Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe
-
Size
90KB
-
MD5
b589a7b0e66283bdb85b2a5e6354856e
-
SHA1
660a2d5c0286f1ad669c60fa81197e689e431ec6
-
SHA256
45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5
-
SHA512
b1ee6dda13c672dde0a237f7a34a0b793c4ab796d19ec224b475b356c3be4d576caa3fade7c94a46e72d0bf743f082104f7930aae044b6e30d6610cc07a98deb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBY:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBy5
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3352-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3352-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3992-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3968-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3212-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1100-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1912-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3212-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/440-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2956-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2520-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4412-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2168-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1904-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4176-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/916-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3824-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1720-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4148-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3724-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3992 3vddv.exe 1100 lfrllll.exe 3968 nhtthh.exe 3212 nhnnhb.exe 2892 7frlrxx.exe 1912 5tnhhh.exe 4836 hnbtnn.exe 3060 rlxrrll.exe 440 xllfxrl.exe 2956 hbhhbb.exe 2520 jdvpp.exe 1540 vdpjd.exe 2076 rrfxrrf.exe 3980 bhhtbt.exe 3348 vjdvp.exe 4412 fxffxfx.exe 4780 3httnb.exe 2168 pdjdd.exe 1904 3vvpj.exe 2376 hnnnhh.exe 4176 bbhbbb.exe 916 jddvv.exe 3824 9ffxlll.exe 3164 9bnhbh.exe 2532 pjppd.exe 4768 frrrllf.exe 1720 llffxrr.exe 4536 ttttnn.exe 4148 ttbbhb.exe 2760 vddvv.exe 3724 xxllfrr.exe 2768 lfllrrx.exe 4364 hbbbbb.exe 4028 7djjd.exe 2628 xflllll.exe 444 rlxxxxr.exe 4324 tbhhhh.exe 3260 fxfrrrl.exe 3692 xxrrlrr.exe 3328 nhbttt.exe 3968 vvdvd.exe 3384 7dppj.exe 904 lffrlff.exe 2612 rrrfflx.exe 1912 tbtnbh.exe 2288 hnttbb.exe 1588 ppvvd.exe 100 frlffrl.exe 5060 lflllll.exe 1792 nhnttt.exe 1668 ppvvp.exe 1172 dpppp.exe 5056 3lfxllx.exe 4500 xflrrrr.exe 1580 hthhnh.exe 1808 9dppj.exe 4420 flfxxll.exe 1620 3bbhhh.exe 3792 nttnht.exe 2416 ppppj.exe 2524 lrrffxr.exe 4408 xrxxrrr.exe 1840 tbtttb.exe 3284 ppppp.exe -
resource yara_rule behavioral2/memory/3352-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 3992 3352 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 83 PID 3352 wrote to memory of 3992 3352 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 83 PID 3352 wrote to memory of 3992 3352 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 83 PID 3992 wrote to memory of 1100 3992 3vddv.exe 84 PID 3992 wrote to memory of 1100 3992 3vddv.exe 84 PID 3992 wrote to memory of 1100 3992 3vddv.exe 84 PID 1100 wrote to memory of 3968 1100 lfrllll.exe 85 PID 1100 wrote to memory of 3968 1100 lfrllll.exe 85 PID 1100 wrote to memory of 3968 1100 lfrllll.exe 85 PID 3968 wrote