Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 20:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe
-
Size
267KB
-
MD5
209d1e329a38c0329b0a926e2289f87b
-
SHA1
350b08d83135692b1e09a8016e574559cb52a77e
-
SHA256
2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d
-
SHA512
219505a4df6311f3d0e787b63fc07e579398e770f478e82fd7ba6bdf55e178955783e92b31558a86faeec02f9148d1276381e3d64524f089517662bf887a582b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMz:n3C9BRIG0asYFm71mPfkVB8dKwaWj
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4888-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/4888-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3228-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2504-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1000-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4760-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3656-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4040-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3776-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3156-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/532-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2368-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2400-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3884-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/528-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/800-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/232-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4292-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5100-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2700-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1476-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3228 lrxfffx.exe 2504 nnnttt.exe 4760 dpjpd.exe 1000 llxlfll.exe 4100 lrxflrx.exe 3656 btbbbb.exe 4040 vdddd.exe 4924 bbthbh.exe 4992 vvvpp.exe 3776 bnbhhn.exe 3184 pdpjj.exe 3156 5llllll.exe 1684 pjdvp.exe 532 xfxrrxl.exe 3456 hnntbh.exe 2368 jvvvd.exe 4516 rfrrrxf.exe 2400 hnhbhn.exe 3884 dpvvv.exe 2412 5flfllf.exe 528 bbhhnn.exe 800 jjppp.exe 3084 lxrrxrx.exe 2056 jjjjj.exe 232 xrffflf.exe 4292 7xffflf.exe 4504 vjvvv.exe 5100 xrllrxf.exe 2700 nntnhh.exe 1476 dvpjj.exe 2788 ntnnnt.exe 1940 bbtttb.exe 1968 xxrllrr.exe 3856 nnnnnn.exe 2164 tthhtb.exe 1532 dddpp.exe 3328 xfffxxf.exe 4328 lllrlxl.exe 1204 ttbthb.exe 4888 jjdvd.exe 4032 9llllll.exe 4572 nbtbnt.exe 3840 jdvdv.exe 1000 rrxxflx.exe 5016 nnnnhh.exe 4960 nhntht.exe 4160 pppvv.exe 4716 llllfxl.exe 2772 lxffrxx.exe 1828 tthntb.exe 3688 hntbbh.exe 2628 vvddd.exe 3184 lxllflf.exe 3720 btbnnt.exe 3672 nhttnt.exe 2444 3dvvv.exe 3400 dpjjp.exe 4996 xrlxfxf.exe 2096 hbbntt.exe 5088 jdvpd.exe 604 vjvvv.exe 3936 fllrrlf.exe 4488 nhbbbh.exe 3876 5jddd.exe -
resource yara_rule behavioral2/memory/4888-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3228 4888 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 83 PID 4888 wrote to memory of 3228 4888 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 83 PID 4888 wrote to memory of 3228 4888 2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe 83 PID 3228 wrote to memory of 2504 3228 lrxfffx.exe 84 PID 3228 wrote to memory of 2504 3228 lrxfffx.exe 84 PID 3228 wrote to memory of 2504 3228 lrxfffx.exe 84 PID 2504 wrote to memory of 4760 2504 nnnttt.exe 85 PID 2504 wrote to memory of 4760 2504 nnnttt.exe 85 PID 2504 wrote to