Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 03:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe
-
Size
74KB
-
MD5
2284dd7ec980d2d6ed1f7c260c15e278
-
SHA1
fc5df705eaacf018149c10c6e23e8d436419873d
-
SHA256
d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866
-
SHA512
56def742d212e99d7640083cd44d33dbf1fbcb8d90975230a15cccb1ef375132f0f650f4a8c13c95d506c2cd92c2d2e0bbdb99e69498d6686f38ec708b9c45f6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot0ioq:ymb3NkkiQ3mdBjFWXkj7afoL
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/564-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/64-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3664-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1028-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3432-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4640-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4640-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4640-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3812-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2956-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1448-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2004-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/440-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3408-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4156-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4924-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4728-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1568-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/564-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2600-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/656-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 64 7djdd.exe 3664 lflrxlr.exe 2384 xrrlxrf.exe 1028 hbhtnh.exe 4052 djdvj.exe 3432 1flfxrl.exe 4640 ttnnhb.exe 4004 ddjdd.exe 3812 jjdvv.exe 2956 llffxll.exe 1448 7nhhtn.exe 2004 pppvd.exe 440 pddpj.exe 5088 7xfxllx.exe 3408 hhthhn.exe 4156 bnnhhb.exe 4924 dvdjd.exe 4728 1rrlllr.exe 1972 xrlrlrl.exe 4628 nhnbtt.exe 5096 9bttnh.exe 3760 7vvpd.exe 784 pdjdd.exe 1568 rlfxfxx.exe 748 ththht.exe 564 hbnhbb.exe 2600 3pdvp.exe 3380 1flrlxr.exe 656 5bthnt.exe 224 tbbnbt.exe 4668 jvvpp.exe 2392 dvvvj.exe 2848 frlfxxr.exe 3628 hbbbtt.exe 5056 hbthnh.exe 4632 3dpjp.exe 3176 jjddj.exe 2660 xlflxxr.exe 4348 nhtbtb.exe 4956 dpvvv.exe 4952 pjjpv.exe 1816 fffrrfx.exe 744 frrrlff.exe 2200 thhbtb.exe 3828 btbttn.exe 1028 dvpjd.exe 3940 lfffxxl.exe 1640 lxxrrlf.exe 216 9tttnt.exe 4860 nnnntn.exe 4076 9ppjv.exe 2704 vjvdp.exe 1128 rlxrxxl.exe 3936 7hhhhh.exe 1800 ttbhhn.exe 3044 jvpvp.exe 3012 pvvdp.exe 4392 xfrllll.exe 3560 htbhhb.exe 3288 pjjdj.exe 1780 jjjdd.exe 4808 fxfxflf.exe 2912 5hbbbh.exe 400 hbbnbt.exe -
resource yara_rule behavioral2/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 64 1572 d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe 82 PID 1572 wrote to memory of 64 1572 d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe 82 PID 1572 wrote to memory of 64 1572 d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe 82 PID 64 wrote to memory of 3664 64 7djdd.exe 83 PID 64 wrote to memory of 3664 64 7djdd.exe 83 PID 64 wrote to memory of 3664 64 7djdd.exe 83 PID 3664 wrote to memory of 2384 3664 lflrxlr.exe 84 PID 3664 wrote to memory of 2384 3664 lflrxlr.exe 84 PID 3664 wrote to