Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 23:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe
-
Size
1.2MB
-
MD5
19b9ea3682a72bd02ebb754b4765bdc0
-
SHA1
33cc0c238a7395b91d4930d2055a03235a197241
-
SHA256
79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e
-
SHA512
fbc234656796e7701aaa05424ec3774786aea59528ac7e88c50d5a38f80b28e312bd51bc529054fa026f0b8c96071f87902e49cf0d6e08206f333dc415c3c7ca
-
SSDEEP
24576:ShPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWt:4bazR0vKLXZ7
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3324-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3324-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3324-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1220-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3696-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3512-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1796-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3964-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2428-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/376-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2520-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4372-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2152-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1508-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3388-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4200-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2720-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3324 7flxrlf.exe 1220 dvdpj.exe 4112 lrxfffl.exe 3696 vvvvd.exe 3512 xllfrrl.exe 1796 lxfxflx.exe 2712 bbhbtb.exe 3964 dvjjd.exe 4948 xrfxxrf.exe 2428 vjpdd.exe 3004 bhhtnh.exe 376 vvjjv.exe 2520 xllfflf.exe 4372 bnbhbb.exe 3728 7rrlflx.exe 4212 djjvp.exe 2388 frrlxxr.exe 5044 tnhbtt.exe 4380 rxrrlfx.exe 2152 jdpjv.exe 1508 xllfxlx.exe 1168 rllffff.exe 2720 tbbtnh.exe 2480 pvdvp.exe 4228 xrfrllf.exe 1952 lfxrffx.exe 3388 pvppj.exe 4200 3llfxxr.exe 1668 dpjdd.exe 4036 nbhhtt.exe 1764 5xlfrxl.exe 4456 dpjdp.exe 1548 tnbthh.exe 1632 dpjjd.exe 408 bbbtnh.exe 4064 dpdvv.exe 2852 nhhbtn.exe 1372 vdddj.exe 4928 xxfxrlr.exe 4780 9thbnh.exe 3692 1fllrrl.exe 2928 hhhbtn.exe 1052 1djvj.exe 1628 lllrflf.exe 3324 hbnthh.exe 3448 jvjdv.exe 4112 rllfxxr.exe 4076 nhnbnh.exe 4220 pjjdp.exe 4360 xlllllf.exe 4704 5hhbnh.exe 5040 9jvjj.exe 3292 fxrxrlf.exe 2288 9htnbn.exe 2076 jjjdv.exe 1516 rxfxxxx.exe 1984 nbnbnh.exe 3188 3rrlffx.exe 4680 nbbtnh.exe 2760 djpjd.exe 2792 9xxrlfr.exe 4252 tbbtnh.exe 4924 5vppj.exe 2876 rrfxlfl.exe -
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-156-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 3324 2408 79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe 81 PID 2408 wrote to memory of 3324 2408 79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe 81 PID 2408 wrote to memory of 3324 2408 79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe 81 PID 3324 wrote to memory of 1220 3324 7flxrlf.exe 82 PID 3324 wrote to memory of 1220 3324 7flxrlf.exe 82 PID 3324 wrote to memory of 1220 3324 7flxrlf.exe 82 PID 1220 wrote to memory of 4112 1220 dvdpj.exe 130 PID 1220 wrote to memory of 4112 1220 dvdpj.exe 130 PID 1220 wrote to memory of 4112 1220 dvdpj.exe 130 PID 4112 wrote to memory of 3696 4112 lrxfffl.exe 85 PID 4112 wrote to memory of 3696 4112 lrxfffl.exe 85 PID 4112 wrote