Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe
-
Size
96KB
-
MD5
737d4f2be92988f2cd2280e52b65a53a
-
SHA1
083778f72a64a345f9dd17be3ddb070d9b011981
-
SHA256
1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6
-
SHA512
de5fecf9abc1ac94598928069c5a9d067ce45186daac3593bfc25c2395a254dd78e22cdebb294034d815993bad72ba8b7cdb8b20f659f14e752d27f12090f0f2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLnnl:ymb3NkkiQ3mdBjFIi/REUZnKlbnv9
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4892-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 34 IoCs
resource yara_rule behavioral2/memory/4892-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/880-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3412-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/428-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4944-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2192-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3144-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3508-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/960-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2412-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4812-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1172-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2664-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/956-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/724-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4292-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1552-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 880 7llxrlf.exe 1552 nhhhhh.exe 4540 dvppj.exe 3412 xxxlfrf.exe 1616 7llfrrx.exe 4292 3ttbtt.exe 1764 ppjjd.exe 2548 dpvpj.exe 3836 rflrxxf.exe 1568 bttbtt.exe 428 hnnbtn.exe 4944 pdjdd.exe 4168 xrrlfrr.exe 4468 bbnnbb.exe 4844 pdjjv.exe 4448 9ddjv.exe 724 frxlxxr.exe 956 bhhbbb.exe 2664 bnnhtt.exe 1172 jjppp.exe 1644 pvjpv.exe 948 7lrlxxx.exe 2192 tbbbth.exe 4812 tbbtnt.exe 2412 dpvvp.exe 3144 rlxrllf.exe 960 lxlrlxl.exe 4340 nttnhh.exe 3508 bbnhnh.exe 4592 pvpvd.exe 2300 1lxrlfx.exe 3304 llxxrrr.exe 3204 9hbbtt.exe 1696 tttbtn.exe 4192 jvjdp.exe 3980 flxlfxf.exe 316 fllxrfr.exe 3900 tntnhh.exe 4892 dvddj.exe 100 jjjdv.exe 4332 flfrxlx.exe 2552 hhhtnb.exe 2772 ttnntn.exe 2860 jvvvp.exe 1616 3jvjj.exe 3364 xlxrlff.exe 4824 9lflllf.exe 2320 9bthbn.exe 3648 ntbttt.exe 3836 jdpvv.exe 3912 lfflrfx.exe 1568 rrxrxxf.exe 2392 thtbht.exe 2872 ttbhnt.exe 3244 vpddj.exe 3368 frxxrrr.exe 524 bnbbhn.exe 868 jvvpj.exe 4672 xxfrlff.exe 4912 rflxrlx.exe 1688 nbbtnh.exe 4220 5pdvv.exe 1316 xxlrlxf.exe 4464 9htttt.exe -
resource yara_rule behavioral2/memory/4892-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-18-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 880 4892 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 82 PID 4892 wrote to memory of 880 4892 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 82 PID 4892 wrote to memory of 880 4892 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 82 PID 880 wrote to memory of 1552 880 7llxrlf.exe 83 PID 880 wrote to memory of 1552 880 7llxrlf.exe 83 PID 880 wrote to memory of 1552 880 7llxrlf.exe 83 PID 1552 wrote to memory of 4540 1552 nhhhhh.exe 84 PID 1552 wrote to memory of 4540 1552 nhhhhh.exe 84 PID 1552 wrote to memory of 4540 1552 nhhhhh.exe 84 PID 4540 wrote