Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 07:03
Behavioral task
behavioral1
Sample
e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe
-
Size
212KB
-
MD5
c9d58c0685de0cf2bfd234445c7eb2cc
-
SHA1
d8e88c79edf87d0c4a494c1deaeae83dbee71f6d
-
SHA256
e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f
-
SHA512
d80c76f78d7e125f9fb0c33bbb056067f789705fa0d9305b9a33f8a4c1676f97a340e94382ddc19f8a87e3596dedfefb265153c06beb853324e5e9e1065e95cd
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+lE:V4wFHoSBK/ubLcfS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/372-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3960-20-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3688-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/860-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2356-9-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3568-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1892-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4520-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5072-54-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2732-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3996-62-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1524-73-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2428-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4484-86-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/924-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3896-112-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3888-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3652-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2704-129-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4872-143-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1188-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4864-155-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1268-161-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3944-180-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4568-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2648-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4200-201-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-220-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2620-224-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3672-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/748-258-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4788-265-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3240-279-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3076-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4292-317-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1432-324-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1268-341-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3436-342-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4000-351-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1320-349-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2140-360-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4428-376-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/752-386-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1028-408-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3648-418-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1524-439-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2428-444-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4100-455-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4836-483-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1664-492-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5032-515-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3760-550-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/672-549-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/544-557-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-565-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5072-593-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3060-624-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3844-625-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4944-673-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3852-739-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1524-809-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1388-836-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1388-840-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4300-901-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 