to memory of 3212 3968 nhtthh.exe 86 PID 3968 wrote to memory of 3212 3968 nhtthh.exe 86 PID 3968 wrote to memory of 3212 3968 nhtthh.exe 86 PID 3212 wrote to memory of 2892 3212 nhnnhb.exe 87 PID 3212 wrote to memory of 2892 3212 nhnnhb.exe 87 PID 3212 wrote to memory of 2892 3212 nhnnhb.exe 87 PID 2892 wrote to memory of 1912 2892 7frlrxx.exe 88 PID 2892 wrote to memory of 1912 2892 7frlrxx.exe 88 PID 2892 wrote to memory of 1912 2892 7frlrxx.exe 88 PID 1912 wrote to memory of 4836 1912 5tnhhh.exe 89 PID 1912 wrote to memory of 4836 1912 5tnhhh.exe 89 PID 1912 wrote to memory of 4836 1912 5tnhhh.exe 89 PID 4836 wrote to memory of 3060 4836 hnbtnn.exe 90 PID 4836 wrote to memory of 3060 4836 hnbtnn.exe 90 PID 4836 wrote to memory of 3060 4836 hnbtnn.exe 90 PID 3060 wrote to memory of 440 3060 rlxrrll.exe 91 PID 3060 wrote to memory of 440 3060 rlxrrll.exe 91 PID 3060 wrote to memory of 440 3060 rlxrrll.exe 91 PID 440 wrote to memory of 2956 440 xllfxrl.exe 92 PID 440 wrote to memory of 2956 440 xllfxrl.exe 92 PID 440 wrote to memory of 2956 440 xllfxrl.exe 92 PID 2956 wrote to memory of 2520 2956 hbhhbb.exe 93 PID 2956 wrote to memory of 2520 2956 hbhhbb.exe 93 PID 2956 wrote to memory of 2520 2956 hbhhbb.exe 93 PID 2520 wrote to memory of 1540 2520 jdvpp.exe 94 PID 2520 wrote to memory of 1540 2520 jdvpp.exe 94 PID 2520 wrote to memory of 1540 2520 jdvpp.exe 94 PID 1540 wrote to memory of 2076 1540 vdpjd.exe 95 PID 1540 wrote to memory of 2076 1540 vdpjd.exe 95 PID 1540 wrote to memory of 2076 1540 vdpjd.exe 95 PID 2076 wrote to memory of 3980 2076 rrfxrrf.exe 96 PID 2076 wrote to memory of 3980 2076 rrfxrrf.exe 96 PID 2076 wrote to memory of 3980 2076 rrfxrrf.exe 96 PID 3980 wrote to memory of 3348 3980 bhhtbt.exe 97 PID 3980 wrote to memory of 3348 3980 bhhtbt.exe 97 PID 3980 wrote to memory of 3348 3980 bhhtbt.exe 97 PID 3348 wrote to memory of 4412 3348 vjdvp.exe 98 PID 3348 wrote to memory of 4412 3348 vjdvp.exe 98 PID 3348 wrote to memory of 4412 3348 vjdvp.exe 98 PID 4412 wrote to memory of 4780 4412 fxffxfx.exe 99 PID 4412 wrote to memory of 4780 4412 fxffxfx.exe 99 PID 4412 wrote to memory of 4780 4412 fxffxfx.exe 99 PID 4780 wrote to memory of 2168 4780 3httnb.exe 100 PID 4780 wrote to memory of 2168 4780 3httnb.exe 100 PID 4780 wrote to memory of 2168 4780 3httnb.exe 100 PID 2168 wrote to memory of 1904 2168 pdjdd.exe 101 PID 2168 wrote to memory of 1904 2168 pdjdd.exe 101 PID 2168 wrote to memory of 1904 2168 pdjdd.exe 101 PID 1904 wrote to memory of 2376 1904 3vvpj.exe 102 PID 1904 wrote to memory of 2376 1904 3vvpj.exe 102 PID 1904 wrote to memory of 2376 1904 3vvpj.exe 102 PID 2376 wrote to memory of 4176 2376 hnnnhh.exe 103 PID 2376 wrote to memory of 4176 2376 hnnnhh.exe 103 PID 2376 wrote to memory of 4176 2376 hnnnhh.exe 103 PID 4176 wrote to memory of 916 4176 bbhbbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe"C:\Users\Admin\AppData\Local\Temp\45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\3vddv.exec:\3vddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\lfrllll.exec:\lfrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\nhtthh.exec:\nhtthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\nhnnhb.exec:\nhnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\7frlrxx.exec:\7frlrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5tnhhh.exec:\5tnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