Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe
-
Size
75KB
-
MD5
0382fbb94d4a1ee4e9f47ead7877afbf
-
SHA1
5c995479ff52d5a6136940365ab72f5add3fac49
-
SHA256
245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed
-
SHA512
41fc372d3cdab91985742a9d50c4c82b022eb1b14b3191e3a254e987f02b6c80c29b1ffc7598aba3ba43be9cf8c5249d78cb00e726aa115d9faa6a7771d29da4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINHB:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCuj
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3616-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral2/memory/3616-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1756-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4972-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1484-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2288-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1320-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4352-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2320-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1572-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1944-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4260-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4732-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3096-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1468-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/944-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/640-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4120-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2452-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1216-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1960-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1756 nhbbnt.exe 4972 dvjpp.exe 1484 rrlfxxr.exe 228 jjppv.exe 1944 lxllfll.exe 2268 rllxxxf.exe 1896 tnnnhn.exe 2320 dppjd.exe 2288 1djdp.exe 4352 lfxlxxr.exe 1320 rrlffxx.exe 1572 hbttnt.exe 2236 vddpv.exe 4260 frlfxxr.exe 1408 nnbntn.exe 4732 vjpjj.exe 3096 xflxlxf.exe 3460 bhhhtt.exe 1468 bntbbh.exe 944 dvvpj.exe 640 3fffxxl.exe 4120 htthnh.exe 4932 dvpdp.exe 4340 vpdvv.exe 2452 xlrrrrr.exe 4640 vpddd.exe 1216 5ffffff.exe 812 lrfxffx.exe 4080 7nnnnn.exe 1960 jdddp.exe 5036 xxxxlxx.exe 1836 jdpvp.exe 1592 dvpvp.exe 3016 9jppv.exe 1804 xfxxxxx.exe 4084 lffrlll.exe 3492 nbnnbh.exe 4320 pjpjd.exe 3364 ppdvj.exe 2652 lxrxrrr.exe 2992 rlrrrll.exe 5060 tntnbb.exe 4216 3nbbbh.exe 4788 pjppd.exe 1968 rfrlrrr.exe 4976 9fxxrxr.exe 3212 hnnbbb.exe 2116 jppvj.exe 1560 dvddd.exe 2288 5xxrrlx.exe 856 9htttt.exe 3048 vjjdd.exe 4852 dpppv.exe 3352 llfxllx.exe 1720 fxffflr.exe 4644 bhhttn.exe 4336 pvjvd.exe 1012 jdjdv.exe 1988 xxrflxl.exe 2044 7xllrxf.exe 1976 3hnnhh.exe 1068 tttnnt.exe 4252 lfxrffx.exe 3344 1bhhhn.exe -
resource yara_rule behavioral2/memory/3616-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 1756 3616 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 83 PID 3616 wrote to memory of 1756 3616 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 83 PID 3616 wrote to memory of 1756 3616 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 83 PID 1756 wrote to memory of 4972 1756 nhbbnt.exe 84 PID 1756 wrote to memory of 4972 1756 nhbbnt.exe 84 PID 1756 wrote to memory of 4972 1756 nhbbnt.exe 84 PID 4972 wrote to memory of 1484 4972 dvjpp.exe 85 PID 4972 wrote to memory of 1484 