Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe
-
Size
82KB
-
MD5
6f06c39347bc945671eb2a41db567c07
-
SHA1
0e6b4e0b88f8a92e607d5afa9b9e5cd877507899
-
SHA256
9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21
-
SHA512
bdfe21808c65b4b0a37312ef6acb19ecc959e6cba3695463e1a5eec44ace7a7a07f2f462315e73b6827528a135f05ab37b1f9848b0345f4ba0e6ee07e4cfa136
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsv7B:ymb3NkkiQ3mdBjFIWeFGyA9Pq
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-23-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3040-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4752-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/740-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2472-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4628-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3368-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1712-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2344-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4108-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2756-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1556-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3948-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3492-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3852-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1552-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2136-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2852-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1464-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3040 jpvpj.exe 2472 djvvj.exe 3560 hbnntt.exe 740 bttnbb.exe 4752 jjppj.exe 1168 dvvpj.exe 1712 7jdvp.exe 4724 5bbbhn.exe 3368 hbthbt.exe 4628 jdppp.exe 2344 pdjdv.exe 4108 btnntt.exe 2756 dvddd.exe 1556 jdppp.exe 4544 lrxrxlx.exe 3948 hhttnn.exe 2384 pvjdv.exe 4660 llfxxxx.exe 3492 llllflf.exe 2984 1httnn.exe 3852 dpppd.exe 452 vppjd.exe 3604 5lrxxrr.exe 1552 bnbbbb.exe 2136 vjjjj.exe 3980 dvjjd.exe 2852 llxrrrr.exe 2616 nhhnhn.exe 3976 7hhhnn.exe 1004 jddpp.exe 1464 1ddvp.exe 4596 frfxxxx.exe 612 tntthn.exe 4124 bbtttb.exe 920 vjdvj.exe 4148 1xxrffx.exe 4320 hhnnnn.exe 2628 nhtntt.exe 4368 vpjjj.exe 4956 rfllffx.exe 1212 7rlfxrl.exe 472 hhtttt.exe 4520 hhhtnn.exe 4948 vvjjj.exe 1604 ppjpj.exe 4088 llrrrrx.exe 828 fxllffl.exe 1908 bbtttt.exe 3376 7nnnhh.exe 3552 jjdvp.exe 1472 5ddvp.exe 3672 rlfxrrl.exe 1688 fxfffff.exe 4312 hhhbhn.exe 2232 ttnntt.exe 4904 pjjdd.exe 4304 jvdvv.exe 3668 lrxxrrf.exe 2808 rlffffx.exe 1984 nthtbh.exe 556 hbhhbb.exe 3800 nhnhnn.exe 4188 1vjjv.exe 3984 jdpvp.exe -
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 3040 1316 9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe 84 PID 1316 wrote to memory of 3040 1316 9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe 84 PID 1316 wrote to memory of 3040 1316 9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe 84 PID 3040 wrote to memory of 2472 3040 jpvpj.exe 85 PID 3040 wrote to memory of 2472 3040 jpvpj.exe 85 PID 3040 wrote to memory of 2472 3040 jpvpj.exe 85 PID 2472 wrote to memory of 3560 2472 djvvj.exe 86 PID 2472 wrote to memory of 3560 2472 djvvj.exe 86 PID 2472 wrote to memory of 3560 2472 djvvj.exe 86 PID 3560 wrote to memory of 740 3560 hbnntt.exe 87 PID 3560 wrote to memory of 740 3560 hbnntt.exe 87 PID 3560 wrote to memory