Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 00:04
Behavioral task
behavioral1
Sample
3316dd48ff6c6ccc6861b77098609330N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
3316dd48ff6c6ccc6861b77098609330N.exe
-
Size
96KB
-
MD5
3316dd48ff6c6ccc6861b77098609330
-
SHA1
6f57f6345f424002353b5cea4141dfd8d119b9d0
-
SHA256
4dd234385d5d30d352fd06d89d5efd9c62c413843a50cfa2f02b3465ccc31dee
-
SHA512
5d21754e9e59bd486886248d68999e01192d66cfc1bb35681a9f0039fd1d2dda1333f73f9f5e1899f98e1ad623ec6e3985d25547c8c74026fc7bd2394521ac4f
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzX:8cm4FmowdHoSgWrXUX
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4448-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/600-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-638-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-830-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1068 jvppp.exe 2956 xxffflf.exe 4052 hbtnnt.exe 4824 htbttb.exe 3608 pdddv.exe 2520 tnthnt.exe 3044 vjpdd.exe 2264 lrxrffx.exe 2028 hntnhb.exe 216 9dddp.exe 4952 flfrfxr.exe 5024 bttbtn.exe 1656 nnbbhn.exe 2712 rrffxxx.exe 4596 lffxxxx.exe 3444 nhhbtt.exe 1460 7jdpj.exe 3024 bttnbh.exe 3924 tnbttt.exe 2412 jdpjd.exe 1428 xxffxxr.exe 1960 hnbbtb.exe 4932 hntthh.exe 4496 dpjpd.exe 3252 xrrlfff.exe 3752 7thttb.exe 3808 thtnhh.exe 1544 jvjdd.exe 1728 1flfxfx.exe 1924 nhhbhh.exe 600 ffflfrr.exe 3684 bhbnbn.exe 1588 jpvpj.exe 4780 7xlfffl.exe 1220 tntbtt.exe 1532 vdpjj.exe 4280 xxrfrff.exe 4960 tnhbtt.exe 4748 pvjdd.exe 1784 lfxfxff.exe 4760 tnbbhh.exe 4316 pjvpp.exe 4524 5rrlllf.exe 2032 jddvp.exe 1384 djjjd.exe 4856 xrfxrrl.exe 4424 3rrlllf.exe 1316 bhnnhh.exe 4364 9bhhnn.exe 5080 9pjjv.exe 4668 djpjd.exe 2684 lfxrfff.exe 4980 hhbbnn.exe 1568 vvjvd.exe 5096 ddppv.exe 4652 5rllfll.exe 2220 xlflffl.exe 3712 ntnhht.exe 648 djpdv.exe 2520 hnbnhh.exe 1108 nhtbnb.exe 1732 pvdjd.exe 1020 rxlrllf.exe 1980 tntnnn.exe -
resource yara_rule behavioral2/memory/4448-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002344c-3.dat upx behavioral2/memory/4448-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1068-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234a7-9.dat upx behavioral2/files/0x00070000000234a8-11.dat upx behavioral2/memory/2956-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a9-18.dat upx behavioral2/memory/4824-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234aa-23.dat upx behavioral2/files/0x00070000000234ab-27.dat upx behavioral2/memory/2520-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ac-32.dat upx behavioral2/memory/2520-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ad-37.dat upx behavioral2/memory/3044-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ae-44.dat upx behavioral2/memory/2264-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234af-48.dat upx behavioral2/memory/2028-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b0-52.dat upx behavioral2/memory/216-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b1-57.dat upx behavioral2/memory/5024-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b2-61.dat upx behavioral2/memory/1656-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2712-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b4-72.dat upx behavioral2/files/0x00070000000234b3-66.dat upx behavioral2/files/0x00070000000234b5-76.dat upx behavioral2/memory/4596-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b6-81.dat upx behavioral2/memory/3444-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1460-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b7-87.dat upx behavioral2/memory/3024-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b8-92.dat upx behavioral2/memory/3924-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b9-97.dat upx behavioral2/files/0x00070000000234ba-102.dat upx behavioral2/memory/2412-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bb-106.dat upx