4972 dvjpp.exe 85 PID 4972 wrote to memory of 1484 4972 dvjpp.exe 85 PID 1484 wrote to memory of 228 1484 rrlfxxr.exe 86 PID 1484 wrote to memory of 228 1484 rrlfxxr.exe 86 PID 1484 wrote to memory of 228 1484 rrlfxxr.exe 86 PID 228 wrote to memory of 1944 228 jjppv.exe 87 PID 228 wrote to memory of 1944 228 jjppv.exe 87 PID 228 wrote to memory of 1944 228 jjppv.exe 87 PID 1944 wrote to memory of 2268 1944 lxllfll.exe 88 PID 1944 wrote to memory of 2268 1944 lxllfll.exe 88 PID 1944 wrote to memory of 2268 1944 lxllfll.exe 88 PID 2268 wrote to memory of 1896 2268 rllxxxf.exe 89 PID 2268 wrote to memory of 1896 2268 rllxxxf.exe 89 PID 2268 wrote to memory of 1896 2268 rllxxxf.exe 89 PID 1896 wrote to memory of 2320 1896 tnnnhn.exe 90 PID 1896 wrote to memory of 2320 1896 tnnnhn.exe 90 PID 1896 wrote to memory of 2320 1896 tnnnhn.exe 90 PID 2320 wrote to memory of 2288 2320 dppjd.exe 91 PID 2320 wrote to memory of 2288 2320 dppjd.exe 91 PID 2320 wrote to memory of 2288 2320 dppjd.exe 91 PID 2288 wrote to memory of 4352 2288 1djdp.exe 92 PID 2288 wrote to memory of 4352 2288 1djdp.exe 92 PID 2288 wrote to memory of 4352 2288 1djdp.exe 92 PID 4352 wrote to memory of 1320 4352 lfxlxxr.exe 93 PID 4352 wrote to memory of 1320 4352 lfxlxxr.exe 93 PID 4352 wrote to memory of 1320 4352 lfxlxxr.exe 93 PID 1320 wrote to memory of 1572 1320 rrlffxx.exe 94 PID 1320 wrote to memory of 1572 1320 rrlffxx.exe 94 PID 1320 wrote to memory of 1572 1320 rrlffxx.exe 94 PID 1572 wrote to memory of 2236 1572 hbttnt.exe 95 PID 1572 wrote to memory of 2236 1572 hbttnt.exe 95 PID 1572 wrote to memory of 2236 1572 hbttnt.exe 95 PID 2236 wrote to memory of 4260 2236 vddpv.exe 96 PID 2236 wrote to memory of 4260 2236 vddpv.exe 96 PID 2236 wrote to memory of 4260 2236 vddpv.exe 96 PID 4260 wrote to memory of 1408 4260 frlfxxr.exe 97 PID 4260 wrote to memory of 1408 4260 frlfxxr.exe 97 PID 4260 wrote to memory of 1408 4260 frlfxxr.exe 97 PID 1408 wrote to memory of 4732 1408 nnbntn.exe 98 PID 1408 wrote to memory of 4732 1408 nnbntn.exe 98 PID 1408 wrote to memory of 4732 1408 nnbntn.exe 98 PID 4732 wrote to memory of 3096 4732 vjpjj.exe 99 PID 4732 wrote to memory of 3096 4732 vjpjj.exe 99 PID 4732 wrote to memory of 3096 4732 vjpjj.exe 99 PID 3096 wrote to memory of 3460 3096 xflxlxf.exe 100 PID 3096 wrote to memory of 3460 3096 xflxlxf.exe 100 PID 3096 wrote to memory of 3460 3096 xflxlxf.exe 100 PID 3460 wrote to memory of 1468 3460 bhhhtt.exe 101 PID 3460 wrote to memory of 1468 3460 bhhhtt.exe 101 PID 3460 wrote to memory of 1468 3460 bhhhtt.exe 101 PID 1468 wrote to memory of 944 1468 bntbbh.exe 102 PID 1468 wrote to memory of 944 1468 bntbbh.exe 102 PID 1468 wrote to memory of 944 1468 bntbbh.exe 102 PID 944 wrote to memory of 640 944 dvvpj.exe 103 PID 944 wrote to memory of 640 944 dvvpj.exe 103 PID 944 wrote to memory of 640 944 dvvpj.exe 103 PID 640 wrote to memory of 4120 640 