Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe
-
Size
383KB
-
MD5
45c6ee5c01e868751da11a2f72e69999
-
SHA1
439d36161743dbe12eab1aca8c857a4e3fff362e
-
SHA256
a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054
-
SHA512
2b9ce2c036bf50e00de39678016cffdf281b727d5d66aa147bafcee9259754b6a30f7f3a400639dde0942054d063572991a6da8d2357d0a1dbc2be065d421895
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqL3yeHmlwe+axBcot39vUDbYhzod03:n3C9BRo7tvnJ99T/KZEL3c5BTkPXKpv
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4288-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral2/memory/4288-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2640-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2744-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1984-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3144-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/208-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4912-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1996-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3832-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5048-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4172-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3984-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3064-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1860-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2764-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1404-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3056-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/884-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4760-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3680-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4428-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1360-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2640 vjdvj.exe 3144 xxrrllr.exe 1984 bthtnn.exe 2744 vjjvp.exe 4844 5frlfff.exe 208 nnnnnn.exe 4912 vvddv.exe 5000 vdpdp.exe 1996 xrfxxxr.exe 3832 thnhbb.exe 5048 ttbtnn.exe 4172 frfxxxx.exe 3984 bhtnhh.exe 3064 rlxrxrf.exe 1860 bhbhnn.exe 2696 rrlffff.exe 1056 hbbbht.exe 1404 dpdvp.exe 2764 xlfxlfl.exe 1596 5vvpj.exe 3456 pjddd.exe 3296 lflfxxl.exe 3056 lxxxxrl.exe 884 vjdvj.exe 4180 lfllflx.exe 4760 vjdvp.exe 3680 lrrxlxl.exe 4428 hhnnhb.exe 1360 hbbbbh.exe 4656 xrxrrfx.exe 632 ppvpd.exe 1224 flxrlff.exe 1780 hnbhbt.exe 4772 ddvpj.exe 2480 xrffrrr.exe 5092 hbttbh.exe 4248 dpdvp.exe 3776 9lrfxxr.exe 3144 bntnbt.exe 1264 vjvvj.exe 1984 llrrlll.exe 4704 vjjjd.exe 1016 lxrflrf.exe 2916 llfxlrf.exe 3652 ntbnhh.exe 3796 dvvvp.exe 3756 frrrllf.exe 2940 1ntnhn.exe 1668 vjddp.exe 5052 jdvvj.exe 3988 xlfllff.exe 3864 nnbtnn.exe 4924 bhnnhn.exe 1836 xrxlffr.exe 1884 hbhhhb.exe 3684 5lrlxxx.exe 1516 3xxxxxr.exe 2436 9bhtnb.exe 1732 vdvpd.exe 3596 9llxxxr.exe 4216 bthhhh.exe 4988 1jjpd.exe 3328 lffxxll.exe 3140 5rrrffr.exe -
resource yara_rule behavioral2/memory/4288-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 2640 4288 a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe 83 PID 4288 wrote to memory of 2640 4288 a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe 83 PID 4288 wrote to memory of 2640 4288 a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe 83 PID 2640 wrote to memory of 3144 2640 vjdvj.exe 84 PID 2640 wrote to memory of 3144 2640 vjdvj.exe 84 PID 2640 wrote to memory of 3144 2640 vjdvj.exe 84 PID 3144 wrote to memory of 