of 740 3560 hbnntt.exe 87 PID 740 wrote to memory of 4752 740 bttnbb.exe 88 PID 740 wrote to memory of 4752 740 bttnbb.exe 88 PID 740 wrote to memory of 4752 740 bttnbb.exe 88 PID 4752 wrote to memory of 1168 4752 jjppj.exe 89 PID 4752 wrote to memory of 1168 4752 jjppj.exe 89 PID 4752 wrote to memory of 1168 4752 jjppj.exe 89 PID 1168 wrote to memory of 1712 1168 dvvpj.exe 90 PID 1168 wrote to memory of 1712 1168 dvvpj.exe 90 PID 1168 wrote to memory of 1712 1168 dvvpj.exe 90 PID 1712 wrote to memory of 4724 1712 7jdvp.exe 91 PID 1712 wrote to memory of 4724 1712 7jdvp.exe 91 PID 1712 wrote to memory of 4724 1712 7jdvp.exe 91 PID 4724 wrote to memory of 3368 4724 5bbbhn.exe 92 PID 4724 wrote to memory of 3368 4724 5bbbhn.exe 92 PID 4724 wrote to memory of 3368 4724 5bbbhn.exe 92 PID 3368 wrote to memory of 4628 3368 hbthbt.exe 93 PID 3368 wrote to memory of 4628 3368 hbthbt.exe 93 PID 3368 wrote to memory of 4628 3368 hbthbt.exe 93 PID 4628 wrote to memory of 2344 4628 jdppp.exe 94 PID 4628 wrote to memory of 2344 4628 jdppp.exe 94 PID 4628 wrote to memory of 2344 4628 jdppp.exe 94 PID 2344 wrote to memory of 4108 2344 pdjdv.exe 95 PID 2344 wrote to memory of 4108 2344 pdjdv.exe 95 PID 2344 wrote to memory of 4108 2344 pdjdv.exe 95 PID 4108 wrote to memory of 2756 4108 btnntt.exe 96 PID 4108 wrote to memory of 2756 4108 btnntt.exe 96 PID 4108 wrote to memory of 2756 4108 btnntt.exe 96 PID 2756 wrote to memory of 1556 2756 dvddd.exe 97 PID 2756 wrote to memory of 1556 2756 dvddd.exe 97 PID 2756 wrote to memory of 1556 2756 dvddd.exe 97 PID 1556 wrote to memory of 4544 1556 jdppp.exe 98 PID 1556 wrote to memory of 4544 1556 jdppp.exe 98 PID 1556 wrote to memory of 4544 1556 jdppp.exe 98 PID 4544 wrote to memory of 3948 4544 lrxrxlx.exe 99 PID 4544 wrote to memory of 3948 4544 lrxrxlx.exe 99 PID 4544 wrote to memory of 3948 4544 lrxrxlx.exe 99 PID 3948 wrote to memory of 2384 3948 hhttnn.exe 100 PID 3948 wrote to memory of 2384 3948 hhttnn.exe 100 PID 3948 wrote to memory of 2384 3948 hhttnn.exe 100 PID 2384 wrote to memory of 4660 2384 pvjdv.exe 101 PID 2384 wrote to memory of 4660 2384 pvjdv.exe 101 PID 2384 wrote to memory of 4660 2384 pvjdv.exe 101 PID 4660 wrote to memory of 3492 4660 llfxxxx.exe 103 PID 4660 wrote to memory of 3492 4660 llfxxxx.exe 103 PID 4660 wrote to memory of 3492 4660 llfxxxx.exe 103 PID 3492 wrote to memory of 2984 3492 llllflf.exe 104 PID 3492 wrote to memory of 2984 3492 llllflf.exe 104 PID 3492 wrote to memory of 2984 3492 llllflf.exe 104 PID 2984 wrote to memory of 3852 2984 1httnn.exe 105 PID 2984 wrote to memory of 3852 2984 1httnn.exe 105 PID 2984 wrote to memory of 3852 2984 1httnn.exe 105 PID 3852 wrote to memory of 452 3852 dpppd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe"C:\Users\Admin\AppData\Local\Temp\9d2b6a5699dc24c7f0ece2ddded7111ae313166970e4ddf6061a700a69f87d21.