Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe
-
Size
92KB
-
MD5
01fbb3c604ed878c2bddff0ec99f709c
-
SHA1
3edabe63bd0ad047fc58d0503eda33b646f7fdcc
-
SHA256
98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed
-
SHA512
068c0c977a0e304e6af0a5b45c146c6fa59abbe8ae622f6e975c3db972ca8c14de38c19f420f6de6dec1a8c34c07154f8327e757a6c087637f1182210d89a828
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBi:ymb3NkkiQ3mdBjFIVLd2hWZGreRCUlba
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/552-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5376-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5424-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6080-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5448-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5544-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/552-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2512-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2832-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2832-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5376-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3936-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3380-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1012-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1012-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4500-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1548-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4888-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/972-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5424-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3508-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/6080-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/688-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1424-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3928-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3492-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5448-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2516-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4632-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5544-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2668-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2512 fllfrxr.exe 2832 bntnth.exe 2828 dvvvv.exe 5376 fflflff.exe 3936 btnbhh.exe 3380 vdjdd.exe 1012 xrfxffl.exe 4348 bthttn.exe 4500 vppjd.exe 1548 llrxrlr.exe 4888 rxfxrlf.exe 972 bhnhhh.exe 5424 vpvvp.exe 3508 7xrlxll.exe 6080 ttnhbh.exe 688 jddpd.exe 1424 pdppv.exe 3928 lrlfxxx.exe 4876 htnhbt.exe 3492 1jjvd.exe 544 3vpdj.exe 5304 lfrlxxl.exe 5448 htnhnh.exe 5416 hhbthb.exe 3720 1vpjv.exe 2516 frfxfxr.exe 4632 frrlflx.exe 5652 htnbnh.exe 5236 ntnhtn.exe 5544 pvpdv.exe 2668 dpjvd.exe 4572 fxrxffl.exe 1600 tnthtn.exe 2084 vjdpd.exe 2464 rxrlfxl.exe 2396 rxxllfr.exe 2076 1bbthb.exe 1212 hhhtht.exe 5152 ppdvd.exe 2152 vvpjv.exe 5624 flfrxrf.exe 4792 htnhtn.exe 5864 tntnnh.exe 608 nththt.exe 5836 9djjp.exe 4268 jddjp.exe 3016 lffrxrl.exe 4448 hhhhbt.exe 6016 nhbnbt.exe 3888 ddvdv.exe 2292 rffxfxr.exe 5692 lfxrllf.exe 5848 nhhthn.exe 5684 vjjdp.exe 944 rrlxlll.exe 3060 lfxrfxr.exe 2744 thtbbt.exe 3964 hhtbnh.exe 5088 7pdvj.exe 3004 frxrrlf.exe 2928 xrlfxlf.exe 1860 7hbnbt.exe 4864 5bthnn.exe 5636 5ntnhb.exe -