memory of 4760 2504 nnnttt.exe 85 PID 4760 wrote to memory of 1000 4760 dpjpd.exe 86 PID 4760 wrote to memory of 1000 4760 dpjpd.exe 86 PID 4760 wrote to memory of 1000 4760 dpjpd.exe 86 PID 1000 wrote to memory of 4100 1000 llxlfll.exe 87 PID 1000 wrote to memory of 4100 1000 llxlfll.exe 87 PID 1000 wrote to memory of 4100 1000 llxlfll.exe 87 PID 4100 wrote to memory of 3656 4100 lrxflrx.exe 88 PID 4100 wrote to memory of 3656 4100 lrxflrx.exe 88 PID 4100 wrote to memory of 3656 4100 lrxflrx.exe 88 PID 3656 wrote to memory of 4040 3656 btbbbb.exe 89 PID 3656 wrote to memory of 4040 3656 btbbbb.exe 89 PID 3656 wrote to memory of 4040 3656 btbbbb.exe 89 PID 4040 wrote to memory of 4924 4040 vdddd.exe 90 PID 4040 wrote to memory of 4924 4040 vdddd.exe 90 PID 4040 wrote to memory of 4924 4040 vdddd.exe 90 PID 4924 wrote to memory of 4992 4924 bbthbh.exe 91 PID 4924 wrote to memory of 4992 4924 bbthbh.exe 91 PID 4924 wrote to memory of 4992 4924 bbthbh.exe 91 PID 4992 wrote to memory of 3776 4992 vvvpp.exe 92 PID 4992 wrote to memory of 3776 4992 vvvpp.exe 92 PID 4992 wrote to memory of 3776 4992 vvvpp.exe 92 PID 3776 wrote to memory of 3184 3776 bnbhhn.exe 93 PID 3776 wrote to memory of 3184 3776 bnbhhn.exe 93 PID 3776 wrote to memory of 3184 3776 bnbhhn.exe 93 PID 3184 wrote to memory of 3156 3184 pdpjj.exe 94 PID 3184 wrote to memory of 3156 3184 pdpjj.exe 94 PID 3184 wrote to memory of 3156 3184 pdpjj.exe 94 PID 3156 wrote to memory of 1684 3156 5llllll.exe 95 PID 3156 wrote to memory of 1684 3156 5llllll.exe 95 PID 3156 wrote to memory of 1684 3156 5llllll.exe 95 PID 1684 wrote to memory of 532 1684 pjdvp.exe 96 PID 1684 wrote to memory of 532 1684 pjdvp.exe 96 PID 1684 wrote to memory of 532 1684 pjdvp.exe 96 PID 532 wrote to memory of 3456 532 xfxrrxl.exe 97 PID 532 wrote to memory of 3456 532 xfxrrxl.exe 97 PID 532 wrote to memory of 3456 532 xfxrrxl.exe 97 PID 3456 wrote to memory of 2368 3456 hnntbh.exe 98 PID 3456 wrote to memory of 2368 3456 hnntbh.exe 98 PID 3456 wrote to memory of 2368 3456 hnntbh.exe 98 PID 2368 wrote to memory of 4516 2368 jvvvd.exe 99 PID 2368 wrote to memory of 4516 2368 jvvvd.exe 99 PID 2368 wrote to memory of 4516 2368 jvvvd.exe 99 PID 4516 wrote to memory of 2400 4516 rfrrrxf.exe 100 PID 4516 wrote to memory of 2400 4516 rfrrrxf.exe 100 PID 4516 wrote to memory of 2400 4516 rfrrrxf.exe 100 PID 2400 wrote to memory of 3884 2400 hnhbhn.exe 102 PID 2400 wrote to memory of 3884 2400 hnhbhn.exe 102 PID 2400 wrote to memory of 3884 2400 hnhbhn.exe 102 PID 3884 wrote to memory of 2412 3884 dpvvv.exe 103 PID 3884 wrote to memory of 2412 3884 dpvvv.exe 103 PID 3884 wrote to memory of 2412 3884 dpvvv.exe 103 PID 2412 wrote to memory of 528 2412 5flfllf.exe 104 PID 2412 wrote to memory of 528 2412 5flfllf.exe 104 PID 2412 wrote to memory of 528 2412 5flfllf.exe 104 PID 528 wrote to memory of 800 528 bbhhnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe"C:\Users\Admin\AppData\Local\Temp\2c1eec17eab32ea0c36a2296a105aaf08a09fa637697f3c61bed76a7785f3c8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lrxfffx.exec:\lrxfffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\nnnttt.exec:\nnnttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dpjpd.exec:\dpjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\llxlfll.exec:\llxlfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\lrxflrx.exec:\lrxflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