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\jpvpj.exec:\jpvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\djvvj.exec:\djvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\hbnntt.exec:\hbnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\bttnbb.exec:\bttnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\jjppj.exec:\jjppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\dvvpj.exec:\dvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\7jdvp.exec:\7jdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\5bbbhn.exec:\5bbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\hbthbt.exec:\hbthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\jdppp.exec:\jdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\pdjdv.exec:\pdjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\btnntt.exec:\btnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\dvddd.exec:\dvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jdppp.exec:\jdppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\lrxrxlx.exec:\lrxrxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\hhttnn.exec:\hhttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\pvjdv.exec:\pvjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\llfxxxx.exec:\llfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\llllflf.exec:\llllflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\1httnn.exec:\1httnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\dpppd.exec:\dpppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\vppjd.exec:\vppjd.exe23⤵
- Executes dropped EXE
PID:452 -
\??\c:\5lrxxrr.exec:\5lrxxrr.exe24⤵
- Executes dropped EXE
PID:3604 -
\??\c:\bnbbbb.exec:\bnbbbb.exe25⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vjjjj.exec:\vjjjj.exe26⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dvjjd.exec:\dvjjd.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\llxrrrr.exec:\llxrrrr.exe28⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nhhnhn.exec:\nhhnhn.exe29⤵
- Executes dropped EXE
PID:2616 -
\??\c:\7hhhnn.exec:\7hhhnn.exe30⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jddpp.exec:\jddpp.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\1ddvp.exec:\1ddvp.exe32⤵
- Executes dropped EXE
PID:1464 -
\??\c:\frfxxxx.exec:\frfxxxx.exe33⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tntthn.exec:\tntthn.exe34⤵
- Executes dropped EXE
PID:612 -
\??\c:\bbtttb.exec:\bbtttb.exe35⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vjdvj.exec:\vjdvj.exe36⤵
- Executes dropped EXE
PID:920 -
\??\c:\1xxrffx.exec:\1xxrffx.exe37⤵
- Executes dropped EXE
PID:4148 -
\??\c:\hhnnnn.exec:\hhnnnn.exe38⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nhtntt.exec:\nhtntt.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vpjjj.exec:\vpjjj.exe40⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rfllffx.exec:\rfllffx.exe41⤵
- Executes dropped EXE
PID:4956 -
\??\c:\7rlfxrl.exec:\7rlfxrl.exe42⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hhtttt.exec:\hhtttt.exe43⤵
- Executes dropped EXE
PID:472 -
\??\c:\hhhtnn.exec:\hhhtnn.exe44⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vvjjj.exec:\vvjjj.exe45⤵
- Executes dropped EXE
PID:4948 -
\??\c:\ppjpj.exec:\ppjpj.exe46⤵
- Executes dropped EXE
PID:1604 -
\??\c:\llrrrrx.exec:\llrrrrx.exe47⤵
- Executes dropped EXE
PID:4088 -
\??\c:\fxllffl.exec:\fxllffl.exe48⤵
- Executes dropped EXE
PID:828 -
\??\c:\bbtttt.exec:\bbtttt.exe49⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7nnnhh.exec:\7nnnhh.exe50⤵
- Executes dropped EXE
PID:3376 -
\??\c:\jjdvp.exec:\jjdvp.exe51⤵
- Executes dropped EXE
PID:3552 -
\??\c:\5ddvp.exec:\5ddvp.exe52⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\fxfffff.exec:\fxfffff.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hhhbhn.exec:\hhhbhn.exe55⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ttnntt.exec:\ttnntt.exe56⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pjjdd.exec:\pjjdd.exe57⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jvdvv.exec:\jvdvv.exe58⤵
