Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe
-
Size
371KB
-
MD5
a3a93eb00dddd577dab4802d405a6add
-
SHA1
44d6c97dd5f75694d790a175fe2f9251b22ce45f
-
SHA256
68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8
-
SHA512
5f19f17ddea1ca824f64d61ed56c139c342290153252e73001359ca7fd3a00839adc528f7ed515c8fa34fe5e7669b8c3109055b9731490a589febaf86ff13f31
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMA:n3C9uYA7i3/stR9HGYyvtTxTKMt
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1960-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/1960-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2984-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1476-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4432-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4852-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1296-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1980-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1140-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2240-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/372-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2976-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2176-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4668-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4420-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4088-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2984 pvvpj.exe 5080 rxxlxrf.exe 2732 xfllxrl.exe 4344 xfxlrrf.exe 1476 7nhbnh.exe 4432 htthtn.exe 2388 dvdvj.exe 4576 rrrrfxx.exe 4852 ppppj.exe 3860 7xfxllf.exe 1296 7ttnnn.exe 2156 frfrlxl.exe 1980 tttthh.exe 1140 rlfxrlf.exe 5044 htbbtn.exe 2056 ddvpj.exe 2240 lfrlffx.exe 372 bbbtnn.exe 2976 llxrfxl.exe 5112 1xfxrll.exe 2176 vpvvp.exe 680 dvdpj.exe 4668 btttnn.exe 4420 ppvpj.exe 1776 lfrrrrf.exe 1744 pdjvv.exe 784 9vdvp.exe 1056 nthbhb.exe 4088 5bhbnn.exe 4356 xrrlllr.exe 1008 hhtntn.exe 5040 ttbnhb.exe 2696 pdjvj.exe 2732 lrfrflr.exe 4880 nhbtbb.exe 3452 pddpd.exe 2500 rrxxrxf.exe 4240 nhhhbt.exe 1860 btnthn.exe 2388 pjpvd.exe 2320 1xxrflx.exe 3884 thnhht.exe 3916 htttnt.exe 1172 jpjdp.exe 1096 llxlrlx.exe 920 nbtnnh.exe 2008 jjjpd.exe 1980 fllfrrl.exe 696 tbbtnh.exe 832 tntbtn.exe 4216 5jdvj.exe 4220 rxrlxrf.exe 3284 lxfrxrx.exe 1620 htbnbt.exe 680 pvjvp.exe 1480 pjdpd.exe 3420 lxxrfxr.exe 5068 hbnhbt.exe 2136 bbtttn.exe 2412 vvvpd.exe 3180 3rrfrlx.exe 2100 xxxrlrf.exe 4372 thtnbn.exe 3204 thbnbb.exe -
resource yara_rule behavioral2/memory/1960-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2984 1960 68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe 85 PID 1960 wrote to memory of 2984 1960 68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe 85 PID 1960 wrote to memory of 2984 1960 68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe 85 PID 2984 wrote to memory of 5080 2984 pvvpj.exe 86 PID 2984 wrote to memory of 5080 2984 pvvpj.exe 86 PID 2984 wrote to memory of 5080 2984 pvvpj.exe 86 PID 5080 wrote to memory of 2732 5080 rxxlxrf.exe 87 PID 5080 wrote to memory of 2732 5080 rxxlxrf.exe 87 PID 5080 wrote to memory of 2732 5080 rxxlxrf.exe 87 PID 2732 wrote to memory of 4344 2732 xfllxrl.exe 88 PID 2732 wrote to memory of 4344 2732 xfllxrl.exe 88 PID 2732 wrote to memory of 4344 2732 xfllxrl.exe 88 PID 4344 wrote to