resource yara_rule behavioral2/memory/552-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5376-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5424-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6080-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5448-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5544-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 552 wrote to memory of 2512 552 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 81 PID 552 wrote to memory of 2512 552 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 81 PID 552 wrote to memory of 2512 552 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 81 PID 2512 wrote to memory of 2832 2512 fllfrxr.exe 82 PID 2512 wrote to memory of 2832 2512 fllfrxr.exe 82 PID 2512 wrote to memory of 2832 2512 fllfrxr.exe 82 PID 2832 wrote to memory of 2828 2832 bntnth.exe 83 PID 2832 wrote to memory of 2828 2832 bntnth.exe 83 PID 2832 wrote to memory of 2828 2832 bntnth.exe 83 PID 2828 wrote to memory of 5376 2828 dvvvv.exe 84 PID 2828 wrote to memory of 5376 2828 dvvvv.exe 84 PID 2828 wrote to memory of 5376 2828 dvvvv.exe 84 PID 5376 wrote to memory of 3936 5376 fflflff.exe 85 PID 5376 wrote to memory of 3936 5376 fflflff.exe 85 PID 5376 wrote to memory of 3936 5376 fflflff.exe 85 PID 3936 wrote to memory of 3380 3936 btnbhh.exe 86 PID 3936 wrote to memory of 3380 3936 btnbhh.exe 86 PID 3936 wrote to memory of 3380 3936 btnbhh.exe 86 PID 3380 wrote to memory of 1012 3380 vdjdd.exe 87 PID 3380 wrote to memory of 1012 3380 vdjdd.exe 87 PID 3380 wrote to memory of 1012 3380 vdjdd.exe 87 PID 1012 wrote to memory of 4348 1012 xrfxffl.exe 89 PID 1012 wrote to memory of 4348 1012 xrfxffl.exe 89 PID 1012 wrote to memory of 4348 1012 xrfxffl.exe 89 PID 4348 wrote to memory of 4500 4348 bthttn.exe 90 PID 4348 wrote to memory of 4500 4348 bthttn.exe 90 PID 4348 wrote to memory of 4500 4348 bthttn.exe 90 PID 4500 wrote to memory of 1548 4500 vppjd.exe 91 PID 4500 wrote to memory of 1548 4500 vppjd.exe 91 PID 4500 wrote to memory of 1548 4500 vppjd.exe 91 PID 1548 wrote to memory of 4888 1548 llrxrlr.exe 92 PID 1548 wrote to memory of 4888 1548 llrxrlr.exe 92 PID 1548 wrote to memory of 4888 1548 llrxrlr.exe 92 PID 4888 wrote to memory of 972 4888 rxfxrlf.exe 93 PID 4888 wrote to memory of 972 4888 rxfxrlf.exe 93 PID 4888 wrote to memory of 972 4888 rxfxrlf.exe 93 PID 972 wrote to memory of 5424 972 bhnhhh.exe 94 PID 972 wrote to memory of 5424 972 bhnhhh.exe 94 PID 972 wrote to memory of 5424 972 bhnhhh.exe 94 PID 5424 wrote to memory of 3508 5424 vpvvp.exe 95 PID 5424 wrote to memory of 3508 5424 vpvvp.exe 95 PID 5424 wrote to memory of 3508 5424 vpvvp.exe 95 PID 3508 wrote to memory of 6080 3508 7xrlxll.exe 97 PID 3508 wrote to memory of 6080 3508 7xrlxll.exe 97 PID 3508 wrote to memory of 6080 3508 7xrlxll.exe 97 PID 6080 wrote to memory of 688 6080 ttnhbh.exe 98 PID 6080 wrote to memory of 688 6080 ttnhbh.exe 98 PID 6080 wrote to memory of 688 6080 ttnhbh.exe 98 PID 688 wrote to memory of 1424 688 jddpd.exe 99 PID 688 wrote to memory of 1424 688 jddpd.exe 99 PID 688 wrote to memory of 1424 688 jddpd.exe 99 PID 1424 wrote to memory of 3928 1424 pdppv.exe 100 PID 1424 wrote to memory of 3928 1424 pdppv.exe 100 PID 1424 wrote to memory of 3928 1424 pdppv.exe 100 PID 3928 wrote to memory of 4876 3928 lrlfxxx.exe 102 PID 3928 wrote to memory of 4876 3928 lrlfxxx.exe 102 PID 3928 wrote to memory of 4876 3928 lrlfxxx.exe 102 PID 4876 wrote to memory of 3492 4876 htnhbt.exe 103 PID 4876 wrote to memory of 3492 4876 htnhbt.exe 103 PID 4876 wrote to memory of 3492 4876 htnhbt.exe 103 PID 3492 wrote to memory of 544 3492 1jjvd.exe 104 PID 3492 wrote to memory of 544 3492 1jjvd.exe 104 PID 3492 wrote to memory of 544 3492 1jjvd.exe 104 PID 544 wrote to memory of 5304 544 3vpdj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe"C:\Users\Admin\AppData\Local\Temp\98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\fllfrxr.exec:\fllfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\bntnth.exec:\bntnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dvvvv.exec:\dvvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fflflff.exec:\fflflff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
