Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe
-
Size
393KB
-
MD5
66aec11d1bf222f301c43affc4c05ea3
-
SHA1
e715e421572a511a91c95cc58180bd77821c8f24
-
SHA256
804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527
-
SHA512
b5b8b6c2e3787d3064c56a923bbcae9155d6cbcd29edd9b129015ca99c17ac0fc7a02abcd44e42a5f3e9f53d177d0bd9f09afa70fc1c53d1d162459bc5deb147
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOs:n3C9uYA7okVqdKwaO5CVm
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4068-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/4068-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/860-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/832-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1272-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1368-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1368-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1368-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1816-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1264-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/856-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/856-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2720-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5032-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4148-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4756-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4816-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3428-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1156-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3320-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2532-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2440-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1136-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 860 jdddj.exe 832 fxrfffl.exe 4656 btbtnt.exe 1272 nhnhtt.exe 1368 dvpjd.exe 1816 vdjdd.exe 1264 xrrlxfx.exe 856 bnnhhh.exe 2720 nnttnt.exe 5032 jdppj.exe 4148 llxrrff.exe 4704 ppvpv.exe 4756 fxxflrr.exe 2556 tbnnnt.exe 3272 flrrlll.exe 4816 xlfxfxr.exe 2796 bntnnn.exe 3428 lllfrrr.exe 2924 htbtth.exe 1156 lfffxff.exe 4548 nnbntn.exe 664 pdppj.exe 3320 pvppj.exe 2532 tnnhtt.exe 2440 rllfxfx.exe 1136 9hnhhh.exe 4880 dvddj.exe 4104 htbbtn.exe 2296 pjvvv.exe 4764 xfxfllf.exe 4748 bhhhhn.exe 5096 ffffrrr.exe 1764 bhnnnn.exe 2104 rffflfr.exe 2492 rlxxrrr.exe 4656 hhnhhh.exe 4424 jdpjv.exe 1908 xlffxxx.exe 2380 3frlllf.exe 4896 nnhhnn.exe 1816 5vvpj.exe 3724 xxrlrff.exe 3608 bhhbnh.exe 5108 7pjdv.exe 3096 vdjjp.exe 1064 5rfxlrf.exe 1960 htnhtn.exe 872 ththth.exe 2488 vjjjv.exe 3156 rllffxf.exe 3288 thbtnh.exe 1916 jjjdv.exe 1668 pjvvv.exe 848 frrllfl.exe 4672 bhnnbt.exe 2916 dvjdd.exe 4948 ppdvj.exe 5024 flffrrl.exe 4056 ntthnh.exe 4140 9hnhhb.exe 3536 dppjv.exe 4460 xrffrxr.exe 3560 bnbtbb.exe 3320 vpddj.exe -
resource yara_rule behavioral2/memory/4068-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4068 wrote to memory of 860 4068 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 84 PID 4068 wrote to memory of 860 4068 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 84 PID 4068 wrote to memory of 860 4068 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 84 PID 860 wrote to memory of 832 860 jdddj.exe 85 PID 860 wrote to memory of 832 860 jdddj.exe 85 PID 860 wrote to memory of 832 860 jdddj.exe 85 PID 832 wrote to memory of 4656 832 fxrfffl.exe 86 