Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 05:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe
-
Size
387KB
-
MD5
a73992931be67358799b9052e51e1104
-
SHA1
7155b82ac6e852e2888ff978cff8b9fe63c95336
-
SHA256
e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b
-
SHA512
7102bd317f4c155d0a0d027317d9308eef36183aa8505f06887fe216272ee22eeeef5b8085cd91696bf680d3249ccef0129e0302dc2a9c6228ad053985b2f025
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwf0:SgdnJVU4TlnwJ6Goh
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3632-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3632-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1584-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3116-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1520-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/876-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1648-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/632-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3296-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4940-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1260-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1172-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4820-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3172-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2524-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/724-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4792-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/456-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/884-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/940-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5100-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4724 nbhhbb.exe 3632 ppppv.exe 1584 rxfxrrr.exe 3116 lffxrlf.exe 1520 btbbtt.exe 876 tnnhbt.exe 1960 pjppj.exe 2120 hhnhnh.exe 3664 pjdvp.exe 1648 nbbhbb.exe 632 htbbnt.exe 3192 dpjjv.exe 3296 ffxrlll.exe 4940 7djvp.exe 1260 ttbtnn.exe 1172 rrrrlrl.exe 4432 lrxrllf.exe 4820 jpvpp.exe 3172 lxfxrlf.exe 4348 ppvpj.exe 2524 hhhtnn.exe 724 ppvvv.exe 1004 jdpvp.exe 4792 rfrrlfx.exe 456 frxrlff.exe 1848 nhnhbh.exe 884 lrffxxr.exe 5100 7htntt.exe 4592 7vdpj.exe 3916 fxfxxxl.exe 940 rxllfll.exe 4528 hnnhbb.exe 2272 pdvpj.exe 4356 3pppj.exe 2016 hbnbhh.exe 5052 btnhbb.exe 1808 pjpjd.exe 1184 xxxrxrx.exe 4996 ffffxxr.exe 2248 thtnnh.exe 3128 bntnhh.exe 3760 vjjdv.exe 4460 llxrrll.exe 1908 1rxrffr.exe 4904 3thbbh.exe 3548 jjvpp.exe 4500 xrfxxxx.exe 2984 thnhhb.exe 4816 vjpjd.exe 1632 1frlrrr.exe 540 jvjvv.exe 4684 frrlxxl.exe 3948 nnnbbh.exe 2616 llrlrrx.exe 3180 bbhbtt.exe 2640 pvddv.exe 3664 rflfxrl.exe 4076 httnth.exe 3288 pjjjd.exe 2316 lrfxrlx.exe 1556 7nnnhh.exe 2332 jddpd.exe 4228 ddpjv.exe 1596 lllfrrl.exe -
resource yara_rule behavioral2/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 4724 2424 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 81 PID 2424 wrote to memory of 4724 2424 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 81 PID 2424 wrote to memory of 4724 2424 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 81 PID 4724 wrote to memory of 3632 4724 nbhhbb.exe 82 PID 4724 wrote to memory of 3632 4724 nbhhbb.exe 82 PID 4724 wrote to memory of 3632 4724 nbhhbb.exe 82 PID 3632 wrote to memory of 1584 3632 ppppv.exe 83 PID 3632 wrote to memory of 1584 3632 