Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe
-
Size
460KB
-
MD5
05614c8e267c7d6f56705b58d2d89b2e
-
SHA1
0e7f5fac319def89a96f1439cd749f068afc7c70
-
SHA256
1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317
-
SHA512
77b38f29c407e15c3bbd77bdf67c5403c3e6cb7f6d7c0e2f49c2a4d2f468fed9f47a3e4a654a411f8e58d2692046849bd384c86b18215141030627b2bc70cb70
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/TJTaYvMmr3C9BRo7tvnJ9Fywhk/Tkh:n3C9ytvn8whkbJTaFmr3C9ytvn8whkbW
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3616-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 35 IoCs
resource yara_rule behavioral2/memory/3616-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2108-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1984-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3168-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1340-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1604-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2704-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4784-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1560-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1560-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1560-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1560-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2756-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3564-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4024-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4536-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1724-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1548-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2604-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4520-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1532-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5108-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/680-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3424-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3540-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3304-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3172-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/556-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4048-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2108 9vjdd.exe 1984 bthbhb.exe 3168 jdppv.exe 1340 fxrlffx.exe 1604 1lrrlrl.exe 2704 thhbbb.exe 4808 pjvpv.exe 4784 bnhhbb.exe 1560 fxrlrrx.exe 3316 9djdj.exe 4348 9tbttt.exe 4500 vpdvv.exe 2756 tbhbtn.exe 3564 7dpjp.exe 4024 frrlffx.exe 3260 frrlfxl.exe 4536 1vvvj.exe 1724 xrxxllr.exe 1548 tthbbb.exe 4520 fxfxxxx.exe 1532 bbnhtt.exe 2604 jvddj.exe 5108 ffrrxxf.exe 680 vjppj.exe 3424 fxlllff.exe 3540 3ttnhb.exe 3172 7rffxrr.exe 3304 nthhhb.exe 116 vjjdv.exe 556 5jjdd.exe 4048 rxrfxxx.exe 4532 7xrlxxf.exe 3660 rrlfffx.exe 1388 5lrlffx.exe 1860 nthhhh.exe 1540 jjjpj.exe 752 frffffx.exe 764 nthhhb.exe 5032 vjddj.exe 2468 dvdpp.exe 736 xxfffff.exe 1692 nhtntt.exe 1508 dddvp.exe 1680 djvvj.exe 4784 7xfxxff.exe 3900 hbtbbb.exe 4492 9djdp.exe 1764 rfrrffr.exe 2996 tbhbtn.exe 3752 vddvp.exe 4500 7pvjv.exe 4416 llrlfxr.exe 2860 vjvvv.exe 3228 jpdpp.exe 2428 llxrlll.exe 1980 ttbbhh.exe 4772 vjpjd.exe 1976 fxxxrrl.exe 3080 bhnhbb.exe 2232 7ddvp.exe 60 xllfxxx.exe 4592 btttbb.exe 4740 bhbtnn.exe 4780 jjdvv.exe -