3fffxxl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe"C:\Users\Admin\AppData\Local\Temp\245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\nhbbnt.exec:\nhbbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\dvjpp.exec:\dvjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\jjppv.exec:\jjppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\lxllfll.exec:\lxllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rllxxxf.exec:\rllxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\tnnnhn.exec:\tnnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\dppjd.exec:\dppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\1djdp.exec:\1djdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\rrlffxx.exec:\rrlffxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\hbttnt.exec:\hbttnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vddpv.exec:\vddpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\frlfxxr.exec:\frlfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\nnbntn.exec:\nnbntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\vjpjj.exec:\vjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\xflxlxf.exec:\xflxlxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\bhhhtt.exec:\bhhhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\bntbbh.exec:\bntbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\dvvpj.exec:\dvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\3fffxxl.exec:\3fffxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\htthnh.exec:\htthnh.exe23⤵
- Executes dropped EXE
PID:4120 -
\??\c:\dvpdp.exec:\dvpdp.exe24⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vpdvv.exec:\vpdvv.exe25⤵
- Executes dropped EXE
PID:4340 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vpddd.exec:\vpddd.exe27⤵
- Executes dropped EXE
PID:4640 -
\??\c:\5ffffff.exec:\5ffffff.exe28⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lrfxffx.exec:\lrfxffx.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\7nnnnn.exec:\7nnnnn.exe30⤵
- Executes dropped EXE
PID:4080 -
\??\c:\jdddp.exec:\jdddp.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xxxxlxx.exec:\xxxxlxx.exe32⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jdpvp.exec:\jdpvp.exe33⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dvpvp.exec:\dvpvp.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9jppv.exec:\9jppv.exe35⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe36⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lffrlll.exec:\lffrlll.exe37⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nbnnbh.exec:\nbnnbh.exe38⤵
- Executes dropped EXE
PID:3492 -
\??\c:\pjpjd.exec:\pjpjd.exe39⤵
- Executes dropped EXE
PID:4320 -
\??\c:\ppdvj.exec:\ppdvj.exe40⤵
- Executes dropped EXE
PID:3364 -
\??\c:\lxrxrrr.exec:\lxrxrrr.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlrrrll.exec:\rlrrrll.exe42⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tntnbb.exec:\tntnbb.exe43⤵
- Executes dropped EXE
PID:5060 -
\??\c:\3nbbbh.exec:\3nbbbh.exe44⤵
- Executes dropped EXE
PID:4216 -
\??\c:\pjppd.exec:\pjppd.exe45⤵
- Executes dropped EXE
PID:4788 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9fxxrxr.exec:\9fxxrxr.exe47⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hnnbbb.exec:\hnnbbb.exe48⤵
- Executes dropped EXE
PID:3212 -
\??\c:\jppvj.exec:\jppvj.exe49⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dvddd.exec:\dvddd.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\5xxrrlx.exec:\5xxrrlx.exe51⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9htttt.exec:\9htttt.exe52⤵
- Executes dropped EXE
PID:856 -
\??\c:\vjjdd.exec:\vjjdd.exe53⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dpppv.exec:\dpppv.exe54⤵
- Executes dropped EXE
PID:4852 -
\??\c:\llfxllx.exec:\llfxllx.exe55⤵
- Executes dropped EXE
PID:3352 -