ppppv.exe 83 PID 3632 wrote to memory of 1584 3632 ppppv.exe 83 PID 1584 wrote to memory of 3116 1584 rxfxrrr.exe 84 PID 1584 wrote to memory of 3116 1584 rxfxrrr.exe 84 PID 1584 wrote to memory of 3116 1584 rxfxrrr.exe 84 PID 3116 wrote to memory of 1520 3116 lffxrlf.exe 85 PID 3116 wrote to memory of 1520 3116 lffxrlf.exe 85 PID 3116 wrote to memory of 1520 3116 lffxrlf.exe 85 PID 1520 wrote to memory of 876 1520 btbbtt.exe 89 PID 1520 wrote to memory of 876 1520 btbbtt.exe 89 PID 1520 wrote to memory of 876 1520 btbbtt.exe 89 PID 876 wrote to memory of 1960 876 tnnhbt.exe 90 PID 876 wrote to memory of 1960 876 tnnhbt.exe 90 PID 876 wrote to memory of 1960 876 tnnhbt.exe 90 PID 1960 wrote to memory of 2120 1960 pjppj.exe 91 PID 1960 wrote to memory of 2120 1960 pjppj.exe 91 PID 1960 wrote to memory of 2120 1960 pjppj.exe 91 PID 2120 wrote to memory of 3664 2120 hhnhnh.exe 92 PID 2120 wrote to memory of 3664 2120 hhnhnh.exe 92 PID 2120 wrote to memory of 3664 2120 hhnhnh.exe 92 PID 3664 wrote to memory of 1648 3664 pjdvp.exe 93 PID 3664 wrote to memory of 1648 3664 pjdvp.exe 93 PID 3664 wrote to memory of 1648 3664 pjdvp.exe 93 PID 1648 wrote to memory of 632 1648 nbbhbb.exe 94 PID 1648 wrote to memory of 632 1648 nbbhbb.exe 94 PID 1648 wrote to memory of 632 1648 nbbhbb.exe 94 PID 632 wrote to memory of 3192 632 htbbnt.exe 95 PID 632 wrote to memory of 3192 632 htbbnt.exe 95 PID 632 wrote to memory of 3192 632 htbbnt.exe 95 PID 3192 wrote to memory of 3296 3192 dpjjv.exe 96 PID 3192 wrote to memory of 3296 3192 dpjjv.exe 96 PID 3192 wrote to memory of 3296 3192 dpjjv.exe 96 PID 3296 wrote to memory of 4940 3296 ffxrlll.exe 97 PID 3296 wrote to memory of 4940 3296 ffxrlll.exe 97 PID 3296 wrote to memory of 4940 3296 ffxrlll.exe 97 PID 4940 wrote to memory of 1260 4940 7djvp.exe 98 PID 4940 wrote to memory of 1260 4940 7djvp.exe 98 PID 4940 wrote to memory of 1260 4940 7djvp.exe 98 PID 1260 wrote to memory of 1172 1260 ttbtnn.exe 99 PID 1260 wrote to memory of 1172 1260 ttbtnn.exe 99 PID 1260 wrote to memory of 1172 1260 ttbtnn.exe 99 PID 1172 wrote to memory of 4432 1172 rrrrlrl.exe 100 PID 1172 wrote to memory of 4432 1172 rrrrlrl.exe 100 PID 1172 wrote to memory of 4432 1172 rrrrlrl.exe 100 PID 4432 wrote to memory of 4820 4432 lrxrllf.exe 101 PID 4432 wrote to memory of 4820 4432 lrxrllf.exe 101 PID 4432 wrote to memory of 4820 4432 lrxrllf.exe 101 PID 4820 wrote to memory of 3172 4820 jpvpp.exe 102 PID 4820 wrote to memory of 3172 4820 jpvpp.exe 102 PID 4820 wrote to memory of 3172 4820 jpvpp.exe 102 PID 3172 wrote to memory of 4348 3172 lxfxrlf.exe 103 PID 3172 wrote to memory of 4348 3172 lxfxrlf.exe 103 PID 3172 wrote to memory of 4348 3172 lxfxrlf.exe 103 PID 4348 wrote to memory of 2524 4348 ppvpj.exe 104 PID 4348 wrote to memory of 2524 4348 ppvpj.exe 104 PID 4348 wrote to memory of 2524 4348 ppvpj.exe 104 PID 2524 wrote to memory of 724 2524 hhhtnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe"C:\Users\Admin\AppData\Local\Temp\e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\nbhhbb.exec:\nbhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\ppppv.exec:\ppppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\lffxrlf.exec:\lffxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\btbbtt.exec:\btbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\tnnhbt.exec:\tnnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\pjppj.exec:\pjppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hhnhnh.exec:\hhnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\pjdvp.exec:\pjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\nbbhbb.exec:\nbbhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\htbbnt.exec:\htbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\dpjjv.exec:\dpjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\ffxrlll.exec:\ffxrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\7djvp.exec:\7djvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\ttbtnn.exec:\ttbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\lrxrllf.exec:\lrxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\jpvpp.exec:\jpvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\ppvpj.exec:\ppvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\hhhtnn.exec:\hhhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ppvvv.exec:\ppvvv.exe23⤵
- Executes dropped EXE
PID:724 -
\??\c:\jdpvp.exec:\jdpvp.exe24⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rfrrlfx.exec:\rfrrlfx.exe25⤵
- Executes dropped EXE
PID:4792 -
\??\c:\frxrlff.exec:\frxrlff.exe26⤵
- Executes dropped EXE
PID:456 -
\??\c:\nhnhbh.exec:\nhnhbh.exe27⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lrffxxr.exec:\lrffxxr.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\7htntt.exec:\7htntt.exe29⤵
- Executes dropped EXE
PID:5100 -
\??\c:\7vdpj.exec:\7vdpj.exe30⤵
- Executes dropped EXE
PID:4592 -
\??\c:\fxfxxxl.exec:\fxfxxxl.exe31⤵
- Executes dropped EXE
PID:3916 -
\??\c:\rxllfll.exec:\rxllfll.exe32⤵
- Executes dropped EXE
PID:940 -
\??\c:\hnnhbb.exec:\hnnhbb.exe33⤵
- Executes dropped EXE
PID:4528 -
\??\c:\pdvpj.exec:\pdvpj.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3pppj.exec:\3pppj.exe35⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hbnbhh.exec:\hbnbhh.exe36⤵
- Executes dropped EXE
PID:2016 -
\??\c:\btnhbb.exec:\btnhbb.exe37⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pjpjd.exec:\pjpjd.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xxxrxrx.exec:\xxxrxrx.exe39⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ffffxxr.exec:\ffffxxr.exe40⤵
- Executes dropped EXE
PID:4996 -
\??\c:\thtnnh.exec:\thtnnh.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bntnhh.exec:\bntnhh.exe42⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vjjdv.exec:\vjjdv.exe43⤵
- Executes dropped EXE
PID:3760 -
\??\c:\llxrrll.exec:\llxrrll.exe44⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1rxrffr.exec:\1rxrffr.exe45⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3thbbh.exec:\3thbbh.exe46⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jjvpp.exec:\jjvpp.exe47⤵
- Executes dropped EXE
PID:3548 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe48⤵
- Executes dropped EXE
PID:4500 -
\??\c:\thnhhb.exec:\thnhhb.exe49⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vjpjd.exec:\vjpjd.exe50⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1frlrrr.exec:\1frlrrr.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jvjvv.exec:\jvjvv.exe52⤵
- Executes dropped EXE
PID:540 -
\??\c:\frrlxxl.exec:\frrlxxl.exe53⤵
- Executes dropped EXE
PID:4684 -
\??\c:\nnnbbh.exec:\nnnbbh.exe54⤵
- Executes dropped EXE
PID:3948 -
\??\c:\llrlrrx.exec:\llrlrrx.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bbhbtt.exec:\bbhbtt.exe56⤵
