Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 00:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe
-
Size
78KB
-
MD5
8e380aaa624d1485e3c6c4b598fec408
-
SHA1
3be3eb4b716930567c597d1fe6f8eb9003000222
-
SHA256
9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde
-
SHA512
9751dbe1646640b46f30c28e40a0d4e395f38bda492ad4cdc70b3f51fe4592a6bcb52370d23563a8de4e3aa598858e05ba5505f1519c73ce8a6f9c7d05a3c317
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdc1:ymb3NkkiQ3mdBjFo68YBVIJc9Jtx1
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3676-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-57-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/3676-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2400-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1924-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3960-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3440-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/664-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4248-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1280-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3640-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3044-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4432-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3840-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4488-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1928-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1368-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4732-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1852-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3788-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1092-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2400 rxxxxfl.exe 1924 nttbbh.exe 3960 lfllffl.exe 3440 bbhhnn.exe 664 jjdjp.exe 404 rffrrrl.exe 4248 hhbnnn.exe 3288 vjjdd.exe 1540 lfxrllf.exe 1280 ntnntb.exe 464 ddddv.exe 3640 lfflfrl.exe 3868 bhhhnt.exe 3044 bnnntb.exe 4432 7jpjj.exe 3840 7djdd.exe 4488 lflfxxr.exe 4200 btbttt.exe 4724 jdpvp.exe 1928 vjjjj.exe 4684 llrlrrx.exe 2272 tbbtbn.exe 1368 vpdpp.exe 4848 llxrfff.exe 4316 lfrrxfl.exe 4732 btnnhh.exe 4184 pjjvp.exe 1852 3rlfrrr.exe 2312 rrffllx.exe 3788 jddvv.exe 1092 ffrxfll.exe 3496 btbnnn.exe 936 9jddd.exe 1448 jdddp.exe 3904 lllffff.exe 5080 nbhhnn.exe 3660 nhhhhh.exe 620 dvddd.exe 4504 rfxxffl.exe 208 xxlrffx.exe 1956 btbbtt.exe 3116 jddvj.exe 776 ddjdd.exe 2596 rrfxrrr.exe 1056 thhhtt.exe 4356 tnnnhh.exe 4652 djjjv.exe 3708 lrrrlff.exe 4216 xflllll.exe 848 bbbttn.exe 2384 dpvvv.exe 2456 9htnnb.exe 2744 bbthtt.exe 1624 vvjdv.exe 1644 jjpjv.exe 1392 lflffff.exe 4804 nhnhnh.exe 932 jjvvv.exe 3256 vjjdv.exe 4672 rfffxrr.exe 624 1ttnnn.exe 2012 5ttnhh.exe 1760 jdddv.exe 2408 jdppp.exe -
resource yara_rule behavioral2/memory/3676-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 2400 3676 9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe 83 PID 3676 wrote to memory of 2400 3676 9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe 83 PID 3676 wrote to memory of 2400 3676 9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe 83 PID 2400 wrote to memory of 1924 2400 rxxxxfl.exe 84 PID 2400 wrote to memory of 1924 2400 rxxxxfl.exe 84 PID 2400 wrote to memory of 1924 2400 rxxxxfl.exe 84 PID 1924 wrote to memory of 3960 1924 nttbbh.exe 85 PID 1924 wrote to memory of 3960 1924 nttbbh.exe 