Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe
-
Size
79KB
-
MD5
781302e1075e9d00bf290be83c96f919
-
SHA1
a4f44e11d7491439672aad3cc1c6cd3d25ac9563
-
SHA256
d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613
-
SHA512
c06f8b4c2307be2b458be682fc221aeeca79cbf8061cf14b64e5dcbf3b008b1f4b3e1ddda2a07a55bcb7698423be52f700b132aa4a7ecb8272e86e1e8e3ee446
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA8v:ymb3NkkiQ3mdBjFIIp9L9QrrA8v
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1568-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1584-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/264-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/264-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/264-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/264-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1456-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4416-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3380-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3380-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3380-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3716-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1664-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2636-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4376-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/876-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2892-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1124-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3764-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2512-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2108-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3132-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1424-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1568 xlfrlxr.exe 1584 9btthh.exe 264 jvvvp.exe 3688 rfrlfxr.exe 1456 7xfxflx.exe 5056 thtttn.exe 4416 bhhbhb.exe 3180 dvvjv.exe 5064 frffrrf.exe 3380 7hhbbb.exe 2180 jvpvj.exe 2204 rfllxrl.exe 3716 lffxlfr.exe 3032 bnbthb.exe 1664 pjvpd.exe 3780 rllfxxx.exe 2636 bnnhtt.exe 4488 pjvpd.exe 4376 lflrllr.exe 876 tnnhnh.exe 4592 xffrfxr.exe 2892 nnnttt.exe 4868 pvpjd.exe 1124 rllflfl.exe 3200 3xxrfxx.exe 3764 hnttnn.exe 2512 9dpjv.exe 3120 dpjvj.exe 2108 1rlfxrl.exe 3132 jpjjv.exe 1424 5llfrlf.exe 3228 5bbhbb.exe 4964 1vdvj.exe 1228 lfxlfxf.exe 1164 vjpdd.exe 3680 5ffxllf.exe 1388 3tttnn.exe 1204 vjvjv.exe 4184 dvpjv.exe 3620 5xxlffr.exe 844 lxlrlfx.exe 1020 bthtnh.exe 3144 pdjjd.exe 468 3djdp.exe 1412 5rrlxxr.exe 1688 9frfrrx.exe 5116 thbtnn.exe 4840 3hnhbt.exe 4316 pvpjv.exe 2320 3rrffxr.exe 1148 3xrxrlf.exe 3704 htntnn.exe 1076 htbntn.exe 1572 5pjjp.exe 5060 lllxlrf.exe 3004 xlfxrlf.exe 1456 1nhhbt.exe 5056 htnbtn.exe 4416 ddjjd.exe 2600 1ffxlll.exe 1852 fllfxrl.exe 3720 nnhhhh.exe 712 vjppp.exe 5040 rfxrffr.exe -
resource yara_rule behavioral2/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1568 2388 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 81 PID 2388 wrote to memory of 1568 2388 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 81 PID 2388 wrote to memory of 1568 2388 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 81 PID 1568 wrote to memory of 1584 1568 xlfrlxr.exe 82 PID 1568 wrote to memory of 1584 1568 xlfrlxr.exe 82 PID 1568 wrote to memory of 1584 1568 xlfrlxr.exe 82 PID 1584 wrote to memory of 264 