\??\c:\fxffflr.exec:\fxffflr.exe56⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bhhttn.exec:\bhhttn.exe57⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pvjvd.exec:\pvjvd.exe58⤵
- Executes dropped EXE
PID:4336 -
\??\c:\jdjdv.exec:\jdjdv.exe59⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xxrflxl.exec:\xxrflxl.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7xllrxf.exec:\7xllrxf.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3hnnhh.exec:\3hnnhh.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tttnnt.exec:\tttnnt.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\lfxrffx.exec:\lfxrffx.exe64⤵
- Executes dropped EXE
PID:4252 -
\??\c:\1bhhhn.exec:\1bhhhn.exe65⤵
- Executes dropped EXE
PID:3344 -
\??\c:\bhbhtn.exec:\bhbhtn.exe66⤵PID:2232
-
\??\c:\pjpdv.exec:\pjpdv.exe67⤵PID:4824
-
\??\c:\pjpdd.exec:\pjpdd.exe68⤵PID:3056
-
\??\c:\xxllrxf.exec:\xxllrxf.exe69⤵PID:3644
-
\??\c:\lrlrrlr.exec:\lrlrrlr.exe70⤵PID:1216
-
\??\c:\ttnttn.exec:\ttnttn.exe71⤵PID:2808
-
\??\c:\vpdjd.exec:\vpdjd.exe72⤵PID:2392
-
\??\c:\3vvvj.exec:\3vvvj.exe73⤵PID:1728
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe74⤵PID:3172
-
\??\c:\thttbt.exec:\thttbt.exe75⤵PID:1312
-
\??\c:\ppdvp.exec:\ppdvp.exe76⤵PID:3000
-
\??\c:\rllxlff.exec:\rllxlff.exe77⤵PID:644
-
\??\c:\fflrrxr.exec:\fflrrxr.exe78⤵PID:3016
-
\??\c:\bbhntt.exec:\bbhntt.exe79⤵PID:3832
-
\??\c:\hbhhbb.exec:\hbhhbb.exe80⤵PID:1420
-
\??\c:\pdddv.exec:\pdddv.exe81⤵PID:4408
-
\??\c:\pjppp.exec:\pjppp.exe82⤵PID:3364
-
\??\c:\1rxrffl.exec:\1rxrffl.exe83⤵PID:1280
-
\??\c:\rxrlllx.exec:\rxrlllx.exe84⤵PID:2992
-
\??\c:\hnhbbb.exec:\hnhbbb.exe85⤵PID:1712
-
\??\c:\jjdjv.exec:\jjdjv.exe86⤵PID:4216
-
\??\c:\vpddv.exec:\vpddv.exe87⤵PID:2268
-
\??\c:\rrfffxr.exec:\rrfffxr.exe88⤵PID:2796
-
\??\c:\xrfxxfx.exec:\xrfxxfx.exe89⤵PID:3840
-
\??\c:\9bnntb.exec:\9bnntb.exe90⤵PID:3068
-
\??\c:\1bnhtt.exec:\1bnhtt.exe91⤵PID:2792
-
\??\c:\pjjjd.exec:\pjjjd.exe92⤵PID:1764
-
\??\c:\3jpjd.exec:\3jpjd.exe93⤵PID:1572
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe94⤵PID:3988
-
\??\c:\rllxfrx.exec:\rllxfrx.exe95⤵PID:3784
-
\??\c:\7hnhhh.exec:\7hnhhh.exe96⤵PID:1380
-
\??\c:\hbtbtn.exec:\hbtbtn.exe97⤵PID:3752
-
\??\c:\pdpjp.exec:\pdpjp.exe98⤵PID:2812
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe99⤵PID:1912
-
\??\c:\frxffff.exec:\frxffff.exe100⤵PID:1444
-
\??\c:\nbhnnn.exec:\nbhnnn.exe101⤵PID:3096
-
\??\c:\thbhbh.exec:\thbhbh.exe102⤵PID:3264
-
\??\c:\jpvvp.exec:\jpvvp.exe103⤵PID:4200
-
\??\c:\vdjpp.exec:\vdjpp.exe104⤵PID:944
-
\??\c:\5flflll.exec:\5flflll.exe105⤵PID:640
-
\??\c:\tnntnn.exec:\tnntnn.exe106⤵PID:3084
-
\??\c:\bttntt.exec:\bttntt.exe107⤵PID:4932
-
\??\c:\vjjvj.exec:\vjjvj.exe108⤵PID:4340
-
\??\c:\vpjdv.exec:\vpjdv.exe109⤵PID:2452
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe110⤵PID:3136
-
\??\c:\rffxlfx.exec:\rffxlfx.exe111⤵PID:4280
-
\??\c:\thnnhh.exec:\thnnhh.exe112⤵PID:812
-
\??\c:\3bhtnn.exec:\3bhtnn.exe113⤵PID:3416
-
\??\c:\vvdpj.exec:\vvdpj.exe114⤵PID:3580
-
\??\c:\ffrrfxl.exec:\ffrrfxl.exe115⤵PID:1640
-
\??\c:\xlllfff.exec:\xlllfff.exe116⤵PID:3304
-
\??\c:\5nhhhh.exec:\5nhhhh.exe117⤵PID:1312
-
\??\c:\nntthh.exec:\nntthh.exe118⤵PID:1600
-
\??\c:\1pvvp.exec:\1pvvp.exe119⤵PID:4528
-
\??\c:\3rfxlfl.exec:\3rfxlfl.exe120⤵PID:2520
-
\??\c:\rxfrxrx.exec:\rxfrxrx.exe121⤵PID:2380
-
\??\c:\bnbttb.exec:\bnbttb.exe122⤵PID:4916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-