memory of 1476 4344 xfxlrrf.exe 89 PID 4344 wrote to memory of 1476 4344 xfxlrrf.exe 89 PID 4344 wrote to memory of 1476 4344 xfxlrrf.exe 89 PID 1476 wrote to memory of 4432 1476 7nhbnh.exe 90 PID 1476 wrote to memory of 4432 1476 7nhbnh.exe 90 PID 1476 wrote to memory of 4432 1476 7nhbnh.exe 90 PID 4432 wrote to memory of 2388 4432 htthtn.exe 91 PID 4432 wrote to memory of 2388 4432 htthtn.exe 91 PID 4432 wrote to memory of 2388 4432 htthtn.exe 91 PID 2388 wrote to memory of 4576 2388 dvdvj.exe 92 PID 2388 wrote to memory of 4576 2388 dvdvj.exe 92 PID 2388 wrote to memory of 4576 2388 dvdvj.exe 92 PID 4576 wrote to memory of 4852 4576 rrrrfxx.exe 93 PID 4576 wrote to memory of 4852 4576 rrrrfxx.exe 93 PID 4576 wrote to memory of 4852 4576 rrrrfxx.exe 93 PID 4852 wrote to memory of 3860 4852 ppppj.exe 94 PID 4852 wrote to memory of 3860 4852 ppppj.exe 94 PID 4852 wrote to memory of 3860 4852 ppppj.exe 94 PID 3860 wrote to memory of 1296 3860 7xfxllf.exe 95 PID 3860 wrote to memory of 1296 3860 7xfxllf.exe 95 PID 3860 wrote to memory of 1296 3860 7xfxllf.exe 95 PID 1296 wrote to memory of 2156 1296 7ttnnn.exe 96 PID 1296 wrote to memory of 2156 1296 7ttnnn.exe 96 PID 1296 wrote to memory of 2156 1296 7ttnnn.exe 96 PID 2156 wrote to memory of 1980 2156 frfrlxl.exe 97 PID 2156 wrote to memory of 1980 2156 frfrlxl.exe 97 PID 2156 wrote to memory of 1980 2156 frfrlxl.exe 97 PID 1980 wrote to memory of 1140 1980 tttthh.exe 99 PID 1980 wrote to memory of 1140 1980 tttthh.exe 99 PID 1980 wrote to memory of 1140 1980 tttthh.exe 99 PID 1140 wrote to memory of 5044 1140 rlfxrlf.exe 101 PID 1140 wrote to memory of 5044 1140 rlfxrlf.exe 101 PID 1140 wrote to memory of 5044 1140 rlfxrlf.exe 101 PID 5044 wrote to memory of 2056 5044 htbbtn.exe 102 PID 5044 wrote to memory of 2056 5044 htbbtn.exe 102 PID 5044 wrote to memory of 2056 5044 htbbtn.exe 102 PID 2056 wrote to memory of 2240 2056 ddvpj.exe 104 PID 2056 wrote to memory of 2240 2056 ddvpj.exe 104 PID 2056 wrote to memory of 2240 2056 ddvpj.exe 104 PID 2240 wrote to memory of 372 2240 lfrlffx.exe 105 PID 2240 wrote to memory of 372 2240 lfrlffx.exe 105 PID 2240 wrote to memory of 372 2240 lfrlffx.exe 105 PID 372 wrote to memory of 2976 372 bbbtnn.exe 106 PID 372 wrote to memory of 2976 372 bbbtnn.exe 106 PID 372 wrote to memory of 2976 372 bbbtnn.exe 106 PID 2976 wrote to memory of 5112 2976 llxrfxl.exe 107 PID 2976 wrote to memory of 5112 2976 llxrfxl.exe 107 PID 2976 wrote to memory of 5112 2976 llxrfxl.exe 107 PID 5112 wrote to memory of 2176 5112 1xfxrll.exe 108 PID 5112 wrote to memory of 2176 5112 1xfxrll.exe 108 PID 5112 wrote to memory of 2176 5112 1xfxrll.exe 108 PID 2176 wrote to memory of 680 2176 vpvvp.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe"C:\Users\Admin\AppData\Local\Temp\68e2a76899ef54b0a4eef7a5d02c22682e591e4e6ed9de6455ee0f16e415c7d8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\pvvpj.exec:\pvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\xfllxrl.exec:\xfllxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xfxlrrf.exec:\xfxlrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\7nhbnh.exec:\7nhbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\htthtn.exec:\htthtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\dvdvj.exec:\dvdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rrrrfxx.exec:\rrrrfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\ppppj.exec:\ppppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\7xfxllf.exec:\7xfxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\7ttnnn.exec:\7ttnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\frfrlxl.exec:\frfrlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\tttthh.exec:\tttthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\htbbtn.exec:\htbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\ddvpj.exec:\ddvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\lfrlffx.exec:\lfrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bbbtnn.exec:\bbbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\llxrfxl.exec:\llxrfxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1xfxrll.exec:\1xfxrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\vpvvp.exec:\vpvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\dvdpj.exec:\dvdpj.exe23⤵
- Executes dropped EXE
PID:680 -
\??\c:\btttnn.exec:\btttnn.exe24⤵
- Executes dropped EXE
PID:4668 -
\??\c:\ppvpj.exec:\ppvpj.exe25⤵
- Executes dropped EXE
PID:4420 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pdjvv.exec:\pdjvv.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9vdvp.exec:\9vdvp.exe28⤵
- Executes dropped EXE
PID:784 -
\??\c:\nthbhb.exec:\nthbhb.exe29⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5bhbnn.exec:\5bhbnn.exe30⤵
- Executes dropped EXE
PID:4088 -
\??\c:\xrrlllr.exec:\xrrlllr.exe31⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hhtntn.exec:\hhtntn.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ttbnhb.exec:\ttbnhb.exe33⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pdjvj.exec:\pdjvj.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lrfrflr.exec:\lrfrflr.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhbtbb.exec:\nhbtbb.exe36⤵
- Executes dropped EXE
PID:4880 -
\??\c:\pddpd.exec:\pddpd.exe37⤵
- Executes dropped EXE
PID:3452 -
\??\c:\rrxxrxf.exec:\rrxxrxf.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhhhbt.exec:\nhhhbt.exe39⤵
- Executes dropped EXE
PID:4240 -
\??\c:\btnthn.exec:\btnthn.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pjpvd.exec:\pjpvd.exe41⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1xxrflx.exec:\1xxrflx.exe42⤵
- Executes dropped EXE
PID:2320 -
\??\c:\thnhht.exec:\thnhht.exe43⤵
- Executes dropped EXE
PID:3884 -
\??\c:\htttnt.exec:\htttnt.exe44⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jpjdp.exec:\jpjdp.exe45⤵
- Executes dropped EXE
PID:1172 -
\??\c:\llxlrlx.exec:\llxlrlx.exe46⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nbtnnh.exec:\nbtnnh.exe47⤵
- Executes dropped EXE
PID:920 -
\??\c:\jjjpd.exec:\jjjpd.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fllfrrl.exec:\fllfrrl.exe49⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tbbtnh.exec:\tbbtnh.exe50⤵
- Executes dropped EXE
PID:696 -
\??\c:\tntbtn.exec:\tntbtn.exe51⤵
- Executes dropped EXE
PID:832 -
\??\c:\5jdvj.exec:\5jdvj.exe52⤵
- Executes dropped EXE
PID:4216 -
\??\c:\rxrlxrf.exec:\rxrlxrf.exe53⤵
- Executes dropped EXE
PID:4220 -
\??\c:\lxfrxrx.exec:\lxfrxrx.exe54⤵
- Executes dropped EXE
PID:3284 -
\??\c:\htbnbt.exec:\htbnbt.exe55⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pvjvp.exec:\pvjvp.exe56⤵