85 PID 1924 wrote to memory of 3960 1924 nttbbh.exe 85 PID 3960 wrote to memory of 3440 3960 lfllffl.exe 86 PID 3960 wrote to memory of 3440 3960 lfllffl.exe 86 PID 3960 wrote to memory of 3440 3960 lfllffl.exe 86 PID 3440 wrote to memory of 664 3440 bbhhnn.exe 87 PID 3440 wrote to memory of 664 3440 bbhhnn.exe 87 PID 3440 wrote to memory of 664 3440 bbhhnn.exe 87 PID 664 wrote to memory of 404 664 jjdjp.exe 88 PID 664 wrote to memory of 404 664 jjdjp.exe 88 PID 664 wrote to memory of 404 664 jjdjp.exe 88 PID 404 wrote to memory of 4248 404 rffrrrl.exe 89 PID 404 wrote to memory of 4248 404 rffrrrl.exe 89 PID 404 wrote to memory of 4248 404 rffrrrl.exe 89 PID 4248 wrote to memory of 3288 4248 hhbnnn.exe 90 PID 4248 wrote to memory of 3288 4248 hhbnnn.exe 90 PID 4248 wrote to memory of 3288 4248 hhbnnn.exe 90 PID 3288 wrote to memory of 1540 3288 vjjdd.exe 91 PID 3288 wrote to memory of 1540 3288 vjjdd.exe 91 PID 3288 wrote to memory of 1540 3288 vjjdd.exe 91 PID 1540 wrote to memory of 1280 1540 lfxrllf.exe 92 PID 1540 wrote to memory of 1280 1540 lfxrllf.exe 92 PID 1540 wrote to memory of 1280 1540 lfxrllf.exe 92 PID 1280 wrote to memory of 464 1280 ntnntb.exe 93 PID 1280 wrote to memory of 464 1280 ntnntb.exe 93 PID 1280 wrote to memory of 464 1280 ntnntb.exe 93 PID 464 wrote to memory of 3640 464 ddddv.exe 94 PID 464 wrote to memory of 3640 464 ddddv.exe 94 PID 464 wrote to memory of 3640 464 ddddv.exe 94 PID 3640 wrote to memory of 3868 3640 lfflfrl.exe 95 PID 3640 wrote to memory of 3868 3640 lfflfrl.exe 95 PID 3640 wrote to memory of 3868 3640 lfflfrl.exe 95 PID 3868 wrote to memory of 3044 3868 bhhhnt.exe 96 PID 3868 wrote to memory of 3044 3868 bhhhnt.exe 96 PID 3868 wrote to memory of 3044 3868 bhhhnt.exe 96 PID 3044 wrote to memory of 4432 3044 bnnntb.exe 97 PID 3044 wrote to memory of 4432 3044 bnnntb.exe 97 PID 3044 wrote to memory of 4432 3044 bnnntb.exe 97 PID 4432 wrote to memory of 3840 4432 7jpjj.exe 98 PID 4432 wrote to memory of 3840 4432 7jpjj.exe 98 PID 4432 wrote to memory of 3840 4432 7jpjj.exe 98 PID 3840 wrote to memory of 4488 3840 7djdd.exe 99 PID 3840 wrote to memory of 4488 3840 7djdd.exe 99 PID 3840 wrote to memory of 4488 3840 7djdd.exe 99 PID 4488 wrote to memory of 4200 4488 lflfxxr.exe 100 PID 4488 wrote to memory of 4200 4488 lflfxxr.exe 100 PID 4488 wrote to memory of 4200 4488 lflfxxr.exe 100 PID 4200 wrote to memory of 4724 4200 btbttt.exe 101 PID 4200 wrote to memory of 4724 4200 btbttt.exe 101 PID 4200 wrote to memory of 4724 4200 btbttt.exe 101 PID 4724 wrote to memory of 1928 4724 jdpvp.exe 102 PID 4724 wrote to memory of 1928 4724 jdpvp.exe 102 PID 4724 wrote to memory of 1928 4724 jdpvp.exe 102 PID 1928 wrote to memory of 4684 1928 vjjjj.exe 103 PID 1928 wrote to memory of 4684 1928 vjjjj.exe 103 PID 1928 wrote to memory of 4684 1928 vjjjj.exe 103 PID 4684 wrote to memory of 2272 4684 llrlrrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe"C:\Users\Admin\AppData\Local\Temp\9f93a58d3dc257f8529a228814bd78f008e5577567b13ae9268ff4ca94d7adde.