vjjpv.exe 860 xflffxf.exe 3960 bhntbh.exe 3688 jdjpv.exe 3568 lrrxxrl.exe 1892 btbnbh.exe 4520 vdddd.exe 5072 pjdvd.exe 2732 rxxxxrf.exe 3996 bbnhnb.exe 1524 9pdvv.exe 2428 1nhbtn.exe 3048 9jddp.exe 4484 9hbbnt.exe 1304 bntttt.exe 976 rllfxxx.exe 924 nbtnnb.exe 3896 rfrlxff.exe 3888 lxrrlfl.exe 3652 jjpvd.exe 2704 rlrflxx.exe 220 nhhnnh.exe 3544 lfffxrl.exe 4872 tnhhbh.exe 1188 pdjdd.exe 4864 jjvvv.exe 1268 xlllrrx.exe 3436 vpjdd.exe 1320 rxrxxxr.exe 3944 rffxrll.exe 2236 ntbnbn.exe 4568 dpjpp.exe 2648 rxfxxxr.exe 2812 9nnhbt.exe 4200 ddjpp.exe 812 jvvpp.exe 1828 hnbhtb.exe 1804 vjdvd.exe 752 lxfxxxx.exe 3852 vjvpd.exe 4588 ffxlxff.exe 2620 tnbttt.exe 2096 rlrrfff.exe 3672 jdpvj.exe 5052 rrxlxff.exe 772 hbhhhn.exe 636 ddvjp.exe 1672 djvpj.exe 888 lrxrlff.exe 1288 hbhttb.exe 2424 vjjvp.exe 748 pddvj.exe 3936 3fxrffr.exe 4788 ttnhhn.exe 2084 btbntn.exe 1072 xlxxfxl.exe 2076 xflrlll.exe 4112 3btntt.exe 3240 jjdvj.exe 2932 pvpjd.exe 3068 fffxxfx.exe 1880 hthbtt.exe 1416 jvdjd.exe 432 lfxxrxx.exe -
resource yara_rule behavioral2/memory/372-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000900000002325a-3.dat upx behavioral2/memory/372-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000023445-11.dat upx behavioral2/files/0x0007000000023446-13.dat upx behavioral2/memory/3960-20-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023447-22.dat upx behavioral2/memory/3688-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/860-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2356-9-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023448-28.dat upx behavioral2/files/0x0007000000023449-33.dat upx behavioral2/memory/1892-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3568-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002344a-40.dat upx behavioral2/memory/1892-43-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4520-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002344b-46.dat upx behavioral2/files/0x000700000002344c-52.dat upx behavioral2/memory/5072-54-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002344d-58.dat upx behavioral2/memory/2732-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3996-62-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002344e-66.dat upx behavioral2/files/0x000700000002344f-70.dat upx behavioral2/memory/1524-73-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2428-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023450-77.dat upx behavioral2/memory/4484-86-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023451-83.dat upx behavioral2/files/0x0007000000023452-88.dat upx behavioral2/files/0x0008000000023443-95.dat upx behavioral2/memory/976-96-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023453-101.dat upx behavioral2/files/0x0007000000023454-104.dat upx behavioral2/memory/924-106-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023455-110.dat upx behavioral2/memory/3896-112-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023456-116.dat upx behavioral2/memory/3888-118-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023457-122.dat upx behavioral2/memory/3652-124-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2704-129-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023458-130.dat upx behavioral2/files/0x0007000000023459-134.dat upx behavioral2/files/0x000700000002345a-141.dat upx