- Executes dropped EXE
PID:4304 -
\??\c:\lrxxrrf.exec:\lrxxrrf.exe59⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rlffffx.exec:\rlffffx.exe60⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nthtbh.exec:\nthtbh.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hbhhbb.exec:\hbhhbb.exe62⤵
- Executes dropped EXE
PID:556 -
\??\c:\nhnhnn.exec:\nhnhnn.exe63⤵
- Executes dropped EXE
PID:3800 -
\??\c:\1vjjv.exec:\1vjjv.exe64⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jdpvp.exec:\jdpvp.exe65⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rlxxrxf.exec:\rlxxrxf.exe66⤵PID:1704
-
\??\c:\9xllllr.exec:\9xllllr.exe67⤵PID:1648
-
\??\c:\htttnb.exec:\htttnb.exe68⤵PID:3928
-
\??\c:\vvjjd.exec:\vvjjd.exe69⤵PID:1988
-
\??\c:\vvdpj.exec:\vvdpj.exe70⤵PID:1960
-
\??\c:\5lfxlxr.exec:\5lfxlxr.exe71⤵PID:2892
-
\??\c:\xlrlffr.exec:\xlrlffr.exe72⤵PID:60
-
\??\c:\3hbhbh.exec:\3hbhbh.exe73⤵PID:2852
-
\??\c:\dpjjv.exec:\dpjjv.exe74⤵PID:5116
-
\??\c:\vpvpj.exec:\vpvpj.exe75⤵PID:916
-
\??\c:\3llfrrr.exec:\3llfrrr.exe76⤵PID:392
-
\??\c:\bhbttn.exec:\bhbttn.exe77⤵PID:4452
-
\??\c:\5thbhh.exec:\5thbhh.exe78⤵PID:2864
-
\??\c:\dpddv.exec:\dpddv.exe79⤵PID:2988
-
\??\c:\vvjdv.exec:\vvjdv.exe80⤵PID:4676
-
\??\c:\5llxlff.exec:\5llxlff.exe81⤵PID:2964
-
\??\c:\fxffxxx.exec:\fxffxxx.exe82⤵PID:1420
-
\??\c:\nbnnhb.exec:\nbnnhb.exe83⤵PID:3052
-
\??\c:\htnhhn.exec:\htnhhn.exe84⤵PID:4844
-
\??\c:\ddjdd.exec:\ddjdd.exe85⤵PID:752
-
\??\c:\7vvpv.exec:\7vvpv.exe86⤵PID:4320
-
\??\c:\rrxfxfx.exec:\rrxfxfx.exe87⤵PID:2628
-
\??\c:\llrxrrx.exec:\llrxrrx.exe88⤵PID:4368
-
\??\c:\hbnnnt.exec:\hbnnnt.exe89⤵PID:860
-
\??\c:\1nbbbb.exec:\1nbbbb.exe90⤵PID:1080
-
\??\c:\ppvvp.exec:\ppvvp.exe91⤵PID:4340
-
\??\c:\ppvpj.exec:\ppvpj.exe92⤵PID:900
-
\??\c:\fxffrrr.exec:\fxffrrr.exe93⤵PID:1176
-
\??\c:\9thhnn.exec:\9thhnn.exe94⤵PID:1432
-
\??\c:\nhnnnn.exec:\nhnnnn.exe95⤵PID:1180
-
\??\c:\pjpjp.exec:\pjpjp.exe96⤵PID:5096
-
\??\c:\dvvvj.exec:\dvvvj.exe97⤵PID:3712
-
\??\c:\5rfxflx.exec:\5rfxflx.exe98⤵PID:4008
-
\??\c:\rrxllll.exec:\rrxllll.exe99⤵PID:2584
-
\??\c:\lllllrl.exec:\lllllrl.exe100⤵PID:4108
-
\??\c:\nhnnnn.exec:\nhnnnn.exe101⤵PID:4848
-
\??\c:\nhntnn.exec:\nhntnn.exe102⤵PID:696
-
\??\c:\vpjjp.exec:\vpjjp.exe103⤵PID:4896
-
\??\c:\dvdjv.exec:\dvdjv.exe104⤵PID:4384
-
\??\c:\3xlrrrr.exec:\3xlrrrr.exe105⤵PID:4304
-
\??\c:\llllflf.exec:\llllflf.exe106⤵PID:3668
-
\??\c:\bbbbbn.exec:\bbbbbn.exe107⤵PID:2808
-
\??\c:\nhhhth.exec:\nhhhth.exe108⤵PID:1984
-
\??\c:\jjvvp.exec:\jjvvp.exe109⤵PID:556
-
\??\c:\9vdvv.exec:\9vdvv.exe110⤵PID:2944
-
\??\c:\lfxrflf.exec:\lfxrflf.exe111⤵PID:3736
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe112⤵PID:4308
-
\??\c:\nhhhbb.exec:\nhhhbb.exe113⤵PID:4056
-
\??\c:\btnhbb.exec:\btnhbb.exe114⤵PID:4144
-
\??\c:\vvvvd.exec:\vvvvd.exe115⤵PID:1568
-
\??\c:\7vjjp.exec:\7vjjp.exe116⤵PID:1796
-
\??\c:\dvddp.exec:\dvddp.exe117⤵PID:3980
-
\??\c:\rrrfffx.exec:\rrrfffx.exe118⤵PID:2704
-
\??\c:\rrffxxl.exec:\rrffxxl.exe119⤵PID:4344
-
\??\c:\tnbbnn.exec:\tnbbnn.exe120⤵PID:2616
-
\??\c:\1jvvp.exec:\1jvvp.exe121⤵PID:5116
-
\??\c:\vjppd.exec:\vjppd.exe122⤵PID:4668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-