\btbbbb.exec:\btbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\vdddd.exec:\vdddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\bbthbh.exec:\bbthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vvvpp.exec:\vvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\bnbhhn.exec:\bnbhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\pdpjj.exec:\pdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\5llllll.exec:\5llllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\pjdvp.exec:\pjdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\xfxrrxl.exec:\xfxrrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\hnntbh.exec:\hnntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\jvvvd.exec:\jvvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\hnhbhn.exec:\hnhbhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\dpvvv.exec:\dpvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\5flfllf.exec:\5flfllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\bbhhnn.exec:\bbhhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\jjppp.exec:\jjppp.exe23⤵
- Executes dropped EXE
PID:800 -
\??\c:\lxrrxrx.exec:\lxrrxrx.exe24⤵
- Executes dropped EXE
PID:3084 -
\??\c:\jjjjj.exec:\jjjjj.exe25⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrffflf.exec:\xrffflf.exe26⤵
- Executes dropped EXE
PID:232 -
\??\c:\7xffflf.exec:\7xffflf.exe27⤵
- Executes dropped EXE
PID:4292 -
\??\c:\vjvvv.exec:\vjvvv.exe28⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xrllrxf.exec:\xrllrxf.exe29⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nntnhh.exec:\nntnhh.exe30⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvpjj.exec:\dvpjj.exe31⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ntnnnt.exec:\ntnnnt.exe32⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bbtttb.exec:\bbtttb.exe33⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xxrllrr.exec:\xxrllrr.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nnnnnn.exec:\nnnnnn.exe35⤵
- Executes dropped EXE
PID:3856 -
\??\c:\tthhtb.exec:\tthhtb.exe36⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dddpp.exec:\dddpp.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xfffxxf.exec:\xfffxxf.exe38⤵
- Executes dropped EXE
PID:3328 -
\??\c:\lllrlxl.exec:\lllrlxl.exe39⤵
- Executes dropped EXE
PID:4328 -
\??\c:\ttbthb.exec:\ttbthb.exe40⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jjdvd.exec:\jjdvd.exe41⤵
- Executes dropped EXE
PID:4888 -
\??\c:\9llllll.exec:\9llllll.exe42⤵
- Executes dropped EXE
PID:4032 -
\??\c:\nbtbnt.exec:\nbtbnt.exe43⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jdvdv.exec:\jdvdv.exe44⤵
- Executes dropped EXE
PID:3840 -
\??\c:\rrxxflx.exec:\rrxxflx.exe45⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nnnnhh.exec:\nnnnhh.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nhntht.exec:\nhntht.exe47⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pppvv.exec:\pppvv.exe48⤵
- Executes dropped EXE
PID:4160 -
\??\c:\llllfxl.exec:\llllfxl.exe49⤵
- Executes dropped EXE
PID:4716 -
\??\c:\lxffrxx.exec:\lxffrxx.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tthntb.exec:\tthntb.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hntbbh.exec:\hntbbh.exe52⤵
- Executes dropped EXE
PID:3688 -
\??\c:\vvddd.exec:\vvddd.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxllflf.exec:\lxllflf.exe54⤵
- Executes dropped EXE
PID:3184 -
\??\c:\btbnnt.exec:\btbnnt.exe55⤵