behavioral2/memory/1960-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bc-110.dat upx behavioral2/files/0x00080000000234a5-115.dat upx behavioral2/memory/4932-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bd-120.dat upx behavioral2/memory/4496-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234be-126.dat upx behavioral2/memory/3252-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bf-130.dat upx behavioral2/files/0x00070000000234c0-135.dat upx behavioral2/memory/3808-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c1-140.dat upx behavioral2/memory/1544-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c2-144.dat upx behavioral2/files/0x00070000000234c3-148.dat upx behavioral2/files/0x00070000000234c4-153.dat upx behavioral2/memory/600-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3684-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1588-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1220-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4960-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4448 wrote to memory of 1068 4448 3316dd48ff6c6ccc6861b77098609330N.exe 84 PID 4448 wrote to memory of 1068 4448 3316dd48ff6c6ccc6861b77098609330N.exe 84 PID 4448 wrote to memory of 1068 4448 3316dd48ff6c6ccc6861b77098609330N.exe 84 PID 1068 wrote to memory of 2956 1068 jvppp.exe 85 PID 1068 wrote to memory of 2956 1068 jvppp.exe 85 PID 1068 wrote to memory of 2956 1068 jvppp.exe 85 PID 2956 wrote to memory of 4052 2956 xxffflf.exe 86 PID 2956 wrote to memory of 4052 2956 xxffflf.exe 86 PID 2956 wrote to memory of 4052 2956 xxffflf.exe 86 PID 4052 wrote to memory of 4824 4052 hbtnnt.exe 87 PID 4052 wrote to memory of 4824 4052 hbtnnt.exe 87 PID 4052 wrote to memory of 4824 4052 hbtnnt.exe 87 PID 4824 wrote to memory of 3608 4824 htbttb.exe 88 PID 4824 wrote to memory of 3608 4824 htbttb.exe 88 PID 4824 wrote to memory of 3608 4824 htbttb.exe 88 PID 3608 wrote to memory of 2520 3608 pdddv.exe 89 PID 3608 wrote to memory of 2520 3608 pdddv.exe 89 PID 3608 wrote to memory of 2520 3608 pdddv.exe 89 PID 2520 wrote to memory of 3044 2520 tnthnt.exe 91 PID 2520 wrote to memory of 3044 2520 tnthnt.exe 91 PID 2520 wrote to memory of 3044 2520 tnthnt.exe 91 PID 3044 wrote to memory of 2264 3044 vjpdd.exe 92 PID 3044 wrote to memory of 2264 3044 vjpdd.exe 92 PID 3044 wrote to memory of 2264 3044 vjpdd.exe 92 PID 2264 wrote to memory of 2028 2264 lrxrffx.exe 93 PID 2264 wrote to memory of 2028 2264 lrxrffx.exe 93 PID 2264 wrote to memory of 2028 2264 lrxrffx.exe 93 PID 2028 wrote to memory of 216 2028 hntnhb.exe 94 PID 2028 wrote to memory of 216 2028 hntnhb.exe 94 PID 2028 wrote to memory of 216 2028 hntnhb.exe 94 PID 216 wrote to memory of 4952 216 9dddp.exe 95 PID 216 wrote to memory of 4952 216 9dddp.exe 95 PID 216 wrote to memory of 4952 216 9dddp.exe 95 PID 4952 wrote to memory of 5024 4952 flfrfxr.exe 96 PID 4952 wrote to memory of 5024 4952 flfrfxr.exe 96 PID 4952 wrote to memory of 5024 4952 flfrfxr.exe 96 PID 5024 wrote to memory of 1656 5024 bttbtn.exe 97 PID 5024 wrote to memory of 1656 5024 bttbtn.exe 97 PID 5024 wrote to memory of 1656 5024 bttbtn.exe 97 PID 1656 wrote to memory of 2712 1656 nnbbhn.exe 99 PID 1656 wrote to memory of 2712 1656 nnbbhn.exe 99 PID 1656 wrote to memory of 2712 1656 nnbbhn.exe 99 PID 2712 wrote to memory of 4596 2712 rrffxxx.exe 100 PID 2712 wrote to memory of 4596 2712 rrffxxx.exe 100 PID 2712 wrote to memory of 4596 2712 rrffxxx.exe 100 PID 4596 wrote to memory of 3444 4596 lffxxxx.exe 101 PID 4596 wrote to memory of 3444 4596 lffxxxx.exe 101 PID 4596 wrote to memory of 3444 4596 lffxxxx.exe 101 PID 3444 wrote to memory of 1460 3444 nhhbtt.exe 102 PID 3444 wrote to memory of 1460 3444 nhhbtt.exe 102 PID 3444 wrote to memory of 1460 3444 nhhbtt.exe 102 PID 1460 wrote to memory of 3024 1460 7jdpj.exe 103 PID 1460 wrote to memory of 3024 1460 7jdpj.exe 103 PID 1460 wrote to memory of 3024 1460 7jdpj.exe 103 PID 3024 wrote