resource yara_rule behavioral2/memory/3616-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 2108 3616 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 83 PID 3616 wrote to memory of 2108 3616 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 83 PID 3616 wrote to memory of 2108 3616 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 83 PID 2108 wrote to memory of 1984 2108 9vjdd.exe 84 PID 2108 wrote to memory of 1984 2108 9vjdd.exe 84 PID 2108 wrote to memory of 1984 2108 9vjdd.exe 84 PID 1984 wrote to memory of 3168 1984 bthbhb.exe 85 PID 1984 wrote to memory of 3168 1984 bthbhb.exe 85 PID 1984 wrote to memory of 3168 1984 bthbhb.exe 85 PID 3168 wrote to memory of 1340 3168 jdppv.exe 86 PID 3168 wrote to memory of 1340 3168 jdppv.exe 86 PID 3168 wrote to memory of 1340 3168 jdppv.exe 86 PID 1340 wrote to memory of 1604 1340 fxrlffx.exe 87 PID 1340 wrote to memory of 1604 1340 fxrlffx.exe 87 PID 1340 wrote to memory of 1604 1340 fxrlffx.exe 87 PID 1604 wrote to memory of 2704 1604 1lrrlrl.exe 88 PID 1604 wrote to memory of 2704 1604 1lrrlrl.exe 88 PID 1604 wrote to memory of 2704 1604 1lrrlrl.exe 88 PID 2704 wrote to memory of 4808 2704 thhbbb.exe 89 PID 2704 wrote to memory of 4808 2704 thhbbb.exe 89 PID 2704 wrote to memory of 4808 2704 thhbbb.exe 89 PID 4808 wrote to memory of 4784 4808 pjvpv.exe 90 PID 4808 wrote to memory of 4784 4808 pjvpv.exe 90 PID 4808 wrote to memory of 4784 4808 pjvpv.exe 90 PID 4784 wrote to memory of 1560 4784 bnhhbb.exe 91 PID 4784 wrote to memory of 1560 4784 bnhhbb.exe 91 PID 4784 wrote to memory of 1560 4784 bnhhbb.exe 91 PID 1560 wrote to memory of 3316 1560 fxrlrrx.exe 92 PID 1560 wrote to memory of 3316 1560 fxrlrrx.exe 92 PID 1560 wrote to memory of 3316 1560 fxrlrrx.exe 92 PID 3316 wrote to memory of 4348 3316 9djdj.exe 93 PID 3316 wrote to memory of 4348 3316 9djdj.exe 93 PID 3316 wrote to memory of 4348 3316 9djdj.exe 93 PID 4348 wrote to memory of 4500 4348 9tbttt.exe 94 PID 4348 wrote to memory of 4500 4348 9tbttt.exe 94 PID 4348 wrote to memory of 4500 4348 9tbttt.exe 94 PID 4500 wrote to memory of 2756 4500 vpdvv.exe 95 PID 4500 wrote to memory of 2756 4500 vpdvv.exe 95 PID 4500 wrote to memory of 2756 4500 vpdvv.exe 95 PID 2756 wrote to memory of 3564 2756 tbhbtn.exe 96 PID 2756 wrote to memory of 3564 2756 tbhbtn.exe 96 PID 2756 wrote to memory of 3564 2756 tbhbtn.exe 96 PID 3564 wrote to memory of 4024 3564 7dpjp.exe 97 PID 3564 wrote to memory of 4024 3564 7dpjp.exe 97 PID 3564 wrote to memory of 4024 3564 7dpjp.exe 97 PID 4024 wrote to memory of 3260 4024 frrlffx.exe 98 PID 4024 wrote to memory of 3260 4024 frrlffx.exe 98 PID 4024 wrote to memory of 3260 4024 frrlffx.exe 98 PID 3260 wrote to memory of 4536 3260 frrlfxl.exe 99 PID 3260 wrote to memory of 4536 3260 frrlfxl.exe 99 PID 3260 wrote to memory of 4536 3260 frrlfxl.exe 99 PID 4536 wrote to memory of 1724 4536 1vvvj.exe 100 PID 4536 wrote to memory of 1724 4536 1vvvj.exe 100 PID 4536 wrote to memory of 1724 4536 1vvvj.exe 100 PID 1724 wrote to memory of 1548 1724 xrxxllr.exe 102 PID 1724 wrote to memory of 1548 1724 xrxxllr.exe 102 PID 1724 wrote to memory of 1548 1724 xrxxllr.exe 102 PID 1548 wrote to memory of 4520 1548 tthbbb.exe 103 PID 1548 wrote to memory of 4520 1548 tthbbb.exe 103 PID 1548 wrote to memory of 4520 1548 tthbbb.exe 103 PID 4520 wrote to memory of 1532 4520 fxfxxxx.exe 104 PID 4520 wrote to memory of 1532 4520 fxfxxxx.exe 104 PID 4520 wrote to memory of 1532 4520 fxfxxxx.exe 104 PID 1532 wrote to memory of 2604 1532 