Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe
-
Size
460KB
-
MD5
2629d94f0ac8939276d3fd40394f977b
-
SHA1
159989e4d6b03840de88a00e7e05b00fedb1b268
-
SHA256
128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f
-
SHA512
b639d64eb4c24e7e9b10973734ebf370b7c0d5d5d6c96ffdb06bba74504d7b4ff60fd2fdda846ff595314b7be0d942d8678619ccca16d26f6d0c94b0b14984ab
-
SSDEEP
12288:n3C9ytvnVXl3C9nQIWJJGmFHQ3C9X3C9qAfIZ/o+gZ6:SgdnV42RfIJ7+
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/4324-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-46-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/4324-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2836-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2032-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4120-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/852-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2308-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3508-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4688-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/964-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3648-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2396-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1172-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2744-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4804-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2588-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2276-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2632-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4648-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4648 tttbbt.exe 1504 1djdv.exe 2836 vpddv.exe 2632 ffxxrrr.exe 1672 tnttnn.exe 2276 ddvvv.exe 4724 rxffffx.exe 2588 tnbbht.exe 4804 hbtnhh.exe 3964 vvvjj.exe 1056 ffllfff.exe 2508 rrflllr.exe 3060 tnhbnt.exe 2744 jdddd.exe 1172 jjvvj.exe 4340 9fxfxxr.exe 3808 hhtbtn.exe 2340 vpvvp.exe 2396 rlfxxll.exe 3648 thbhbb.exe 964 hbhnnh.exe 4688 dvjjd.exe 1868 xrrlllf.exe 2032 7rrlflf.exe 3508 tnhbhh.exe 1720 hbnhhb.exe 2308 dpjjj.exe 4228 llxfffr.exe 852 5frllxr.exe 4120 tnbttt.exe 1176 jpvvv.exe 1984 jpppv.exe 4856 xxffflr.exe 1284 hbhbtt.exe 3848 bhnbtn.exe 4356 dvjpp.exe 3596 1flfxxx.exe 4972 rxllxxf.exe 2900 5bnhnt.exe 1828 pppjd.exe 2300 vvvvj.exe 4384 9fxxrrl.exe 4888 9xxrrll.exe 4076 9hhhbh.exe 2860 dvjdv.exe 3116 ppvvp.exe 4544 lflfffx.exe 1832 nhbbtt.exe 3376 nntntt.exe 804 dddjj.exe 4452 jpvvv.exe 4512 xxfxxrx.exe 4388 tntnhh.exe 4288 5nbbht.exe 3748 pvpjp.exe 1724 7rrrxff.exe 2632 bthnnn.exe 3728 7tbbtt.exe 2276 jpdjd.exe 4840 xrrllll.exe 3204 1rrrlll.exe 4540 hbnhhb.exe 2752 dvpdv.exe 1624 9vjdp.exe -
resource yara_rule behavioral2/memory/4324-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-12-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 4648 4324 128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe 83 PID 4324 wrote to memory of 4648 4324 128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe 83 PID 4324 wrote to memory of 4648 4324 128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe 83 PID 4648 wrote to memory of 1504 4648 tttbbt.exe 84 PID 4648 wrote to memory of 1504 4648 tttbbt.exe 84 PID 4648 wrote to memory of 1504 4648 tttbbt.exe 84 PID 1504 wrote to memory of 2836 1504 1djdv.exe 85 PID 1504 wrote to memory of 2836 1504 1djdv.exe 85 PID 1504 wrote to memory of 2836 1504 1djdv.exe 85 PID 