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\rxxxxfl.exec:\rxxxxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\nttbbh.exec:\nttbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\lfllffl.exec:\lfllffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\bbhhnn.exec:\bbhhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\jjdjp.exec:\jjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\rffrrrl.exec:\rffrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\hhbnnn.exec:\hhbnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\vjjdd.exec:\vjjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\lfxrllf.exec:\lfxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\ntnntb.exec:\ntnntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\ddddv.exec:\ddddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\lfflfrl.exec:\lfflfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\bhhhnt.exec:\bhhhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\bnnntb.exec:\bnnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\7jpjj.exec:\7jpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\7djdd.exec:\7djdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\lflfxxr.exec:\lflfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\btbttt.exec:\btbttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\jdpvp.exec:\jdpvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\vjjjj.exec:\vjjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\llrlrrx.exec:\llrlrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\tbbtbn.exec:\tbbtbn.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vpdpp.exec:\vpdpp.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\llxrfff.exec:\llxrfff.exe25⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe26⤵
- Executes dropped EXE
PID:4316 -
\??\c:\btnnhh.exec:\btnnhh.exe27⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pjjvp.exec:\pjjvp.exe28⤵
- Executes dropped EXE
PID:4184 -
\??\c:\3rlfrrr.exec:\3rlfrrr.exe29⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rrffllx.exec:\rrffllx.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jddvv.exec:\jddvv.exe31⤵
- Executes dropped EXE
PID:3788 -
\??\c:\ffrxfll.exec:\ffrxfll.exe32⤵
- Executes dropped EXE
PID:1092 -
\??\c:\btbnnn.exec:\btbnnn.exe33⤵
- Executes dropped EXE
PID:3496 -
\??\c:\9jddd.exec:\9jddd.exe34⤵
- Executes dropped EXE
PID:936 -
\??\c:\jdddp.exec:\jdddp.exe35⤵
- Executes dropped EXE
PID:1448 -
\??\c:\lllffff.exec:\lllffff.exe36⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nbhhnn.exec:\nbhhnn.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nhhhhh.exec:\nhhhhh.exe38⤵
- Executes dropped EXE
PID:3660 -
\??\c:\dvddd.exec:\dvddd.exe39⤵
- Executes dropped EXE
PID:620 -
\??\c:\rfxxffl.exec:\rfxxffl.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xxlrffx.exec:\xxlrffx.exe41⤵
- Executes dropped EXE
PID:208 -
\??\c:\btbbtt.exec:\btbbtt.exe42⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jddvj.exec:\jddvj.exe43⤵
- Executes dropped EXE
PID:3116 -
\??\c:\ddjdd.exec:\ddjdd.exe44⤵
- Executes dropped EXE
PID:776 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\thhhtt.exec:\thhhtt.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tnnnhh.exec:\tnnnhh.exe47⤵
- Executes dropped EXE
PID:4356 -
\??\c:\djjjv.exec:\djjjv.exe48⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lrrrlff.exec:\lrrrlff.exe49⤵
- Executes dropped EXE
PID:3708 -
\??\c:\xflllll.exec:\xflllll.exe50⤵
- Executes dropped EXE
PID:4216 -
\??\c:\bbbttn.exec:\bbbttn.exe51⤵
- Executes dropped EXE
PID:848 -