bbnhtt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe"C:\Users\Admin\AppData\Local\Temp\1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\9vjdd.exec:\9vjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\bthbhb.exec:\bthbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jdppv.exec:\jdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\fxrlffx.exec:\fxrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\1lrrlrl.exec:\1lrrlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\thhbbb.exec:\thhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pjvpv.exec:\pjvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\bnhhbb.exec:\bnhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\9djdj.exec:\9djdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\9tbttt.exec:\9tbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\vpdvv.exec:\vpdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\tbhbtn.exec:\tbhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7dpjp.exec:\7dpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\frrlffx.exec:\frrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\frrlfxl.exec:\frrlfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\1vvvj.exec:\1vvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\xrxxllr.exec:\xrxxllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\tthbbb.exec:\tthbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\bbnhtt.exec:\bbnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jvddj.exec:\jvddj.exe23⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe24⤵
- Executes dropped EXE
PID:5108 -
\??\c:\vjppj.exec:\vjppj.exe25⤵
- Executes dropped EXE
PID:680 -
\??\c:\fxlllff.exec:\fxlllff.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3ttnhb.exec:\3ttnhb.exe27⤵
- Executes dropped EXE
PID:3540 -
\??\c:\7rffxrr.exec:\7rffxrr.exe28⤵
- Executes dropped EXE
PID:3172 -
\??\c:\nthhhb.exec:\nthhhb.exe29⤵
- Executes dropped EXE
PID:3304 -
\??\c:\vjjdv.exec:\vjjdv.exe30⤵
- Executes dropped EXE
PID:116 -
\??\c:\5jjdd.exec:\5jjdd.exe31⤵
- Executes dropped EXE
PID:556 -
\??\c:\rxrfxxx.exec:\rxrfxxx.exe32⤵
- Executes dropped EXE
PID:4048 -
\??\c:\7xrlxxf.exec:\7xrlxxf.exe33⤵
- Executes dropped EXE
PID:4532 -
\??\c:\rrlfffx.exec:\rrlfffx.exe34⤵
- Executes dropped EXE
PID:3660 -
\??\c:\5lrlffx.exec:\5lrlffx.exe35⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nthhhh.exec:\nthhhh.exe36⤵
- Executes dropped EXE
PID:1860 -
\??\c:\jjjpj.exec:\jjjpj.exe37⤵
- Executes dropped EXE
PID:1540 -
\??\c:\frffffx.exec:\frffffx.exe38⤵
- Executes dropped EXE
PID:752 -
\??\c:\nthhhb.exec:\nthhhb.exe39⤵
- Executes dropped EXE
PID:764 -
\??\c:\vjddj.exec:\vjddj.exe40⤵
- Executes dropped EXE
PID:5032 -
\??\c:\dvdpp.exec:\dvdpp.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xxfffff.exec:\xxfffff.exe42⤵
- Executes dropped EXE
PID:736 -
\??\c:\nhtntt.exec:\nhtntt.exe43⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dddvp.exec:\dddvp.exe44⤵
- Executes dropped EXE
PID:1508 -
\??\c:\djvvj.exec:\djvvj.exe45⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7xfxxff.exec:\7xfxxff.exe46⤵
- Executes dropped EXE
PID:4784 -
\??\c:\hbtbbb.exec:\hbtbbb.exe47⤵
- Executes dropped EXE
PID:3900 -
\??\c:\9djdp.exec:\9djdp.exe48⤵
- Executes dropped EXE
PID:4492 -
\??\c:\rfrrffr.exec:\rfrrffr.exe49⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tbhbtn.exec:\tbhbtn.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vddvp.exec:\vddvp.exe51⤵
- Executes dropped EXE
PID:3752 -
\??\c:\7pvjv.exec:\7pvjv.exe52⤵
- Executes dropped EXE
PID:4500 -