2836 wrote to memory of 2632 2836 vpddv.exe 86 PID 2836 wrote to memory of 2632 2836 vpddv.exe 86 PID 2836 wrote to memory of 2632 2836 vpddv.exe 86 PID 2632 wrote to memory of 1672 2632 ffxxrrr.exe 87 PID 2632 wrote to memory of 1672 2632 ffxxrrr.exe 87 PID 2632 wrote to memory of 1672 2632 ffxxrrr.exe 87 PID 1672 wrote to memory of 2276 1672 tnttnn.exe 141 PID 1672 wrote to memory of 2276 1672 tnttnn.exe 141 PID 1672 wrote to memory of 2276 1672 tnttnn.exe 141 PID 2276 wrote to memory of 4724 2276 ddvvv.exe 89 PID 2276 wrote to memory of 4724 2276 ddvvv.exe 89 PID 2276 wrote to memory of 4724 2276 ddvvv.exe 89 PID 4724 wrote to memory of 2588 4724 rxffffx.exe 90 PID 4724 wrote to memory of 2588 4724 rxffffx.exe 90 PID 4724 wrote to memory of 2588 4724 rxffffx.exe 90 PID 2588 wrote to memory of 4804 2588 tnbbht.exe 91 PID 2588 wrote to memory of 4804 2588 tnbbht.exe 91 PID 2588 wrote to memory of 4804 2588 tnbbht.exe 91 PID 4804 wrote to memory of 3964 4804 hbtnhh.exe 92 PID 4804 wrote to memory of 3964 4804 hbtnhh.exe 92 PID 4804 wrote to memory of 3964 4804 hbtnhh.exe 92 PID 3964 wrote to memory of 1056 3964 vvvjj.exe 93 PID 3964 wrote to memory of 1056 3964 vvvjj.exe 93 PID 3964 wrote to memory of 1056 3964 vvvjj.exe 93 PID 1056 wrote to memory of 2508 1056 ffllfff.exe 94 PID 1056 wrote to memory of 2508 1056 ffllfff.exe 94 PID 1056 wrote to memory of 2508 1056 ffllfff.exe 94 PID 2508 wrote to memory of 3060 2508 rrflllr.exe 95 PID 2508 wrote to memory of 3060 2508 rrflllr.exe 95 PID 2508 wrote to memory of 3060 2508 rrflllr.exe 95 PID 3060 wrote to memory of 2744 3060 tnhbnt.exe 96 PID 3060 wrote to memory of 2744 3060 tnhbnt.exe 96 PID 3060 wrote to memory of 2744 3060 tnhbnt.exe 96 PID 2744 wrote to memory of 1172 2744 jdddd.exe 97 PID 2744 wrote to memory of 1172 2744 jdddd.exe 97 PID 2744 wrote to memory of 1172 2744 jdddd.exe 97 PID 1172 wrote to memory of 4340 1172 jjvvj.exe 98 PID 1172 wrote to memory of 4340 1172 jjvvj.exe 98 PID 1172 wrote to memory of 4340 1172 jjvvj.exe 98 PID 4340 wrote to memory of 3808 4340 9fxfxxr.exe 99 PID 4340 wrote to memory of 3808 4340 9fxfxxr.exe 99 PID 4340 wrote to memory of 3808 4340 9fxfxxr.exe 99 PID 3808 wrote to memory of 2340 3808 hhtbtn.exe 100 PID 3808 wrote to memory of 2340 3808 hhtbtn.exe 100 PID 3808 wrote to memory of 2340 3808 hhtbtn.exe 100 PID 2340 wrote to memory of 2396 2340 vpvvp.exe 101 PID 2340 wrote to memory of 2396 2340 vpvvp.exe 101 PID 2340 wrote to memory of 2396 2340 vpvvp.exe 101 PID 2396 wrote to memory of 3648 2396 rlfxxll.exe 102 PID 2396 wrote to memory of 3648 2396 rlfxxll.exe 102 PID 2396 wrote to memory of 3648 2396 rlfxxll.exe 102 PID 3648 wrote to memory of 964 3648 thbhbb.exe 103 PID 3648 wrote to memory of 964 3648 thbhbb.exe 103 PID 3648 wrote to memory of 964 3648 thbhbb.exe 103 PID 964 wrote to memory of 4688 964 hbhnnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe"C:\Users\Admin\AppData\Local\Temp\128a503197ca8cdb4d4af4de699f7697f9e07e35d2b99e8ee6bc7925a2d6699f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\tttbbt.exec:\tttbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\1djdv.exec:\1djdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vpddv.exec:\vpddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\tnttnn.exec:\tnttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\ddvvv.exec:\ddvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