\??\c:\btnbhh.exec:\btnbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vdjdd.exec:\vdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\xrfxffl.exec:\xrfxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\bthttn.exec:\bthttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\vppjd.exec:\vppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\llrxrlr.exec:\llrxrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\bhnhhh.exec:\bhnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\vpvvp.exec:\vpvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
\??\c:\7xrlxll.exec:\7xrlxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\ttnhbh.exec:\ttnhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
\??\c:\jddpd.exec:\jddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\pdppv.exec:\pdppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\lrlfxxx.exec:\lrlfxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\htnhbt.exec:\htnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\1jjvd.exec:\1jjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\3vpdj.exec:\3vpdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe23⤵
- Executes dropped EXE
PID:5304 -
\??\c:\htnhnh.exec:\htnhnh.exe24⤵
- Executes dropped EXE
PID:5448 -
\??\c:\hhbthb.exec:\hhbthb.exe25⤵
- Executes dropped EXE
PID:5416 -
\??\c:\1vpjv.exec:\1vpjv.exe26⤵
- Executes dropped EXE
PID:3720 -
\??\c:\frfxfxr.exec:\frfxfxr.exe27⤵
- Executes dropped EXE
PID:2516 -
\??\c:\frrlflx.exec:\frrlflx.exe28⤵
- Executes dropped EXE
PID:4632 -
\??\c:\htnbnh.exec:\htnbnh.exe29⤵
- Executes dropped EXE
PID:5652 -
\??\c:\ntnhtn.exec:\ntnhtn.exe30⤵
- Executes dropped EXE
PID:5236 -
\??\c:\pvpdv.exec:\pvpdv.exe31⤵
- Executes dropped EXE
PID:5544 -
\??\c:\dpjvd.exec:\dpjvd.exe32⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxrxffl.exec:\fxrxffl.exe33⤵
- Executes dropped EXE
PID:4572 -
\??\c:\tnthtn.exec:\tnthtn.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjdpd.exec:\vjdpd.exe35⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxrlfxl.exec:\rxrlfxl.exe36⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rxxllfr.exec:\rxxllfr.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1bbthb.exec:\1bbthb.exe38⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hhhtht.exec:\hhhtht.exe39⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ppdvd.exec:\ppdvd.exe40⤵
- Executes dropped EXE
PID:5152 -
\??\c:\vvpjv.exec:\vvpjv.exe41⤵
- Executes dropped EXE
PID:2152 -
\??\c:\flfrxrf.exec:\flfrxrf.exe42⤵
- Executes dropped EXE
PID:5624 -
\??\c:\htnhtn.exec:\htnhtn.exe43⤵
- Executes dropped EXE
PID:4792 -
\??\c:\tntnnh.exec:\tntnnh.exe44⤵
- Executes dropped EXE
PID:5864 -
\??\c:\nththt.exec:\nththt.exe45⤵
- Executes dropped EXE
PID:608 -
\??\c:\9djjp.exec:\9djjp.exe46⤵
- Executes dropped EXE
PID:5836 -
\??\c:\jddjp.exec:\jddjp.exe47⤵
- Executes dropped EXE
PID:4268 -
\??\c:\lffrxrl.exec:\lffrxrl.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhhhbt.exec:\hhhhbt.exe49⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nhbnbt.exec:\nhbnbt.exe50⤵
- Executes dropped EXE
PID:6016 -