\??\c:\llrlfxr.exec:\llrlfxr.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vjvvv.exec:\vjvvv.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jpdpp.exec:\jpdpp.exe55⤵
- Executes dropped EXE
PID:3228 -
\??\c:\llxrlll.exec:\llxrlll.exe56⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ttbbhh.exec:\ttbbhh.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vjpjd.exec:\vjpjd.exe58⤵
- Executes dropped EXE
PID:4772 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe59⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bhnhbb.exec:\bhnhbb.exe60⤵
- Executes dropped EXE
PID:3080 -
\??\c:\7ddvp.exec:\7ddvp.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xllfxxx.exec:\xllfxxx.exe62⤵
- Executes dropped EXE
PID:60 -
\??\c:\btttbb.exec:\btttbb.exe63⤵
- Executes dropped EXE
PID:4592 -
\??\c:\bhbtnn.exec:\bhbtnn.exe64⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jjdvv.exec:\jjdvv.exe65⤵
- Executes dropped EXE
PID:4780 -
\??\c:\xfllffr.exec:\xfllffr.exe66⤵PID:1108
-
\??\c:\tnhhbh.exec:\tnhhbh.exe67⤵PID:812
-
\??\c:\hbhbbb.exec:\hbhbbb.exe68⤵PID:4764
-
\??\c:\pddjv.exec:\pddjv.exe69⤵PID:1084
-
\??\c:\frfxrrl.exec:\frfxrrl.exe70⤵PID:1872
-
\??\c:\hbbbbb.exec:\hbbbbb.exe71⤵PID:3832
-
\??\c:\5vvpd.exec:\5vvpd.exe72⤵PID:4228
-
\??\c:\rfrllll.exec:\rfrllll.exe73⤵PID:1644
-
\??\c:\fxxrrll.exec:\fxxrrll.exe74⤵PID:3112
-
\??\c:\tnbttb.exec:\tnbttb.exe75⤵PID:1804
-
\??\c:\jvjjd.exec:\jvjjd.exe76⤵PID:3364
-
\??\c:\vppdd.exec:\vppdd.exe77⤵PID:3376
-
\??\c:\fffllll.exec:\fffllll.exe78⤵PID:1280
-
\??\c:\tthnhh.exec:\tthnhh.exe79⤵PID:4452
-
\??\c:\nnnhbt.exec:\nnnhbt.exe80⤵PID:2972
-
\??\c:\vjdvp.exec:\vjdvp.exe81⤵PID:1020
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe82⤵PID:3840
-
\??\c:\hbnhnh.exec:\hbnhnh.exe83⤵PID:3560
-
\??\c:\5nbtnt.exec:\5nbtnt.exe84⤵PID:3340
-
\??\c:\vjjdv.exec:\vjjdv.exe85⤵PID:1968
-
\??\c:\jjdvv.exec:\jjdvv.exe86⤵PID:2116
-
\??\c:\9flfxrl.exec:\9flfxrl.exe87⤵PID:4700
-
\??\c:\tbhbtn.exec:\tbhbtn.exe88⤵PID:1508
-
\??\c:\3bbthh.exec:\3bbthh.exe89⤵PID:3636
-
\??\c:\jdvpp.exec:\jdvpp.exe90⤵PID:1560
-
\??\c:\ffllfrl.exec:\ffllfrl.exe91⤵PID:3200
-
\??\c:\rlxxffx.exec:\rlxxffx.exe92⤵PID:4852
-
\??\c:\bttntn.exec:\bttntn.exe93⤵PID:4644
-
\??\c:\pdjdv.exec:\pdjdv.exe94⤵PID:760
-
\??\c:\jjvvv.exec:\jjvvv.exe95⤵PID:1344
-
\??\c:\rflllff.exec:\rflllff.exe96⤵PID:852
-
\??\c:\9nhhbb.exec:\9nhhbb.exe97⤵PID:1296
-
\??\c:\bhthht.exec:\bhthht.exe98⤵PID:2976
-
\??\c:\vpvpv.exec:\vpvpv.exe99⤵PID:1976
-
\??\c:\9fxrrrl.exec:\9fxrrrl.exe100⤵PID:2592
-
\??\c:\llffxfx.exec:\llffxfx.exe101⤵PID:4340
-
\??\c:\hhnhbb.exec:\hhnhbb.exe102⤵PID:3220
-
\??\c:\ntbhhn.exec:\ntbhhn.exe103⤵PID:4740
-
\??\c:\jdvvj.exec:\jdvvj.exe104⤵PID:3324
-
\??\c:\rfllfff.exec:\rfllfff.exe105⤵PID:4080
-
\??\c:\tbbbbn.exec:\tbbbbn.exe106⤵PID:1960
-
\??\c:\3pdvp.exec:\3pdvp.exe107⤵PID:3804
-
\??\c:\3flffff.exec:\3flffff.exe108⤵PID:1404
-
\??\c:\nhhbtt.exec:\nhhbtt.exe109⤵PID:4616
-
\??\c:\nntnbt.exec:\nntnbt.exe110⤵PID:1044
-
\??\c:\pddvv.exec:\pddvv.exe111⤵PID:4448
-
\??\c:\flrrlrl.exec:\flrrlrl.exe112⤵PID:4528
-
\??\c:\nntnhb.exec:\nntnhb.exe113⤵PID:2884
-
\??\c:\1ppvj.exec:\1ppvj.exe114⤵PID:3376
-
\??\c:\7lrlllf.exec:\7lrlllf.exe115⤵PID:1280
-
\??\c:\bttttt.exec:\bttttt.exe116⤵PID:4452
-
\??\c:\bhnhhb.exec:\bhnhhb.exe117⤵PID:3924
-
\??\c:\pvpjj.exec:\pvpjj.exe118⤵PID:1020
-
\??\c:\xrllrll.exec:\xrllrll.exe119⤵PID:1712
-
\??\c:\ntbbtn.exec:\ntbbtn.exe120⤵PID:1456
-
\??\c:\pjvpp.exec:\pjvpp.exe121⤵PID:2320
-
\??\c:\9rxrrll.exec:\9rxrrll.exe122⤵PID:1968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-