Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe
-
Size
70KB
-
MD5
3f61e232e98fef2ecd373a417e4ced9e
-
SHA1
a3889a600f362cea47e91a7f3c23b6e908f111a3
-
SHA256
30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9
-
SHA512
4842336a4424b5083c853e64cb1bb9c2ae2579c842da200db34ae1251aead0849c9af60c702781d7df35f0dcecb84c30d501a41fe85021824642cd5adb101b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60LbB:ymb3NkkiQ3mdBjFIIp9LV
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral2/memory/3928-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1080 rrlfxxr.exe 1524 vjjjv.exe 3392 rfxrrfx.exe 3872 3djvp.exe 3840 pjpjv.exe 2220 hnnhbt.exe 2168 dpjdv.exe 4992 tbhbnn.exe 4124 vpjdd.exe 3484 1bhbtt.exe 2340 ppvpv.exe 4264 tnnnnn.exe 4508 vpppp.exe 4616 3httnn.exe 4272 jpjjv.exe 4944 htbbht.exe 4604 pdjdd.exe 1076 9lxxlll.exe 2296 bnnhbb.exe 2692 xrxrffx.exe 1820 ttbhhh.exe 2740 xrxfflr.exe 3668 nhttbb.exe 4572 xrxxlll.exe 1552 jddjd.exe 4452 hhtnnb.exe 2152 dpjvj.exe 5016 nhhbtn.exe 2040 fxxxllf.exe 960 htnhbt.exe 4444 frfxllf.exe 3992 nbbbnn.exe 1256 lrrfrrl.exe 2640 hbnhth.exe 3648 7lxxlll.exe 2576 tnhtnn.exe 3440 dvdjv.exe 3272 nhnhbh.exe 4404 jppjd.exe 2816 bttnhh.exe 3572 pdddv.exe 760 btnhhb.exe 2512 rlrlffl.exe 4248 htthbt.exe 1928 pvjjj.exe 3248 tnhttn.exe 3436 ddpjp.exe 1400 ntthbn.exe 1532 vvjpj.exe 2524 bthtnn.exe 888 jpvpj.exe 2492 xffrfxl.exe 4272 hbhbbb.exe 4600 xrxrlll.exe 1336 btnhtn.exe 836 jdpjp.exe 4652 xllfrrl.exe 1344 dpvpj.exe 2280 1xrlrlx.exe 2076 htbnbt.exe 4044 jvvpd.exe 3580 5llxfxf.exe 1832 jjvpp.exe 3904 ffrfrlr.exe -
resource yara_rule behavioral2/memory/3928-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-447-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3928 wrote to memory of 1080 3928 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 86 PID 3928 wrote to memory of 1080 3928 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 86 PID 3928 wrote to memory of 1080 3928 30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe 86 PID 1080 wrote to memory of 1524 1080 rrlfxxr.exe 87 PID 1080 wrote to memory of 1524 1080 rrlfxxr.exe 87 PID 1080 wrote to memory of 1524 1080 rrlfxxr.exe 87 PID 1524 wrote to memory of 3392 1524 vjjjv.exe 88 PID 1524 wrote to memory of 3392 1524 vjjjv.exe 88 PID 1524 wrote to memory of 3392 1524 vjjjv.exe 88 PID 3392 wrote to memory of 3872 3392 rfxrrfx.exe 89 PID 3392 wrote to memory of 3872 3392 rfxrrfx.exe 89 PID 3392 wrote to memory of 3872 3392 rfxrrfx.exe 89 PID 3872 wrote to memory of 3840 3872 3djvp.exe 91 PID 3872 wrote to memory of 3840 3872 3djvp.exe 91 PID 3872 wrote to memory of 3840 3872 3djvp.exe 91 PID 3840 wrote to memory of 2220 3840 pjpjv.exe 92 PID 3840 wrote to memory of 2220 3840 pjpjv.exe 92 PID 3840 wrote to memory of 2220 3840 pjpjv.exe 92 PID 2220 wrote to memory of 2168 2220 hnnhbt.exe 93 PID 2220 wrote to memory of 2168 2220 hnnhbt.exe 93 PID 2220 wrote to memory of 2168 2220 hnnhbt.exe 93 PID 2168 wrote to memory of 4992 2168 dpjdv.exe 94 PID 2168 wrote to memory of 4992 2168 dpjdv.exe 94 PID 2168 wrote to memory of 4992 2168 dpjdv.exe 94 PID 4992 wrote to memory of 4124 