\??\c:\ddvdv.exec:\ddvdv.exe51⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rffxfxr.exec:\rffxfxr.exe52⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lfxrllf.exec:\lfxrllf.exe53⤵
- Executes dropped EXE
PID:5692 -
\??\c:\nhhthn.exec:\nhhthn.exe54⤵
- Executes dropped EXE
PID:5848 -
\??\c:\vjjdp.exec:\vjjdp.exe55⤵
- Executes dropped EXE
PID:5684 -
\??\c:\rrlxlll.exec:\rrlxlll.exe56⤵
- Executes dropped EXE
PID:944 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\thtbbt.exec:\thtbbt.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hhtbnh.exec:\hhtbnh.exe59⤵
- Executes dropped EXE
PID:3964 -
\??\c:\7pdvj.exec:\7pdvj.exe60⤵
- Executes dropped EXE
PID:5088 -
\??\c:\frxrrlf.exec:\frxrrlf.exe61⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hbnbt.exec:\7hbnbt.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5bthnn.exec:\5bthnn.exe64⤵
- Executes dropped EXE
PID:4864 -
\??\c:\5ntnhb.exec:\5ntnhb.exe65⤵
- Executes dropped EXE
PID:5636 -
\??\c:\ddvpd.exec:\ddvpd.exe66⤵PID:3544
-
\??\c:\jvpjv.exec:\jvpjv.exe67⤵PID:4908
-
\??\c:\rlflrxf.exec:\rlflrxf.exe68⤵PID:4900
-
\??\c:\xlfxlxr.exec:\xlfxlxr.exe69⤵PID:3300
-
\??\c:\tbnttt.exec:\tbnttt.exe70⤵PID:320
-
\??\c:\ppvjv.exec:\ppvjv.exe71⤵PID:2032
-
\??\c:\rxlxfxr.exec:\rxlxfxr.exe72⤵PID:4288
-
\??\c:\xllxrlx.exec:\xllxrlx.exe73⤵PID:4748
-
\??\c:\btthbt.exec:\btthbt.exe74⤵PID:2216
-
\??\c:\tthnnt.exec:\tthnnt.exe75⤵PID:3000
-
\??\c:\jpjvd.exec:\jpjvd.exe76⤵PID:4464
-
\??\c:\vjjvp.exec:\vjjvp.exe77⤵PID:3560
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe78⤵PID:624
-
\??\c:\tnbbbn.exec:\tnbbbn.exe79⤵PID:5376
-
\??\c:\htthtn.exec:\htthtn.exe80⤵PID:3628
-
\??\c:\pvdpd.exec:\pvdpd.exe81⤵PID:2844
-
\??\c:\5ddpd.exec:\5ddpd.exe82⤵PID:2852
-
\??\c:\1xxrfxl.exec:\1xxrfxl.exe83⤵PID:5056
-
\??\c:\tnhtnh.exec:\tnhtnh.exe84⤵PID:1392
-
\??\c:\7ntntn.exec:\7ntntn.exe85⤵PID:2296
-
\??\c:\vpjvv.exec:\vpjvv.exe86⤵PID:1920
-
\??\c:\fflfrfx.exec:\fflfrfx.exe87⤵PID:6052
-
\??\c:\hhhhnt.exec:\hhhhnt.exe88⤵PID:5160
-
\??\c:\tbbthb.exec:\tbbthb.exe89⤵PID:5728
-
\??\c:\pdppp.exec:\pdppp.exe90⤵PID:1036
-
\??\c:\vjdpd.exec:\vjdpd.exe91⤵PID:1564
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe92⤵PID:4512
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe93⤵PID:3684
-
\??\c:\nbtntb.exec:\nbtntb.exe94⤵PID:5828
-
\??\c:\5pdvj.exec:\5pdvj.exe95⤵PID:6112
-
\??\c:\llfrflx.exec:\llfrflx.exe96⤵PID:688
-
\??\c:\9ffrfxl.exec:\9ffrfxl.exe97⤵PID:5136
-
\??\c:\nbnbth.exec:\nbnbth.exe98⤵PID:1252
-
\??\c:\thbtnt.exec:\thbtnt.exe99⤵PID:2252
-
\??\c:\7djdj.exec:\7djdj.exe100⤵PID:2604
-
\??\c:\pdjdp.exec:\pdjdp.exe101⤵PID:4876
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe102⤵PID:5148
-
\??\c:\rlfxllf.exec:\rlfxllf.exe103⤵PID:4192
-
\??\c:\tbbbtt.exec:\tbbbtt.exe104⤵PID:5460
-
\??\c:\5thhht.exec:\5thhht.exe105⤵PID:4248
-
\??\c:\7jdvj.exec:\7jdvj.exe106⤵PID:4636
-
\??\c:\7pvjd.exec:\7pvjd.exe107⤵PID:5596
-
\??\c:\xllxxrf.exec:\xllxxrf.exe108⤵PID:872
-
\??\c:\lffxffl.exec:\lffxffl.exe109⤵PID:5732
-
\??\c:\hbbbtt.exec:\hbbbtt.exe110⤵PID:1556
-
\??\c:\bnnbbb.exec:\bnnbbb.exe111⤵PID:508
-
\??\c:\jdvpj.exec:\jdvpj.exe112⤵PID:2424
-
\??\c:\rrllfxx.exec:\rrllfxx.exe113⤵PID:3664
-
\??\c:\llxxxrx.exec:\llxxxrx.exe114⤵PID:5576
-
\??\c:\rlffxxx.exec:\rlffxxx.exe115⤵PID:4204
-
\??\c:\7hbbbt.exec:\7hbbbt.exe116⤵PID:2936
-
\??\c:\pddvj.exec:\pddvj.exe117⤵PID:5360
-
\??\c:\dvvpj.exec:\dvvpj.exe118⤵PID:1216
-
\??\c:\rffxlll.exec:\rffxlll.exe119⤵PID:2564
-
\??\c:\xxfffff.exec:\xxfffff.exe120⤵PID:1456
-
\??\c:\3tnnbb.exec:\3tnnbb.exe121⤵PID:2376
-
\??\c:\bbhbnn.exec:\bbhbnn.exe122⤵PID:6008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-