1984 3144 xxrrllr.exe 85 PID 3144 wrote to memory of 1984 3144 xxrrllr.exe 85 PID 3144 wrote to memory of 1984 3144 xxrrllr.exe 85 PID 1984 wrote to memory of 2744 1984 bthtnn.exe 86 PID 1984 wrote to memory of 2744 1984 bthtnn.exe 86 PID 1984 wrote to memory of 2744 1984 bthtnn.exe 86 PID 2744 wrote to memory of 4844 2744 vjjvp.exe 87 PID 2744 wrote to memory of 4844 2744 vjjvp.exe 87 PID 2744 wrote to memory of 4844 2744 vjjvp.exe 87 PID 4844 wrote to memory of 208 4844 5frlfff.exe 88 PID 4844 wrote to memory of 208 4844 5frlfff.exe 88 PID 4844 wrote to memory of 208 4844 5frlfff.exe 88 PID 208 wrote to memory of 4912 208 nnnnnn.exe 89 PID 208 wrote to memory of 4912 208 nnnnnn.exe 89 PID 208 wrote to memory of 4912 208 nnnnnn.exe 89 PID 4912 wrote to memory of 5000 4912 vvddv.exe 90 PID 4912 wrote to memory of 5000 4912 vvddv.exe 90 PID 4912 wrote to memory of 5000 4912 vvddv.exe 90 PID 5000 wrote to memory of 1996 5000 vdpdp.exe 91 PID 5000 wrote to memory of 1996 5000 vdpdp.exe 91 PID 5000 wrote to memory of 1996 5000 vdpdp.exe 91 PID 1996 wrote to memory of 3832 1996 xrfxxxr.exe 92 PID 1996 wrote to memory of 3832 1996 xrfxxxr.exe 92 PID 1996 wrote to memory of 3832 1996 xrfxxxr.exe 92 PID 3832 wrote to memory of 5048 3832 thnhbb.exe 93 PID 3832 wrote to memory of 5048 3832 thnhbb.exe 93 PID 3832 wrote to memory of 5048 3832 thnhbb.exe 93 PID 5048 wrote to memory of 4172 5048 ttbtnn.exe 94 PID 5048 wrote to memory of 4172 5048 ttbtnn.exe 94 PID 5048 wrote to memory of 4172 5048 ttbtnn.exe 94 PID 4172 wrote to memory of 3984 4172 frfxxxx.exe 95 PID 4172 wrote to memory of 3984 4172 frfxxxx.exe 95 PID 4172 wrote to memory of 3984 4172 frfxxxx.exe 95 PID 3984 wrote to memory of 3064 3984 bhtnhh.exe 96 PID 3984 wrote to memory of 3064 3984 bhtnhh.exe 96 PID 3984 wrote to memory of 3064 3984 bhtnhh.exe 96 PID 3064 wrote to memory of 1860 3064 rlxrxrf.exe 97 PID 3064 wrote to memory of 1860 3064 rlxrxrf.exe 97 PID 3064 wrote to memory of 1860 3064 rlxrxrf.exe 97 PID 1860 wrote to memory of 2696 1860 bhbhnn.exe 98 PID 1860 wrote to memory of 2696 1860 bhbhnn.exe 98 PID 1860 wrote to memory of 2696 1860 bhbhnn.exe 98 PID 2696 wrote to memory of 1056 2696 rrlffff.exe 99 PID 2696 wrote to memory of 1056 2696 rrlffff.exe 99 PID 2696 wrote to memory of 1056 2696 rrlffff.exe 99 PID 1056 wrote to memory of 1404 1056 hbbbht.exe 100 PID 1056 wrote to memory of 1404 1056 hbbbht.exe 100 PID 1056 wrote to memory of 1404 1056 hbbbht.exe 100 PID 1404 wrote to memory of 2764 1404 dpdvp.exe 101 PID 1404 wrote to memory of 2764 1404 dpdvp.exe 101 PID 1404 wrote to memory of 2764 1404 dpdvp.exe 101 PID 2764 wrote to memory of 1596 2764 xlfxlfl.exe 103 PID 2764 wrote to memory of 1596 2764 xlfxlfl.exe 103 PID 2764 wrote to memory of 1596 2764 xlfxlfl.exe 103 PID 1596 wrote to memory of 3456 1596 5vvpj.exe 104 PID 1596 wrote to memory of 3456 1596 5vvpj.exe 104 PID 1596 wrote to memory of 3456 1596 5vvpj.exe 104 PID 3456 wrote to memory of 3296 3456 pjddd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe"C:\Users\Admin\AppData\Local\Temp\a43dc91b3beb7bf3275cdad059683b1bd2a1d9202529f4f9446f02da719af054.