhh.exec:\5hnhhh.exe99⤵PID:3272
-
\??\c:\dvjdj.exec:\dvjdj.exe100⤵PID:396
-
\??\c:\vjpvv.exec:\vjpvv.exe101⤵PID:4480
-
\??\c:\lffxxxx.exec:\lffxxxx.exe102⤵PID:1928
-
\??\c:\1nbtnt.exec:\1nbtnt.exe103⤵PID:5484
-
\??\c:\tntttt.exec:\tntttt.exe104⤵PID:5708
-
\??\c:\jjppj.exec:\jjppj.exe105⤵PID:5736
-
\??\c:\pjdvp.exec:\pjdvp.exe106⤵PID:4100
-
\??\c:\llrxxxl.exec:\llrxxxl.exe107⤵PID:3116
-
\??\c:\xxflrxf.exec:\xxflrxf.exe108⤵PID:4484
-
\??\c:\thnhbb.exec:\thnhbb.exe109⤵PID:5740
-
\??\c:\ttnttb.exec:\ttnttb.exe110⤵PID:1704
-
\??\c:\djdjp.exec:\djdjp.exe111⤵PID:5504
-
\??\c:\ppjpd.exec:\ppjpd.exe112⤵PID:4624
-
\??\c:\lrfflff.exec:\lrfflff.exe113⤵PID:4464
-
\??\c:\ffxxflr.exec:\ffxxflr.exe114⤵PID:4900
-
\??\c:\tbnntt.exec:\tbnntt.exe115⤵PID:912
-
\??\c:\ttnnhb.exec:\ttnnhb.exe116⤵PID:3068
-
\??\c:\9jpjj.exec:\9jpjj.exe117⤵PID:3188
-
\??\c:\pddvp.exec:\pddvp.exe118⤵PID:3136
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe119⤵PID:2008
-
\??\c:\xxffffx.exec:\xxffffx.exe120⤵PID:1340
-
\??\c:\9btnnn.exec:\9btnnn.exe121⤵PID:1124
-
\??\c:\vpvpj.exec:\vpvpj.exe122⤵PID:3100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-