1584 9btthh.exe 83 PID 1584 wrote to memory of 264 1584 9btthh.exe 83 PID 1584 wrote to memory of 264 1584 9btthh.exe 83 PID 264 wrote to memory of 3688 264 jvvvp.exe 84 PID 264 wrote to memory of 3688 264 jvvvp.exe 84 PID 264 wrote to memory of 3688 264 jvvvp.exe 84 PID 3688 wrote to memory of 1456 3688 rfrlfxr.exe 85 PID 3688 wrote to memory of 1456 3688 rfrlfxr.exe 85 PID 3688 wrote to memory of 1456 3688 rfrlfxr.exe 85 PID 1456 wrote to memory of 5056 1456 7xfxflx.exe 86 PID 1456 wrote to memory of 5056 1456 7xfxflx.exe 86 PID 1456 wrote to memory of 5056 1456 7xfxflx.exe 86 PID 5056 wrote to memory of 4416 5056 thtttn.exe 87 PID 5056 wrote to memory of 4416 5056 thtttn.exe 87 PID 5056 wrote to memory of 4416 5056 thtttn.exe 87 PID 4416 wrote to memory of 3180 4416 bhhbhb.exe 88 PID 4416 wrote to memory of 3180 4416 bhhbhb.exe 88 PID 4416 wrote to memory of 3180 4416 bhhbhb.exe 88 PID 3180 wrote to memory of 5064 3180 dvvjv.exe 89 PID 3180 wrote to memory of 5064 3180 dvvjv.exe 89 PID 3180 wrote to memory of 5064 3180 dvvjv.exe 89 PID 5064 wrote to memory of 3380 5064 frffrrf.exe 90 PID 5064 wrote to memory of 3380 5064 frffrrf.exe 90 PID 5064 wrote to memory of 3380 5064 frffrrf.exe 90 PID 3380 wrote to memory of 2180 3380 7hhbbb.exe 91 PID 3380 wrote to memory of 2180 3380 7hhbbb.exe 91 PID 3380 wrote to memory of 2180 3380 7hhbbb.exe 91 PID 2180 wrote to memory of 2204 2180 jvpvj.exe 92 PID 2180 wrote to memory of 2204 2180 jvpvj.exe 92 PID 2180 wrote to memory of 2204 2180 jvpvj.exe 92 PID 2204 wrote to memory of 3716 2204 rfllxrl.exe 93 PID 2204 wrote to memory of 3716 2204 rfllxrl.exe 93 PID 2204 wrote to memory of 3716 2204 rfllxrl.exe 93 PID 3716 wrote to memory of 3032 3716 lffxlfr.exe 94 PID 3716 wrote to memory of 3032 3716 lffxlfr.exe 94 PID 3716 wrote to memory of 3032 3716 lffxlfr.exe 94 PID 3032 wrote to memory of 1664 3032 bnbthb.exe 95 PID 3032 wrote to memory of 1664 3032 bnbthb.exe 95 PID 3032 wrote to memory of 1664 3032 bnbthb.exe 95 PID 1664 wrote to memory of 3780 1664 pjvpd.exe 96 PID 1664 wrote to memory of 3780 1664 pjvpd.exe 96 PID 1664 wrote to memory of 3780 1664 pjvpd.exe 96 PID 3780 wrote to memory of 2636 3780 rllfxxx.exe 97 PID 3780 wrote to memory of 2636 3780 rllfxxx.exe 97 PID 3780 wrote to memory of 2636 3780 rllfxxx.exe 97 PID 2636 wrote to memory of 4488 2636 bnnhtt.exe 98 PID 2636 wrote to memory of 4488 2636 bnnhtt.exe 98 PID 2636 wrote to memory of 4488 2636 bnnhtt.exe 98 PID 4488 wrote to memory of 4376 4488 pjvpd.exe 99 PID 4488 wrote to memory of 4376 4488 pjvpd.exe 99 PID 4488 wrote to memory of 4376 4488 pjvpd.exe 99 PID 4376 wrote to memory of 876 4376 lflrllr.exe 100 PID 4376 wrote to memory of 876 4376 lflrllr.exe 100 PID 4376 wrote to memory of 876 4376 lflrllr.exe 100 PID 876 wrote to memory of 4592 876 tnnhnh.exe 101 PID 876 wrote to memory of 4592 876 tnnhnh.exe 101 PID 876 wrote to memory of 4592 876 tnnhnh.exe 101 PID 4592 wrote to memory of 2892 4592 xffrfxr.