- Executes dropped EXE
PID:3720 -
\??\c:\nhttnt.exec:\nhttnt.exe56⤵
- Executes dropped EXE
PID:3672 -
\??\c:\3dvvv.exec:\3dvvv.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dpjjp.exec:\dpjjp.exe58⤵
- Executes dropped EXE
PID:3400 -
\??\c:\xrlxfxf.exec:\xrlxfxf.exe59⤵
- Executes dropped EXE
PID:4996 -
\??\c:\hbbntt.exec:\hbbntt.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jdvpd.exec:\jdvpd.exe61⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vjvvv.exec:\vjvvv.exe62⤵
- Executes dropped EXE
PID:604 -
\??\c:\fllrrlf.exec:\fllrrlf.exe63⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nhbbbh.exec:\nhbbbh.exe64⤵
- Executes dropped EXE
PID:4488 -
\??\c:\5jddd.exec:\5jddd.exe65⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jdppv.exec:\jdppv.exe66⤵PID:2412
-
\??\c:\lfxxfff.exec:\lfxxfff.exe67⤵PID:1116
-
\??\c:\5xlllrr.exec:\5xlllrr.exe68⤵PID:1544
-
\??\c:\bhhhnn.exec:\bhhhnn.exe69⤵PID:4624
-
\??\c:\9dvdp.exec:\9dvdp.exe70⤵PID:3696
-
\??\c:\dddvj.exec:\dddvj.exe71⤵PID:2892
-
\??\c:\frfxflr.exec:\frfxflr.exe72⤵PID:4180
-
\??\c:\thnnhb.exec:\thnnhb.exe73⤵PID:1904
-
\??\c:\tthhnh.exec:\tthhnh.exe74⤵PID:2876
-
\??\c:\9rrllrr.exec:\9rrllrr.exe75⤵PID:3992
-
\??\c:\lllrlxf.exec:\lllrlxf.exe76⤵PID:4948
-
\??\c:\hnttbh.exec:\hnttbh.exe77⤵PID:4308
-
\??\c:\ffxxfxx.exec:\ffxxfxx.exe78⤵PID:2460
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe79⤵PID:2600
-
\??\c:\hbhnnn.exec:\hbhnnn.exe80⤵PID:2132
-
\??\c:\ddjpj.exec:\ddjpj.exe81⤵PID:4840
-
\??\c:\lxlllll.exec:\lxlllll.exe82⤵PID:632
-
\??\c:\lrxxxfx.exec:\lrxxxfx.exe83⤵PID:1360
-
\??\c:\bttnhh.exec:\bttnhh.exe84⤵PID:5104
-
\??\c:\dpjjp.exec:\dpjjp.exe85⤵PID:3872
-
\??\c:\fflxlll.exec:\fflxlll.exe86⤵PID:4452
-
\??\c:\xfxrrlf.exec:\xfxrrlf.exe87⤵PID:4856
-
\??\c:\bbtnhh.exec:\bbtnhh.exe88⤵PID:3460
-
\??\c:\vpvpj.exec:\vpvpj.exe89⤵PID:4696
-
\??\c:\vjpjd.exec:\vjpjd.exe90⤵PID:4612
-
\??\c:\rflfxll.exec:\rflfxll.exe91⤵PID:2884
-
\??\c:\ffrxfrr.exec:\ffrxfrr.exe92⤵PID:224
-
\??\c:\hbhhhb.exec:\hbhhhb.exe93⤵PID:1056
-
\??\c:\vdjjj.exec:\vdjjj.exe94⤵PID:1676
-
\??\c:\llrlrxl.exec:\llrlrxl.exe95⤵PID:3656
-
\??\c:\thtttb.exec:\thtttb.exe96⤵PID:1616
-
\??\c:\ppdjj.exec:\ppdjj.exe97⤵PID:4976
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe98⤵PID:2848
-
\??\c:\rrffffl.exec:\rrffffl.exe99⤵PID:4692
-
\??\c:\nttntt.exec:\nttntt.exe100⤵PID:4748
-
\??\c:\dvvpj.exec:\dvvpj.exe101⤵PID:2076
-
\??\c:\dvjdp.exec:\dvjdp.exe102⤵PID:3184
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe103⤵PID:3720
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe104⤵PID:532
-
\??\c:\htbtnn.exec:\htbtnn.exe105⤵PID:4496
-
\??\c:\jvjdv.exec:\jvjdv.exe106⤵PID:3400
-
\??\c:\pjjdd.exec:\pjjdd.exe107⤵PID:2764
-
\??\c:\7xfxxxx.exec:\7xfxxxx.exe108⤵PID:1844
-
\??\c:\tttnhh.exec:\tttnhh.exe109⤵PID:1732
-
\??\c:\hhbbhn.exec:\hhbbhn.exe110⤵PID:988
-
\??\c:\vddvv.exec:\vddvv.exe111⤵PID:4620
-
\??\c:\fffffxf.exec:\fffffxf.exe112⤵PID:4436
-
\??\c:\xlllrll.exec:\xlllrll.exe113⤵PID:528
-
\??\c:\hbbttn.exec:\hbbttn.exe114⤵PID:3012
-
\??\c:\dvdjj.exec:\dvdjj.exe115⤵PID:1580
-
\??\c:\rxfrllf.exec:\rxfrllf.exe116⤵PID:2432
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe117⤵PID:4932
-
\??\c:\nbbtnn.exec:\nbbtnn.exe118⤵PID:2064
-
\??\c:\ppppd.exec:\ppppd.exe119⤵PID:1756
-
\??\c:\pjppd.exec:\pjppd.exe120⤵PID:1772
-
\??\c:\3fxxrrl.exec:\3fxxrrl.exe121⤵PID:3924
-
\??\c:\tnhbtt.exec:\tnhbtt.exe122⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-