to memory of 3924 3024 bttnbh.exe 104 PID 3024 wrote to memory of 3924 3024 bttnbh.exe 104 PID 3024 wrote to memory of 3924 3024 bttnbh.exe 104 PID 3924 wrote to memory of 2412 3924 tnbttt.exe 105 PID 3924 wrote to memory of 2412 3924 tnbttt.exe 105 PID 3924 wrote to memory of 2412 3924 tnbttt.exe 105 PID 2412 wrote to memory of 1428 2412 jdpjd.exe 106 PID 2412 wrote to memory of 1428 2412 jdpjd.exe 106 PID 2412 wrote to memory of 1428 2412 jdpjd.exe 106 PID 1428 wrote to memory of 1960 1428 xxffxxr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3316dd48ff6c6ccc6861b77098609330N.exe"C:\Users\Admin\AppData\Local\Temp\3316dd48ff6c6ccc6861b77098609330N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\jvppp.exec:\jvppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\xxffflf.exec:\xxffflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hbtnnt.exec:\hbtnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\htbttb.exec:\htbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\pdddv.exec:\pdddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\tnthnt.exec:\tnthnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjpdd.exec:\vjpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lrxrffx.exec:\lrxrffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hntnhb.exec:\hntnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9dddp.exec:\9dddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\flfrfxr.exec:\flfrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\bttbtn.exec:\bttbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\nnbbhn.exec:\nnbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rrffxxx.exec:\rrffxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lffxxxx.exec:\lffxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\nhhbtt.exec:\nhhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\7jdpj.exec:\7jdpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\bttnbh.exec:\bttnbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\tnbttt.exec:\tnbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\jdpjd.exec:\jdpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xxffxxr.exec:\xxffxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\hnbbtb.exec:\hnbbtb.exe23⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hntthh.exec:\hntthh.exe24⤵
- Executes dropped EXE
PID:4932 -
\??\c:\dpjpd.exec:\dpjpd.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xrrlfff.exec:\xrrlfff.exe26⤵
- Executes dropped EXE
PID:3252 -
\??\c:\7thttb.exec:\7thttb.exe27⤵
- Executes dropped EXE
PID:3752 -
\??\c:\thtnhh.exec:\thtnhh.exe28⤵
- Executes dropped EXE
PID:3808 -
\??\c:\jvjdd.exec:\jvjdd.exe29⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1flfxfx.exec:\1flfxfx.exe30⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nhhbhh.exec:\nhhbhh.exe31⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ffflfrr.exec:\ffflfrr.exe32⤵
- Executes dropped EXE
PID:600 -
\??\c:\bhbnbn.exec:\bhbnbn.exe33⤵
- Executes dropped EXE
PID:3684 -
\??\c:\jpvpj.exec:\jpvpj.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7xlfffl.exec:\7xlfffl.exe35⤵
- Executes dropped EXE
PID:4780 -
\??\c:\tntbtt.exec:\tntbtt.exe36⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vdpjj.exec:\vdpjj.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxrfrff.exec:\xxrfrff.exe38⤵
- Executes dropped EXE
PID:4280 -
\??\c:\tnhbtt.exec:\tnhbtt.exe39⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pvjdd.exec:\pvjdd.exe40⤵
- Executes dropped EXE
PID:4748 -
\??\c:\lfxfxff.exec:\lfxfxff.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tnbbhh.exec:\tnbbhh.exe42⤵
- Executes dropped EXE
PID:4760 -
\??\c:\pjvpp.exec:\pjvpp.exe43⤵
- Executes dropped EXE
PID:4316 -
\??\c:\5rrlllf.exec:\5rrlllf.exe44⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jddvp.exec:\jddvp.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\djjjd.exec:\djjjd.exe46⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3rrlllf.exec:\3rrlllf.exe48⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bhnnhh.exec:\bhnnhh.exe49⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9bhhnn.exec:\9bhhnn.exe50⤵