PID 832 wrote to memory of 4656 832 fxrfffl.exe 86 PID 832 wrote to memory of 4656 832 fxrfffl.exe 86 PID 4656 wrote to memory of 1272 4656 btbtnt.exe 87 PID 4656 wrote to memory of 1272 4656 btbtnt.exe 87 PID 4656 wrote to memory of 1272 4656 btbtnt.exe 87 PID 1272 wrote to memory of 1368 1272 nhnhtt.exe 88 PID 1272 wrote to memory of 1368 1272 nhnhtt.exe 88 PID 1272 wrote to memory of 1368 1272 nhnhtt.exe 88 PID 1368 wrote to memory of 1816 1368 dvpjd.exe 90 PID 1368 wrote to memory of 1816 1368 dvpjd.exe 90 PID 1368 wrote to memory of 1816 1368 dvpjd.exe 90 PID 1816 wrote to memory of 1264 1816 vdjdd.exe 92 PID 1816 wrote to memory of 1264 1816 vdjdd.exe 92 PID 1816 wrote to memory of 1264 1816 vdjdd.exe 92 PID 1264 wrote to memory of 856 1264 xrrlxfx.exe 93 PID 1264 wrote to memory of 856 1264 xrrlxfx.exe 93 PID 1264 wrote to memory of 856 1264 xrrlxfx.exe 93 PID 856 wrote to memory of 2720 856 bnnhhh.exe 94 PID 856 wrote to memory of 2720 856 bnnhhh.exe 94 PID 856 wrote to memory of 2720 856 bnnhhh.exe 94 PID 2720 wrote to memory of 5032 2720 nnttnt.exe 95 PID 2720 wrote to memory of 5032 2720 nnttnt.exe 95 PID 2720 wrote to memory of 5032 2720 nnttnt.exe 95 PID 5032 wrote to memory of 4148 5032 jdppj.exe 96 PID 5032 wrote to memory of 4148 5032 jdppj.exe 96 PID 5032 wrote to memory of 4148 5032 jdppj.exe 96 PID 4148 wrote to memory of 4704 4148 llxrrff.exe 97 PID 4148 wrote to memory of 4704 4148 llxrrff.exe 97 PID 4148 wrote to memory of 4704 4148 llxrrff.exe 97 PID 4704 wrote to memory of 4756 4704 ppvpv.exe 99 PID 4704 wrote to memory of 4756 4704 ppvpv.exe 99 PID 4704 wrote to memory of 4756 4704 ppvpv.exe 99 PID 4756 wrote to memory of 2556 4756 fxxflrr.exe 100 PID 4756 wrote to memory of 2556 4756 fxxflrr.exe 100 PID 4756 wrote to memory of 2556 4756 fxxflrr.exe 100 PID 2556 wrote to memory of 3272 2556 tbnnnt.exe 101 PID 2556 wrote to memory of 3272 2556 tbnnnt.exe 101 PID 2556 wrote to memory of 3272 2556 tbnnnt.exe 101 PID 3272 wrote to memory of 4816 3272 flrrlll.exe 102 PID 3272 wrote to memory of 4816 3272 flrrlll.exe 102 PID 3272 wrote to memory of 4816 3272 flrrlll.exe 102 PID 4816 wrote to memory of 2796 4816 xlfxfxr.exe 103 PID 4816 wrote to memory of 2796 4816 xlfxfxr.exe 103 PID 4816 wrote to memory of 2796 4816 xlfxfxr.exe 103 PID 2796 wrote to memory of 3428 2796 bntnnn.exe 104 PID 2796 wrote to memory of 3428 2796 bntnnn.exe 104 PID 2796 wrote to memory of 3428 2796 bntnnn.exe 104 PID 3428 wrote to memory of 2924 3428 lllfrrr.exe 105 PID 3428 wrote to memory of 2924 3428 lllfrrr.exe 105 PID 3428 wrote to memory of 2924 3428 lllfrrr.exe 105 PID 2924 wrote to memory of 1156 2924 htbtth.exe 106 PID 2924 wrote to memory of 1156 2924 htbtth.exe 106 PID 2924 wrote to memory of 1156 2924 htbtth.exe 106 PID 1156 wrote to memory of 4548 1156 lfffxff.exe 107 PID 1156 wrote to memory of 4548 1156 lfffxff.exe 107 PID 1156 wrote to memory of 4548 1156 lfffxff.exe 107 PID 4548 wrote to memory of 664 4548 nnbntn.