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe"C:\Users\Admin\AppData\Local\Temp\d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\9btthh.exec:\9btthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\jvvvp.exec:\jvvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\7xfxflx.exec:\7xfxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\thtttn.exec:\thtttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bhhbhb.exec:\bhhbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\dvvjv.exec:\dvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\frffrrf.exec:\frffrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\7hhbbb.exec:\7hhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\jvpvj.exec:\jvpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rfllxrl.exec:\rfllxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lffxlfr.exec:\lffxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\bnbthb.exec:\bnbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\pjvpd.exec:\pjvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\rllfxxx.exec:\rllfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\bnnhtt.exec:\bnnhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pjvpd.exec:\pjvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\lflrllr.exec:\lflrllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\tnnhnh.exec:\tnnhnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\xffrfxr.exec:\xffrfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\nnnttt.exec:\nnnttt.exe23⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pvpjd.exec:\pvpjd.exe24⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rllflfl.exec:\rllflfl.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3xxrfxx.exec:\3xxrfxx.exe26⤵
- Executes dropped EXE
PID:3200 -
\??\c:\hnttnn.exec:\hnttnn.exe27⤵
- Executes dropped EXE
PID:3764 -
\??\c:\9dpjv.exec:\9dpjv.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dpjvj.exec:\dpjvj.exe29⤵
- Executes dropped EXE
PID:3120 -
\??\c:\1rlfxrl.exec:\1rlfxrl.exe30⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jpjjv.exec:\jpjjv.exe31⤵
- Executes dropped EXE
PID:3132 -
\??\c:\5llfrlf.exec:\5llfrlf.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5bbhbb.exec:\5bbhbb.exe33⤵
- Executes dropped EXE
PID:3228 -
\??\c:\1vdvj.exec:\1vdvj.exe34⤵
- Executes dropped EXE
PID:4964 -
\??\c:\lfxlfxf.exec:\lfxlfxf.exe35⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vjpdd.exec:\vjpdd.exe36⤵
- Executes dropped EXE
PID:1164 -
\??\c:\5ffxllf.exec:\5ffxllf.exe37⤵
- Executes dropped EXE
PID:3680 -
\??\c:\3tttnn.exec:\3tttnn.exe38⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vjvjv.exec:\vjvjv.exe39⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dvpjv.exec:\dvpjv.exe40⤵
- Executes dropped EXE
PID:4184 -
\??\c:\5xxlffr.exec:\5xxlffr.exe41⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lxlrlfx.exec:\lxlrlfx.exe42⤵
- Executes dropped EXE
PID:844 -
\??\c:\bthtnh.exec:\bthtnh.exe43⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pdjjd.exec:\pdjjd.exe44⤵
- Executes dropped EXE
PID:3144 -
\??\c:\3djdp.exec:\3djdp.exe45⤵
- Executes dropped EXE
PID:468 -
\??\c:\5rrlxxr.exec:\5rrlxxr.exe46⤵
- Executes dropped EXE
PID:1412 -
\??\c:\9frfrrx.exec:\9frfrrx.exe47⤵
- Executes dropped EXE
PID:1688 -
\??\c:\thbtnn.exec:\thbtnn.exe48⤵
- Executes dropped EXE
PID:5116 -
\??\c:\3hnhbt.exec:\3hnhbt.exe49⤵
- Executes dropped EXE
PID:4840 -
\??\c:\pvpjv.exec:\pvpjv.exe50⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3rrffxr.exec:\3rrffxr.exe51⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3xrxrlf.exec:\3xrxrlf.exe52⤵
- Executes dropped EXE
PID:1148 -
\??\c:\htntnn.exec:\htntnn.exe53⤵
- Executes dropped EXE
PID:3704 -