to memory of 3412 4540 dvppj.exe 85 PID 4540 wrote to memory of 3412 4540 dvppj.exe 85 PID 4540 wrote to memory of 3412 4540 dvppj.exe 85 PID 3412 wrote to memory of 1616 3412 xxxlfrf.exe 130 PID 3412 wrote to memory of 1616 3412 xxxlfrf.exe 130 PID 3412 wrote to memory of 1616 3412 xxxlfrf.exe 130 PID 1616 wrote to memory of 4292 1616 7llfrrx.exe 87 PID 1616 wrote to memory of 4292 1616 7llfrrx.exe 87 PID 1616 wrote to memory of 4292 1616 7llfrrx.exe 87 PID 4292 wrote to memory of 1764 4292 3ttbtt.exe 88 PID 4292 wrote to memory of 1764 4292 3ttbtt.exe 88 PID 4292 wrote to memory of 1764 4292 3ttbtt.exe 88 PID 1764 wrote to memory of 2548 1764 ppjjd.exe 89 PID 1764 wrote to memory of 2548 1764 ppjjd.exe 89 PID 1764 wrote to memory of 2548 1764 ppjjd.exe 89 PID 2548 wrote to memory of 3836 2548 dpvpj.exe 90 PID 2548 wrote to memory of 3836 2548 dpvpj.exe 90 PID 2548 wrote to memory of 3836 2548 dpvpj.exe 90 PID 3836 wrote to memory of 1568 3836 rflrxxf.exe 91 PID 3836 wrote to memory of 1568 3836 rflrxxf.exe 91 PID 3836 wrote to memory of 1568 3836 rflrxxf.exe 91 PID 1568 wrote to memory of 428 1568 bttbtt.exe 93 PID 1568 wrote to memory of 428 1568 bttbtt.exe 93 PID 1568 wrote to memory of 428 1568 bttbtt.exe 93 PID 428 wrote to memory of 4944 428 hnnbtn.exe 94 PID 428 wrote to memory of 4944 428 hnnbtn.exe 94 PID 428 wrote to memory of 4944 428 hnnbtn.exe 94 PID 4944 wrote to memory of 4168 4944 pdjdd.exe 95 PID 4944 wrote to memory of 4168 4944 pdjdd.exe 95 PID 4944 wrote to memory of 4168 4944 pdjdd.exe 95 PID 4168 wrote to memory of 4468 4168 xrrlfrr.exe 97 PID 4168 wrote to memory of 4468 4168 xrrlfrr.exe 97 PID 4168 wrote to memory of 4468 4168 xrrlfrr.exe 97 PID 4468 wrote to memory of 4844 4468 bbnnbb.exe 98 PID 4468 wrote to memory of 4844 4468 bbnnbb.exe 98 PID 4468 wrote to memory of 4844 4468 bbnnbb.exe 98 PID 4844 wrote to memory of 4448 4844 pdjjv.exe 99 PID 4844 wrote to memory of 4448 4844 pdjjv.exe 99 PID 4844 wrote to memory of 4448 4844 pdjjv.exe 99 PID 4448 wrote to memory of 724 4448 9ddjv.exe 100 PID 4448 wrote to memory of 724 4448 9ddjv.exe 100 PID 4448 wrote to memory of 724 4448 9ddjv.exe 100 PID 724 wrote to memory of 956 724 frxlxxr.exe 102 PID 724 wrote to memory of 956 724 frxlxxr.exe 102 PID 724 wrote to memory of 956 724 frxlxxr.exe 102 PID 956 wrote to memory of 2664 956 bhhbbb.exe 103 PID 956 wrote to memory of 2664 956 bhhbbb.exe 103 PID 956 wrote to memory of 2664 956 bhhbbb.exe 103 PID 2664 wrote to memory of 1172 2664 bnnhtt.exe 104 PID 2664 wrote to memory of 1172 2664 bnnhtt.exe 104 PID 2664 wrote to memory of 1172 2664 bnnhtt.exe 104 PID 1172 wrote to memory of 1644 1172 jjppp.exe 105 PID 1172 wrote to memory of 1644 1172 jjppp.exe 105 PID 1172 wrote to memory of 1644 1172 jjppp.exe 105 PID 1644 wrote to memory of 948 1644 pvjpv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe"C:\Users\Admin\AppData\Local\Temp\1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\7llxrlf.exec:\7llxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\nhhhhh.exec:\nhhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\dvppj.exec:\dvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\7llfrrx.exec:\7llfrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\3ttbtt.exec:\3ttbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\ppjjd.exec:\ppjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\dpvpj.exec:\dpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rflrxxf.exec:\rflrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\bttbtt.exec:\bttbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\hnnbtn.exec:\hnnbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\pdjdd.exec:\pdjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\xrrlfrr.exec:\xrrlfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\bbnnbb.exec:\bbnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\pdjjv.exec:\pdjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\9ddjv.exec:\9ddjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\frxlxxr.exec:\frxlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\bhhbbb.exec:\bhhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\bnnhtt.exec:\bnnhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jjppp.exec:\jjppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\pvjpv.exec:\pvjpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\7lrlxxx.exec:\7lrlxxx.exe23⤵
- Executes dropped EXE
PID:948 -
\??\c:\tbbbth.exec:\tbbbth.exe24⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tbbtnt.exec:\tbbtnt.exe25⤵
- Executes dropped EXE
PID:4812 -
\??\c:\dpvvp.exec:\dpvvp.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rlxrllf.exec:\rlxrllf.exe27⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lxlrlxl.exec:\lxlrlxl.exe28⤵
- Executes dropped EXE
PID:960 -
\??\c:\nttnhh.exec:\nttnhh.exe29⤵
- Executes dropped EXE
PID:4340 -
\??\c:\bbnhnh.exec:\bbnhnh.exe30⤵
- Executes dropped EXE
PID:3508 -
\??\c:\pvpvd.exec:\pvpvd.exe31⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1lxrlfx.exec:\1lxrlfx.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\llxxrrr.exec:\llxxrrr.exe33⤵
- Executes dropped EXE
PID:3304 -
\??\c:\9hbbtt.exec:\9hbbtt.exe34⤵
- Executes dropped EXE
PID:3204 -
\??\c:\tttbtn.exec:\tttbtn.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jvjdp.exec:\jvjdp.exe36⤵
- Executes dropped EXE
PID:4192 -
\??\c:\flxlfxf.exec:\flxlfxf.exe37⤵
- Executes dropped EXE
PID:3980 -
\??\c:\fllxrfr.exec:\fllxrfr.exe38⤵
- Executes dropped EXE
PID:316 -
\??\c:\tntnhh.exec:\tntnhh.exe39⤵
- Executes dropped EXE
PID:3900 -
\??\c:\3nthnn.exec:\3nthnn.exe40⤵PID:1420
-
\??\c:\dvddj.exec:\dvddj.exe41⤵
- Executes dropped EXE
PID:4892 -
\??\c:\jjjdv.exec:\jjjdv.exe42⤵
- Executes dropped EXE
PID:100 -
\??\c:\flfrxlx.exec:\flfrxlx.exe43⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hhhtnb.exec:\hhhtnb.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ttnntn.exec:\ttnntn.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jvvvp.exec:\jvvvp.exe46⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3jvjj.exec:\3jvjj.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xlxrlff.exec:\xlxrlff.exe48⤵
- Executes dropped EXE
PID:3364 -
\??\c:\9lflllf.exec:\9lflllf.exe49⤵
- Executes dropped EXE
PID:4824 -
\??\c:\9bthbn.exec:\9bthbn.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ntbttt.exec:\ntbttt.exe51⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jdpvv.exec:\jdpvv.exe52⤵
- Executes dropped EXE
PID:3836 -
\??\c:\lfflrfx.exec:\lfflrfx.exe53⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\thtbht.exec:\thtbht.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ttbhnt.exec:\ttbhnt.exe56⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vpddj.exec:\vpddj.exe57⤵