to memory of 3696 4112 lrxfffl.exe 85 PID 3696 wrote to memory of 3512 3696 vvvvd.exe 87 PID 3696 wrote to memory of 3512 3696 vvvvd.exe 87 PID 3696 wrote to memory of 3512 3696 vvvvd.exe 87 PID 3512 wrote to memory of 1796 3512 xllfrrl.exe 89 PID 3512 wrote to memory of 1796 3512 xllfrrl.exe 89 PID 3512 wrote to memory of 1796 3512 xllfrrl.exe 89 PID 1796 wrote to memory of 2712 1796 lxfxflx.exe 90 PID 1796 wrote to memory of 2712 1796 lxfxflx.exe 90 PID 1796 wrote to memory of 2712 1796 lxfxflx.exe 90 PID 2712 wrote to memory of 3964 2712 bbhbtb.exe 91 PID 2712 wrote to memory of 3964 2712 bbhbtb.exe 91 PID 2712 wrote to memory of 3964 2712 bbhbtb.exe 91 PID 3964 wrote to memory of 4948 3964 dvjjd.exe 92 PID 3964 wrote to memory of 4948 3964 dvjjd.exe 92 PID 3964 wrote to memory of 4948 3964 dvjjd.exe 92 PID 4948 wrote to memory of 2428 4948 xrfxxrf.exe 93 PID 4948 wrote to memory of 2428 4948 xrfxxrf.exe 93 PID 4948 wrote to memory of 2428 4948 xrfxxrf.exe 93 PID 2428 wrote to memory of 3004 2428 vjpdd.exe 94 PID 2428 wrote to memory of 3004 2428 vjpdd.exe 94 PID 2428 wrote to memory of 3004 2428 vjpdd.exe 94 PID 3004 wrote to memory of 376 3004 bhhtnh.exe 95 PID 3004 wrote to memory of 376 3004 bhhtnh.exe 95 PID 3004 wrote to memory of 376 3004 bhhtnh.exe 95 PID 376 wrote to memory of 2520 376 vvjjv.exe 96 PID 376 wrote to memory of 2520 376 vvjjv.exe 96 PID 376 wrote to memory of 2520 376 vvjjv.exe 96 PID 2520 wrote to memory of 4372 2520 xllfflf.exe 97 PID 2520 wrote to memory of 4372 2520 xllfflf.exe 97 PID 2520 wrote to memory of 4372 2520 xllfflf.exe 97 PID 4372 wrote to memory of 3728 4372 bnbhbb.exe 98 PID 4372 wrote to memory of 3728 4372 bnbhbb.exe 98 PID 4372 wrote to memory of 3728 4372 bnbhbb.exe 98 PID 3728 wrote to memory of 4212 3728 7rrlflx.exe 99 PID 3728 wrote to memory of 4212 3728 7rrlflx.exe 99 PID 3728 wrote to memory of 4212 3728 7rrlflx.exe 99 PID 4212 wrote to memory of 2388 4212 djjvp.exe 100 PID 4212 wrote to memory of 2388 4212 djjvp.exe 100 PID 4212 wrote to memory of 2388 4212 djjvp.exe 100 PID 2388 wrote to memory of 5044 2388 frrlxxr.exe 101 PID 2388 wrote to memory of 5044 2388 frrlxxr.exe 101 PID 2388 wrote to memory of 5044 2388 frrlxxr.exe 101 PID 5044 wrote to memory of 4380 5044 tnhbtt.exe 102 PID 5044 wrote to memory of 4380 5044 tnhbtt.exe 102 PID 5044 wrote to memory of 4380 5044 tnhbtt.exe 102 PID 4380 wrote to memory of 2152 4380 rxrrlfx.exe 103 PID 4380 wrote to memory of 2152 4380 rxrrlfx.exe 103 PID 4380 wrote to memory of 2152 4380 rxrrlfx.exe 103 PID 2152 wrote to memory of 1508 2152 jdpjv.exe 156 PID 2152 wrote to memory of 1508 2152 jdpjv.exe 156 PID 2152 wrote to memory of 1508 2152 jdpjv.exe 156 PID 1508 wrote to memory of 1168 1508 xllfxlx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe"C:\Users\Admin\AppData\Local\Temp\79b51ecad9d4ce2f760b069ec18b96720e0037eef69c3b7d4fec6836628fc45e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\7flxrlf.exec:\7flxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\dvdpj.exec:\dvdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\lrxfffl.exec:\lrxfffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vvvvd.exec:\vvvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\xllfrrl.exec:\xllfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\lxfxflx.exec:\lxfxflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\bbhbtb.exec:\bbhbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\dvjjd.exec:\dvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\xrfxxrf.exec:\xrfxxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vjpdd.exec:\vjpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bhhtnh.exec:\bhhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vvjjv.exec:\vvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\xllfflf.exec:\xllfflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bnbhbb.exec:\bnbhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\7rrlflx.exec:\7rrlflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\djjvp.exec:\djjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\frrlxxr.exec:\frrlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\tnhbtt.exec:\tnhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rxrrlfx.exec:\rxrrlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\jdpjv.exec:\jdpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\xllfxlx.exec:\xllfxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\rllffff.exec:\rllffff.exe23⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tbbtnh.exec:\tbbtnh.exe24⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pvdvp.exec:\pvdvp.exe25⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xrfrllf.exec:\xrfrllf.exe26⤵
- Executes dropped EXE
PID:4228 -
\??\c:\lfxrffx.exec:\lfxrffx.exe27⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pvppj.exec:\pvppj.exe28⤵
- Executes dropped EXE
PID:3388 -
\??\c:\3llfxxr.exec:\3llfxxr.exe29⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dpjdd.exec:\dpjdd.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nbhhtt.exec:\nbhhtt.exe31⤵
- Executes dropped EXE
PID:4036 -
\??\c:\5xlfrxl.exec:\5xlfrxl.exe32⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dpjdp.exec:\dpjdp.exe33⤵
- Executes dropped EXE
PID:4456 -
\??\c:\tnbthh.exec:\tnbthh.exe34⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dpjjd.exec:\dpjjd.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bbbtnh.exec:\bbbtnh.exe36⤵
- Executes dropped EXE
PID:408 -
\??\c:\dpdvv.exec:\dpdvv.exe37⤵
- Executes dropped EXE
PID:4064 -
\??\c:\nhhbtn.exec:\nhhbtn.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vdddj.exec:\vdddj.exe39⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xxfxrlr.exec:\xxfxrlr.exe40⤵
- Executes dropped EXE
PID:4928 -
\??\c:\9thbnh.exec:\9thbnh.exe41⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1fllrrl.exec:\1fllrrl.exe42⤵
- Executes dropped EXE
PID:3692 -
\??\c:\hhhbtn.exec:\hhhbtn.exe43⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1djvj.exec:\1djvj.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lllrflf.exec:\lllrflf.exe45⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hbnthh.exec:\hbnthh.exe46⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jvjdv.exec:\jvjdv.exe47⤵
- Executes dropped EXE
PID:3448 -
\??\c:\rllfxxr.exec:\rllfxxr.exe48⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhnbnh.exec:\nhnbnh.exe49⤵
- Executes dropped EXE
PID:4076 -
\??\c:\pjjdp.exec:\pjjdp.exe50⤵
- Executes dropped EXE
PID:4220 -
\??\c:\xlllllf.exec:\xlllllf.exe51⤵
- Executes dropped EXE
PID:4360 -
\??\c:\5hhbnh.exec:\5hhbnh.exe52⤵
- Executes dropped EXE
PID:4704 -
\??\c:\9jvjj.exec:\9jvjj.exe53⤵
- Executes dropped EXE
PID:5040 -
\??\c:\fxrxrlf.exec:\fxrxrlf.exe54⤵
- Executes dropped EXE
PID:3292 -