memory of 2384 3664 lflrxlr.exe 84 PID 2384 wrote to memory of 1028 2384 xrrlxrf.exe 85 PID 2384 wrote to memory of 1028 2384 xrrlxrf.exe 85 PID 2384 wrote to memory of 1028 2384 xrrlxrf.exe 85 PID 1028 wrote to memory of 4052 1028 hbhtnh.exe 86 PID 1028 wrote to memory of 4052 1028 hbhtnh.exe 86 PID 1028 wrote to memory of 4052 1028 hbhtnh.exe 86 PID 4052 wrote to memory of 3432 4052 djdvj.exe 87 PID 4052 wrote to memory of 3432 4052 djdvj.exe 87 PID 4052 wrote to memory of 3432 4052 djdvj.exe 87 PID 3432 wrote to memory of 4640 3432 1flfxrl.exe 88 PID 3432 wrote to memory of 4640 3432 1flfxrl.exe 88 PID 3432 wrote to memory of 4640 3432 1flfxrl.exe 88 PID 4640 wrote to memory of 4004 4640 ttnnhb.exe 89 PID 4640 wrote to memory of 4004 4640 ttnnhb.exe 89 PID 4640 wrote to memory of 4004 4640 ttnnhb.exe 89 PID 4004 wrote to memory of 3812 4004 ddjdd.exe 90 PID 4004 wrote to memory of 3812 4004 ddjdd.exe 90 PID 4004 wrote to memory of 3812 4004 ddjdd.exe 90 PID 3812 wrote to memory of 2956 3812 jjdvv.exe 91 PID 3812 wrote to memory of 2956 3812 jjdvv.exe 91 PID 3812 wrote to memory of 2956 3812 jjdvv.exe 91 PID 2956 wrote to memory of 1448 2956 llffxll.exe 92 PID 2956 wrote to memory of 1448 2956 llffxll.exe 92 PID 2956 wrote to memory of 1448 2956 llffxll.exe 92 PID 1448 wrote to memory of 2004 1448 7nhhtn.exe 94 PID 1448 wrote to memory of 2004 1448 7nhhtn.exe 94 PID 1448 wrote to memory of 2004 1448 7nhhtn.exe 94 PID 2004 wrote to memory of 440 2004 pppvd.exe 95 PID 2004 wrote to memory of 440 2004 pppvd.exe 95 PID 2004 wrote to memory of 440 2004 pppvd.exe 95 PID 440 wrote to memory of 5088 440 pddpj.exe 96 PID 440 wrote to memory of 5088 440 pddpj.exe 96 PID 440 wrote to memory of 5088 440 pddpj.exe 96 PID 5088 wrote to memory of 3408 5088 7xfxllx.exe 97 PID 5088 wrote to memory of 3408 5088 7xfxllx.exe 97 PID 5088 wrote to memory of 3408 5088 7xfxllx.exe 97 PID 3408 wrote to memory of 4156 3408 hhthhn.exe 98 PID 3408 wrote to memory of 4156 3408 hhthhn.exe 98 PID 3408 wrote to memory of 4156 3408 hhthhn.exe 98 PID 4156 wrote to memory of 4924 4156 bnnhhb.exe 99 PID 4156 wrote to memory of 4924 4156 bnnhhb.exe 99 PID 4156 wrote to memory of 4924 4156 bnnhhb.exe 99 PID 4924 wrote to memory of 4728 4924 dvdjd.exe 100 PID 4924 wrote to memory of 4728 4924 dvdjd.exe 100 PID 4924 wrote to memory of 4728 4924 dvdjd.exe 100 PID 4728 wrote to memory of 1972 4728 1rrlllr.exe 102 PID 4728 wrote to memory of 1972 4728 1rrlllr.exe 102 PID 4728 wrote to memory of 1972 4728 1rrlllr.exe 102 PID 1972 wrote to memory of 4628 1972 xrlrlrl.exe 103 PID 1972 wrote to memory of 4628 1972 xrlrlrl.exe 103 PID 1972 wrote to memory of 4628 1972 xrlrlrl.exe 103 PID 4628 wrote to memory of 5096 4628 nhnbtt.exe 104 PID 4628 wrote to memory of 5096 4628 nhnbtt.exe 104 PID 4628 wrote to memory of 5096 4628 nhnbtt.exe 104 PID 5096 wrote to memory of 3760 5096 9bttnh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe"C:\Users\Admin\AppData\Local\Temp\d0b51b97c1e967880e0e888f487ce66e79773812c46608f947253dd5a224c866.