behavioral2/memory/4872-143-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002345b-146.dat upx behavioral2/files/0x000700000002345c-150.dat upx behavioral2/memory/1188-153-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4864-155-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002345d-159.dat upx behavioral2/memory/1268-161-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002345e-162.dat upx behavioral2/files/0x000700000002345f-168.dat upx behavioral2/files/0x0007000000023460-174.dat upx behavioral2/memory/3944-180-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023461-179.dat upx behavioral2/files/0x0007000000023462-184.dat upx behavioral2/memory/4568-188-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2648-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4200-201-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4588-220-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2620-224-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 2356 372 e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe 82 PID 372 wrote to memory of 2356 372 e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe 82 PID 372 wrote to memory of 2356 372 e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe 82 PID 2356 wrote to memory of 860 2356 vjjpv.exe 83 PID 2356 wrote to memory of 860 2356 vjjpv.exe 83 PID 2356 wrote to memory of 860 2356 vjjpv.exe 83 PID 860 wrote to memory of 3960 860 xflffxf.exe 84 PID 860 wrote to memory of 3960 860 xflffxf.exe 84 PID 860 wrote to memory of 3960 860 xflffxf.exe 84 PID 3960 wrote to memory of 3688 3960 bhntbh.exe 85 PID 3960 wrote to memory of 3688 3960 bhntbh.exe 85 PID 3960 wrote to memory of 3688 3960 bhntbh.exe 85 PID 3688 wrote to memory of 3568 3688 jdjpv.exe 88 PID 3688 wrote to memory of 3568 3688 jdjpv.exe 88 PID 3688 wrote to memory of 3568 3688 jdjpv.exe 88 PID 3568 wrote to memory of 1892 3568 lrrxxrl.exe 89 PID 3568 wrote to memory of 1892 3568 lrrxxrl.exe 89 PID 3568 wrote to memory of 1892 3568 lrrxxrl.exe 89 PID 1892 wrote to memory of 4520 1892 btbnbh.exe 90 PID 1892 wrote to memory of 4520 1892 btbnbh.exe 90 PID 1892 wrote to memory of 4520 1892 btbnbh.exe 90 PID 4520 wrote to memory of 5072 4520 vdddd.exe 91 PID 4520 wrote to memory of 5072 4520 vdddd.exe 91 PID 4520 wrote to memory of 5072 4520 vdddd.exe 91 PID 5072 wrote to memory of 2732 5072 pjdvd.exe 93 PID 5072 wrote to memory of 2732 5072 pjdvd.exe 93 PID 5072 wrote to memory of 2732 5072 pjdvd.exe 93 PID 2732 wrote to memory of 3996 2732 rxxxxrf.exe 94 PID 2732 wrote to memory of 3996 2732 rxxxxrf.exe 94 PID 2732 wrote to memory of 3996 2732 rxxxxrf.exe 94 PID 3996 wrote to memory of 1524 3996 bbnhnb.exe 95 PID 3996 wrote to memory of 1524 3996 bbnhnb.exe 95 PID 3996 wrote to memory of 1524 3996 bbnhnb.exe 95 PID 1524 wrote to memory of 2428 1524 9pdvv.exe 96 PID 1524 wrote to memory of 2428 1524 9pdvv.exe 96 PID 1524 wrote to memory of 2428 1524 9pdvv.exe 96 PID 2428 wrote to memory of 3048 2428 1nhbtn.exe 97 PID 2428 wrote to memory of 3048 2428 1nhbtn.exe 97 PID 2428 wrote to memory of 3048 2428 1nhbtn.exe 97 PID 3048 wrote to memory of 4484 3048 9jddp.exe 98 PID 3048 wrote to memory of 4484 3048 9jddp.exe 98 PID 3048 wrote to memory of 4484 3048 9jddp.exe 98 PID 4484 wrote to memory of 1304 4484 9hbbnt.exe 99 PID 4484 wrote to memory of 1304 4484 9hbbnt.exe 99 PID 4484 wrote to memory of 1304 4484 9hbbnt.exe 99 PID 1304 wrote to memory of 976 1304 bntttt.exe 100 PID 1304 wrote to memory of 976 1304 bntttt.exe 100 PID 1304 wrote to memory of 976 1304 bntttt.exe 100 PID 976 wrote to memory of 924 976 rllfxxx.exe 101 PID 976 wrote to memory of 924 976 rllfxxx.exe 101 PID 976 wrote to memory of 924 976 rllfxxx.exe 101 PID 924 wrote to memory of 3896 924 nbtnnb.exe 102 PID 924 wrote to memory of 3896 924 nbtnnb.exe 102 PID 924 wrote to memory of 3896 924 nbtnnb.exe 102 PID 3896 wrote to memory of 3888 3896 rfrlxff.exe 103 PID 3896 wrote to memory