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe"C:\Users\Admin\AppData\Local\Temp\804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\jdddj.exec:\jdddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\fxrfffl.exec:\fxrfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\btbtnt.exec:\btbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\nhnhtt.exec:\nhnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\dvpjd.exec:\dvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\vdjdd.exec:\vdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\bnnhhh.exec:\bnnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\nnttnt.exec:\nnttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdppj.exec:\jdppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\llxrrff.exec:\llxrrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\ppvpv.exec:\ppvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\fxxflrr.exec:\fxxflrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\tbnnnt.exec:\tbnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\flrrlll.exec:\flrrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\xlfxfxr.exec:\xlfxfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\bntnnn.exec:\bntnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lllfrrr.exec:\lllfrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\htbtth.exec:\htbtth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lfffxff.exec:\lfffxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\nnbntn.exec:\nnbntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\pdppj.exec:\pdppj.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\pvppj.exec:\pvppj.exe24⤵
- Executes dropped EXE
PID:3320 -
\??\c:\tnnhtt.exec:\tnnhtt.exe25⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rllfxfx.exec:\rllfxfx.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9hnhhh.exec:\9hnhhh.exe27⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dvddj.exec:\dvddj.exe28⤵
- Executes dropped EXE
PID:4880 -
\??\c:\htbbtn.exec:\htbbtn.exe29⤵
- Executes dropped EXE
PID:4104 -
\??\c:\pjvvv.exec:\pjvvv.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xfxfllf.exec:\xfxfllf.exe31⤵
- Executes dropped EXE
PID:4764 -
\??\c:\bhhhhn.exec:\bhhhhn.exe32⤵
- Executes dropped EXE
PID:4748 -
\??\c:\jjppv.exec:\jjppv.exe33⤵PID:3252
-
\??\c:\ffffrrr.exec:\ffffrrr.exe34⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bhnnnn.exec:\bhnnnn.exe35⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rffflfr.exec:\rffflfr.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlxxrrr.exec:\rlxxrrr.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhnhhh.exec:\hhnhhh.exe38⤵
- Executes dropped EXE
PID:4656 -
\??\c:\jdpjv.exec:\jdpjv.exe39⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xlffxxx.exec:\xlffxxx.exe40⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3frlllf.exec:\3frlllf.exe41⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nnhhnn.exec:\nnhhnn.exe42⤵
- Executes dropped EXE
PID:4896 -
\??\c:\5vvpj.exec:\5vvpj.exe43⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xxrlrff.exec:\xxrlrff.exe44⤵
- Executes dropped EXE
PID:3724 -
\??\c:\bhhbnh.exec:\bhhbnh.exe45⤵
- Executes dropped EXE
PID:3608 -
\??\c:\7pjdv.exec:\7pjdv.exe46⤵
- Executes dropped EXE
PID:5108 -
\??\c:\vdjjp.exec:\vdjjp.exe47⤵
- Executes dropped EXE
PID:3096 -
\??\c:\5rfxlrf.exec:\5rfxlrf.exe48⤵
- Executes dropped EXE
PID:1064 -
\??\c:\htnhtn.exec:\htnhtn.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ththth.exec:\ththth.exe50⤵
- Executes dropped EXE
PID:872 -
\??\c:\vjjjv.exec:\vjjjv.exe51⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rllffxf.exec:\rllffxf.exe52⤵
- Executes dropped EXE
PID:3156 -
\??\c:\thbtnh.exec:\thbtnh.exe53⤵
- Executes dropped EXE
PID:3288 -
\??\c:\jjjdv.exec:\jjjdv.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pjvvv.exec:\pjvvv.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frrllfl.exec:\frrllfl.exe56⤵
