Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe
-
Size
55KB
-
MD5
e034c30cd04d381720f3a691960839c7
-
SHA1
d531ae810fba3bbe0dc947f94d9604bcc3f1302e
-
SHA256
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c
-
SHA512
f9098cdfe997080ecfd87efbe33d797309f4d9e96c5c5ba6d6a1f46a140878e900c29ff3adb13d22834165512169e6d288304ed7eebe505134cc3d803af7c06e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFK:ymb3NkkiQ3mdBjFIFK
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4860-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 37 IoCs
resource yara_rule behavioral2/memory/4860-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4308-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2024-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2004-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2020-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3752-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3172-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3940-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1460-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2448-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4024-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/396-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/652-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4308 xrxrfxf.exe 4572 5ppjv.exe 2940 fffflrr.exe 3572 hbnbhn.exe 2024 pvddv.exe 2004 3bbnth.exe 2020 jdvdj.exe 980 frxxflr.exe 816 hhhhtt.exe 3032 xlrrllr.exe 3752 hbhbbb.exe 3172 fflfllf.exe 3940 fflrlxr.exe 1016 bhbbbn.exe 1460 djjvj.exe 2848 1rrxrll.exe 4724 bntnnn.exe 3456 lxfxffx.exe 2448 5tntbt.exe 4024 vjvpp.exe 8 nhbbtb.exe 3592 pdvpd.exe 4932 xxffllr.exe 3860 jdrxf.exe 396 tbhnth.exe 2348 jjjpj.exe 1148 xxllrxx.exe 652 rffffxr.exe 3364 pvpdj.exe 1176 lrxlfff.exe 4484 5bbhbn.exe 3684 jpdjp.exe 1700 fflrlrf.exe 4896 bbthbn.exe 4516 tnbhht.exe 3100 vvvvd.exe 4040 ddppv.exe 4764 rxlfllr.exe 4564 btbthh.exe 1436 bbhhhh.exe 2004 vpdvv.exe 4812 jdvpj.exe 3252 frfrxlx.exe 4980 rfrxxff.exe 1992 btntbh.exe 816 vpppp.exe 3896 pvjjj.exe 4056 xlrrrxx.exe 4108 tbnbht.exe 4544 pvjjj.exe 2856 lllfxxx.exe 424 tnnntn.exe 4520 nhntth.exe 3696 dpjjp.exe 1532 llxflrx.exe 4944 nnttbt.exe 1892 ppjpj.exe 4004 nhnhbb.exe 3084 pjdjd.exe 3536 xxrllrl.exe 3472 nhbhnb.exe 5116 jjdjj.exe 2044 bhhbbn.exe 5024 pppjj.exe -
resource yara_rule behavioral2/memory/4860-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4308 4860 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 88 PID 4860 wrote to memory of 4308 4860 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 88 PID 4860 wrote to memory of 4308 4860 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe 88 PID 4308 wrote to memory of 4572 4308 xrxrfxf.exe 89 PID 4308 wrote to memory of 4572 4308 xrxrfxf.exe 89 PID 4308 wrote to memory of 4572 4308 xrxrfxf.exe 89 PID 4572 wrote to memory of 2940 4572 5ppjv.exe 90 PID 4572 wrote to memory of 2940 4572 5ppjv.exe 90 PID 4572 wrote to memory of 2940 4572 5ppjv.exe 90 PID 2940 wrote to memory of 3572 2940 fffflrr.exe 169 PID 2940 wrote to memory of 3572 2940 fffflrr.exe 169 PID 2940 wrote to memory of 3572 2940 fffflrr.exe 169 PID 3572 wrote to memory of 2024 3572 hbnbhn.exe 92 PID 3572 wrote to memory of 2024 3572 hbnbhn.exe 92 PID 