\hnbtnn.exec:\hnbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\rlxrrll.exec:\rlxrrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xllfxrl.exec:\xllfxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\hbhhbb.exec:\hbhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jdvpp.exec:\jdvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vdpjd.exec:\vdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\rrfxrrf.exec:\rrfxrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\bhhtbt.exec:\bhhtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\vjdvp.exec:\vjdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\fxffxfx.exec:\fxffxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\3httnb.exec:\3httnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\pdjdd.exec:\pdjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\3vvpj.exec:\3vvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hnnnhh.exec:\hnnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bbhbbb.exec:\bbhbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\jddvv.exec:\jddvv.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\9ffxlll.exec:\9ffxlll.exe24⤵
- Executes dropped EXE
PID:3824 -
\??\c:\9bnhbh.exec:\9bnhbh.exe25⤵
- Executes dropped EXE
PID:3164 -
\??\c:\pjppd.exec:\pjppd.exe26⤵
- Executes dropped EXE
PID:2532 -
\??\c:\frrrllf.exec:\frrrllf.exe27⤵
- Executes dropped EXE
PID:4768 -
\??\c:\llffxrr.exec:\llffxrr.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ttttnn.exec:\ttttnn.exe29⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ttbbhb.exec:\ttbbhb.exe30⤵
- Executes dropped EXE
PID:4148 -
\??\c:\vddvv.exec:\vddvv.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxllfrr.exec:\xxllfrr.exe32⤵
- Executes dropped EXE
PID:3724 -
\??\c:\lfllrrx.exec:\lfllrrx.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbbbbb.exec:\hbbbbb.exe34⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7djjd.exec:\7djjd.exe35⤵
- Executes dropped EXE
PID:4028 -
\??\c:\xflllll.exec:\xflllll.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe37⤵
- Executes dropped EXE
PID:444 -
\??\c:\tbhhhh.exec:\tbhhhh.exe38⤵
- Executes dropped EXE
PID:4324 -
\??\c:\fxfrrrl.exec:\fxfrrrl.exe39⤵
- Executes dropped EXE
PID:3260 -
\??\c:\xxrrlrr.exec:\xxrrlrr.exe40⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nhbttt.exec:\nhbttt.exe41⤵
- Executes dropped EXE
PID:3328 -
\??\c:\vvdvd.exec:\vvdvd.exe42⤵
- Executes dropped EXE
PID:3968 -
\??\c:\7dppj.exec:\7dppj.exe43⤵
- Executes dropped EXE
PID:3384 -
\??\c:\lffrlff.exec:\lffrlff.exe44⤵
- Executes dropped EXE
PID:904 -
\??\c:\rrrfflx.exec:\rrrfflx.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tbtnbh.exec:\tbtnbh.exe46⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hnttbb.exec:\hnttbb.exe47⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ppvvd.exec:\ppvvd.exe48⤵
- Executes dropped EXE
PID:1588 -
\??\c:\frlffrl.exec:\frlffrl.exe49⤵
- Executes dropped EXE
PID:100 -
\??\c:\lflllll.exec:\lflllll.exe50⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nhnttt.exec:\nhnttt.exe51⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ppvvp.exec:\ppvvp.exe52⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dpppp.exec:\dpppp.exe53⤵
- Executes dropped EXE
PID:1172 -
\??\c:\3lfxllx.exec:\3lfxllx.exe54⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xflrrrr.exec:\xflrrrr.exe55⤵