rxffffx.exec:\rxffffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\tnbbht.exec:\tnbbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbtnhh.exec:\hbtnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\vvvjj.exec:\vvvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ffllfff.exec:\ffllfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\rrflllr.exec:\rrflllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\tnhbnt.exec:\tnhbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jdddd.exec:\jdddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jjvvj.exec:\jjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\9fxfxxr.exec:\9fxfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\hhtbtn.exec:\hhtbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\vpvvp.exec:\vpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\rlfxxll.exec:\rlfxxll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\thbhbb.exec:\thbhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\hbhnnh.exec:\hbhnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\dvjjd.exec:\dvjjd.exe23⤵
- Executes dropped EXE
PID:4688 -
\??\c:\xrrlllf.exec:\xrrlllf.exe24⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7rrlflf.exec:\7rrlflf.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnhbhh.exec:\tnhbhh.exe26⤵
- Executes dropped EXE
PID:3508 -
\??\c:\hbnhhb.exec:\hbnhhb.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dpjjj.exec:\dpjjj.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\llxfffr.exec:\llxfffr.exe29⤵
- Executes dropped EXE
PID:4228 -
\??\c:\5frllxr.exec:\5frllxr.exe30⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnbttt.exec:\tnbttt.exe31⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jpvvv.exec:\jpvvv.exe32⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jpppv.exec:\jpppv.exe33⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxffflr.exec:\xxffflr.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hbhbtt.exec:\hbhbtt.exe35⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bhnbtn.exec:\bhnbtn.exe36⤵
- Executes dropped EXE
PID:3848 -
\??\c:\dvjpp.exec:\dvjpp.exe37⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1flfxxx.exec:\1flfxxx.exe38⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rxllxxf.exec:\rxllxxf.exe39⤵
- Executes dropped EXE
PID:4972 -
\??\c:\5bnhnt.exec:\5bnhnt.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pppjd.exec:\pppjd.exe41⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vvvvj.exec:\vvvvj.exe42⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9fxxrrl.exec:\9fxxrrl.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\9xxrrll.exec:\9xxrrll.exe44⤵
- Executes dropped EXE
PID:4888 -
\??\c:\9hhhbh.exec:\9hhhbh.exe45⤵
- Executes dropped EXE
PID:4076 -
\??\c:\dvjdv.exec:\dvjdv.exe46⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ppvvp.exec:\ppvvp.exe47⤵
- Executes dropped EXE
PID:3116 -
\??\c:\lflfffx.exec:\lflfffx.exe48⤵
- Executes dropped EXE
PID:4544 -
\??\c:\nhbbtt.exec:\nhbbtt.exe49⤵
- Executes dropped EXE
PID:1832 -
\??\c:\nntntt.exec:\nntntt.exe50⤵
- Executes dropped EXE
PID:3376 -
\??\c:\dddjj.exec:\dddjj.exe51⤵
- Executes dropped EXE
PID:804 -
\??\c:\jpvvv.exec:\jpvvv.exe52⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xxfxxrx.exec:\xxfxxrx.exe53⤵
- Executes dropped EXE
PID:4512 -
\??\c:\tntnhh.exec:\tntnhh.exe54⤵
- Executes dropped EXE
PID:4388 -