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\7djdd.exec:\7djdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\lflrxlr.exec:\lflrxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\xrrlxrf.exec:\xrrlxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\hbhtnh.exec:\hbhtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\djdvj.exec:\djdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\1flfxrl.exec:\1flfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\ttnnhb.exec:\ttnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\ddjdd.exec:\ddjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\jjdvv.exec:\jjdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\llffxll.exec:\llffxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\7nhhtn.exec:\7nhhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\pppvd.exec:\pppvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pddpj.exec:\pddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\7xfxllx.exec:\7xfxllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\hhthhn.exec:\hhthhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\bnnhhb.exec:\bnnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\dvdjd.exec:\dvdjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\1rrlllr.exec:\1rrlllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\nhnbtt.exec:\nhnbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\9bttnh.exec:\9bttnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\7vvpd.exec:\7vvpd.exe23⤵
- Executes dropped EXE
PID:3760 -
\??\c:\pdjdd.exec:\pdjdd.exe24⤵
- Executes dropped EXE
PID:784 -
\??\c:\rlfxfxx.exec:\rlfxfxx.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ththht.exec:\ththht.exe26⤵
- Executes dropped EXE
PID:748 -
\??\c:\hbnhbb.exec:\hbnhbb.exe27⤵
- Executes dropped EXE
PID:564 -
\??\c:\3pdvp.exec:\3pdvp.exe28⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1flrlxr.exec:\1flrlxr.exe29⤵
- Executes dropped EXE
PID:3380 -
\??\c:\5bthnt.exec:\5bthnt.exe30⤵
- Executes dropped EXE
PID:656 -
\??\c:\tbbnbt.exec:\tbbnbt.exe31⤵
- Executes dropped EXE
PID:224 -
\??\c:\jvvpp.exec:\jvvpp.exe32⤵
- Executes dropped EXE
PID:4668 -
\??\c:\dvvvj.exec:\dvvvj.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\frlfxxr.exec:\frlfxxr.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hbbbtt.exec:\hbbbtt.exe35⤵
- Executes dropped EXE
PID:3628 -
\??\c:\hbthnh.exec:\hbthnh.exe36⤵
- Executes dropped EXE
PID:5056 -
\??\c:\3dpjp.exec:\3dpjp.exe37⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jjddj.exec:\jjddj.exe38⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xlflxxr.exec:\xlflxxr.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhtbtb.exec:\nhtbtb.exe40⤵
- Executes dropped EXE
PID:4348 -
\??\c:\dpvvv.exec:\dpvvv.exe41⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pjjpv.exec:\pjjpv.exe42⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fffrrfx.exec:\fffrrfx.exe43⤵
- Executes dropped EXE
PID:1816 -
\??\c:\frrrlff.exec:\frrrlff.exe44⤵
- Executes dropped EXE
PID:744 -
\??\c:\thhbtb.exec:\thhbtb.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\btbttn.exec:\btbttn.exe46⤵
- Executes dropped EXE
PID:3828 -
\??\c:\dvpjd.exec:\dvpjd.exe47⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfffxxl.exec:\lfffxxl.exe48⤵
- Executes dropped EXE
PID:3940 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9tttnt.exec:\9tttnt.exe50⤵
- Executes dropped EXE
PID:216 -
\??\c:\nnnntn.exec:\nnnntn.exe51⤵
- Executes dropped EXE
PID:4860 -
\??\c:\9ppjv.exec:\9ppjv.exe52⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vjvdp.exec:\vjvdp.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe54⤵
- Executes dropped EXE
PID:1128 -
\??\c:\7hhhhh.exec:\7hhhhh.exe55⤵
- Executes dropped EXE