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\vjdvj.exec:\vjdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xxrrllr.exec:\xxrrllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\bthtnn.exec:\bthtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vjjvp.exec:\vjjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5frlfff.exec:\5frlfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\nnnnnn.exec:\nnnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\vvddv.exec:\vvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vdpdp.exec:\vdpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\xrfxxxr.exec:\xrfxxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\thnhbb.exec:\thnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\ttbtnn.exec:\ttbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\frfxxxx.exec:\frfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\bhtnhh.exec:\bhtnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\bhbhnn.exec:\bhbhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\rrlffff.exec:\rrlffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hbbbht.exec:\hbbbht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\dpdvp.exec:\dpdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\xlfxlfl.exec:\xlfxlfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5vvpj.exec:\5vvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\pjddd.exec:\pjddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\lflfxxl.exec:\lflfxxl.exe23⤵
- Executes dropped EXE
PID:3296 -
\??\c:\lxxxxrl.exec:\lxxxxrl.exe24⤵
- Executes dropped EXE
PID:3056 -
\??\c:\vjdvj.exec:\vjdvj.exe25⤵
- Executes dropped EXE
PID:884 -
\??\c:\lfllflx.exec:\lfllflx.exe26⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vjdvp.exec:\vjdvp.exe27⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lrrxlxl.exec:\lrrxlxl.exe28⤵
- Executes dropped EXE
PID:3680 -
\??\c:\hhnnhb.exec:\hhnnhb.exe29⤵
- Executes dropped EXE
PID:4428 -
\??\c:\hbbbbh.exec:\hbbbbh.exe30⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xrxrrfx.exec:\xrxrrfx.exe31⤵
- Executes dropped EXE
PID:4656 -
\??\c:\ppvpd.exec:\ppvpd.exe32⤵
- Executes dropped EXE
PID:632 -
\??\c:\flxrlff.exec:\flxrlff.exe33⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hnbhbt.exec:\hnbhbt.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddvpj.exec:\ddvpj.exe35⤵
- Executes dropped EXE
PID:4772 -
\??\c:\xrffrrr.exec:\xrffrrr.exe36⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hbttbh.exec:\hbttbh.exe37⤵
- Executes dropped EXE
PID:5092 -
\??\c:\dpdvp.exec:\dpdvp.exe38⤵
- Executes dropped EXE
PID:4248 -
\??\c:\9lrfxxr.exec:\9lrfxxr.exe39⤵
- Executes dropped EXE
PID:3776 -
\??\c:\bntnbt.exec:\bntnbt.exe40⤵
- Executes dropped EXE
PID:3144 -
\??\c:\vjvvj.exec:\vjvvj.exe41⤵
- Executes dropped EXE
PID:1264 -
\??\c:\llrrlll.exec:\llrrlll.exe42⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vjjjd.exec:\vjjjd.exe43⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lxrflrf.exec:\lxrflrf.exe44⤵
- Executes dropped EXE
PID:1016 -
\??\c:\llfxlrf.exec:\llfxlrf.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ntbnhh.exec:\ntbnhh.exe46⤵
- Executes dropped EXE
PID:3652 -
\??\c:\dvvvp.exec:\dvvvp.exe47⤵
- Executes dropped EXE
PID:3796 -
\??\c:\frrrllf.exec:\frrrllf.exe48⤵
- Executes dropped EXE
PID:3756 -
\??\c:\1ntnhn.exec:\1ntnhn.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vjddp.exec:\vjddp.exe50⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jdvvj.exec:\jdvvj.exe51⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xlfllff.exec:\xlfllff.exe52⤵
- Executes dropped EXE
PID:3988 -
\??\c:\nnbtnn.exec:\nnbtnn.exe53⤵
- Executes dropped EXE
PID:3864 -
\??\c:\bhnnhn.exec:\bhnnhn.exe54⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xrxlffr.exec:\xrxlffr.exe55⤵