3572 wrote to memory of 2024 3572 hbnbhn.exe 92 PID 2024 wrote to memory of 2004 2024 pvddv.exe 128 PID 2024 wrote to memory of 2004 2024 pvddv.exe 128 PID 2024 wrote to memory of 2004 2024 pvddv.exe 128 PID 2004 wrote to memory of 2020 2004 3bbnth.exe 94 PID 2004 wrote to memory of 2020 2004 3bbnth.exe 94 PID 2004 wrote to memory of 2020 2004 3bbnth.exe 94 PID 2020 wrote to memory of 980 2020 jdvdj.exe 95 PID 2020 wrote to memory of 980 2020 jdvdj.exe 95 PID 2020 wrote to memory of 980 2020 jdvdj.exe 95 PID 980 wrote to memory of 816 980 frxxflr.exe 322 PID 980 wrote to memory of 816 980 frxxflr.exe 322 PID 980 wrote to memory of 816 980 frxxflr.exe 322 PID 816 wrote to memory of 3032 816 hhhhtt.exe 97 PID 816 wrote to memory of 3032 816 hhhhtt.exe 97 PID 816 wrote to memory of 3032 816 hhhhtt.exe 97 PID 3032 wrote to memory of 3752 3032 xlrrllr.exe 215 PID 3032 wrote to memory of 3752 3032 xlrrllr.exe 215 PID 3032 wrote to memory of 3752 3032 xlrrllr.exe 215 PID 3752 wrote to memory of 3172 3752 hbhbbb.exe 99 PID 3752 wrote to memory of 3172 3752 hbhbbb.exe 99 PID 3752 wrote to memory of 3172 3752 hbhbbb.exe 99 PID 3172 wrote to memory of 3940 3172 fflfllf.exe 401 PID 3172 wrote to memory of 3940 3172 fflfllf.exe 401 PID 3172 wrote to memory of 3940 3172 fflfllf.exe 401 PID 3940 wrote to memory of 1016 3940 fflrlxr.exe 402 PID 3940 wrote to memory of 1016 3940 fflrlxr.exe 402 PID 3940 wrote to memory of 1016 3940 fflrlxr.exe 402 PID 1016 wrote to memory of 1460 1016 bhbbbn.exe 327 PID 1016 wrote to memory of 1460 1016 bhbbbn.exe 327 PID 1016 wrote to memory of 1460 1016 bhbbbn.exe 327 PID 1460 wrote to memory of 2848 1460 djjvj.exe 446 PID 1460 wrote to memory of 2848 1460 djjvj.exe 446 PID 1460 wrote to memory of 2848 1460 djjvj.exe 446 PID 2848 wrote to memory of 4724 2848 1rrxrll.exe 452 PID 2848 wrote to memory of 4724 2848 1rrxrll.exe 452 PID 2848 wrote to memory of 4724 2848 1rrxrll.exe 452 PID 4724 wrote to memory of 3456 4724 bntnnn.exe 105 PID 4724 wrote to memory of 3456 4724 bntnnn.exe 105 PID 4724 wrote to memory of 3456 4724 bntnnn.exe 105 PID 3456 wrote to memory of 2448 3456 lxfxffx.exe 296 PID 3456 wrote to memory of 2448 3456 lxfxffx.exe 296 PID 3456 wrote to memory of 2448 3456 lxfxffx.exe 296 PID 2448 wrote to memory of 4024 2448 5tntbt.exe 521 PID 2448 wrote to memory of 4024 2448 5tntbt.exe 521 PID 2448 wrote to memory of 4024 2448 5tntbt.exe 521 PID 4024 wrote to memory of 8 4024 vjvpp.exe 108 PID 4024 wrote to memory of 8 4024 vjvpp.exe 108 PID 4024 wrote to memory of 8 4024 vjvpp.exe 108 PID 8 wrote to memory of 3592 8 nhbbtb.exe 194
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe"C:\Users\Admin\AppData\Local\Temp\2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\xrxrfxf.exec:\xrxrfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\5ppjv.exec:\5ppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\fffflrr.exec:\fffflrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hbnbhn.exec:\hbnbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\pvddv.exec:\pvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\3bbnth.exec:\3bbnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\frxxflr.exec:\frxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\hhhhtt.exec:\hhhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