4992 tbhbnn.exe 95 PID 4992 wrote to memory of 4124 4992 tbhbnn.exe 95 PID 4992 wrote to memory of 4124 4992 tbhbnn.exe 95 PID 4124 wrote to memory of 3484 4124 vpjdd.exe 96 PID 4124 wrote to memory of 3484 4124 vpjdd.exe 96 PID 4124 wrote to memory of 3484 4124 vpjdd.exe 96 PID 3484 wrote to memory of 2340 3484 1bhbtt.exe 97 PID 3484 wrote to memory of 2340 3484 1bhbtt.exe 97 PID 3484 wrote to memory of 2340 3484 1bhbtt.exe 97 PID 2340 wrote to memory of 4264 2340 ppvpv.exe 98 PID 2340 wrote to memory of 4264 2340 ppvpv.exe 98 PID 2340 wrote to memory of 4264 2340 ppvpv.exe 98 PID 4264 wrote to memory of 4508 4264 tnnnnn.exe 99 PID 4264 wrote to memory of 4508 4264 tnnnnn.exe 99 PID 4264 wrote to memory of 4508 4264 tnnnnn.exe 99 PID 4508 wrote to memory of 4616 4508 vpppp.exe 100 PID 4508 wrote to memory of 4616 4508 vpppp.exe 100 PID 4508 wrote to memory of 4616 4508 vpppp.exe 100 PID 4616 wrote to memory of 4272 4616 3httnn.exe 101 PID 4616 wrote to memory of 4272 4616 3httnn.exe 101 PID 4616 wrote to memory of 4272 4616 3httnn.exe 101 PID 4272 wrote to memory of 4944 4272 jpjjv.exe 102 PID 4272 wrote to memory of 4944 4272 jpjjv.exe 102 PID 4272 wrote to memory of 4944 4272 jpjjv.exe 102 PID 4944 wrote to memory of 4604 4944 htbbht.exe 103 PID 4944 wrote to memory of 4604 4944 htbbht.exe 103 PID 4944 wrote to memory of 4604 4944 htbbht.exe 103 PID 4604 wrote to memory of 1076 4604 pdjdd.exe 104 PID 4604 wrote to memory of 1076 4604 pdjdd.exe 104 PID 4604 wrote to memory of 1076 4604 pdjdd.exe 104 PID 1076 wrote to memory of 2296 1076 9lxxlll.exe 105 PID 1076 wrote to memory of 2296 1076 9lxxlll.exe 105 PID 1076 wrote to memory of 2296 1076 9lxxlll.exe 105 PID 2296 wrote to memory of 2692 2296 bnnhbb.exe 106 PID 2296 wrote to memory of 2692 2296 bnnhbb.exe 106 PID 2296 wrote to memory of 2692 2296 bnnhbb.exe 106 PID 2692 wrote to memory of 1820 2692 xrxrffx.exe 107 PID 2692 wrote to memory of 1820 2692 xrxrffx.exe 107 PID 2692 wrote to memory of 1820 2692 xrxrffx.exe 107 PID 1820 wrote to memory of 2740 1820 ttbhhh.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe"C:\Users\Admin\AppData\Local\Temp\30b29aeee76428a87d880ca97a330f626d35b9640fab9c0b5e291311d7604fc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\vjjjv.exec:\vjjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\rfxrrfx.exec:\rfxrrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\3djvp.exec:\3djvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\pjpjv.exec:\pjpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\hnnhbt.exec:\hnnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\dpjdv.exec:\dpjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\tbhbnn.exec:\tbhbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\vpjdd.exec:\vpjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\1bhbtt.exec:\1bhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\ppvpv.exec:\ppvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\tnnnnn.exec:\tnnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\vpppp.exec:\vpppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\3httnn.exec:\3httnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\jpjjv.exec:\jpjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\htbbht.exec:\htbbht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pdjdd.exec:\pdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\9lxxlll.exec:\9lxxlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\bnnhbb.exec:\bnnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xrxrffx.exec:\xrxrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ttbhhh.exec:\ttbhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\xrxfflr.exec:\xrxfflr.exe23⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhttbb.exec:\nhttbb.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xrxxlll.exec:\xrxxlll.exe25⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jddjd.exec:\jddjd.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhtnnb.exec:\hhtnnb.exe27⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dpjvj.exec:\dpjvj.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhhbtn.exec:\nhhbtn.exe29⤵
- Executes dropped EXE
PID:5016 -
\??\c:\fxxxllf.exec:\fxxxllf.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\htnhbt.exec:\htnhbt.exe31⤵
- Executes dropped EXE
PID:960 -
\??\c:\frfxllf.exec:\frfxllf.exe32⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nbbbnn.exec:\nbbbnn.exe33⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lrrfrrl.exec:\lrrfrrl.exe34⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hbnhth.exec:\hbnhth.exe35⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7lxxlll.exec:\7lxxlll.exe36⤵
- Executes dropped EXE
PID:3648 -
\??\c:\tnhtnn.exec:\tnhtnn.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dvdjv.exec:\dvdjv.exe38⤵
- Executes dropped EXE
PID:3440 -
\??\c:\nhnhbh.exec:\nhnhbh.exe39⤵
- Executes dropped EXE
PID:3272 -
\??\c:\jppjd.exec:\jppjd.exe40⤵
- Executes dropped EXE
PID:4404 -
\??\c:\bttnhh.exec:\bttnhh.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pdddv.exec:\pdddv.exe42⤵
- Executes dropped EXE
PID:3572 -
\??\c:\btnhhb.exec:\btnhhb.exe43⤵
- Executes dropped EXE
PID:760 -
\??\c:\rlrlffl.exec:\rlrlffl.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\htthbt.exec:\htthbt.exe45⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pvjjj.exec:\pvjjj.exe46⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnhttn.exec:\tnhttn.exe47⤵
- Executes dropped EXE
PID:3248 -
\??\c:\ddpjp.exec:\ddpjp.exe48⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ntthbn.exec:\ntthbn.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vvjpj.exec:\vvjpj.exe50⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bthtnn.exec:\bthtnn.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jpvpj.exec:\jpvpj.exe52⤵
- Executes dropped EXE
PID:888 -
\??\c:\xffrfxl.exec:\xffrfxl.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hbhbbb.exec:\hbhbbb.exe54⤵
- Executes dropped EXE
PID:4272 -
\??\c:\xrxrlll.exec:\xrxrlll.exe55⤵
- Executes dropped EXE
PID:4600 -
\??\c:\btnhtn.exec:\btnhtn.exe56⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jdpjp.exec:\jdpjp.exe57⤵
- Executes dropped EXE
PID:836 -
\??\c:\xllfrrl.exec:\xllfrrl.exe58⤵
- Executes dropped EXE