\??\c:\dpvvv.exec:\dpvvv.exe52⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9htnnb.exec:\9htnnb.exe53⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bbthtt.exec:\bbthtt.exe54⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvjdv.exec:\vvjdv.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jjpjv.exec:\jjpjv.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lflffff.exec:\lflffff.exe57⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nhnhnh.exec:\nhnhnh.exe58⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jjvvv.exec:\jjvvv.exe59⤵
- Executes dropped EXE
PID:932 -
\??\c:\vjjdv.exec:\vjjdv.exe60⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rfffxrr.exec:\rfffxrr.exe61⤵
- Executes dropped EXE
PID:4672 -
\??\c:\1ttnnn.exec:\1ttnnn.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\5ttnhh.exec:\5ttnhh.exe63⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jdddv.exec:\jdddv.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdppp.exec:\jdppp.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nthnnn.exec:\nthnnn.exe66⤵PID:4724
-
\??\c:\pvjpj.exec:\pvjpj.exe67⤵PID:3452
-
\??\c:\pjjjj.exec:\pjjjj.exe68⤵PID:3220
-
\??\c:\flfrxxr.exec:\flfrxxr.exe69⤵PID:3324
-
\??\c:\hhtnhn.exec:\hhtnhn.exe70⤵PID:2336
-
\??\c:\7djjd.exec:\7djjd.exe71⤵PID:3460
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe72⤵PID:4316
-
\??\c:\bthnnn.exec:\bthnnn.exe73⤵PID:4084
-
\??\c:\ddjpp.exec:\ddjpp.exe74⤵PID:5076
-
\??\c:\dppvv.exec:\dppvv.exe75⤵PID:1844
-
\??\c:\rxrllrx.exec:\rxrllrx.exe76⤵PID:2908
-
\??\c:\nthhbn.exec:\nthhbn.exe77⤵PID:3732
-
\??\c:\jdddd.exec:\jdddd.exe78⤵PID:3336
-
\??\c:\llfrffr.exec:\llfrffr.exe79⤵PID:3496
-
\??\c:\bbhhnb.exec:\bbhhnb.exe80⤵PID:1740
-
\??\c:\hhnbnt.exec:\hhnbnt.exe81⤵PID:3284
-
\??\c:\pvppj.exec:\pvppj.exe82⤵PID:4188
-
\??\c:\fllfxxx.exec:\fllfxxx.exe83⤵PID:4656
-
\??\c:\tntntt.exec:\tntntt.exe84⤵PID:2124
-
\??\c:\tthhhh.exec:\tthhhh.exe85⤵PID:1268
-
\??\c:\dpdpv.exec:\dpdpv.exe86⤵PID:4444
-
\??\c:\jpjpp.exec:\jpjpp.exe87⤵PID:1956
-
\??\c:\xfxllfx.exec:\xfxllfx.exe88⤵PID:2400
-
\??\c:\btbbbh.exec:\btbbbh.exe89⤵PID:776
-
\??\c:\tthhnt.exec:\tthhnt.exe90⤵PID:4052
-
\??\c:\dvpjv.exec:\dvpjv.exe91⤵PID:3960
-
\??\c:\dvddv.exec:\dvddv.exe92⤵PID:260
-
\??\c:\vjdvd.exec:\vjdvd.exe93⤵PID:4652
-
\??\c:\frxrlll.exec:\frxrlll.exe94⤵PID:3048
-
\??\c:\rfflffx.exec:\rfflffx.exe95⤵PID:4156
-
\??\c:\bbtnhn.exec:\bbtnhn.exe96⤵PID:848
-
\??\c:\ntnnnn.exec:\ntnnnn.exe97⤵PID:1744
-
\??\c:\dpppd.exec:\dpppd.exe98⤵PID:1052
-
\??\c:\jjjdd.exec:\jjjdd.exe99⤵PID:5100
-
\??\c:\1ffffff.exec:\1ffffff.exe100⤵PID:1624
-
\??\c:\lrfffrr.exec:\lrfffrr.exe101⤵PID:2128
-
\??\c:\rlfrxrl.exec:\rlfrxrl.exe102⤵PID:4076
-
\??\c:\1thhhh.exec:\1thhhh.exe103⤵PID:1308
-
\??\c:\9hnbtb.exec:\9hnbtb.exe104⤵PID:692
-
\??\c:\vpddv.exec:\vpddv.exe105⤵PID:652
-
\??\c:\jvddv.exec:\jvddv.exe106⤵PID:1880
-
\??\c:\rllfxxx.exec:\rllfxxx.exe107⤵PID:804
-
\??\c:\rlllfff.exec:\rlllfff.exe108⤵PID:2848
-
\??\c:\bhtbhn.exec:\bhtbhn.exe109⤵PID:4436
-
\??\c:\3nnhbb.exec:\3nnhbb.exe110⤵PID:3104
-
\??\c:\9pdpd.exec:\9pdpd.exe111⤵PID:2204
-
\??\c:\7dpvp.exec:\7dpvp.exe112⤵PID:1272
-
\??\c:\frxlxff.exec:\frxlxff.exe113⤵PID:1912
-
\??\c:\rffxlxf.exec:\rffxlxf.exe114⤵PID:1576
-
\??\c:\bttnnn.exec:\bttnnn.exe115⤵PID:2336
-
\??\c:\tbbhhn.exec:\tbbhhn.exe116⤵PID:5072
-
\??\c:\3ppjj.exec:\3ppjj.exe117⤵PID:1660
-
\??\c:\jvddp.exec:\jvddp.exe118⤵PID:5076
-
\??\c:\1nnnhh.exec:\1nnnhh.exe119⤵PID:1188
-
\??\c:\7jpjd.exec:\7jpjd.exe120⤵PID:1516
-
\??\c:\dvjdd.exec:\dvjdd.exe121⤵PID:1448
-
\??\c:\xxlxxfx.exec:\xxlxxfx.exe122⤵PID:3420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-