xlrrllr.exec:\xlrrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hbhbbb.exec:\hbhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\fflfllf.exec:\fflfllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\fflrlxr.exec:\fflrlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\bhbbbn.exec:\bhbbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\djjvj.exec:\djjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\1rrxrll.exec:\1rrxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bntnnn.exec:\bntnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\lxfxffx.exec:\lxfxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\5tntbt.exec:\5tntbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vjvpp.exec:\vjvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\nhbbtb.exec:\nhbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\pdvpd.exec:\pdvpd.exe23⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xxffllr.exec:\xxffllr.exe24⤵
- Executes dropped EXE
PID:4932 -
\??\c:\jdrxf.exec:\jdrxf.exe25⤵
- Executes dropped EXE
PID:3860 -
\??\c:\tbhnth.exec:\tbhnth.exe26⤵
- Executes dropped EXE
PID:396 -
\??\c:\jjjpj.exec:\jjjpj.exe27⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xxllrxx.exec:\xxllrxx.exe28⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rffffxr.exec:\rffffxr.exe29⤵
- Executes dropped EXE
PID:652 -
\??\c:\pvpdj.exec:\pvpdj.exe30⤵
- Executes dropped EXE
PID:3364 -
\??\c:\lrxlfff.exec:\lrxlfff.exe31⤵
- Executes dropped EXE
PID:1176 -
\??\c:\5bbhbn.exec:\5bbhbn.exe32⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jpdjp.exec:\jpdjp.exe33⤵
- Executes dropped EXE
PID:3684 -
\??\c:\fflrlrf.exec:\fflrlrf.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bbthbn.exec:\bbthbn.exe35⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tnbhht.exec:\tnbhht.exe36⤵
- Executes dropped EXE
PID:4516 -
\??\c:\vvvvd.exec:\vvvvd.exe37⤵
- Executes dropped EXE
PID:3100 -
\??\c:\ddppv.exec:\ddppv.exe38⤵
- Executes dropped EXE
PID:4040 -
\??\c:\rxlfllr.exec:\rxlfllr.exe39⤵
- Executes dropped EXE
PID:4764 -
\??\c:\btbthh.exec:\btbthh.exe40⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bbhhhh.exec:\bbhhhh.exe41⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vpdvv.exec:\vpdvv.exe42⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jdvpj.exec:\jdvpj.exe43⤵
- Executes dropped EXE
PID:4812 -
\??\c:\frfrxlx.exec:\frfrxlx.exe44⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rfrxxff.exec:\rfrxxff.exe45⤵
- Executes dropped EXE
PID:4980 -
\??\c:\btntbh.exec:\btntbh.exe46⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vpppp.exec:\vpppp.exe47⤵
- Executes dropped EXE
PID:816 -
\??\c:\pvjjj.exec:\pvjjj.exe48⤵
- Executes dropped EXE
PID:3896 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe49⤵
- Executes dropped EXE
PID:4056 -
\??\c:\tbnbht.exec:\tbnbht.exe50⤵
- Executes dropped EXE
PID:4108 -
\??\c:\pvjjj.exec:\pvjjj.exe51⤵
- Executes dropped EXE
PID:4544 -
\??\c:\lllfxxx.exec:\lllfxxx.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tnnntn.exec:\tnnntn.exe53⤵
- Executes dropped EXE
PID:424 -
\??\c:\nhntth.exec:\nhntth.exe54⤵
- Executes dropped EXE
PID:4520 -
\??\c:\dpjjp.exec:\dpjjp.exe55⤵
- Executes dropped EXE
PID:3696 -