\??\c:\9htnbn.exec:\9htnbn.exe55⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jjjdv.exec:\jjjdv.exe56⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe57⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nbnbnh.exec:\nbnbnh.exe58⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3rrlffx.exec:\3rrlffx.exe59⤵
- Executes dropped EXE
PID:3188 -
\??\c:\nbbtnh.exec:\nbbtnh.exe60⤵
- Executes dropped EXE
PID:4680 -
\??\c:\djpjd.exec:\djpjd.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9xxrlfr.exec:\9xxrlfr.exe62⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbbtnh.exec:\tbbtnh.exe63⤵
- Executes dropped EXE
PID:4252 -
\??\c:\5vppj.exec:\5vppj.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\rrfxlfl.exec:\rrfxlfl.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhhbbb.exec:\nhhbbb.exe66⤵PID:2540
-
\??\c:\vpppp.exec:\vpppp.exe67⤵PID:3756
-
\??\c:\frxxxrx.exec:\frxxxrx.exe68⤵PID:2352
-
\??\c:\tbbtth.exec:\tbbtth.exe69⤵PID:2020
-
\??\c:\1flflrx.exec:\1flflrx.exe70⤵PID:764
-
\??\c:\rxrrfff.exec:\rxrrfff.exe71⤵PID:332
-
\??\c:\jvdvp.exec:\jvdvp.exe72⤵PID:912
-
\??\c:\xlrllff.exec:\xlrllff.exe73⤵PID:3972
-
\??\c:\1xfffff.exec:\1xfffff.exe74⤵PID:1508
-
\??\c:\vjjdp.exec:\vjjdp.exe75⤵PID:428
-
\??\c:\llrllfx.exec:\llrllfx.exe76⤵PID:4460
-
\??\c:\nhnbbt.exec:\nhnbbt.exe77⤵PID:1492
-
\??\c:\ppdvj.exec:\ppdvj.exe78⤵PID:4364
-
\??\c:\9rxrxxl.exec:\9rxrxxl.exe79⤵PID:4116
-
\??\c:\9nttbb.exec:\9nttbb.exe80⤵PID:1120
-
\??\c:\vddjp.exec:\vddjp.exe81⤵PID:1368
-
\??\c:\3rxfrlx.exec:\3rxfrlx.exe82⤵PID:2860
-
\??\c:\3hhbnn.exec:\3hhbnn.exe83⤵PID:1584
-
\??\c:\djvjj.exec:\djvjj.exe84⤵PID:4384
-
\??\c:\lrxrllx.exec:\lrxrllx.exe85⤵PID:1064
-
\??\c:\bttnht.exec:\bttnht.exe86⤵PID:1884
-
\??\c:\pdjjj.exec:\pdjjj.exe87⤵PID:3304
-
\??\c:\rlxlxll.exec:\rlxlxll.exe88⤵PID:4632
-
\??\c:\bttnhb.exec:\bttnhb.exe89⤵PID:916
-
\??\c:\vjvpv.exec:\vjvpv.exe90⤵PID:628
-
\??\c:\3xfrllf.exec:\3xfrllf.exe91⤵PID:2532
-
\??\c:\frxlrll.exec:\frxlrll.exe92⤵PID:1180
-
\??\c:\7jpjd.exec:\7jpjd.exe93⤵PID:4900
-
\??\c:\xxrrllr.exec:\xxrrllr.exe94⤵PID:2884
-
\??\c:\ttbbtn.exec:\ttbbtn.exe95⤵PID:3784
-
\??\c:\9llfllf.exec:\9llfllf.exe96⤵PID:3656
-
\??\c:\5bbhnn.exec:\5bbhnn.exe97⤵PID:3692
-
\??\c:\bntnhb.exec:\bntnhb.exe98⤵PID:2928
-
\??\c:\llrlrll.exec:\llrlrll.exe99⤵PID:1948
-
\??\c:\nnhnnn.exec:\nnhnnn.exe100⤵PID:2900
-
\??\c:\9pdvp.exec:\9pdvp.exe101⤵PID:3760
-
\??\c:\jdpdv.exec:\jdpdv.exe102⤵PID:4984
-
\??\c:\vjvpp.exec:\vjvpp.exe103⤵PID:2296
-
\??\c:\frfxlrr.exec:\frfxlrr.exe104⤵PID:4016
-
\??\c:\1vvpj.exec:\1vvpj.exe105⤵PID:1776
-
\??\c:\1ppdp.exec:\1ppdp.exe106⤵PID:2524
-
\??\c:\bbhbtt.exec:\bbhbtt.exe107⤵PID:4704
-
\??\c:\vvjdp.exec:\vvjdp.exe108⤵PID:3300
-
\??\c:\frfxrrl.exec:\frfxrrl.exe109⤵PID:4668
-
\??\c:\9hbnbt.exec:\9hbnbt.exe110⤵PID:4500
-
\??\c:\9rxlrrf.exec:\9rxlrrf.exe111⤵PID:2076
-
\??\c:\nnhbnb.exec:\nnhbnb.exe112⤵PID:5012
-
\??\c:\pdppj.exec:\pdppj.exe113⤵PID:4948
-
\??\c:\lllflfl.exec:\lllflfl.exe114⤵PID:696
-
\??\c:\1jvvd.exec:\1jvvd.exe115⤵PID:4680
-
\??\c:\3lfrrlx.exec:\3lfrrlx.exe116⤵PID:4432
-
\??\c:\tbnhbb.exec:\tbnhbb.exe117⤵PID:376
-
\??\c:\5jjjd.exec:\5jjjd.exe118⤵PID:2520
-
\??\c:\hhtnhb.exec:\hhtnhb.exe119⤵PID:4372
-
\??\c:\vdppp.exec:\vdppp.exe120⤵PID:2876
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe121⤵PID:1900
-
\??\c:\nnnhtn.exec:\nnnhtn.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-