PID:3936 -
\??\c:\ttbhhn.exec:\ttbhhn.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jvpvp.exec:\jvpvp.exe57⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pvvdp.exec:\pvvdp.exe58⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xfrllll.exec:\xfrllll.exe59⤵
- Executes dropped EXE
PID:4392 -
\??\c:\htbhhb.exec:\htbhhb.exe60⤵
- Executes dropped EXE
PID:3560 -
\??\c:\pjjdj.exec:\pjjdj.exe61⤵
- Executes dropped EXE
PID:3288 -
\??\c:\jjjdd.exec:\jjjdd.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fxfxflf.exec:\fxfxflf.exe63⤵
- Executes dropped EXE
PID:4808 -
\??\c:\5hbbbh.exec:\5hbbbh.exe64⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hbbnbt.exec:\hbbnbt.exe65⤵
- Executes dropped EXE
PID:400 -
\??\c:\3pvvv.exec:\3pvvv.exe66⤵PID:3188
-
\??\c:\dpvpd.exec:\dpvpd.exe67⤵PID:4868
-
\??\c:\frfrrrr.exec:\frfrrrr.exe68⤵PID:1972
-
\??\c:\3lflllf.exec:\3lflllf.exe69⤵PID:2572
-
\??\c:\1tttth.exec:\1tttth.exe70⤵PID:5096
-
\??\c:\btttnt.exec:\btttnt.exe71⤵PID:4844
-
\??\c:\dvjjj.exec:\dvjjj.exe72⤵PID:5012
-
\??\c:\1djvp.exec:\1djvp.exe73⤵PID:2964
-
\??\c:\rllflfl.exec:\rllflfl.exe74⤵PID:3368
-
\??\c:\lxflllx.exec:\lxflllx.exe75⤵PID:5108
-
\??\c:\bbtnnt.exec:\bbtnnt.exe76⤵PID:4920
-
\??\c:\vvjpd.exec:\vvjpd.exe77⤵PID:3100
-
\??\c:\dpjpv.exec:\dpjpv.exe78⤵PID:3676
-
\??\c:\rffffrr.exec:\rffffrr.exe79⤵PID:2600
-
\??\c:\flxxxff.exec:\flxxxff.exe80⤵PID:3924
-
\??\c:\3nbbbb.exec:\3nbbbb.exe81⤵PID:3608
-
\??\c:\vpvvp.exec:\vpvvp.exe82⤵PID:536
-
\??\c:\djpjj.exec:\djpjj.exe83⤵PID:4928
-
\??\c:\llxrffl.exec:\llxrffl.exe84⤵PID:3972
-
\??\c:\bbnnnb.exec:\bbnnnb.exe85⤵PID:3300
-
\??\c:\nhnthn.exec:\nhnthn.exe86⤵PID:968
-
\??\c:\vvvvp.exec:\vvvvp.exe87⤵PID:2664
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe88⤵PID:4148
-
\??\c:\rrlllll.exec:\rrlllll.exe89⤵PID:5056
-
\??\c:\hhnhhn.exec:\hhnhhn.exe90⤵PID:3112
-
\??\c:\3hnbtt.exec:\3hnbtt.exe91⤵PID:3176
-
\??\c:\3dvpv.exec:\3dvpv.exe92⤵PID:4364
-
\??\c:\vjpjv.exec:\vjpjv.exe93⤵PID:1012
-
\??\c:\3lfxrlf.exec:\3lfxrlf.exe94⤵PID:1288
-
\??\c:\7hhbth.exec:\7hhbth.exe95⤵PID:3476
-
\??\c:\nhhtth.exec:\nhhtth.exe96⤵PID:4836
-
\??\c:\jdpjd.exec:\jdpjd.exe97⤵PID:3448
-
\??\c:\jpdvd.exec:\jpdvd.exe98⤵PID:4052
-
\??\c:\xlllxrl.exec:\xlllxrl.exe99⤵PID:2100
-
\??\c:\lrxxrrf.exec:\lrxxrrf.exe100⤵PID:3432
-
\??\c:\nnbhtb.exec:\nnbhtb.exe101⤵PID:1712
-
\??\c:\ttttnh.exec:\ttttnh.exe102⤵PID:2844
-
\??\c:\jdddv.exec:\jdddv.exe103⤵PID:4860
-
\??\c:\jpvpj.exec:\jpvpj.exe104⤵PID:4640
-
\??\c:\xrxffxr.exec:\xrxffxr.exe105⤵PID:2704
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe106⤵PID:2904
-
\??\c:\3httbb.exec:\3httbb.exe107⤵PID:732
-
\??\c:\3nbhbh.exec:\3nbhbh.exe108⤵PID:5064
-
\??\c:\jjddv.exec:\jjddv.exe109⤵PID:2004
-
\??\c:\1vvvp.exec:\1vvvp.exe110⤵PID:4264
-
\??\c:\rllflxr.exec:\rllflxr.exe111⤵PID:1732
-
\??\c:\jpddv.exec:\jpddv.exe112⤵PID:1932
-
\??\c:\pdjjd.exec:\pdjjd.exe113⤵PID:3620
-
\??\c:\rrxfxlr.exec:\rrxfxlr.exe114⤵PID:4172
-
\??\c:\nhhbbb.exec:\nhhbbb.exe115⤵PID:4852
-
\??\c:\dvjdv.exec:\dvjdv.exe116⤵PID:3124
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe117⤵PID:2372
-
\??\c:\xxlflrr.exec:\xxlflrr.exe118⤵PID:4728
-
\??\c:\hbttnn.exec:\hbttnn.exe119⤵PID:4112
-
\??\c:\jpdjj.exec:\jpdjj.exe120⤵PID:4448
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe121⤵PID:964
-
\??\c:\thtbhh.exec:\thtbhh.exe122⤵PID:672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-