- Executes dropped EXE
PID:3244 -
\??\c:\frxxrrr.exec:\frxxrrr.exe58⤵
- Executes dropped EXE
PID:3368 -
\??\c:\bnbbhn.exec:\bnbbhn.exe59⤵
- Executes dropped EXE
PID:524 -
\??\c:\jvvpj.exec:\jvvpj.exe60⤵
- Executes dropped EXE
PID:868 -
\??\c:\xxfrlff.exec:\xxfrlff.exe61⤵
- Executes dropped EXE
PID:4672 -
\??\c:\rflxrlx.exec:\rflxrlx.exe62⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nbbtnh.exec:\nbbtnh.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5pdvv.exec:\5pdvv.exe64⤵
- Executes dropped EXE
PID:4220 -
\??\c:\xxlrlxf.exec:\xxlrlxf.exe65⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9htttt.exec:\9htttt.exe66⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jvjjp.exec:\jvjjp.exe67⤵PID:4964
-
\??\c:\ddvdp.exec:\ddvdp.exe68⤵PID:3676
-
\??\c:\7xllllr.exec:\7xllllr.exe69⤵PID:4080
-
\??\c:\9bbbtb.exec:\9bbbtb.exe70⤵PID:3576
-
\??\c:\vpvdv.exec:\vpvdv.exe71⤵PID:2904
-
\??\c:\dvvpj.exec:\dvvpj.exe72⤵PID:1668
-
\??\c:\fflfrfx.exec:\fflfrfx.exe73⤵PID:1980
-
\??\c:\hthhhh.exec:\hthhhh.exe74⤵PID:4440
-
\??\c:\hnhntb.exec:\hnhntb.exe75⤵PID:4812
-
\??\c:\pjvvp.exec:\pjvvp.exe76⤵PID:2412
-
\??\c:\lxllrff.exec:\lxllrff.exe77⤵PID:4968
-
\??\c:\bbhbbh.exec:\bbhbbh.exe78⤵PID:2612
-
\??\c:\vpvvp.exec:\vpvvp.exe79⤵PID:1336
-
\??\c:\llxxrxx.exec:\llxxrxx.exe80⤵PID:3432
-
\??\c:\dddvv.exec:\dddvv.exe81⤵PID:3256
-
\??\c:\xfxxxxr.exec:\xfxxxxr.exe82⤵PID:2868
-
\??\c:\xflfxll.exec:\xflfxll.exe83⤵PID:1188
-
\??\c:\tbtnhh.exec:\tbtnhh.exe84⤵PID:3136
-
\??\c:\vpvvv.exec:\vpvvv.exe85⤵PID:4564
-
\??\c:\nttnth.exec:\nttnth.exe86⤵PID:3848
-
\??\c:\pdvvp.exec:\pdvvp.exe87⤵PID:3324
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe88⤵PID:4152
-
\??\c:\tnbbth.exec:\tnbbth.exe89⤵PID:4268
-
\??\c:\7btnhh.exec:\7btnhh.exe90⤵PID:4240
-
\??\c:\pjddv.exec:\pjddv.exe91⤵PID:1592
-
\??\c:\lrxlrrx.exec:\lrxlrrx.exe92⤵PID:2780
-
\??\c:\nntttt.exec:\nntttt.exe93⤵PID:4892
-
\??\c:\jdppp.exec:\jdppp.exe94⤵PID:2464
-
\??\c:\flxlxrf.exec:\flxlxrf.exe95⤵PID:4332
-
\??\c:\ttttbn.exec:\ttttbn.exe96⤵PID:2996
-
\??\c:\btntbb.exec:\btntbb.exe97⤵PID:2256
-
\??\c:\1pvvd.exec:\1pvvd.exe98⤵PID:2632
-
\??\c:\xxxllrx.exec:\xxxllrx.exe99⤵PID:1112
-
\??\c:\hhthtn.exec:\hhthtn.exe100⤵PID:3476
-
\??\c:\hntnhb.exec:\hntnhb.exe101⤵PID:5112
-
\??\c:\pjppp.exec:\pjppp.exe102⤵PID:1080
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe103⤵PID:1884
-
\??\c:\5nbbbb.exec:\5nbbbb.exe104⤵PID:4576
-
\??\c:\hbntbn.exec:\hbntbn.exe105⤵PID:2260
-
\??\c:\jdjjp.exec:\jdjjp.exe106⤵PID:5064
-
\??\c:\dpddp.exec:\dpddp.exe107⤵PID:4736
-
\??\c:\frffxll.exec:\frffxll.exe108⤵PID:3700
-
\??\c:\fllllll.exec:\fllllll.exe109⤵PID:3404
-
\??\c:\5hnnnt.exec:\5hnnnt.exe110⤵PID:4168
-
\??\c:\hnhnbn.exec:\hnhnbn.exe111⤵PID:524
-
\??\c:\pjvvj.exec:\pjvvj.exe112⤵PID:4140
-
\??\c:\dddjj.exec:\dddjj.exe113⤵PID:4672
-
\??\c:\dpvvj.exec:\dpvvj.exe114⤵PID:3884
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe115⤵PID:3012
-
\??\c:\fflrxfl.exec:\fflrxfl.exe116⤵PID:460
-
\??\c:\1hhtnt.exec:\1hhtnt.exe117⤵PID:3468
-
\??\c:\htbtnt.exec:\htbtnt.exe118⤵PID:1892
-
\??\c:\3ddvp.exec:\3ddvp.exe119⤵PID:668
-
\??\c:\pvvvp.exec:\pvvvp.exe120⤵PID:852
-
\??\c:\djddv.exec:\djddv.exe121⤵PID:4136
-
\??\c:\bnbtbn.exec:\bnbtbn.exe122⤵PID:4984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-