Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe
-
Size
94KB
-
MD5
97441b8669bdeebe70131d85721081e0
-
SHA1
89b2573357fce1c3928d91d0371965b67979c798
-
SHA256
793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3
-
SHA512
a8167dda9c6621077c04d88c156ca6564f3b4211f8fc2c0bfbc45337d6855c538d9da9ae6ead38e14528d73784ad43d7da02d03c1c904c3fd7ebd1663beba732
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OXRY:ymb3NkkiQ3mdBjFo7NguQG1n0USu
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3748-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-23-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/1792-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2972-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3748-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3012-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2484-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1360-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/544-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2080-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2080-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2080-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2080-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1708-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2208-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3792-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4352-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/972-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3944-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3740-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4204-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3260-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1792 nnnbtn.exe 2972 tnnhtn.exe 3012 pdjdj.exe 4880 xxlrxff.exe 2484 htbtnh.exe 1360 tnbbbt.exe 5036 djjdp.exe 544 dvjvj.exe 5096 bttnbb.exe 2080 jpdjp.exe 1708 ffllrrr.exe 2208 tnntnn.exe 4016 djjdv.exe 2760 pjdvp.exe 3792 xrrllrl.exe 4132 hnnbtb.exe 4572 djpjd.exe 4352 vpvpj.exe 2140 9ffxrlf.exe 376 rxrxlrr.exe 1052 hbtnhb.exe 3372 djvdv.exe 972 lrxxlff.exe 3944 lxxxlxx.exe 3740 hthtbt.exe 1488 pppdv.exe 4204 pjjdp.exe 2144 5rlfxrr.exe 3260 tnhbbt.exe 5004 vvpdd.exe 3292 3rxlxrl.exe 3016 flxrxxx.exe 884 5thbtn.exe 1300 tnhbnn.exe 3124 3pvjd.exe 3576 xrxlxrf.exe 4020 frxxxff.exe 3056 nbbthb.exe 4460 7ttbtn.exe 1144 vjpdd.exe 1008 dvddv.exe 3616 rrfxfxf.exe 2160 rlffrrr.exe 4792 tnhbbb.exe 3716 vpddv.exe 1740 jddvp.exe 3036 rrlxrrl.exe 1044 1fllffx.exe 4976 htthtb.exe 5036 pjjdd.exe 2872 3ppjj.exe 2512 xrlxfxl.exe 2172 rrlxrxx.exe 2040 htnnhn.exe 1852 jvjdv.exe 2796 rxxrlfx.exe 1228 rflxrrx.exe 4076 hhbthb.exe 1428 5tnnhb.exe 3160 djdpp.exe 3068 7xrlxrl.exe 3048 frffxxr.exe 2696 9bbthh.exe 4132 tnnhbb.exe -
resource yara_rule behavioral2/memory/1792-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3748 wrote to memory of 1792 3748 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 82 PID 3748 wrote to memory of 1792 3748 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 82 PID 3748 wrote to memory of 1792 3748 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 82 PID 1792 wrote to memory of 2972 1792 nnnbtn.exe 83 PID 1792 wrote to memory of 2972 1792 nnnbtn.exe 83 PID 1792 wrote to memory of 2972 1792 nnnbtn.exe 83 PID 2972 wrote to memory of 3012 2972 tnnhtn.exe 84 PID 2972 