- Executes dropped EXE
PID:848 -
\??\c:\bhnnbt.exec:\bhnnbt.exe57⤵
- Executes dropped EXE
PID:4672 -
\??\c:\dvjdd.exec:\dvjdd.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ppdvj.exec:\ppdvj.exe59⤵
- Executes dropped EXE
PID:4948 -
\??\c:\flffrrl.exec:\flffrrl.exe60⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ntthnh.exec:\ntthnh.exe61⤵
- Executes dropped EXE
PID:4056 -
\??\c:\9hnhhb.exec:\9hnhhb.exe62⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dppjv.exec:\dppjv.exe63⤵
- Executes dropped EXE
PID:3536 -
\??\c:\xrffrxr.exec:\xrffrxr.exe64⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bnbtbb.exec:\bnbtbb.exe65⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vpddj.exec:\vpddj.exe66⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xxfrllf.exec:\xxfrllf.exe67⤵PID:2268
-
\??\c:\xxrflrx.exec:\xxrflrx.exe68⤵PID:220
-
\??\c:\btnhhn.exec:\btnhhn.exe69⤵PID:1136
-
\??\c:\djjpp.exec:\djjpp.exe70⤵PID:1712
-
\??\c:\rffrlfx.exec:\rffrlfx.exe71⤵PID:2972
-
\??\c:\9llfxfx.exec:\9llfxfx.exe72⤵PID:1080
-
\??\c:\hhnhtn.exec:\hhnhtn.exe73⤵PID:5104
-
\??\c:\pvdpj.exec:\pvdpj.exe74⤵PID:4964
-
\??\c:\djpjv.exec:\djpjv.exe75⤵PID:4340
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe76⤵PID:4700
-
\??\c:\7bnbtt.exec:\7bnbtt.exe77⤵PID:5080
-
\??\c:\hnthbt.exec:\hnthbt.exe78⤵PID:1128
-
\??\c:\jvdvv.exec:\jvdvv.exe79⤵PID:1016
-
\??\c:\lxffxff.exec:\lxffxff.exe80⤵PID:1456
-
\??\c:\xrfxxlf.exec:\xrfxxlf.exe81⤵PID:1272
-
\??\c:\hnnttn.exec:\hnnttn.exe82⤵PID:1496
-
\??\c:\xffflrr.exec:\xffflrr.exe83⤵PID:1368
-
\??\c:\btthhb.exec:\btthhb.exe84⤵PID:2164
-
\??\c:\jvvpd.exec:\jvvpd.exe85⤵PID:1444
-
\??\c:\fxxlffx.exec:\fxxlffx.exe86⤵PID:2520
-
\??\c:\tnntbt.exec:\tnntbt.exe87⤵PID:4956
-
\??\c:\hhthhh.exec:\hhthhh.exe88⤵PID:3080
-
\??\c:\jjddv.exec:\jjddv.exe89⤵PID:4728
-
\??\c:\rrxlrfx.exec:\rrxlrfx.exe90⤵PID:1040
-
\??\c:\btbntt.exec:\btbntt.exe91⤵PID:3460
-
\??\c:\7jjdp.exec:\7jjdp.exe92⤵PID:2452
-
\??\c:\dpjvd.exec:\dpjvd.exe93⤵PID:2652
-
\??\c:\fxfrrxr.exec:\fxfrrxr.exe94⤵PID:848
-
\??\c:\htnhhb.exec:\htnhhb.exe95⤵PID:4040
-
\??\c:\ppvpj.exec:\ppvpj.exe96⤵PID:5056
-
\??\c:\rrlffxf.exec:\rrlffxf.exe97⤵PID:4108
-
\??\c:\lxxffxr.exec:\lxxffxr.exe98⤵PID:4688
-
\??\c:\bnbtnn.exec:\bnbtnn.exe99⤵PID:3376
-
\??\c:\9dddd.exec:\9dddd.exe100⤵PID:2832
-
\??\c:\rllfxxr.exec:\rllfxxr.exe101⤵PID:664
-
\??\c:\9nhbnn.exec:\9nhbnn.exe102⤵PID:3688
-
\??\c:\vpjdv.exec:\vpjdv.exe103⤵PID:2128
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe104⤵PID:2300
-
\??\c:\9xlxxrl.exec:\9xlxxrl.exe105⤵PID:1428
-
\??\c:\nhhbbb.exec:\nhhbbb.exe106⤵PID:3748
-
\??\c:\djpdj.exec:\djpdj.exe107⤵PID:1136
-
\??\c:\3frfxxr.exec:\3frfxxr.exe108⤵PID:1424
-
\??\c:\bbbbtt.exec:\bbbbtt.exe109⤵PID:5088
-
\??\c:\pjjdp.exec:\pjjdp.exe110⤵PID:2296
-
\??\c:\lfxrlff.exec:\lfxrlff.exe111⤵PID:4084
-
\??\c:\bttnbn.exec:\bttnbn.exe112⤵PID:2348
-
\??\c:\9vjdd.exec:\9vjdd.exe113⤵PID:3828
-
\??\c:\dvpjd.exec:\dvpjd.exe114⤵PID:4644
-
\??\c:\rllrlfx.exec:\rllrlfx.exe115⤵PID:4700
-
\??\c:\nnnhbb.exec:\nnnhbb.exe116⤵PID:4004
-
\??\c:\jvpdp.exec:\jvpdp.exe117⤵PID:1764
-
\??\c:\xrxrllf.exec:\xrxrllf.exe118⤵PID:4464
-
\??\c:\hbnhtn.exec:\hbnhtn.exe119⤵PID:208
-
\??\c:\dpvjj.exec:\dpvjj.exe120⤵PID:412
-
\??\c:\pdpjv.exec:\pdpjv.exe121⤵PID:4308
-
\??\c:\rllfxrl.exec:\rllfxrl.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-