PID:4652 -
\??\c:\dpvpj.exec:\dpvpj.exe59⤵
- Executes dropped EXE
PID:1344 -
\??\c:\1xrlrlx.exec:\1xrlrlx.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\htbnbt.exec:\htbnbt.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jvvpd.exec:\jvvpd.exe62⤵
- Executes dropped EXE
PID:4044 -
\??\c:\5llxfxf.exec:\5llxfxf.exe63⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jjvpp.exec:\jjvpp.exe64⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ffrfrlr.exec:\ffrfrlr.exe65⤵
- Executes dropped EXE
PID:3904 -
\??\c:\jpvvp.exec:\jpvvp.exe66⤵PID:1552
-
\??\c:\xrlrflf.exec:\xrlrflf.exe67⤵PID:4620
-
\??\c:\hnnhbt.exec:\hnnhbt.exe68⤵PID:3076
-
\??\c:\1fllfff.exec:\1fllfff.exe69⤵PID:4180
-
\??\c:\hhtbtt.exec:\hhtbtt.exe70⤵PID:2480
-
\??\c:\rxfxlll.exec:\rxfxlll.exe71⤵PID:2452
-
\??\c:\dddvv.exec:\dddvv.exe72⤵PID:4744
-
\??\c:\5lrflfx.exec:\5lrflfx.exe73⤵PID:4396
-
\??\c:\nhhhtt.exec:\nhhhtt.exe74⤵PID:3104
-
\??\c:\jdddv.exec:\jdddv.exe75⤵PID:456
-
\??\c:\lflxlxr.exec:\lflxlxr.exe76⤵PID:3416
-
\??\c:\bbbnhh.exec:\bbbnhh.exe77⤵PID:3796
-
\??\c:\xlrrlfr.exec:\xlrrlfr.exe78⤵PID:4868
-
\??\c:\3tbbhb.exec:\3tbbhb.exe79⤵PID:728
-
\??\c:\9jdvp.exec:\9jdvp.exe80⤵PID:1592
-
\??\c:\jddvj.exec:\jddvj.exe81⤵PID:3140
-
\??\c:\5lllxxx.exec:\5lllxxx.exe82⤵PID:2308
-
\??\c:\vvvvv.exec:\vvvvv.exe83⤵PID:3572
-
\??\c:\3xffrxr.exec:\3xffrxr.exe84⤵PID:4596
-
\??\c:\lfffxxx.exec:\lfffxxx.exe85⤵PID:5116
-
\??\c:\ppppp.exec:\ppppp.exe86⤵PID:2512
-
\??\c:\1flrlxx.exec:\1flrlxx.exe87⤵PID:4040
-
\??\c:\pjvpp.exec:\pjvpp.exe88⤵PID:2384
-
\??\c:\9llfxxx.exec:\9llfxxx.exe89⤵PID:5092
-
\??\c:\tthhbh.exec:\tthhbh.exe90⤵PID:3436
-
\??\c:\rfffxxx.exec:\rfffxxx.exe91⤵PID:4792
-
\??\c:\ntbbhh.exec:\ntbbhh.exe92⤵PID:4548
-
\??\c:\frxrllf.exec:\frxrllf.exe93⤵PID:3824
-
\??\c:\btbttt.exec:\btbttt.exe94⤵PID:3960
-
\??\c:\xrxrllf.exec:\xrxrllf.exe95⤵PID:3712
-
\??\c:\bbbbtb.exec:\bbbbtb.exe96⤵PID:2812
-
\??\c:\fxrlffx.exec:\fxrlffx.exe97⤵PID:2004
-
\??\c:\ttnbtt.exec:\ttnbtt.exe98⤵PID:4652
-
\??\c:\lrffrrr.exec:\lrffrrr.exe99⤵PID:1820
-
\??\c:\nbbbbb.exec:\nbbbbb.exe100⤵PID:2076
-
\??\c:\jjjdv.exec:\jjjdv.exe101⤵PID:3252
-
\??\c:\5ntnhh.exec:\5ntnhh.exe102⤵PID:4884
-
\??\c:\5hhbtt.exec:\5hhbtt.exe103⤵PID:4024
-
\??\c:\vjjjv.exec:\vjjjv.exe104⤵PID:4064
-
\??\c:\hbnnhh.exec:\hbnnhh.exe105⤵PID:1732
-
\??\c:\ttnnbb.exec:\ttnnbb.exe106⤵PID:3076
-
\??\c:\dpvvp.exec:\dpvvp.exe107⤵PID:5024
-
\??\c:\1htnbb.exec:\1htnbb.exe108⤵PID:1772
-
\??\c:\jjdvp.exec:\jjdvp.exe109⤵PID:4432
-
\??\c:\7htnht.exec:\7htnht.exe110⤵PID:3992
-
\??\c:\vjddv.exec:\vjddv.exe111⤵PID:3104
-
\??\c:\dvjjj.exec:\dvjjj.exe112⤵PID:3984
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe113⤵PID:3936
-
\??\c:\ddddv.exec:\ddddv.exe114⤵PID:2336
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe115⤵PID:3872
-
\??\c:\bbhhbb.exec:\bbhhbb.exe116⤵PID:2132
-
\??\c:\1dppp.exec:\1dppp.exe117⤵PID:4512
-
\??\c:\5bhthn.exec:\5bhthn.exe118⤵PID:240
-
\??\c:\9thtnn.exec:\9thtnn.exe119⤵PID:976
-
\??\c:\lllfxxr.exec:\lllfxxr.exe120⤵PID:3656
-
\??\c:\ffxrlll.exec:\ffxrlll.exe121⤵PID:4776
-
\??\c:\jjjjj.exec:\jjjjj.exe122⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-