- Executes dropped EXE
PID:4364 -
\??\c:\9pjjv.exec:\9pjjv.exe51⤵
- Executes dropped EXE
PID:5080 -
\??\c:\djpjd.exec:\djpjd.exe52⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lfxrfff.exec:\lfxrfff.exe53⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hhbbnn.exec:\hhbbnn.exe54⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vvjvd.exec:\vvjvd.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ddppv.exec:\ddppv.exe56⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5rllfll.exec:\5rllfll.exe57⤵
- Executes dropped EXE
PID:4652 -
\??\c:\xlflffl.exec:\xlflffl.exe58⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ntnhht.exec:\ntnhht.exe59⤵
- Executes dropped EXE
PID:3712 -
\??\c:\djpdv.exec:\djpdv.exe60⤵
- Executes dropped EXE
PID:648 -
\??\c:\hnbnhh.exec:\hnbnhh.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nhtbnb.exec:\nhtbnb.exe62⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pvdjd.exec:\pvdjd.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rxlrllf.exec:\rxlrllf.exe64⤵
- Executes dropped EXE
PID:1020 -
\??\c:\tntnnn.exec:\tntnnn.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bbtbbt.exec:\bbtbbt.exe66⤵PID:100
-
\??\c:\vpppv.exec:\vpppv.exe67⤵PID:3208
-
\??\c:\pjjpj.exec:\pjjpj.exe68⤵PID:3168
-
\??\c:\tnnhhh.exec:\tnnhhh.exe69⤵PID:3596
-
\??\c:\bhnnbb.exec:\bhnnbb.exe70⤵PID:4600
-
\??\c:\9jjjj.exec:\9jjjj.exe71⤵PID:1412
-
\??\c:\lflfrll.exec:\lflfrll.exe72⤵PID:4632
-
\??\c:\bbnntt.exec:\bbnntt.exe73⤵PID:212
-
\??\c:\nntbbb.exec:\nntbbb.exe74⤵PID:3196
-
\??\c:\jddvv.exec:\jddvv.exe75⤵PID:592
-
\??\c:\lffxrff.exec:\lffxrff.exe76⤵PID:1236
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe77⤵PID:3444
-
\??\c:\nbtttb.exec:\nbtttb.exe78⤵PID:4880
-
\??\c:\5nnhhh.exec:\5nnhhh.exe79⤵PID:3964
-
\??\c:\jvjdv.exec:\jvjdv.exe80⤵PID:2668
-
\??\c:\3rlrrrr.exec:\3rlrrrr.exe81⤵PID:4284
-
\??\c:\3fxxffr.exec:\3fxxffr.exe82⤵PID:4484
-
\??\c:\tbnthn.exec:\tbnthn.exe83⤵PID:2760
-
\??\c:\jddvd.exec:\jddvd.exe84⤵PID:644
-
\??\c:\vvvpp.exec:\vvvpp.exe85⤵PID:2464
-
\??\c:\xfrrlll.exec:\xfrrlll.exe86⤵PID:3236
-
\??\c:\nhbbtb.exec:\nhbbtb.exe87⤵PID:3156
-
\??\c:\dpvpj.exec:\dpvpj.exe88⤵PID:2348
-
\??\c:\jdpjp.exec:\jdpjp.exe89⤵PID:1760
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe90⤵PID:2352
-
\??\c:\thtttb.exec:\thtttb.exe91⤵PID:4236
-
\??\c:\pdjdv.exec:\pdjdv.exe92⤵PID:4988
-
\??\c:\pvpjd.exec:\pvpjd.exe93⤵PID:1528
-
\??\c:\xrlrflr.exec:\xrlrflr.exe94⤵PID:3084
-
\??\c:\nthhbh.exec:\nthhbh.exe95⤵PID:4896
-
\??\c:\nbtthh.exec:\nbtthh.exe96⤵PID:2468
-
\??\c:\jdjjd.exec:\jdjjd.exe97⤵PID:2432
-
\??\c:\djjdv.exec:\djjdv.exe98⤵PID:1404
-
\??\c:\frlllxx.exec:\frlllxx.exe99⤵PID:1056
-
\??\c:\tnbttt.exec:\tnbttt.exe100⤵PID:1880
-
\??\c:\nnnhnn.exec:\nnnhnn.exe101⤵PID:1872
-
\??\c:\7rxlfxl.exec:\7rxlfxl.exe102⤵PID:4780
-
\??\c:\hbttnh.exec:\hbttnh.exe103⤵PID:2524
-
\??\c:\9dpjv.exec:\9dpjv.exe104⤵PID:2552
-
\??\c:\7pjdp.exec:\7pjdp.exe105⤵PID:2748
-
\??\c:\rrfxrxx.exec:\rrfxrxx.exe106⤵PID:1420
-
\??\c:\hthbtt.exec:\hthbtt.exe107⤵PID:3588
-
\??\c:\nttntb.exec:\nttntb.exe108⤵PID:1712
-
\??\c:\9pppj.exec:\9pppj.exe109⤵PID:2076
-
\??\c:\lxfxllf.exec:\lxfxllf.exe110⤵PID:3064
-
\??\c:\9bhtnn.exec:\9bhtnn.exe111⤵PID:1380
-
\??\c:\pppjj.exec:\pppjj.exe112⤵PID:388
-
\??\c:\dddjv.exec:\dddjv.exe113⤵PID:968
-
\??\c:\ffrrfff.exec:\ffrrfff.exe114⤵PID:404
-
\??\c:\bhtnnn.exec:\bhtnnn.exe115⤵PID:416
-
\??\c:\hnttnn.exec:\hnttnn.exe116⤵PID:996
-
\??\c:\jvjvp.exec:\jvjvp.exe117⤵PID:4356
-
\??\c:\lxlfflr.exec:\lxlfflr.exe118⤵PID:4364
-
\??\c:\5xlfxxr.exec:\5xlfxxr.exe119⤵PID:2428
-
\??\c:\tnbbtt.exec:\tnbbtt.exe120⤵PID:4668
-
\??\c:\jvjjd.exec:\jvjjd.exe121⤵PID:864
-
\??\c:\pjjvd.exec:\pjjvd.exe122⤵PID:4804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-