wrote to memory of 3012 2972 tnnhtn.exe 84 PID 2972 wrote to memory of 3012 2972 tnnhtn.exe 84 PID 3012 wrote to memory of 4880 3012 pdjdj.exe 85 PID 3012 wrote to memory of 4880 3012 pdjdj.exe 85 PID 3012 wrote to memory of 4880 3012 pdjdj.exe 85 PID 4880 wrote to memory of 2484 4880 xxlrxff.exe 86 PID 4880 wrote to memory of 2484 4880 xxlrxff.exe 86 PID 4880 wrote to memory of 2484 4880 xxlrxff.exe 86 PID 2484 wrote to memory of 1360 2484 htbtnh.exe 87 PID 2484 wrote to memory of 1360 2484 htbtnh.exe 87 PID 2484 wrote to memory of 1360 2484 htbtnh.exe 87 PID 1360 wrote to memory of 5036 1360 tnbbbt.exe 88 PID 1360 wrote to memory of 5036 1360 tnbbbt.exe 88 PID 1360 wrote to memory of 5036 1360 tnbbbt.exe 88 PID 5036 wrote to memory of 544 5036 djjdp.exe 89 PID 5036 wrote to memory of 544 5036 djjdp.exe 89 PID 5036 wrote to memory of 544 5036 djjdp.exe 89 PID 544 wrote to memory of 5096 544 dvjvj.exe 90 PID 544 wrote to memory of 5096 544 dvjvj.exe 90 PID 544 wrote to memory of 5096 544 dvjvj.exe 90 PID 5096 wrote to memory of 2080 5096 bttnbb.exe 91 PID 5096 wrote to memory of 2080 5096 bttnbb.exe 91 PID 5096 wrote to memory of 2080 5096 bttnbb.exe 91 PID 2080 wrote to memory of 1708 2080 jpdjp.exe 92 PID 2080 wrote to memory of 1708 2080 jpdjp.exe 92 PID 2080 wrote to memory of 1708 2080 jpdjp.exe 92 PID 1708 wrote to memory of 2208 1708 ffllrrr.exe 93 PID 1708 wrote to memory of 2208 1708 ffllrrr.exe 93 PID 1708 wrote to memory of 2208 1708 ffllrrr.exe 93 PID 2208 wrote to memory of 4016 2208 tnntnn.exe 94 PID 2208 wrote to memory of 4016 2208 tnntnn.exe 94 PID 2208 wrote to memory of 4016 2208 tnntnn.exe 94 PID 4016 wrote to memory of 2760 4016 djjdv.exe 95 PID 4016 wrote to memory of 2760 4016 djjdv.exe 95 PID 4016 wrote to memory of 2760 4016 djjdv.exe 95 PID 2760 wrote to memory of 3792 2760 pjdvp.exe 96 PID 2760 wrote to memory of 3792 2760 pjdvp.exe 96 PID 2760 wrote to memory of 3792 2760 pjdvp.exe 96 PID 3792 wrote to memory of 4132 3792 xrrllrl.exe 97 PID 3792 wrote to memory of 4132 3792 xrrllrl.exe 97 PID 3792 wrote to memory of 4132 3792 xrrllrl.exe 97 PID 4132 wrote to memory of 4572 4132 hnnbtb.exe 98 PID 4132 wrote to memory of 4572 4132 hnnbtb.exe 98 PID 4132 wrote to memory of 4572 4132 hnnbtb.exe 98 PID 4572 wrote to memory of 4352 4572 djpjd.exe 99 PID 4572 wrote to memory of 4352 4572 djpjd.exe 99 PID 4572 wrote to memory of 4352 4572 djpjd.exe 99 PID 4352 wrote to memory of 2140 4352 vpvpj.exe 101 PID 4352 wrote to memory of 2140 4352 vpvpj.exe 101 PID 4352 wrote to memory of 2140 4352 vpvpj.exe 101 PID 2140 wrote to memory of 376 2140 9ffxrlf.exe 102 PID 2140 wrote to memory of 376 2140 9ffxrlf.exe 102 PID 2140 wrote to memory of 376 2140 9ffxrlf.exe 102 PID 376 wrote to memory of 1052 376 rxrxlrr.exe 103 PID 376 wrote to memory of 1052 376 rxrxlrr.exe 103 PID 376 wrote to memory of 1052 376 rxrxlrr.exe 103 PID 1052 wrote to memory of 3372 1052 hbtnhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe"C:\Users\Admin\AppData\Local\Temp\793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\nnnbtn.exec:\nnnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\tnnhtn.exec:\tnnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\pdjdj.exec:\pdjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xxlrxff.exec:\xxlrxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\htbtnh.exec:\htbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\tnbbbt.exec:\tnbbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\djjdp.exec:\djjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\dvjvj.exec:\dvjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\bttnbb.exec:\bttnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\jpdjp.exec:\jpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ffllrrr.exec:\ffllrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tnntnn.exec:\tnntnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\djjdv.exec:\djjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\pjdvp.exec:\pjdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xrrllrl.exec:\xrrllrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\hnnbtb.exec:\hnnbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\djpjd.exec:\djpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\vpvpj.exec:\vpvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\rxrxlrr.exec:\rxrxlrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\hbtnhb.exec:\hbtnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\djvdv.exec:\djvdv.exe23⤵
- Executes dropped EXE
PID:3372 -
\??\c:\lrxxlff.exec:\lrxxlff.exe24⤵
- Executes dropped EXE
PID:972 -
\??\c:\lxxxlxx.exec:\lxxxlxx.exe25⤵
- Executes dropped EXE
PID:3944 -
\??\c:\hthtbt.exec:\hthtbt.exe26⤵
- Executes dropped EXE
PID:3740 -
\??\c:\pppdv.exec:\pppdv.exe27⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pjjdp.exec:\pjjdp.exe28⤵
- Executes dropped EXE
PID:4204 -
\??\c:\5rlfxrr.exec:\5rlfxrr.exe29⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tnhbbt.exec:\tnhbbt.exe30⤵
- Executes dropped EXE
PID:3260 -
\??\c:\vvpdd.exec:\vvpdd.exe31⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3rxlxrl.exec:\3rxlxrl.exe32⤵
- Executes dropped EXE
PID:3292 -
\??\c:\flxrxxx.exec:\flxrxxx.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5thbtn.exec:\5thbtn.exe34⤵
- Executes dropped EXE
PID:884 -
\??\c:\tnhbnn.exec:\tnhbnn.exe35⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3pvjd.exec:\3pvjd.exe36⤵
- Executes dropped EXE
PID:3124 -
\??\c:\xrxlxrf.exec:\xrxlxrf.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\frxxxff.exec:\frxxxff.exe38⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nbbthb.exec:\nbbthb.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7ttbtn.exec:\7ttbtn.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\vjpdd.exec:\vjpdd.exe41⤵
- Executes dropped EXE
PID:1144 -
\??\c:\dvddv.exec:\dvddv.exe42⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rrfxfxf.exec:\rrfxfxf.exe43⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rlffrrr.exec:\rlffrrr.exe44⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnhbbb.exec:\tnhbbb.exe45⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vpddv.exec:\vpddv.exe46⤵
- Executes dropped EXE
PID:3716 -
\??\c:\jddvp.exec:\jddvp.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rrlxrrl.exec:\rrlxrrl.exe48⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1fllffx.exec:\1fllffx.exe49⤵
- Executes dropped EXE
PID:1044 -
\??\c:\htthtb.exec:\htthtb.exe50⤵
- Executes dropped EXE
PID:4976 -
\??\c:\pjjdd.exec:\pjjdd.exe51⤵
- Executes dropped EXE
PID:5036 -
\??\c:\3ppjj.exec:\3ppjj.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xrlxfxl.exec:\xrlxfxl.exe53⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrlxrxx.exec:\rrlxrxx.exe54⤵
- Executes dropped EXE