of 3888 3896 rfrlxff.exe 103 PID 3896 wrote to memory of 3888 3896 rfrlxff.exe 103 PID 3888 wrote to memory of 3652 3888 lxrrlfl.exe 104 PID 3888 wrote to memory of 3652 3888 lxrrlfl.exe 104 PID 3888 wrote to memory of 3652 3888 lxrrlfl.exe 104 PID 3652 wrote to memory of 2704 3652 jjpvd.exe 105 PID 3652 wrote to memory of 2704 3652 jjpvd.exe 105 PID 3652 wrote to memory of 2704 3652 jjpvd.exe 105 PID 2704 wrote to memory of 220 2704 rlrflxx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe"C:\Users\Admin\AppData\Local\Temp\e07ef2abb74250afcc7f89e4d6341877254131aa6fd814e8484cadf3afeb021f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\vjjpv.exec:\vjjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\xflffxf.exec:\xflffxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\bhntbh.exec:\bhntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\jdjpv.exec:\jdjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\lrrxxrl.exec:\lrrxxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\btbnbh.exec:\btbnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\vdddd.exec:\vdddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\pjdvd.exec:\pjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\rxxxxrf.exec:\rxxxxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bbnhnb.exec:\bbnhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\9pdvv.exec:\9pdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\1nhbtn.exec:\1nhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\9jddp.exec:\9jddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9hbbnt.exec:\9hbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bntttt.exec:\bntttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\rllfxxx.exec:\rllfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\nbtnnb.exec:\nbtnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\rfrlxff.exec:\rfrlxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\lxrrlfl.exec:\lxrrlfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\jjpvd.exec:\jjpvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\rlrflxx.exec:\rlrflxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhhnnh.exec:\nhhnnh.exe23⤵
- Executes dropped EXE
PID:220 -
\??\c:\lfffxrl.exec:\lfffxrl.exe24⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnhhbh.exec:\tnhhbh.exe25⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pdjdd.exec:\pdjdd.exe26⤵
- Executes dropped EXE
PID:1188 -
\??\c:\jjvvv.exec:\jjvvv.exe27⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xlllrrx.exec:\xlllrrx.exe28⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vpjdd.exec:\vpjdd.exe29⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rxrxxxr.exec:\rxrxxxr.exe30⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rffxrll.exec:\rffxrll.exe31⤵
- Executes dropped EXE
PID:3944 -
\??\c:\ntbnbn.exec:\ntbnbn.exe32⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dpjpp.exec:\dpjpp.exe33⤵
- Executes dropped EXE
PID:4568 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe34⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9nnhbt.exec:\9nnhbt.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ddjpp.exec:\ddjpp.exe36⤵
- Executes dropped EXE
PID:4200 -
\??\c:\jvvpp.exec:\jvvpp.exe37⤵
- Executes dropped EXE
PID:812 -
\??\c:\hnbhtb.exec:\hnbhtb.exe38⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vjdvd.exec:\vjdvd.exe39⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe40⤵
- Executes dropped EXE
PID:752 -
\??\c:\vjvpd.exec:\vjvpd.exe41⤵
- Executes dropped EXE
PID:3852 -
\??\c:\ffxlxff.exec:\ffxlxff.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\tnbttt.exec:\tnbttt.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rlrrfff.exec:\rlrrfff.exe44⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jdpvj.exec:\jdpvj.exe45⤵
- Executes dropped EXE
PID:3672 -
\??\c:\rrxlxff.exec:\rrxlxff.exe46⤵
- Executes dropped EXE
PID:5052 -
\??\c:\hbhhhn.exec:\hbhhhn.exe47⤵