- Executes dropped EXE
PID:4500 -
\??\c:\hthhnh.exec:\hthhnh.exe56⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9dppj.exec:\9dppj.exe57⤵
- Executes dropped EXE
PID:1808 -
\??\c:\flfxxll.exec:\flfxxll.exe58⤵
- Executes dropped EXE
PID:4420 -
\??\c:\3bbhhh.exec:\3bbhhh.exe59⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nttnht.exec:\nttnht.exe60⤵
- Executes dropped EXE
PID:3792 -
\??\c:\ppppj.exec:\ppppj.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lrrffxr.exec:\lrrffxr.exe62⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe63⤵
- Executes dropped EXE
PID:4408 -
\??\c:\tbtttb.exec:\tbtttb.exe64⤵
- Executes dropped EXE
PID:1840 -
\??\c:\ppppp.exec:\ppppp.exe65⤵
- Executes dropped EXE
PID:3284 -
\??\c:\3rlflll.exec:\3rlflll.exe66⤵PID:3952
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe67⤵PID:2104
-
\??\c:\bnttth.exec:\bnttth.exe68⤵PID:2424
-
\??\c:\3htnbb.exec:\3htnbb.exe69⤵PID:3872
-
\??\c:\ddpvv.exec:\ddpvv.exe70⤵PID:3164
-
\??\c:\7vvvv.exec:\7vvvv.exe71⤵PID:4036
-
\??\c:\bhhbtn.exec:\bhhbtn.exe72⤵PID:3996
-
\??\c:\pjjjj.exec:\pjjjj.exe73⤵PID:3748
-
\??\c:\pdppp.exec:\pdppp.exe74⤵PID:4820
-
\??\c:\9xxfxxf.exec:\9xxfxxf.exe75⤵PID:2808
-
\??\c:\llrrrrr.exec:\llrrrrr.exe76⤵PID:3396
-
\??\c:\htbnnn.exec:\htbnnn.exe77⤵PID:436
-
\??\c:\bbnhnt.exec:\bbnhnt.exe78⤵PID:4804
-
\??\c:\pjppj.exec:\pjppj.exe79⤵PID:4468
-
\??\c:\djvpv.exec:\djvpv.exe80⤵PID:4628
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe81⤵PID:1152
-
\??\c:\ffrllrr.exec:\ffrllrr.exe82⤵PID:4876
-
\??\c:\hbhhhh.exec:\hbhhhh.exe83⤵PID:2536
-
\??\c:\1bhhnn.exec:\1bhhnn.exe84⤵PID:5028
-
\??\c:\vvvpv.exec:\vvvpv.exe85⤵PID:1292
-
\??\c:\7jvvv.exec:\7jvvv.exe86⤵PID:908
-
\??\c:\3rfxflr.exec:\3rfxflr.exe87⤵PID:4560
-
\??\c:\7ffrrxf.exec:\7ffrrxf.exe88⤵PID:1100
-
\??\c:\nhtbhn.exec:\nhtbhn.exe89⤵PID:3496
-
\??\c:\nnnhbt.exec:\nnnhbt.exe90⤵PID:408
-
\??\c:\1jvpp.exec:\1jvpp.exe91⤵PID:2052
-
\??\c:\jjvpd.exec:\jjvpd.exe92⤵PID:716
-
\??\c:\xrxxffl.exec:\xrxxffl.exe93⤵PID:228
-
\??\c:\lrlllrr.exec:\lrlllrr.exe94⤵PID:4572
-
\??\c:\9bhhnn.exec:\9bhhnn.exe95⤵PID:4924
-
\??\c:\pdpvj.exec:\pdpvj.exe96⤵PID:560
-
\??\c:\jdjjj.exec:\jdjjj.exe97⤵PID:5092
-
\??\c:\lllffff.exec:\lllffff.exe98⤵PID:4548
-
\??\c:\xrxrrll.exec:\xrxrrll.exe99⤵PID:5096
-
\??\c:\bbhbbb.exec:\bbhbbb.exe100⤵PID:5004
-
\??\c:\nnhhhh.exec:\nnhhhh.exe101⤵PID:1412
-
\??\c:\vvpjv.exec:\vvpjv.exe102⤵PID:4420
-
\??\c:\xxlrxff.exec:\xxlrxff.exe103⤵PID:4740
-
\??\c:\llrrrrx.exec:\llrrrrx.exe104⤵PID:3792
-
\??\c:\tnnnnn.exec:\tnnnnn.exe105⤵PID:1568
-
\??\c:\bnttnh.exec:\bnttnh.exe106⤵PID:2240
-
\??\c:\jjjdp.exec:\jjjdp.exe107⤵PID:2376
-
\??\c:\dvjdp.exec:\dvjdp.exe108⤵PID:4448
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe109⤵PID:4552
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe110⤵PID:3588
-
\??\c:\nhnntb.exec:\nhnntb.exe111⤵PID:3732
-
\??\c:\vpdvv.exec:\vpdvv.exe112⤵PID:5116
-
\??\c:\ppvvv.exec:\ppvvv.exe113⤵PID:1216
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe114⤵PID:4768
-
\??\c:\rllrrrl.exec:\rllrrrl.exe115⤵PID:4036
-
\??\c:\nnhhtt.exec:\nnhhtt.exe116⤵PID:3996
-
\??\c:\nnttbb.exec:\nnttbb.exe117⤵PID:3748
-
\??\c:\jpvpp.exec:\jpvpp.exe118⤵PID:4820
-
\??\c:\jpddv.exec:\jpddv.exe119⤵PID:4568
-
\??\c:\tnnnnt.exec:\tnnnnt.exe120⤵PID:3396
-
\??\c:\7nhhbb.exec:\7nhhbb.exe121⤵PID:436
-
\??\c:\9ddpj.exec:\9ddpj.exe122⤵PID:3056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-