- Executes dropped EXE
PID:3180 -
\??\c:\pvddv.exec:\pvddv.exe57⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rflfxrl.exec:\rflfxrl.exe58⤵
- Executes dropped EXE
PID:3664 -
\??\c:\httnth.exec:\httnth.exe59⤵
- Executes dropped EXE
PID:4076 -
\??\c:\pjjjd.exec:\pjjjd.exe60⤵
- Executes dropped EXE
PID:3288 -
\??\c:\lrfxrlx.exec:\lrfxrlx.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\7nnnhh.exec:\7nnnhh.exe62⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jddpd.exec:\jddpd.exe63⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ddpjv.exec:\ddpjv.exe64⤵
- Executes dropped EXE
PID:4228 -
\??\c:\lllfrrl.exec:\lllfrrl.exe65⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7nnhtt.exec:\7nnhtt.exe66⤵PID:1260
-
\??\c:\bbthhb.exec:\bbthhb.exe67⤵PID:1676
-
\??\c:\5ppdp.exec:\5ppdp.exe68⤵PID:1736
-
\??\c:\lffxllr.exec:\lffxllr.exe69⤵PID:1060
-
\??\c:\nbtnbb.exec:\nbtnbb.exe70⤵PID:4056
-
\??\c:\vdjdp.exec:\vdjdp.exe71⤵PID:1156
-
\??\c:\ddjdv.exec:\ddjdv.exe72⤵PID:3596
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe73⤵PID:548
-
\??\c:\bnttbt.exec:\bnttbt.exe74⤵PID:1820
-
\??\c:\hhnhht.exec:\hhnhht.exe75⤵PID:2288
-
\??\c:\pjdvj.exec:\pjdvj.exe76⤵PID:3764
-
\??\c:\xrxrlfl.exec:\xrxrlfl.exe77⤵PID:3352
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe78⤵PID:920
-
\??\c:\hbbnhb.exec:\hbbnhb.exe79⤵PID:2552
-
\??\c:\pjdvp.exec:\pjdvp.exe80⤵PID:1792
-
\??\c:\nhnnhb.exec:\nhnnhb.exe81⤵PID:1180
-
\??\c:\vjpvp.exec:\vjpvp.exe82⤵PID:3692
-
\??\c:\xflflrl.exec:\xflflrl.exe83⤵PID:1188
-
\??\c:\frffxlf.exec:\frffxlf.exe84⤵PID:916
-
\??\c:\5thbtt.exec:\5thbtt.exe85⤵PID:2404
-
\??\c:\hntnbb.exec:\hntnbb.exe86⤵PID:3636
-
\??\c:\djpdp.exec:\djpdp.exe87⤵PID:4924
-
\??\c:\1frfxxl.exec:\1frfxxl.exe88⤵PID:1952
-
\??\c:\rlrlffx.exec:\rlrlffx.exe89⤵PID:2652
-
\??\c:\1nttnn.exec:\1nttnn.exe90⤵PID:4328
-
\??\c:\jvvpj.exec:\jvvpj.exe91⤵PID:1724
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe92⤵PID:116
-
\??\c:\xrllllx.exec:\xrllllx.exe93⤵PID:3292
-
\??\c:\tbtnhh.exec:\tbtnhh.exe94⤵PID:3348
-
\??\c:\jddvp.exec:\jddvp.exe95⤵PID:552
-
\??\c:\pjppj.exec:\pjppj.exe96⤵PID:4384
-
\??\c:\xlrrfxr.exec:\xlrrfxr.exe97⤵PID:3640
-
\??\c:\htbtnh.exec:\htbtnh.exe98⤵PID:3376
-
\??\c:\3nhbtt.exec:\3nhbtt.exe99⤵PID:4292
-
\??\c:\pvvjv.exec:\pvvjv.exe100⤵PID:3632
-
\??\c:\rffxlff.exec:\rffxlff.exe101⤵PID:1584
-
\??\c:\frxrlff.exec:\frxrlff.exe102⤵PID:4544
-
\??\c:\tbbthh.exec:\tbbthh.exe103⤵PID:5044
-
\??\c:\ddpjp.exec:\ddpjp.exe104⤵PID:1592
-
\??\c:\dvjdv.exec:\dvjdv.exe105⤵PID:4536
-
\??\c:\3xlfrrl.exec:\3xlfrrl.exe106⤵PID:1800
-
\??\c:\9llfffx.exec:\9llfffx.exe107⤵PID:5112
-
\??\c:\btbbhb.exec:\btbbhb.exe108⤵PID:3856
-
\??\c:\jdjdj.exec:\jdjdj.exe109⤵PID:5016
-
\??\c:\3rrfxrx.exec:\3rrfxrx.exe110⤵PID:612
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe111⤵PID:4588
-
\??\c:\bhhbtn.exec:\bhhbtn.exe112⤵PID:2780
-
\??\c:\vpvpj.exec:\vpvpj.exe113⤵PID:1208
-
\??\c:\vpvpj.exec:\vpvpj.exe114⤵PID:440
-
\??\c:\rllxxxr.exec:\rllxxxr.exe115⤵PID:5028
-
\??\c:\xfrlffx.exec:\xfrlffx.exe116⤵PID:4492
-
\??\c:\hbnnth.exec:\hbnnth.exe117⤵PID:1556
-
\??\c:\vdjjd.exec:\vdjjd.exe118⤵PID:3368
-
\??\c:\lrrlffx.exec:\lrrlffx.exe119⤵PID:4716
-
\??\c:\xrlfxfx.exec:\xrlfxfx.exe120⤵PID:1596
-
\??\c:\5tbbbb.exec:\5tbbbb.exe121⤵PID:2944
-
\??\c:\ppdvj.exec:\ppdvj.exe122⤵PID:1504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-