\??\c:\llxflrx.exec:\llxflrx.exe56⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nnttbt.exec:\nnttbt.exe57⤵
- Executes dropped EXE
PID:4944 -
\??\c:\ppjpj.exec:\ppjpj.exe58⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nhnhbb.exec:\nhnhbb.exe59⤵
- Executes dropped EXE
PID:4004 -
\??\c:\pjdjd.exec:\pjdjd.exe60⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xxrllrl.exec:\xxrllrl.exe61⤵
- Executes dropped EXE
PID:3536 -
\??\c:\nhbhnb.exec:\nhbhnb.exe62⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jjdjj.exec:\jjdjj.exe63⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bhhbbn.exec:\bhhbbn.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pppjj.exec:\pppjj.exe65⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bnbtnn.exec:\bnbtnn.exe66⤵PID:4364
-
\??\c:\vpvpj.exec:\vpvpj.exe67⤵PID:1568
-
\??\c:\9rfffxx.exec:\9rfffxx.exe68⤵PID:4832
-
\??\c:\xrflxfr.exec:\xrflxfr.exe69⤵PID:4384
-
\??\c:\nhhbnn.exec:\nhhbnn.exe70⤵PID:3500
-
\??\c:\3jdpd.exec:\3jdpd.exe71⤵PID:2936
-
\??\c:\pdvdj.exec:\pdvdj.exe72⤵PID:2696
-
\??\c:\xfxrfxf.exec:\xfxrfxf.exe73⤵PID:3936
-
\??\c:\flllfff.exec:\flllfff.exe74⤵PID:4492
-
\??\c:\nhnbhb.exec:\nhnbhb.exe75⤵PID:3648
-
\??\c:\3hthhn.exec:\3hthhn.exe76⤵PID:4948
-
\??\c:\pdpjd.exec:\pdpjd.exe77⤵PID:2892
-
\??\c:\rfxrfxf.exec:\rfxrfxf.exe78⤵PID:1840
-
\??\c:\rrflffx.exec:\rrflffx.exe79⤵PID:3164
-
\??\c:\thnbtb.exec:\thnbtb.exe80⤵PID:4180
-
\??\c:\bntttn.exec:\bntttn.exe81⤵PID:3572
-
\??\c:\jjddd.exec:\jjddd.exe82⤵PID:3620
-
\??\c:\vpddd.exec:\vpddd.exe83⤵PID:2968
-
\??\c:\flxxlxl.exec:\flxxlxl.exe84⤵PID:4564
-
\??\c:\tnttnn.exec:\tnttnn.exe85⤵PID:1252
-
\??\c:\jdpjj.exec:\jdpjj.exe86⤵PID:4232
-
\??\c:\pvdpd.exec:\pvdpd.exe87⤵PID:5108
-
\??\c:\fxxfllf.exec:\fxxfllf.exe88⤵PID:3944
-
\??\c:\rrrlrxf.exec:\rrrlrxf.exe89⤵PID:5088
-
\??\c:\tbtnth.exec:\tbtnth.exe90⤵PID:4400
-
\??\c:\pvpdj.exec:\pvpdj.exe91⤵PID:4108
-
\??\c:\jvjpv.exec:\jvjpv.exe92⤵PID:2756
-
\??\c:\lrllrxx.exec:\lrllrxx.exe93⤵PID:1016
-
\??\c:\nhnnht.exec:\nhnnht.exe94⤵PID:3724
-
\??\c:\bntntb.exec:\bntntb.exe95⤵PID:2976
-
\??\c:\dpvpj.exec:\dpvpj.exe96⤵PID:2944
-
\??\c:\rrrlfff.exec:\rrrlfff.exe97⤵PID:3932
-
\??\c:\fffrrrl.exec:\fffrrrl.exe98⤵PID:2920
-
\??\c:\bbntht.exec:\bbntht.exe99⤵PID:2148
-
\??\c:\7tnhbt.exec:\7tnhbt.exe100⤵PID:3084
-
\??\c:\pdpvj.exec:\pdpvj.exe101⤵PID:1972
-
\??\c:\fxxxrlr.exec:\fxxxrlr.exe102⤵PID:2036
-
\??\c:\rlxxfff.exec:\rlxxfff.exe103⤵PID:3020
-
\??\c:\hbthhh.exec:\hbthhh.exe104⤵PID:3076
-
\??\c:\djddj.exec:\djddj.exe105⤵PID:3592
-
\??\c:\jvjdp.exec:\jvjdp.exe106⤵PID:4728
-
\??\c:\lrxflfr.exec:\lrxflfr.exe107⤵PID:1568
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe108⤵PID:3292
-
\??\c:\nhnbbn.exec:\nhnbbn.exe109⤵PID:1612
-
\??\c:\vpjpj.exec:\vpjpj.exe110⤵PID:2160
-
\??\c:\vjppp.exec:\vjppp.exe111⤵PID:2380
-
\??\c:\rxfflxl.exec:\rxfflxl.exe112⤵PID:2644
-
\??\c:\rxfrxrx.exec:\rxfrxrx.exe113⤵PID:4484
-
\??\c:\bthbhn.exec:\bthbhn.exe114⤵PID:3648
-
\??\c:\pjvdd.exec:\pjvdd.exe115⤵PID:4308
-
\??\c:\7flffff.exec:\7flffff.exe116⤵PID:4572
-
\??\c:\rfrlffx.exec:\rfrlffx.exe117⤵PID:4516
-
\??\c:\tnnbbt.exec:\tnnbbt.exe118⤵PID:4040
-
\??\c:\jvjdd.exec:\jvjdd.exe119⤵PID:4180
-
\??\c:\rllfxxx.exec:\rllfxxx.exe120⤵PID:2692
-
\??\c:\hbhnnb.exec:\hbhnnb.exe121⤵PID:2280
-
\??\c:\jvdpv.exec:\jvdpv.exe122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-