- Executes dropped EXE
PID:772 -
\??\c:\ddvjp.exec:\ddvjp.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\djvpj.exec:\djvpj.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lrxrlff.exec:\lrxrlff.exe50⤵
- Executes dropped EXE
PID:888 -
\??\c:\hbhttb.exec:\hbhttb.exe51⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vjjvp.exec:\vjjvp.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pddvj.exec:\pddvj.exe53⤵
- Executes dropped EXE
PID:748 -
\??\c:\3fxrffr.exec:\3fxrffr.exe54⤵
- Executes dropped EXE
PID:3936 -
\??\c:\ttnhhn.exec:\ttnhhn.exe55⤵
- Executes dropped EXE
PID:4788 -
\??\c:\btbntn.exec:\btbntn.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe57⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xflrlll.exec:\xflrlll.exe58⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3btntt.exec:\3btntt.exe59⤵
- Executes dropped EXE
PID:4112 -
\??\c:\jjdvj.exec:\jjdvj.exe60⤵
- Executes dropped EXE
PID:3240 -
\??\c:\pvpjd.exec:\pvpjd.exe61⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fffxxfx.exec:\fffxxfx.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hthbtt.exec:\hthbtt.exe63⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jvdjd.exec:\jvdjd.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe65⤵
- Executes dropped EXE
PID:432 -
\??\c:\tnbbnn.exec:\tnbbnn.exe66⤵PID:3864
-
\??\c:\vjvpp.exec:\vjvpp.exe67⤵PID:764
-
\??\c:\jdppv.exec:\jdppv.exe68⤵PID:3076
-
\??\c:\fffxrll.exec:\fffxrll.exe69⤵PID:4488
-
\??\c:\thhbtn.exec:\thhbtn.exe70⤵PID:2704
-
\??\c:\vvjdv.exec:\vvjdv.exe71⤵PID:220
-
\??\c:\jjjjj.exec:\jjjjj.exe72⤵PID:4292
-
\??\c:\9rfxxxr.exec:\9rfxxxr.exe73⤵PID:1432
-
\??\c:\htnnhb.exec:\htnnhb.exe74⤵PID:1512
-
\??\c:\bnbbnh.exec:\bnbbnh.exe75⤵PID:3552
-
\??\c:\dvpjv.exec:\dvpjv.exe76⤵PID:1644
-
\??\c:\lfrlxlf.exec:\lfrlxlf.exe77⤵PID:3964
-
\??\c:\dddvj.exec:\dddvj.exe78⤵PID:1268
-
\??\c:\5rxrrrl.exec:\5rxrrrl.exe79⤵PID:3436
-
\??\c:\bhtttt.exec:\bhtttt.exe80⤵PID:1320
-
\??\c:\thbnth.exec:\thbnth.exe81⤵PID:4000
-
\??\c:\dpjdd.exec:\dpjdd.exe82⤵PID:1872
-
\??\c:\jvvvp.exec:\jvvvp.exe83⤵PID:2140
-
\??\c:\rlxxffx.exec:\rlxxffx.exe84⤵PID:2204
-
\??\c:\nhthbb.exec:\nhthbb.exe85⤵PID:3816
-
\??\c:\vppvv.exec:\vppvv.exe86⤵PID:4132
-
\??\c:\lrxxrll.exec:\lrxxrll.exe87⤵PID:4536
-
\??\c:\rxrrxxl.exec:\rxrrxxl.exe88⤵PID:4428
-
\??\c:\1nnnnn.exec:\1nnnnn.exe89⤵PID:1920
-
\??\c:\ppdpp.exec:\ppdpp.exe90⤵PID:1480
-
\??\c:\vppjv.exec:\vppjv.exe91⤵PID:752
-
\??\c:\rxxxllf.exec:\rxxxllf.exe92⤵PID:1956
-
\??\c:\llrfxlf.exec:\llrfxlf.exe93⤵PID:4588
-
\??\c:\tnnntt.exec:\tnnntt.exe94⤵PID:2908
-
\??\c:\dvjdp.exec:\dvjdp.exe95⤵PID:4216
-
\??\c:\rxfllxr.exec:\rxfllxr.exe96⤵PID:832
-
\??\c:\lffxrxr.exec:\lffxrxr.exe97⤵PID:2408
-
\??\c:\bhhnnt.exec:\bhhnnt.exe98⤵PID:1028
-
\??\c:\ddpjp.exec:\ddpjp.exe99⤵PID:3612
-
\??\c:\dpvpp.exec:\dpvpp.exe100⤵PID:2804
-
\??\c:\frllxxx.exec:\frllxxx.exe101⤵PID:3648
-
\??\c:\tnnnhh.exec:\tnnnhh.exe102⤵PID:3064
-
\??\c:\jpvpp.exec:\jpvpp.exe103⤵PID:60
-
\??\c:\jpjdp.exec:\jpjdp.exe104⤵PID:1884
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe105⤵PID:1712
-
\??\c:\bhnhhb.exec:\bhnhhb.exe106⤵PID:4592
-
\??\c:\pdjjj.exec:\pdjjj.exe107⤵PID:1524
-
\??\c:\lxxfllf.exec:\lxxfllf.exe108⤵PID:2428
-
\??\c:\bhtttb.exec:\bhtttb.exe109⤵PID:3132
-
\??\c:\thhbtt.exec:\thhbtt.exe110⤵PID:5004
-
\??\c:\jvdvv.exec:\jvdvv.exe111⤵PID:4668
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe112⤵PID:4100
-
\??\c:\7hnnbh.exec:\7hnnbh.exe113⤵PID:1988
-
\??\c:\7pjjv.exec:\7pjjv.exe114⤵PID:3100
-
\??\c:\jvpjd.exec:\jvpjd.exe115⤵PID:2412
-
\??\c:\5lfxlll.exec:\5lfxlll.exe116⤵PID:1004
-
\??\c:\bhttbh.exec:\bhttbh.exe117⤵PID:3940
-
\??\c:\thnhbb.exec:\thnhbb.exe118⤵PID:3888
-
\??\c:\ppvpp.exec:\ppvpp.exe119⤵PID:4916
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe120⤵PID:216
-
\??\c:\lxlffxr.exec:\lxlffxr.exe121⤵PID:4836
-
\??\c:\5nbtnn.exec:\5nbtnn.exe122⤵PID:4364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-