\??\c:\htbntn.exec:\htbntn.exe54⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5pjjp.exec:\5pjjp.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lllxlrf.exec:\lllxlrf.exe56⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe57⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1nhhbt.exec:\1nhhbt.exe58⤵
- Executes dropped EXE
PID:1456 -
\??\c:\htnbtn.exec:\htnbtn.exe59⤵
- Executes dropped EXE
PID:5056 -
\??\c:\ddjjd.exec:\ddjjd.exe60⤵
- Executes dropped EXE
PID:4416 -
\??\c:\1ffxlll.exec:\1ffxlll.exe61⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fllfxrl.exec:\fllfxrl.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nnhhhh.exec:\nnhhhh.exe63⤵
- Executes dropped EXE
PID:3720 -
\??\c:\vjppp.exec:\vjppp.exe64⤵
- Executes dropped EXE
PID:712 -
\??\c:\rfxrffr.exec:\rfxrffr.exe65⤵
- Executes dropped EXE
PID:5040 -
\??\c:\flrrfrr.exec:\flrrfrr.exe66⤵PID:1616
-
\??\c:\9bttnn.exec:\9bttnn.exe67⤵PID:5072
-
\??\c:\pvvpd.exec:\pvvpd.exe68⤵PID:4256
-
\??\c:\3vvpd.exec:\3vvpd.exe69⤵PID:4672
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe70⤵PID:3328
-
\??\c:\djjvj.exec:\djjvj.exe71⤵PID:3408
-
\??\c:\5rrffxr.exec:\5rrffxr.exe72⤵PID:4884
-
\??\c:\lfrxllx.exec:\lfrxllx.exe73⤵PID:1012
-
\??\c:\tnhttn.exec:\tnhttn.exe74⤵PID:64
-
\??\c:\bbtnnt.exec:\bbtnnt.exe75⤵PID:1264
-
\??\c:\pjdvv.exec:\pjdvv.exe76⤵PID:556
-
\??\c:\llllxrl.exec:\llllxrl.exe77⤵PID:4076
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe78⤵PID:3580
-
\??\c:\htttnn.exec:\htttnn.exe79⤵PID:3872
-
\??\c:\3vvvj.exec:\3vvvj.exe80⤵PID:4868
-
\??\c:\dvdvv.exec:\dvdvv.exe81⤵PID:2256
-
\??\c:\rrrrlrf.exec:\rrrrlrf.exe82⤵PID:4980
-
\??\c:\bntnhb.exec:\bntnhb.exe83⤵PID:3528
-
\??\c:\htthtn.exec:\htthtn.exe84⤵PID:2016
-
\??\c:\jdvpp.exec:\jdvpp.exe85⤵PID:2020
-
\??\c:\rlrrllf.exec:\rlrrllf.exe86⤵PID:2512
-
\??\c:\1rffffx.exec:\1rffffx.exe87⤵PID:4616
-
\??\c:\nhhhbh.exec:\nhhhbh.exe88⤵PID:2108
-
\??\c:\1hbtnn.exec:\1hbtnn.exe89⤵PID:1828
-
\??\c:\jjjdd.exec:\jjjdd.exe90⤵PID:3564
-
\??\c:\jpjpj.exec:\jpjpj.exe91⤵PID:752
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe92⤵PID:2628
-
\??\c:\tnhhtt.exec:\tnhhtt.exe93⤵PID:1432
-
\??\c:\3btbbb.exec:\3btbbb.exe94⤵PID:1216
-
\??\c:\jvdvv.exec:\jvdvv.exe95⤵PID:4088
-
\??\c:\7jjdv.exec:\7jjdv.exe96⤵PID:4008
-
\??\c:\5ffxlll.exec:\5ffxlll.exe97⤵PID:1720
-
\??\c:\bhnhtt.exec:\bhnhtt.exe98⤵PID:3308
-
\??\c:\bhthtn.exec:\bhthtn.exe99⤵PID:4880
-
\??\c:\jppdj.exec:\jppdj.exe100⤵PID:532
-
\??\c:\vpdvp.exec:\vpdvp.exe101⤵PID:4948
-
\??\c:\5xrlxrl.exec:\5xrlxrl.exe102⤵PID:848
-
\??\c:\hhhhtt.exec:\hhhhtt.exe103⤵PID:2420
-
\??\c:\httnhb.exec:\httnhb.exe104⤵PID:1384
-
\??\c:\pddvj.exec:\pddvj.exe105⤵PID:4684
-
\??\c:\dpjdp.exec:\dpjdp.exe106⤵PID:1068
-
\??\c:\flflxrr.exec:\flflxrr.exe107⤵PID:4320
-
\??\c:\1xfxrll.exec:\1xfxrll.exe108⤵PID:2572
-
\??\c:\1hnttn.exec:\1hnttn.exe109⤵PID:4680
-
\??\c:\1tbtbb.exec:\1tbtbb.exe110⤵PID:2348
-
\??\c:\jddvj.exec:\jddvj.exe111⤵PID:2492
-
\??\c:\rxlxrxx.exec:\rxlxrxx.exe112⤵PID:264
-
\??\c:\frxllfl.exec:\frxllfl.exe113⤵PID:3964
-
\??\c:\btbtnn.exec:\btbtnn.exe114⤵PID:1572
-
\??\c:\5bbtnt.exec:\5bbtnt.exe115⤵PID:5060
-
\??\c:\jpvjv.exec:\jpvjv.exe116⤵PID:656
-
\??\c:\9bbbbb.exec:\9bbbbb.exe117⤵PID:1044
-
\??\c:\7jjdv.exec:\7jjdv.exe118⤵PID:4416
-
\??\c:\jjpjp.exec:\jjpjp.exe119⤵PID:1324
-
\??\c:\lffxlll.exec:\lffxlll.exe120⤵PID:5084
-
\??\c:\fxlfflx.exec:\fxlfflx.exe121⤵PID:712
-
\??\c:\1tttth.exec:\1tttth.exe122⤵PID:4216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-