PID:2172 -
\??\c:\htnnhn.exec:\htnnhn.exe55⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvjdv.exec:\jvjdv.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rflxrrx.exec:\rflxrrx.exe58⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hhbthb.exec:\hhbthb.exe59⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5tnnhb.exec:\5tnnhb.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\djdpp.exec:\djdpp.exe61⤵
- Executes dropped EXE
PID:3160 -
\??\c:\7xrlxrl.exec:\7xrlxrl.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\frffxxr.exec:\frffxxr.exe63⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9bbthh.exec:\9bbthh.exe64⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tnnhbb.exec:\tnnhbb.exe65⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vjpjd.exec:\vjpjd.exe66⤵PID:4684
-
\??\c:\rflfxxx.exec:\rflfxxx.exe67⤵PID:4352
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe68⤵PID:4316
-
\??\c:\thbtnh.exec:\thbtnh.exe69⤵PID:2308
-
\??\c:\jpdvp.exec:\jpdvp.exe70⤵PID:376
-
\??\c:\dvvvv.exec:\dvvvv.exe71⤵PID:3952
-
\??\c:\llrrxxx.exec:\llrrxxx.exe72⤵PID:664
-
\??\c:\9hnnnn.exec:\9hnnnn.exe73⤵PID:4668
-
\??\c:\htttnn.exec:\htttnn.exe74⤵PID:3536
-
\??\c:\9djjv.exec:\9djjv.exe75⤵PID:4560
-
\??\c:\jdvvp.exec:\jdvvp.exe76⤵PID:1944
-
\??\c:\9lfxlfx.exec:\9lfxlfx.exe77⤵PID:652
-
\??\c:\nhttnn.exec:\nhttnn.exe78⤵PID:2720
-
\??\c:\hbnhnt.exec:\hbnhnt.exe79⤵PID:4204
-
\??\c:\jdddp.exec:\jdddp.exe80⤵PID:4644
-
\??\c:\vpvpj.exec:\vpvpj.exe81⤵PID:3108
-
\??\c:\rxxrlff.exec:\rxxrlff.exe82⤵PID:1644
-
\??\c:\bbbbhh.exec:\bbbbhh.exe83⤵PID:2908
-
\??\c:\nttthh.exec:\nttthh.exe84⤵PID:5004
-
\??\c:\jpvdv.exec:\jpvdv.exe85⤵PID:2608
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe86⤵PID:2660
-
\??\c:\ttbtnh.exec:\ttbtnh.exe87⤵PID:1276
-
\??\c:\9ttnhh.exec:\9ttnhh.exe88⤵PID:2492
-
\??\c:\pppjv.exec:\pppjv.exe89⤵PID:2212
-
\??\c:\jvvvj.exec:\jvvvj.exe90⤵PID:2848
-
\??\c:\rrrllll.exec:\rrrllll.exe91⤵PID:1936
-
\??\c:\tbbbbt.exec:\tbbbbt.exe92⤵PID:4468
-
\??\c:\nttthh.exec:\nttthh.exe93⤵PID:2168
-
\??\c:\nhtnhh.exec:\nhtnhh.exe94⤵PID:64
-
\??\c:\dpppj.exec:\dpppj.exe95⤵PID:4208
-
\??\c:\frrfrlf.exec:\frrfrlf.exe96⤵PID:4944
-
\??\c:\rlllffx.exec:\rlllffx.exe97⤵PID:2216
-
\??\c:\3ntttt.exec:\3ntttt.exe98⤵PID:1596
-
\??\c:\dpjdp.exec:\dpjdp.exe99⤵PID:2800
-
\??\c:\vvdvj.exec:\vvdvj.exe100⤵PID:2956
-
\??\c:\xlfxfxr.exec:\xlfxfxr.exe101⤵PID:5112
-
\??\c:\lxfrrrl.exec:\lxfrrrl.exe102⤵PID:3484
-
\??\c:\ttttnt.exec:\ttttnt.exe103⤵PID:2756
-
\??\c:\tthhbh.exec:\tthhbh.exe104⤵PID:4072
-
\??\c:\djvdv.exec:\djvdv.exe105⤵PID:5016
-
\??\c:\jdjdv.exec:\jdjdv.exe106⤵PID:2464
-
\??\c:\lrrfxrx.exec:\lrrfxrx.exe107⤵PID:5096
-
\??\c:\nhtttt.exec:\nhtttt.exe108⤵PID:3196
-
\??\c:\tnnhbb.exec:\tnnhbb.exe109⤵PID:4980
-
\??\c:\pjjdv.exec:\pjjdv.exe110⤵PID:3920
-
\??\c:\xfxrlrl.exec:\xfxrlrl.exe111⤵PID:3532
-
\??\c:\tnhbbb.exec:\tnhbbb.exe112⤵PID:1228
-
\??\c:\ntnbht.exec:\ntnbht.exe113⤵PID:4076
-
\??\c:\jddvv.exec:\jddvv.exe114⤵PID:4052
-
\??\c:\3flxrrl.exec:\3flxrrl.exe115⤵PID:3620
-
\??\c:\xxlfxxl.exec:\xxlfxxl.exe116⤵PID:3068
-
\??\c:\hbbbhb.exec:\hbbbhb.exe117⤵PID:864
-
\??\c:\vdpjd.exec:\vdpjd.exe118⤵PID:4572
-
\??\c:\jvdvv.exec:\jvdvv.exe119⤵PID:3932
-
\??\c:\llrrrxx.exec:\llrrrxx.exe120⤵PID:4684
-
\??\c:\9fxxxxr.exec:\9fxxxxr.exe121⤵PID:4352
-
\??\c:\nhnnhh.exec:\nhnnhh.exe122⤵PID:4456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-