\??\c:\5nbbht.exec:\5nbbht.exe55⤵
- Executes dropped EXE
PID:4288 -
\??\c:\pvpjp.exec:\pvpjp.exe56⤵
- Executes dropped EXE
PID:3748 -
\??\c:\7rrrxff.exec:\7rrrxff.exe57⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bthnnn.exec:\bthnnn.exe58⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7tbbtt.exec:\7tbbtt.exe59⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jpdjd.exec:\jpdjd.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xrrllll.exec:\xrrllll.exe61⤵
- Executes dropped EXE
PID:4840 -
\??\c:\1rrrlll.exec:\1rrrlll.exe62⤵
- Executes dropped EXE
PID:3204 -
\??\c:\hbnhhb.exec:\hbnhhb.exe63⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dvpdv.exec:\dvpdv.exe64⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9vjdp.exec:\9vjdp.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe66⤵PID:1460
-
\??\c:\1ttnnn.exec:\1ttnnn.exe67⤵PID:5080
-
\??\c:\nhnnnt.exec:\nhnnnt.exe68⤵PID:716
-
\??\c:\5dpjp.exec:\5dpjp.exe69⤵PID:3496
-
\??\c:\7fllfff.exec:\7fllfff.exe70⤵PID:4732
-
\??\c:\flrlffx.exec:\flrlffx.exe71⤵PID:64
-
\??\c:\thhhbt.exec:\thhhbt.exe72⤵PID:4584
-
\??\c:\jvddv.exec:\jvddv.exe73⤵PID:1208
-
\??\c:\vpjjv.exec:\vpjjv.exe74⤵PID:2684
-
\??\c:\rlrrllf.exec:\rlrrllf.exe75⤵PID:2892
-
\??\c:\hbnbtn.exec:\hbnbtn.exe76⤵PID:3032
-
\??\c:\nnthhb.exec:\nnthhb.exe77⤵PID:3952
-
\??\c:\jdpvj.exec:\jdpvj.exe78⤵PID:1720
-
\??\c:\xflfxxx.exec:\xflfxxx.exe79⤵PID:4228
-
\??\c:\frxxfff.exec:\frxxfff.exe80⤵PID:3916
-
\??\c:\jjjdv.exec:\jjjdv.exe81⤵PID:808
-
\??\c:\1flllrl.exec:\1flllrl.exe82⤵PID:3860
-
\??\c:\fxlllxx.exec:\fxlllxx.exe83⤵PID:4976
-
\??\c:\5tbbtb.exec:\5tbbtb.exe84⤵PID:1456
-
\??\c:\jdjdd.exec:\jdjdd.exe85⤵PID:2784
-
\??\c:\5fllfll.exec:\5fllfll.exe86⤵PID:3168
-
\??\c:\xflfxxx.exec:\xflfxxx.exe87⤵PID:1628
-
\??\c:\9ntntt.exec:\9ntntt.exe88⤵PID:5088
-
\??\c:\9vppv.exec:\9vppv.exe89⤵PID:3972
-
\??\c:\rrfffll.exec:\rrfffll.exe90⤵PID:4888
-
\??\c:\5hnnnt.exec:\5hnnnt.exe91⤵PID:1280
-
\??\c:\hhhbbb.exec:\hhhbbb.exe92⤵PID:3572
-
\??\c:\vjvpp.exec:\vjvpp.exe93⤵PID:1832
-
\??\c:\fxxrfxl.exec:\fxxrfxl.exe94⤵PID:1388
-
\??\c:\xrllllr.exec:\xrllllr.exe95⤵PID:804
-
\??\c:\httttb.exec:\httttb.exe96⤵PID:3092
-
\??\c:\ddvdp.exec:\ddvdp.exe97⤵PID:4064
-
\??\c:\rrxxfxx.exec:\rrxxfxx.exe98⤵PID:3008
-
\??\c:\hbnnhn.exec:\hbnnhn.exe99⤵PID:1248
-
\??\c:\nhttbh.exec:\nhttbh.exe100⤵PID:2716
-
\??\c:\vpvvv.exec:\vpvvv.exe101⤵PID:1448
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe102⤵PID:1756
-
\??\c:\1ttnnn.exec:\1ttnnn.exe103⤵PID:4312
-
\??\c:\nntnnn.exec:\nntnnn.exe104⤵PID:3000
-
\??\c:\pdpjj.exec:\pdpjj.exe105⤵PID:4648
-
\??\c:\tnnnhn.exec:\tnnnhn.exe106⤵PID:4780
-
\??\c:\pvjjd.exec:\pvjjd.exe107⤵PID:4800
-
\??\c:\lxlffff.exec:\lxlffff.exe108⤵PID:1672
-
\??\c:\hhhtnh.exec:\hhhtnh.exe109⤵PID:316
-
\??\c:\ddvvd.exec:\ddvvd.exe110⤵PID:1172
-
\??\c:\jddvv.exec:\jddvv.exe111⤵PID:2676
-
\??\c:\ffllllr.exec:\ffllllr.exe112⤵PID:2936
-
\??\c:\tnbbnn.exec:\tnbbnn.exe113⤵PID:1844
-
\??\c:\5btttb.exec:\5btttb.exe114⤵PID:4732
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe115⤵PID:1396
-
\??\c:\7rrfflf.exec:\7rrfflf.exe116⤵PID:3484
-
\??\c:\nhbtnn.exec:\nhbtnn.exe117⤵PID:1296
-
\??\c:\pjpjd.exec:\pjpjd.exe118⤵PID:220
-
\??\c:\vpvvv.exec:\vpvvv.exe119⤵PID:856
-
\??\c:\9lffxfx.exec:\9lffxfx.exe120⤵PID:2940
-
\??\c:\bbhhhh.exec:\bbhhhh.exe121⤵PID:916
-
\??\c:\3vjdd.exec:\3vjdd.exe122⤵PID:700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-