- Executes dropped EXE
PID:680 -
\??\c:\pjdpd.exec:\pjdpd.exe57⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe58⤵
- Executes dropped EXE
PID:3420 -
\??\c:\hbnhbt.exec:\hbnhbt.exe59⤵
- Executes dropped EXE
PID:5068 -
\??\c:\bbtttn.exec:\bbtttn.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vvvpd.exec:\vvvpd.exe61⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3rrfrlx.exec:\3rrfrlx.exe62⤵
- Executes dropped EXE
PID:3180 -
\??\c:\xxxrlrf.exec:\xxxrlrf.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\thtnbn.exec:\thtnbn.exe64⤵
- Executes dropped EXE
PID:4372 -
\??\c:\thbnbb.exec:\thbnbb.exe65⤵
- Executes dropped EXE
PID:3204 -
\??\c:\pddvj.exec:\pddvj.exe66⤵PID:4356
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe67⤵PID:440
-
\??\c:\xlxlxlx.exec:\xlxlxlx.exe68⤵PID:5040
-
\??\c:\bnbnbt.exec:\bnbnbt.exe69⤵PID:3416
-
\??\c:\vpjdp.exec:\vpjdp.exe70⤵PID:948
-
\??\c:\vvppv.exec:\vvppv.exe71⤵PID:2684
-
\??\c:\rfrfrlf.exec:\rfrfrlf.exe72⤵PID:2580
-
\??\c:\nnnhtn.exec:\nnnhtn.exe73⤵PID:4272
-
\??\c:\hhhhtn.exec:\hhhhtn.exe74⤵PID:512
-
\??\c:\vpdpj.exec:\vpdpj.exe75⤵PID:1916
-
\??\c:\frlxrlx.exec:\frlxrlx.exe76⤵PID:4288
-
\??\c:\fflxlfx.exec:\fflxlfx.exe77⤵PID:4848
-
\??\c:\bhnbbt.exec:\bhnbbt.exe78⤵PID:4852
-
\??\c:\jvdpj.exec:\jvdpj.exe79⤵PID:1632
-
\??\c:\djpdp.exec:\djpdp.exe80⤵PID:4676
-
\??\c:\5rxxllx.exec:\5rxxllx.exe81⤵PID:4604
-
\??\c:\nntnbh.exec:\nntnbh.exe82⤵PID:232
-
\??\c:\btbthh.exec:\btbthh.exe83⤵PID:4476
-
\??\c:\7vvjd.exec:\7vvjd.exe84⤵PID:3880
-
\??\c:\frrllll.exec:\frrllll.exe85⤵PID:3460
-
\??\c:\rxffrrx.exec:\rxffrrx.exe86⤵PID:3968
-
\??\c:\hnhbbt.exec:\hnhbbt.exe87⤵PID:3496
-
\??\c:\5nnbbt.exec:\5nnbbt.exe88⤵PID:868
-
\??\c:\jvjvd.exec:\jvjvd.exe89⤵PID:964
-
\??\c:\xflxlfx.exec:\xflxlfx.exe90⤵PID:4216
-
\??\c:\3fxrffr.exec:\3fxrffr.exe91⤵PID:848
-
\??\c:\tbnnnb.exec:\tbnnnb.exe92⤵PID:1572
-
\??\c:\hnnnhh.exec:\hnnnhh.exe93⤵PID:712
-
\??\c:\1vvjv.exec:\1vvjv.exe94⤵PID:3780
-
\??\c:\jjddv.exec:\jjddv.exe95⤵PID:2908
-
\??\c:\rflxfxr.exec:\rflxfxr.exe96⤵PID:1620
-
\??\c:\hnnhtn.exec:\hnnhtn.exe97⤵PID:680
-
\??\c:\nbbtnh.exec:\nbbtnh.exe98⤵PID:3380
-
\??\c:\jjjdv.exec:\jjjdv.exe99⤵PID:1640
-
\??\c:\dppdj.exec:\dppdj.exe100⤵PID:2264
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe101⤵PID:1512
-
\??\c:\pvvpj.exec:\pvvpj.exe102⤵PID:3716
-
\??\c:\pjjdd.exec:\pjjdd.exe103⤵PID:5060
-
\??\c:\llrlrlf.exec:\llrlrlf.exe104⤵PID:2640
-
\??\c:\tbbnhb.exec:\tbbnhb.exe105⤵PID:1104
-
\??\c:\hbtnhb.exec:\hbtnhb.exe106⤵PID:2060
-
\??\c:\5pjpj.exec:\5pjpj.exe107⤵PID:4656
-
\??\c:\rxfrflx.exec:\rxfrflx.exe108⤵PID:2116
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe109⤵PID:2584
-
\??\c:\pdvvj.exec:\pdvvj.exe110⤵PID:3148
-
\??\c:\pdjvj.exec:\pdjvj.exe111⤵PID:3596
-
\??\c:\5fxlfxf.exec:\5fxlfxf.exe112⤵PID:1476
-
\??\c:\bbbnhb.exec:\bbbnhb.exe113⤵PID:3376
-
\??\c:\vvdvv.exec:\vvdvv.exe114⤵PID:4708
-
\??\c:\dddjv.exec:\dddjv.exe115⤵PID:3472
-
\??\c:\fffxffr.exec:\fffxffr.exe116⤵PID:3640
-
\??\c:\lxlffxx.exec:\lxlffxx.exe117⤵PID:1908
-
\??\c:\bbbtbt.exec:\bbbtbt.exe118⤵PID:4760
-
\??\c:\dddvp.exec:\dddvp.exe119⤵PID:652
-
\??\c:\lfrlxxx.exec:\lfrlxxx.exe120⤵PID:2020
-
\??\c:\rlllfff.exec:\rlllfff.exe121⤵PID:2156
-
\??\c:\nttttt.exec:\nttttt.exe122⤵PID:3184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-