- Executes dropped EXE
PID:1836 -
\??\c:\hbhhhb.exec:\hbhhhb.exe56⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5lrlxxx.exec:\5lrlxxx.exe57⤵
- Executes dropped EXE
PID:3684 -
\??\c:\3xxxxxr.exec:\3xxxxxr.exe58⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9bhtnb.exec:\9bhtnb.exe59⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vdvpd.exec:\vdvpd.exe60⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9llxxxr.exec:\9llxxxr.exe61⤵
- Executes dropped EXE
PID:3596 -
\??\c:\bthhhh.exec:\bthhhh.exe62⤵
- Executes dropped EXE
PID:4216 -
\??\c:\1jjpd.exec:\1jjpd.exe63⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lffxxll.exec:\lffxxll.exe64⤵
- Executes dropped EXE
PID:3328 -
\??\c:\5rrrffr.exec:\5rrrffr.exe65⤵
- Executes dropped EXE
PID:3140 -
\??\c:\htbhbb.exec:\htbhbb.exe66⤵PID:1236
-
\??\c:\jvvpj.exec:\jvvpj.exe67⤵PID:2728
-
\??\c:\ffrllll.exec:\ffrllll.exe68⤵PID:1564
-
\??\c:\nbhbtn.exec:\nbhbtn.exe69⤵PID:4180
-
\??\c:\pdjvd.exec:\pdjvd.exe70⤵PID:2140
-
\??\c:\lxlffff.exec:\lxlffff.exe71⤵PID:1628
-
\??\c:\hbntbh.exec:\hbntbh.exe72⤵PID:2648
-
\??\c:\7djjd.exec:\7djjd.exe73⤵PID:1148
-
\??\c:\dvjdp.exec:\dvjdp.exe74⤵PID:2980
-
\??\c:\fxffxxf.exec:\fxffxxf.exe75⤵PID:4444
-
\??\c:\9nnnhn.exec:\9nnnhn.exe76⤵PID:632
-
\??\c:\pjppp.exec:\pjppp.exe77⤵PID:4032
-
\??\c:\jvpvv.exec:\jvpvv.exe78⤵PID:2472
-
\??\c:\rlrlllf.exec:\rlrlllf.exe79⤵PID:2692
-
\??\c:\5ntnhh.exec:\5ntnhh.exe80⤵PID:3016
-
\??\c:\vpvvp.exec:\vpvvp.exe81⤵PID:3620
-
\??\c:\9vpjd.exec:\9vpjd.exe82⤵PID:4288
-
\??\c:\xlrllfx.exec:\xlrllfx.exe83⤵PID:2948
-
\??\c:\hbtnbt.exec:\hbtnbt.exe84⤵PID:3584
-
\??\c:\bbtnht.exec:\bbtnht.exe85⤵PID:1372
-
\??\c:\jjppj.exec:\jjppj.exe86⤵PID:1896
-
\??\c:\5rffxfx.exec:\5rffxfx.exe87⤵PID:3760
-
\??\c:\rffxrrl.exec:\rffxrrl.exe88⤵PID:4824
-
\??\c:\bhnnbb.exec:\bhnnbb.exe89⤵PID:4704
-
\??\c:\vpvjv.exec:\vpvjv.exe90⤵PID:1016
-
\??\c:\jvdjp.exec:\jvdjp.exe91⤵PID:4912
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe92⤵PID:836
-
\??\c:\bbbbtb.exec:\bbbbtb.exe93⤵PID:3232
-
\??\c:\tbhbtn.exec:\tbhbtn.exe94⤵PID:1816
-
\??\c:\jdjdj.exec:\jdjdj.exe95⤵PID:5080
-
\??\c:\llllxxr.exec:\llllxxr.exe96⤵PID:3732
-
\??\c:\tbntnn.exec:\tbntnn.exe97⤵PID:4460
-
\??\c:\tbnnhb.exec:\tbnnhb.exe98⤵PID:3864
-
\??\c:\pdjjd.exec:\pdjjd.exe99⤵PID:4188
-
\??\c:\5rlrllf.exec:\5rlrllf.exe100⤵PID:2972
-
\??\c:\tnnhtt.exec:\tnnhtt.exe101⤵PID:5040
-
\??\c:\vpvjp.exec:\vpvjp.exe102⤵PID:5036
-
\??\c:\pdpjd.exec:\pdpjd.exe103⤵PID:648
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe104⤵PID:3952
-
\??\c:\bntnnn.exec:\bntnnn.exe105⤵PID:3456
-
\??\c:\5bhhbh.exec:\5bhhbh.exe106⤵PID:3496
-
\??\c:\lllffxx.exec:\lllffxx.exe107⤵PID:4228
-
\??\c:\thtnhh.exec:\thtnhh.exe108⤵PID:3332
-
\??\c:\dppjd.exec:\dppjd.exe109⤵PID:4180
-
\??\c:\lrllxrf.exec:\lrllxrf.exe110⤵PID:1252
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe111⤵PID:4092
-
\??\c:\htbnhb.exec:\htbnhb.exe112⤵PID:800
-
\??\c:\5jjjp.exec:\5jjjp.exe113⤵PID:3900
-
\??\c:\jdpjp.exec:\jdpjp.exe114⤵PID:3920
-
\??\c:\lrrxxff.exec:\lrrxxff.exe115⤵PID:2556
-
\??\c:\ttttnn.exec:\ttttnn.exe116⤵PID:1224
-
\??\c:\bbbtbb.exec:\bbbtbb.exe117⤵PID:4072
-
\??\c:\1djjj.exec:\1djjj.exe118⤵PID:4504
-
\??\c:\frrrrxf.exec:\frrrrxf.exe119⤵PID:4300
-
\??\c:\5nbtnt.exec:\5nbtnt.exe120⤵PID:4996
-
\??\c:\pjvvj.exec:\pjvvj.exe121⤵PID:5092
-
\??\c:\jvdvv.exec:\jvdvv.exe122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-